Explora S.A., headquartered in Avenue Eugene-Pittard 16, Geneva, Switzerland, registered for tax purposes under number CHE-315.766.578, acting as data controller, (the "Data Controller", "we" or "us"), is committed to the fair processing of the users' personal data ("your data"). In order to provide you with a great journey experience, we collect personal data about you on different occasions, such as when you use our Host App.

For all matters relating to the protection of personal data, it is possible to contact us via e-mail at privacy@explorajourneys.com.

Please carefully read this information notice, which is based on Article 13 of the General Data Protection Regulation (Reg. (EU) 2016/679 or simply "GDPR") and the requirements of in the Swiss Federal Act on Data Protection of 25 September 2020 (hereinafter "FADP").

As we are part of the MSC Cruises Group of companies, we appointed a Group Data Protection Officer ("DPO"). The DPO is available for any information regarding the processing of personal data carried out by Explora S.A. via privacy@explorajourneys.com. You can also send requests in writing; in that case, please specify "For the Attention of the Data Protection Officer" on the envelope.

• We process your identity and contact information (i.e. your name, surname, email, phone number, gender, date of birth) as well as your picture (only if you decide to upload one to your account) to allow you to use the app by creating an account and linking your profile. We also process this data to allow you to access and organize your schedule as well as in case you signup or book a specific event/activity. For instance, in some cases, an activity may have limited capacity, as such, we require your identity information for the sole purpose of registering you at a particular event if needed. We process this information on the basis of our contract with you.
• We process your financial and payment information to allow you to easily view your payslips in one place, check your balance and history of purchases as well as to top-up your account to carry out onboard transactions. We process this information on the basis of our contract with you.
• We process your technical data related to online activity via Software Development Kits (SDKs) on the app to ensure its proper functioning.
  The app may use some of the following types of SDKs:
  • Necessary (technical) SDKs, which are strictly necessary for the app's operation, and/or to allow you to use the app's content and services.
  • Analytics SDKs, which allow the Data Controller to understand how users make use of the app, and to track traffic to and from it
  • Preference SDKs, which are used to activate specific functions and to configure the app according to your choices (e.g., language), in order to improve your experience. For more details on the specific SDKs that we use, their purposes as well as their type, please refer to the table below under Annex I.

In accordance with the principle of 'storage limitation', personal data that we collect is kept in a form which permits the identification of data subjects for no longer than is necessary for the purposes for which personal data are collected and processed in each specific case, and in any case no longer than as specified by the relevant applicable laws.

Your personal data may be shared with:

1. Service providers (such as IT externalService providers, consultants, etc.), including companies of MSC Cruises Group, who act as data processors on behalf of the Data Controller, such as Microsoft and NTT Data;
2. Persons authorized to process the personal data needed to carry out activities strictly related to the provision of the services, who have committed themselves to confidentiality or have an appropriate legal obligation of confidentiality;
3. Companies which process personal data acting as independent data controllers where necessary to provide you with our services or in connection with them;
4. Agents, bodies or authorities we need to disclose your personal data to in accordance with our legal obligations or orders of the authorities for compliance purposes

We store your personal data on servers located in Switzerland. We may transfer personal data to MSC Cruises Group's companies, or other reputable third party organizations situated inside or outside Switzerland, such as other entities of our Group that offer technical support in Italy. For all these cases, Explora S.A. ensures that your personal data are transferred to these recipients in accordance with the applicable data protection law. Indeed, transfers outside of the EEA can be based on an adequacy decision, the Standard Contractual Clauses approved by the European Commission or another legal transfer mechanism. For further information please send a written request to privacy@explorajourneys.com.

Your personal data may be shared with:

1. The right to access your personal data and obtain specific information about how we process it. Please be aware that you can only exercise this right in relation to your own data, unless you can provide evidence to exercise a data subject request on behalf of another person. Explora S.A. reserves the right to ask for proof of identity, as well as to refuse to provide the personal data if the identity or relevant connection to the data subject cannot be proven.
2. The right to rectify your personal data, including by means of providing a supplementary statement.
3. The right to obtain the erasure of personal data concerning you, unless the data are necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing by Union or Member State law to which Explora S.A. is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health; or for the establishment, exercise or defence of legal claims.
4. The right to obtain the restriction of the processing of your personal data, this right may be exercised in the following cases:
   • Temporary restriction, where you are contesting the accuracy of the personal data; in this case, we will restrict the processing of your data for a period enabling us to verify the accuracy of your data and we will provide feedback to you as to the lifting of the restriction;
   • The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
   • Explora S.A. no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
   • Where you have objected to processing, the processing is restricted pending the verification whether our legitimate grounds override your rights as data subject.
5. The right to data portability. You may exercise this right in those cases where the processing is based on your consent or on your contractual relationship with Explora S.A., and the processing is carried out by automated means.
6. The right to object, at any time, to the processing of the personal data concerning you. You may exercise this right where the processing is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in us, or where the processing is based on our legitimate interests.
7. The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or which similarly significantly affects you. You may exercise this right unless the processing is necessary for entering into, or performance of, a contract between you and Explora S.A. or one of the companies of our group; or is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or if the processing is based on the your explicit consent.
8. The right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to him or her infringes your data protection related rights.

Please find the list of all European Data Protection Supervisory Authorities at the following link: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm

To exercise your data subject rights, you can send your request to the Data Controller using the contact details listed under section 1.

Explora S.A. is fully committed to ensuring that your privacy is respected at all times and that the personal data processing put in place is compliant with the applicable data protection legislation. If you have any doubts or questions about the data processing carried out by us, please contact us using our contact details provided in section 1 of this notice.

Last updated on 12.12.2023.