Basic information about the processing of personal information

Data Controller

Outpayce, S.A.U.(“Outpayce”) will be the data controller for data processing activities related to Outpayce.com (the Site).

Purpose of Personal Information Processing

Outpayce will be the data controller for processing your personal data for the purposes of making the Site available to you, as well as for any processing of personal data carried out based on theTerms of use , specific forms made available to you and/or the sending of commercial communications as well as for the purposes of improving the Site (as applicable).

Legal Grounds for Processing

The legal basis by which we will process your personal data is: (i) the performance of a contract with you, governed by theTerms of use , by specific forms used when collecting your data; (ii) your consent when subscribing to our commercial communications (if applicable) and/or; (iii) Outpayce’s legitimate interest for the purposes of research, analytical and statistical improvements.

Information Outpayce collects from you

• IP address
• Information collected through cookies (as applicable)
• If shared by you: (i) name and surname; (ii) e-mail address; (iii) company name; (iv) address and country; (v) phone number; and/or (vi) position or business title.
• Other information you may share with us based on specific forms.

Recipients of the Personal Information

As an Amadeus group entity, we may share personal data with other Amadeus group entities, who, due to the nature of the services Outpayce provides as a global payment services supplier, may be in any location around the world. We may also disclose your information to third parties, business partners, suppliers, subcontractors, and service providers for the performance of any contract we enter into with them. If necessary or legally required we may disclose your personal data to public and government authorities, including public and government authorities outside your country of residence.

International Transfers of Data

Outpayce may share your personal data with other Amadeus group entities and third-party service providers, this may involve transferring personal data outside the European Economic Area. When personal data is transferred to a third country, it will continue to receive adequate protection through contractual or other arrangements put in place with other Amadeus group entities and third-party service providers.

Retention Period

Outpayce retains personal data for as long as necessary to fulfil the purposes it was collected for, including for the purposes of satisfying any legal requirements.

Your rights

You have the right to access, rectification, erasure, to object to and/or to restrict processing of personal information and the right to lodge a complaint with a supervisory authority (Spanish Data Protection Authority).

You may exercise your rights via e-mail:dataprotection@outpayce.com or by sending your request to our registered office at Calle Salvador de Madariaga, 1, 28027 Madrid (Spain).

Additional information

More information about privacy and data protection is available below.

Data Controller

This Site is operated by Outpayce, S.A.U. with registered office at Calle Salvador de Madariaga, 1, 28027 Madrid (Spain).

Outpayce will be the data controller for processing your personal data for the purposes of making the Site available to you, as well as for any processing of personal data carried out based on theTerms of use , specific forms made available to you and/or the sending of commercial communications as well as for the purposes of improving the Site (as applicable).

Purpose of Personal Information Processing

This Privacy Statement (“Statement”) is applicable to all the information collected by Outpayce from you for the purposes of making the website and its features (the “Site”) available to you. This Statement does not address the collection, use, or disclosure of information through any other means other than the Site. This Statement does not apply to the personal data that Outpayce and/or other Amadeus group entities may process about you as a traveler. If you are interested in learning more about these other processes, please follow thislink .

Personal information you share with us and that we collect about you during your navigation through the Site will be used, transferred and disclosed (if applicable) (“processed”) as permitted by local law, to:

• Fulfill requests made by you through specific forms (e.g., to send you commercial communications such as subscriptions and newsletters);
• Obtain your feedback and respond to questions made by you (e.g., through surveys);
• Send you information regarding the Site such as changes to ourTerms of use ,
  policies, notices and/or other administrative information;
• Conduct data analysis, audits, developing new products, enhancing our website, improving our services, and identifying usage trends;
• Detect, prevent, or otherwise address security or technical issues in connection with this Site.

Legal grounds for processing

We process your personal data based on:

• The performance of a contract on the basis of the Terms of use and/or specific forms used when collecting your personal data.
• Your consent to send you commercial communications related to Outpayce’s product and/or services (if you request us to do so).
• Outpayce’s legitimate interest for research, analytical and statistical activities for the purposes of improving the Site.

Information Outpayce collects from you

This Statement covers any personal information that we may collect during your navigation through the Site:

• IP address.
• Information that Outpayce may obtain through the use of cookies.

We and our service providers may use “cookies” and similar technologies on the Site. We may use cookies and other technologies to better serve you with more tailored information and facilitate your ongoing access to and use of the Site. For detailed information on the cookies we may use and the purposes for which we may use them, see ourCookie Notice.

We may process additional personal data that you share with us through specific forms, additional privacy and data protection disclosures will accompany any such forms. Such data may include (as applicable):

• Name and surname
• E-mail address
• Company name
• Address and country
• Phone number
• Position or business title

If you intend to provide us with personal data of a third party, it is your responsibility to obtain consent from that third party prior to passing the personal information to us.

You are responsible for the content of the information you provide to us and you must ensure it is legal, truthful, accurate and not misleading in any way and does not infringe on any third party’s rights or is not otherwise legally actionable by such third party.

Recipients of personal information

We may share personal data with other Amadeus group entities, who, due to the nature of the services Amadeus group provides as a global travel and payments technology supplier, may be in any location around the world. These Amadeus group entities may process personal data for the purposes described in this Statement. A link to the complete list of Amadeus group entities and their locations can be foundhere .

In addition, we may also disclose your information to:

• Third parties, business partners, suppliers, subcontractors, and service providers for the performance of any contract we enter into with them;
• Analytics and search engine providers that assist us in the improvement and optimization of our Site;
• Other Amadeus group entities or other third parties in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets or stock (including without limitation in connection with any bankruptcy or similar proceedings); and
• If necessary: (a) under applicable law, including laws outside your country of residence; (b) to comply with legal processes; (c) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of Amadeus group entities; (f) to protect our rights, privacy, safety, property, and/or that of Amadeus group entities, you, or others; and (g) to permit us to pursue available remedies or limit the damages that we may sustain.

Where such disclosures take place Outpayce requires the appropriate technical and organizational security measures to be in place to protect personal data, and for personal data to be processed lawfully.

Outpayce only allows Amadeus group companies and third-party service providers to use personal data for specified purposes and in accordance with Outpayce’ instructions. Any sharing of personal data using third party platforms would be governed by the terms of the third-party platform used.

International Transfer of Personal Data

When Outpayce shares your personal data with other Amadeus group entities and third-party service providers who process personal data on behalf of Outpayce, this may involve transferring personal data outside the European Economic Area (“EEA"). When personal data is transferred to a third country, it will continue to receive adequate protection through contractual or other arrangements put in place with other Amadeus group entities and third-party service providers. For these transfers, at least one of the following appropriate safeguards will be implemented:

• Personal data will be transferred to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission;
• Standard contractual clauses as approved by the European Commission which, together with supplementary measures, will ensure personal data transferred will retain the same protection it has in EEA; or
• Any other lawful transfer mechanism as foreseen in applicable laws and/or as approved by the European Commission or relevant Data Protection Authority.

Further information on the appropriate safeguards used when transferring personal data outside the EEA can be requested through the contact details set out below in the section legal rights. When requesting this information please make a reference to the transfer of personal data outside the EEA.

Retention Period

Outpayce retains personal data for as long as necessary to fulfil the purposes it was collected for, including for the purposes of satisfying any legal requirements.

Please note that on any forms where you provide us with your details, we may specify the period of time that we intend to keep the data according to the specific proposes defined in the form.

Security and Integrity of Personal Information

We use reasonable organizational, technical and administrative measures to protect personal information under our control. Unfortunately, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure. Please do not send us sensitive information through e-mail. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), you must immediately notify us of the problem by contacting us in accordance with the contacting section of this Site. Please note that e-mail communications will not necessarily be secure; accordingly, you should not include health or financial information in your e-mail correspondence with us.

When Personal Data is processed on behalf of Outpayce, access is limited to those who have a business need to know. Personal Data will be processed in accordance with the instructions of Outpayce and those who have access are subject to a duty of confidentiality.

Outpayce has procedures in place to deal with any suspected personal data breach and will notify individuals and any applicable regulator of a breach where they are legally required to do so.

Third party sites and sending messages through the site

This Statement does not address, and Outpayce is not responsible for, the privacy, information or other practices of any third parties, including without limitation any third party operating any site to which this Site contains a link; or any third-party platform such as a social media platform where Outpayce may share personal information at your request. Where personal information is shared in this way, the use of the personal information will be governed by the terms of the third-party platform you have requested personal information is shared with. The inclusion of a link on this Site does not imply endorsement of the linked site by us.

This Site may permit you to send messages regarding site-related content to another individual though the site. If you wish to use this feature, you may be required to provide us with the individual’s email address. By using this functionality, you affirm that you are entitled to use and provide us with the recipient's name and email address for this purpose and that you will remain solely responsible for this. Outpayce shall not assume any liability that may arise from sending these kinds of messages to the recipients, because we are doing this at your request.

Use of the site by children

The Site is not directed to children, and we request such individuals to not provide personal data through the Site.

Your rights

You may exercise your rights of access, erasure, to object, to rectification, data portability and/or to restrict the processing of your personal data by sending a request via email:dataprotection@outpayce.com or by sending your request to the applicable registered office.

Although Outpayce intends to carefully address any request and/or claim from you, as well as carefully process your Personal Data, you are entitled to file any claim or complaint before the relevant data protection authorities.

Contacting Us

If you have any questions regarding this Statement, please contact us at:dataprotection@outpayce.com .

Additional Privacy Disclosures for the United States, California and Nevada

If you are a California or Nevada (United States) resident, please see our Additional Privacy Disclosures for the United States California and Nevadahere , which is incorporated by reference into this Statement.