5-Star Planet® Privacy Policy

Date of last update: December 2025

Data Controller: The 5-Star Planet® Service is operated by [COMPANY NAME / FUTURE LEGAL ENTITY], with its registered office at [ADDRESS], registered with [TRADE REGISTER], and with the official contact address for data protection matters: [DEDICATED EMAIL]. This entity acts as the Data Controller in accordance with Regulation (EU) 2016/679 (GDPR).

The www.5starplanet.org website Privacy Policy (we may refer as "Our Policy" or just "Policy") informs you about the policies regarding the collection, use and disclosure of personal information when you use access www.5starplanet.org (we may refer as just "Service").

The Service is in the process of being launched, and the required legal formalities are presently underway. By continuing to access this site, using the proposed model, or downloading and utilizing the resources provided, you confirm that you accept and understand the following:

− 5-Star Planet®, GROUPnTRAVEL, their partners and collaborators cannot be held liable beyond the limits permitted by applicable law, whether directly or indirectly, for any direct or indirect consequence resulting from the use of the information, the model or the resources provided.

− The information and resources provided on this site are for educational and informational purposes only and do not constitute legal, tax, or professional advice.

− It is your responsibility to consult a lawyer, tax expert, or other professionals before implementing the model or making any decisions based on the information provided.

Your access and the use of the Service are conditioned by the acceptance and reading of the Terms of Use and the Privacy Policy that applies to all visitors or users accessing or using the Service. If you do not agree with any part of the Terms or the Privacy Policy then do not access the Service.

We will not use or share Your information with anyone except as described in this Privacy Policy. We use your Personal Information for providing and improving the Service. By using the Service, you agree to the collection and use of information in accordance with Our Policy. Unless otherwise defined in this Privacy Policy, terms used in this Privacy Policy have the same meanings as in our Terms of Use, accessible at www.5starplanet.org/terms.

We may also use Personal Information to provide you with activity reports or materials about the Service or information related to the Service, such as the notifications, files, accounts or the activity of your account, including updates to the Service, content provided or published by the Service. We may provide you this materials and information by email or web push notifications in your phone or browser.

For your contributor account, if published, we will display your contact details on the contributor's page, so that they can be publicly available. Your data may also appear in the updates, backups.

We will not share Personal Information with third parties independent of the Service, except as specified in this Policy or in an extent that we will ask you to agree as a new Privacy Policy Agreement. If some of your data is incorrect, please inform us as soon as possible.

Purposes and the legal ground of the processing

Pursuant to the national legislation (Law no. 102/2005, republished, Law no. 190/2018, Law no. 506/2004) and the European legislation (Regulation 2016/679/EU, Directive 2016/680/EC, Directive 2002/58/EC) in force, the Service has the obligation to use the personal data provided to it in a safe way and only for the specified purposes.

The Service processes your personal data in accordance with the GDPR provisions, through the online platform, in accordance with the applicable specific provisions, in order to carry out the following activities:

• Maintenance of the user account, including the contributor account

• Maintenance of the projects registered by the user

• In order to prevent fraud or illegal activities or to improve the Service

The provision of data is absolutely necessary for the creation and personalization of the account, offering and improving access to the Service related to the account and sending email notifications. Your refusal determines the impossibility of accessing the account and providing the Service.

Categories of data that we process

The Service's Policy on the data protection and data security is to collect only personal data that is necessary for the purposes mentioned and to require the data subjects to communicate only those personal data strictly necessary for the fulfilment of these purposes.

For user accounts, the information received after logging in with Google or manually entered:

• session data (custom generated id, time zone difference, localization)

• name, surname

• email address

Categories of recipients of the personal data personal

Your personal data is intended for use by the Service and communicated to the following recipients, as the case may be:

• other users with the access rights to the mentioned projects

• in the framework of the activities of investigation/control

• the courts for the purpose of formulating actions and representation in court

The disclosure of data to third parties is made in accordance with the legal provisions for the categories of recipients specified above.

Retention period of personal data

If the user closes his account we will proceed to delete his personal data, imported during the authentication process or entered manually directly, but if necessary, they will remain stored for as long as necessary to carry out all activities undertaken in order to support the Service activities, solving actions by competent courts, fulfilling the legal control and investigation tasks, handling complaints, registration and handling the personal data breach notification forms.

Your rights and how to exercise them

In accordance with Article 6 of the GDPR, we process your data on the following legal grounds, as applicable: (i) the performance of a contract or steps taken at your request prior to entering into a contract, (ii) compliance with our legal obligations, (iii) our legitimate interest in operating and administering the Service, (iv) your consent for those processing activities that require it.

Under the GDPR, users also benefit from the following rights: the right to be informed, the right to data portability, the right to object to processing, the right not to be subject to a decision based solely on automated processing, including profiling, and the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

To exercise the rights provided by the GDPR, you can contact us at the official email address dedicated to data protection: [EMAIL]. We will respond to your requests within the statutory time limit of 30 days.

According to the applicable legal provisions and EU GDPR Regulation, you have the right of access, the right of rectification, the right of erasure, the right to restriction of processing.

Activity log

We may also collect information that the browser sends whenever you visit our Service ("Log Data"). This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages and other traffic analysis.

You may visit the website pages even when you are not logged in the platform. Your Personal Account Information, as name and email will only be collected by Us, if you freely disclose them by logging in with your Gmail Google account or by changing them after you logged in.

Some of the website's pages contains programs (plugins) operated by Google. These third party programs are exclusively operated by www.google.com. When visiting the Service, your browser will establish a direct link with these third parties, and the data will be processed by them, under the regulation of their terms.

Even we do not use any tracking methods or sophisticated methods for information collection, at this time, we do not respond to Do Not Track signals or other, similar mechanisms.

We are using Google Analytics, service provided by Google Inc., which uses cookies and similar technologies to collect and analyze information about the use of the Service and report on activities and trends. These services may collect information regarding the use of other websites, apps and online resources. You can learn about Google's privacy practices by going to policies.google.com/privacy, and opt-out by downloading the Google Analytics opt-out browser add-on, available at tools.google.com/dlpage/gaoptout .

The use of Google Analytics is based on the user's consent, expressed via the cookie-banner mechanism, in accordance with Article 6(1)(a) of the GDPR.

We have no control over, and are not responsible for, this third party's collection, use and disclosure of your Personal Information, such as Google.

If you have any questions about data collection, analysis and use of personal data, disclosure, amendment, blocking and deletion of personal data contact: www.dataprotection.ro.

Cookies

The following types of cookies are found on the www.5starplanet.org website:

• PHPSESSID = It is a session cookie, automatically generated, which is used for the management of web applications. This cookie is automatically deleted when you close your browser. you can instruct your browser to refuse all cookies or to indicate when a cookie is saved. However, if you do not allow this session cookies to be saved, you will not be able to use the Service as a logged in user, but only as public

• Cookies generated by Google = Cookies are processed by Google. You can read more about Google's privacy policy by visiting policies.google.com/privacy

How can I stop cookies?

Users can configure their browser to reject cookies. Disabling and refusing to receive cookies will prevent you from using the Service as a registered user.

Service providers

We may employ third party companies and individuals to facilitate our Service, to provide the Service on Our behalf, to perform Service-related services about activity and maintenance or to assist us in analyzing how our Service is used.

These third parties have access to your Personal Information only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Law compliance

We will disclose your Personal Information where required to do so by law or subpoena or if we believe that such action is necessary to comply with the law and the reasonable requests of law enforcement or to protect the security or integrity of our Service.

Transfer of ownership

If www.5starplanet.org is involved in a merger, acquisition or sale of assets, your Personal Information may be transferred. We will publish a notification on our official LinkedIn page www.linkedin.com/company/5starplanet/ before personal information needs to be transferred and we will notify any updates to this Privacy Policy.

Security

We will take reasonable measures to: (i) protect personal information from unauthorized access, disclosure, alteration or destruction, and (ii) keep personal information accurate and up-to-date as appropriate. In order to do this we decided on cloud business solutions for data and server storage, solution offered by a data center Linode, located in Frankfurt, DE and Google Storage Cloud, with a data center located in London, UK for our static content. As well, we are using secured connections (https) with all Service users.

The security of your Personal Information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

Data Breach Policy (Art. 33, 34 GDPR)

In the event of a security incident affecting personal data, the Controller will notify the National Supervisory Authority for Personal Data Processing (ANSPDCP) within 72 hours and, where required, will inform the affected users in accordance with Articles 33 and 34 of the GDPR.

International transfer

The Personal Information may be transferred - and maintained - to computers located outside of your state, province, country or other governmental jurisdiction where data protection law may differ from that of your jurisdiction.

Transfers of data to providers located outside the EEA are carried out on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission, as well as additional technical and organisational measures implemented to protect the data.

Your consent to this Privacy Policy followed by the presentation of this information is your agreement to this transfer.

Links to other sites

The Service may contain links to other sites that are not operated by us, like property's map links or property's private websites. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over, and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

We do not use any external plugins or links to private servers or websites, except the tools provided by Google (like Login with Gmail, Fonts, Recaptcha, Analytics).

Children's privacy

Our Service is intended only for persons who are of full legal age under the laws of their country of residence and in any case not younger than 18 years of age. The Controller uses reasonable procedures to prevent the accidental collection of data from persons under 18 and will delete such data as soon as it is identified.

We do not knowingly collect personally identifiable information from children or teenagers under 18. If you are a parent or guardian and you are aware that your Children has provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from children under age 18 without verification of parental consent, we will take steps to remove that information.

Changes to this Privacy Policy

We may update the Privacy Policy or the Terms of Use from time to time. We will notify you of any changes by posting a notice on Our LinkedIn official page www.linkedin.com/company/5starplanet/ and the changes will become effective on the publishing day.

You are advised to follow and review periodically our LinkedIn page for any changes.

Contact Us

At present, the Controller is not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. Should this obligation arise in the future, this Policy will be updated accordingly.

If you have any questions about this Privacy Policy, please contact us, leaving us a message on the LinkedIn page or on the website contact page.

Glossary

• Internet cookie = term also known as cookies or HTTP cookie is a small file, made up of letters and numbers, which will be stored on your computer, mobile or other equipment of a user from which the Internet is accessed. The cookie is installed by a web server's request from a browser (ex: Microsoft Edge, Firefox, Chrome, Safari) and is completely passive (does not contain software, viruses or spyware and cannot access the information on the hard-disk). A cookie consists of 2 parts: the name and content or value of the cookie. Furthermore, the cookie's lifetime is determined; technically, only the web server that sent the cookie can access it again when a user returns to the website associated with that webserver.