1. Information We Collect

Depending on how you use Trovarel, we may collect the following categories of personal data:

• Account and registration information: Name, username, email address, password credentials, and other information submitted when creating or managing an account.

• Host information: Profile details, business or professional information, listing content, qualifications, and supporting documents requested for identity verification, eligibility, safety, or legal compliance.

• Booking and transaction information: Booking details, transaction records, amounts, payment status, and related communications. Payment card details may be collected and processed directly by third-party payment providers rather than stored by Trovarel.

• Communications and support: Messages, enquiries, support requests, feedback, and information you choose to provide when contacting us or communicating through the platform.

• Technical and usage information: IP address, browser and device information, pages visited, interactions with the website, and security logs, where collected.

• Cookie and preference information: Information collected through cookies and similar technologies, subject to the Cookie Policy and applicable consent requirements.

We use this information for the purposes described in this Privacy Policy. We do not knowingly permit children to create Trovarel accounts or book independently where prohibited by our eligibility rules. Information concerning minors may nevertheless be provided in connection with a lawful booking or participation in an experience, as described in Section 4.

2. How We Use Your Information

Trovarel uses personal data for the following purposes:

• Account management: To create and maintain user accounts and provide access to marketplace features.

• Marketplace operations: To enable Hosts to create listings and allow Guests to discover, enquire about, and book experiences and services.

• Bookings and transactions: To support booking-related communications and transaction processing where these features are available. Payment information may be processed directly by third-party payment providers, subject to their own privacy policies and applicable data protection law.

• Host verification and safety: To review information or documentation submitted by Hosts where reasonably necessary for identity verification, marketplace eligibility, safety, or legal compliance.

• Communications and support: To respond to enquiries, provide service-related notifications, and assist with account or platform issues.

• Platform improvement and security: To maintain, troubleshoot, secure, and improve the website and its features.

• Legal and regulatory compliance: To comply with applicable legal obligations and establish, exercise, or defend legal claims where necessary.

• Marketing: To send marketing communications where permitted by law and, where required, with your consent. You may opt out of marketing communications at any time.

We process personal data only where we have an applicable legal basis, such as performing a contract, complying with a legal obligation, pursuing legitimate interests where permitted, or obtaining consent where required.

The specific legal basis depends on the purpose and circumstances of the processing. Further information about data sharing and international transfers is provided in the relevant sections of this Privacy Policy.

3. How We Share Information

Trovarel may share personal data with the following categories of recipients where necessary for the purposes described in this Privacy Policy:

• Hosts and Guests: Relevant booking, contact, and experience information may be shared to facilitate enquiries, bookings, communications, and the delivery of an experience.

• Hosting and technical providers: Providers that host, maintain, secure, and support the website and its functionality.

• Payment providers: Providers that process payments, transactions, refunds, payouts, or related verification where these services are used.

• Communications and support providers: Providers used to send service-related emails, manage enquiries, or support platform communications.

• Security and verification providers: Providers used for spam prevention, fraud prevention, identity checks, or other security measures where implemented.

• Analytics, mapping, and other website providers: Providers whose services are enabled on the platform, subject to applicable privacy and cookie requirements.

• Professional advisers and public authorities: Where necessary to obtain professional advice, comply with legal obligations, respond to lawful requests, or establish, exercise, or defend legal claims.

We do not sell personal data to third parties.

Recipients may process personal data under their own privacy policies or under arrangements governing their services to Trovarel. The actual recipients depend on the services enabled on the website. Where personal data is shared, we will apply the requirements of applicable data protection law.

4. Children and Minors

Trovarel accounts, Host registration, and independent bookings are intended for adults aged 18 or older, subject to applicable law and the platform’s eligibility requirements.

Minors may participate in an experience where permitted by applicable law and the Host’s requirements. A parent, guardian, or other authorized adult may need to make the booking or provide relevant information on the minor’s behalf.

Where information about a minor is provided in connection with a booking or experience, it must be limited to what is reasonably necessary and handled in accordance with applicable data protection law. Hosts must handle any information about participating minors lawfully and only as necessary to provide the experience.

Trovarel does not knowingly allow children to create accounts or book independently contrary to these requirements. If you believe a child has created an account in violation of this policy, contact us using the details provided in this Privacy Policy.

6. Your Data Protection Rights

Depending on applicable data protection law and the circumstances of the processing, you may have the right to:

• Access: Request a copy of the personal data Trovarel holds about you.

• Rectification: Request correction of inaccurate or incomplete personal data.

• Erasure: Request deletion of your personal data where the legal requirements for deletion are met.

• Restriction: Request restriction of processing in circumstances provided by law.

• Data portability: Receive certain personal data in a structured, commonly used, machine-readable format and request its transfer to another controller where the legal requirements apply.

• Object: Object to certain processing of your personal data, including processing based on legitimate interests and processing for direct marketing, where applicable.

• Withdraw consent: Where processing is based on consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

• Complain to a supervisory authority: You may lodge a complaint with the data protection authority competent for your circumstances. In Spain, this may include the Spanish Data Protection Agency (AEPD).

To exercise your rights, contact Trovarel using the contact details provided in this Privacy Policy. We may request information reasonably necessary to verify your identity before responding. We will respond within the time limits required by applicable law.

Some rights are subject to legal conditions and exceptions. Exercising a right does not necessarily require Trovarel to delete information that it must retain to comply with legal obligations or establish, exercise, or defend legal claims.

7. Data Security and Retention

Trovarel takes reasonable technical and organizational measures intended to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. No method of transmission or electronic storage can be guaranteed to be completely secure.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services, maintaining accounts and transaction records, addressing disputes, preventing fraud, complying with legal obligations, and establishing, exercising, or defending legal claims.

Retention periods depend on the type of information, the purpose of processing, whether an account or booking remains active, and any applicable legal requirements. When information is no longer required, it will be deleted or anonymized where appropriate, subject to lawful retention obligations.

Where identity or verification documents are collected, access should be restricted to authorized persons and the documents should not be retained longer than necessary for the relevant verification, safety, legal, or dispute-related purpose.

8. Third-Party Links

9. Marketing Communications

Trovarel may send marketing communications about experiences, services, platform updates, or promotions where permitted by applicable law and, where required, with your consent.

Marketing communications are separate from essential service communications, such as account notices, booking confirmations, security alerts, and important changes to the Services. You may continue to receive essential service communications even if you opt out of marketing.

You may withdraw marketing consent or unsubscribe at any time using the unsubscribe mechanism provided in the communication or by contacting Trovarel. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Where consent is required, Trovarel will use an appropriate mechanism to obtain and record it.

10. Changes to This Policy

11. Contact