PRIVACY POLICY

of the 5-Star Planet® Platform

www.5starplanet.org

Version: 1

Date: June 27, 2026

About Us and the Platform

1. When we refer to “we”, “the Company”, “5-Star Planet” or any similar term, this means 5-STAR PLANET S.R.L., a Romanian legal entity with its registered office in Bucharest, Sector 5, Str. Ana Davila, No. 6D, room 1, Floor 1, Apartment 3, registered with the Trade Register under no. J2026014776009, unique registration code 54170047, with the e-mail address: [echipa@groupntravel.com].
2. We created and developed the 5-Star Planet® Platform (hereinafter the “Platform”) as a digital tool that facilitates the planning, organization, collaboration and transparent presentation of Projects, based on the 5-Star Planet® model of fair profit sharing between the Startup and its Contributors. You can find out more about us on the website www.5starplanet.org.
3. If you wish to contact us, you can do so using the contact details mentioned in point 1 above.

Purpose of this Privacy Policy. Interpretation

4. This Privacy Policy describes how, when you use the Platform, we process your personal data, as these concepts are defined by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”).
5. We have adopted and implemented this Privacy Policy (the “Policy”) in order to align with applicable legal requirements, in particular the GDPR, but not only. Unless otherwise defined in this Policy, specific terms shall have the meaning established by the GDPR. The Policy is also supplemented by the Terms and Conditions of use of the Platform (www.5starplanet.org/terms).
6. In addition, when you access the Platform, we use our own cookies and, where applicable, third-party cookies (“Website Cookies”), including strictly necessary cookies (for example, to recognize Users authenticated through Google and to remember your consent choices) and, if you opt for this, optional cookies (for example, [related to marketing communications/website traffic analysis]). Your consent   is requested, through the consent banner displayed when accessing the website, for all cookies that are not strictly necessary. You may disable cookies from your browser settings, in which case the use of the Platform may be affected by interruptions or malfunctions.

What cookies do we use?

7. This Policy presents, in a clear and transparent manner, important information regarding, among other things, the personal data we process and the details of this processing (the purposes of processing, the rights of Data Subjects, etc.), as described below.
8. In addition, this Privacy Policy is supplemented by the Data Processing Agreement, which we are required to conclude with you, in accordance with Art. 28(3) of the GDPR (www.5starplanet.org/terms), also mentioned in Section 2 of the Terms and Conditions of the Platform.

Data processed and our relationship with Users

9. While you use the Platform, regardless of the Usage Plan chosen (Solo, Team or Contributor) or as a simple visitor, we may collect, store and use various information, including personal data.
10. Most personal data processing operations will be carried out in the name and on behalf of the User who entered the respective data, in accordance with that User's instructions, since the Platform is a tool made available to Users for managing Projects and their relationship with Contributors. In this case, we act as a processor of personal data, in accordance with Section 7 of the Terms and Conditions of the Platform.
11. We also process a limited amount of personal data in our own name and on our own behalf, for the purposes described below. In this case, our capacity is that of controller of personal data.

Processing operations as a processor

12. Depending on the Usage Plan chosen, you may enter and store various information on the Platform (“User-Generated Content”), which may include personal data (for example: the names and contact details of Contributors mentioned in Task descriptions, data regarding allocated ownership shares, comments, or other personal data entered in Project descriptions).
13. As a general rule, you, as the initiator of the Project, will be the sole party with access to and control over this User-Generated Content in connection with a specific Project, and may enter, modify or delete it, within the limits of the Usage Plan chosen.
14. We may access User-Generated Content on your instructions or, from time to time, for technical and maintenance purposes, in order to ensure the operation of the Platform.
15. For the purpose of processing User-Generated Content on your behalf, the Company shall comply with the Data Processing Agreement, which you can find by accessing the following link. When creating your User account, you expressly give your consent to the Data Processing Agreement (in accordance with Section 3.2 of the Terms and Conditions of the Platform), which you can find by accessing the following link.

Processing as a data controller

Context of the processing

16. In order for you to benefit from the Platform's functionalities, you will be required to authenticate through your Google account, which involves providing certain personal data, as described below (see also Section 6 of the Terms and Conditions of the Platform).
17. You may also access the public pages of the Platform as an unregistered visitor, with access only to a limited number of functions (see the Terms and Conditions of use).

Personal data retention period

18. We will store your personal data for a limited period of time (as a rule, 3 years from the termination of the contractual relationship, this being the general limitation period for most legal actions). The storage period may vary as necessary to achieve the purposes of processing personal data, as described in this Policy and in accordance with our legal and contractual obligations or industry practices. This means that we may retain different categories of data for different periods of time, depending on the type of data, the category of Data Subjects to which the data relates, and the purposes for which we collected the data (for example: accounting data may be kept for a longer period, of up to 10 years or even longer). Once the retention period expires for a particular category of data, we will delete, archive, anonymize or destroy it, in accordance with our internal policies and procedures, unless this is prohibited by applicable law. You may request the deletion of all your personal data at any time, by contacting us in this regard.
19. However, certain information (such as comments, Task descriptions or other elements of Content) may be retained, including in anonymized form, in order not to jeopardize the coherence and integrity of the Platform and the usefulness of that information for other Users. 

Legal basis for processing as controller

20. Art. 6(1)(a) GDPR – the consent of the Data Subject. With regard to personal data processed for marketing purposes, your consent is requested when creating the User account or separately, in the case of unregistered visitors. You may withdraw your consent at any time.
21. Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the Data Subject is a party, or in order to enter into such a contract (for example, billing data, for Users with paid plans, as well as the preferences set in Account Settings, necessary for providing the Platform in accordance with the Usage Plan chosen).
22. Art. 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which we are subject, in particular our tax and accounting record-keeping obligations regarding invoices issued to Users with paid plans.
23. Art. 6(1)(f) GDPR – Processing is necessary for the purposes of the legitimate interests pursued by the data controller, namely carrying out its activity and ensuring the use of the Platform.

To whom we may disclose personal data processed as controller

24. We may disclose personal data processed as controller to:

1. Our employees, collaborators, consultants or other authorized persons who need to know this information. Each such person is subject to a legal or contractual confidentiality obligation;
2. Our partners. This category may include persons such as: our hosting providers (Linode, Google), the payment processor used for paid plans, software or online service providers, online advertising service providers; 
3. Where legally required. We may also provide personal data to third parties in the following situations:

• at the request of public authorities, auditors or institutions competent to carry out inspections of the Company, based on their legal obligations, such as data protection authorities, which may request that we provide information;
• to third parties, as part of a change of control, a merger or acquisition involving the Company, or similar proceedings, if the data must form part of the transaction.

25. The recipients of personal data implement the necessary security measures for the protection of personal data and process such data exclusively for the purposes mentioned in this Privacy Policy.

International transfer of personal data

26. We use hosting services provided by Google, which involve the encrypted storage of data, including outside the EU. To the extent that the processing of data through this infrastructure involves their transfer outside the European Economic Area, such a transfer is carried out in compliance with the appropriate safeguards provided by the GDPR (for example, standard contractual clauses adopted by the European Commission), in accordance with the contractual commitments of the hosting provider.

Absence of automated decision-making

27. You will not be subject to a decision based solely on the automated processing of your personal data, such as profiling.

How we protect your personal data

28. Your personal data is protected through a variety of security measures, both locally and online. The Platform is hosted on the cloud infrastructure provided by Linode and Google, reputable hosting providers, which offer protection against cyberattacks. Communication between services is also secured through HTTPS. 

What are your rights as a Data Subject and how can you exercise them

29. Right to object. At any time, on grounds relating to their particular situation, in the case of processing based on Article 6(1)(e) or (f) of the GDPR (the legitimate interest of the controller or the public interest), the Data Subject has the right to request the cessation of any processing of personal data, in accordance with the law (for example: if the Data Subject invokes reasons related to their personal situation in connection with certain personal data processed). However, a request based on the right to object to processing will not always be granted by the controller, if the controller has compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or if the purpose is the establishment, exercise or defense of a legal claim.
30. Other rights of the Data Subject

• Right of access. Data Subjects have the right, at any time, to have access to the personal data processed by the Controller or its partners and to obtain a copy thereof. By virtue of this right, Data Subjects have the right to obtain information regarding aspects such as: the nature, processing and disclosure of such personal data to third parties.
• Right to rectification. At the request of Data Subjects, the controller will rectify any error or inaccuracy regarding personal data.
• “Right to be forgotten” (erasure of data). Data Subjects have the right to request, at any time, the erasure of personal data processed by the controller or its partners, for certain reasons (for example: if the purpose of the processing has been fulfilled). However, a request based on the right to be forgotten will not always be granted by the controller, for example: if the data is necessary for the defense of a legal claim by the controller.
• Right to restrict processing. Under certain conditions provided by law, the Data Subject has the right to restrict the processing of personal data (for example: in a situation where the accuracy or correctness of personal data is contested by the Data Subject). In such situations, processing may only continue with the consent of the Data Subject, with certain exceptions (for example: storage).
• Right to data portability. Under the conditions provided by law, the Data Subject has the right to request that the personal data concerning them, which they have provided, be transmitted in a structured, commonly used and machine-readable format; the personal data thus provided may be transmitted to another controller, at the request of the Data Subject.
• Right to withdraw consent. When personal data is processed on the basis of the Data Subject's consent, this consent may be withdrawn at any time. This will not affect processing carried out in the past, but may prevent future processing.
• Right to lodge a complaint with the supervisory authority. For processing falling within the competence of the Romanian authorities, the Data Subject may lodge a complaint with the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro).

31. In order to exercise any of the rights mentioned above, as well as to ask any question regarding this Privacy Policy, you may contact us using the contact details above.

Other information

What happens if you refuse to provide us with your personal data

32. You are not obliged to provide us with your personal data; however, refusing to do so will make it impossible to create a User account and, therefore, to access the Solo, Team or Contributor Plans. You will still be able to access the public pages of the Platform, as an unregistered visitor, with limited functionalities.

Changes to the Privacy Policy

33. From time to time, we may modify this Privacy Policy to reflect legislative changes or changes to our internal policies, the website, or the technology we use, subject to the prior notice period set out in Section 16 of the Terms and Conditions of the Platform (10 days before the amendment takes effect). When you return, please check the applicable version/date of the Privacy Policy and any amendments that have occurred.

Related documents

34. This Privacy Policy, the Terms and Conditions of use of the Platform (link) and the Data Processing Agreement on personal data represent your contract with us. This contract governs the use of the Platform, which is why we encourage you to read the above documents carefully, in conjunction with one another.
35. In addition, the Data Processing Agreement, available at the following link, applies to personal data processing carried out in our capacity as processor.

Links to other websites

36. This website may contain links to other third-party websites (which may, in turn, collect and process your personal data). By accessing these links, you will become subject to the practices and policies of those third-party websites. The Company does not assume and cannot be held responsible for such practices or policies of those third-party websites.

Copyright © 2023—2026 5-STAR PLANET S.R.L.

All rights reserved.