Beyond Trails & Tales

Privacy & Data Protection Notice

Version 3.4 | Effective from: 7 October 2026

1. About this Privacy Notice

This Privacy & Data Protection Notice ("Privacy Notice") explains how Beyond Trails and Tales Kft. collects, uses, stores, shares and otherwise processes personal data relating to Travellers, prospective Travellers, customers, website visitors, Beyond Portal and customer-account users, newsletter subscribers, emergency contacts, business contacts and other individuals who interact with Beyond.

This Privacy Notice is provided principally in accordance with Regulation (EU) 2016/679 ("GDPR"), Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Infotv."), Act C of 2003 on Electronic Communications, Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities, applicable Hungarian consumer-protection, accounting and tax legislation, and other applicable Hungarian and European Union laws.

This Privacy Notice is intended to provide information required by data-protection law. It does not constitute a waiver of any data-subject right and does not itself create a legal basis for processing which would otherwise be unlawful.

This Privacy Notice does not form part of the Traveller Contract as a contractual limitation of privacy rights.

2. Data Controller

The data controller is:

Beyond Trails and Tales Kft.

Registered office: 1126 Budapest, Márvány utca 50., 3rd Floor, Door 3, Hungary

Company Registration Number: 01-09-452025

Tax Number: 32969768-2-43

Tour Operator Registration Number: U-002106

Website: www.beyondtrailsandtales.com

Email: info@beyondtrailsandtales.com

In this Privacy Notice, "Beyond", "Beyond Trails & Tales", "we", "us" and "our" mean Beyond Trails and Tales Kft.

Questions or requests concerning personal data may be sent to info@beyondtrailsandtales.com.

Where the appointment of a Data Protection Officer becomes legally required, this Privacy Notice will be updated with the relevant contact details.

3. Language of this Notice

Beyond conducts its principal website, booking and contractual process in English. Accordingly, this Privacy Notice is provided in English.

Where Beyond provides a translation, that translation is intended to facilitate understanding.

Nothing in this provision limits Beyond's obligation under Article 12 GDPR to provide privacy information in a concise, transparent, intelligible and easily accessible form using clear and plain language.

4. Data Protection Principles

Beyond processes personal data according to the principles contained in Article 5 GDPR. Personal data must therefore be:

1. processed lawfully, fairly and transparently;
2. collected for specified, explicit and legitimate purposes;
3. adequate, relevant and limited to what is necessary;
4. accurate and, where necessary, kept up to date;
5. kept in identifiable form for no longer than necessary;
6. protected by appropriate technical and organisational measures; and
7. processed in a manner for which Beyond can demonstrate accountability.

5. Where We Obtain Personal Data

Depending on the circumstances, Beyond may receive personal data:

1. directly from you;
2. from another Traveller making a booking which includes you;
3. from a parent or guardian;
4. from a person who lists you as an emergency contact;
5. from a travel supplier involved in your trip;
6. from a payment provider or bank;
7. from Squarespace or another technology provider;
8. from social-media platforms when you interact with Beyond;
9. from cookies and similar technologies where permitted;
10. from publicly available information where use of that information is lawful; or
11. from authorities, insurers, lawyers or other persons involved in a legitimate complaint, claim or legal matter.

Where personal data are obtained from someone other than the data subject, Article 14 GDPR may require Beyond to provide privacy information directly to that person within a reasonable time, normally no later than one month, at first communication, or before the data are first disclosed, depending on the circumstances.

6. Categories of Personal Data

6.1 Identity information

This may include:

• name;
• date of birth where genuinely required;
• nationality where relevant;
• country of residence;
• passport or travel-document information where necessary for a particular trip; and
• other identification details required by law or a travel supplier.

Beyond does not collect information such as mother's name, place of birth or comparable identification information simply as a matter of routine unless there is a genuine legal or operational requirement.

6.2 Contact information

• email address;
• telephone number;
• billing address;
• residential address where required;
• customer-account contact information; and
• emergency-contact information.

6.3 Beyond Portal and customer-account information

• account identifier;
• account email address;
• account creation information;
• login/account status;
• booking history;
• contractual documents associated with the account;
• preference information;
• support history;
• authentication/security information made available to Beyond; and
• account activity reasonably relevant to administration or security.
• application and booking workflow status;
• internal staff/admin actions relating to the account or booking where relevant to administration, security, audit or compliance; and
• portal security, access and audit information reasonably necessary to protect the system and establish relevant actions.

Authentication credentials are processed through the customer portal authentication provider. Beyond does not receive or store customer passwords in readable form. Authentication and security records may include password hashes, login status, multi-factor-authentication status, session information and security events where made available by the provider.

6.4 Booking and contractual data

• trip selected;
• destination;
• dates;
• price;
• deposit;
• instalment schedule;
• accommodation selection;
• room type;
• roommate preference;
• single supplement;
• special requests;
• booking reference;
• contractual correspondence;
• cancellation or amendment records;
• Traveller Contract version;
• GTC version;
• Privacy Notice version;
• mandatory package-travel information version;
• acceptance date and time; and
• other information necessary to establish what was booked and accepted.

6.5 Payment and transaction information

• payer name;
• billing information;
• transaction reference;
• amount;
• currency;
• date of payment;
• payment status;
• payment method;
• bank-account information visible in a bank transfer;
• refund information; and
• chargeback/payment-dispute information.

Beyond does not ordinarily receive or store complete payment-card numbers, security codes or equivalent authentication credentials where those are processed directly by SimplePay.

6.6 Travel and operational information

• flight or arrival information;
• transfer information;
• accommodation allocation;
• emergency contact;
• activity registration;
• swimming ability where relevant;
• licences or certifications required for an activity;
• dietary requirements;
• accessibility requirements;
• equipment information; and
• other information genuinely necessary to operate a particular trip.

6.7 Technical and website information

• browser type;
• device type;
• operating system;
• approximate location;
• page views;
• referral information;
• interactions;
• cookie or device identifiers;
• session information;
• advertising identifiers;
• conversion information; and
• security-related technical records.

Some of this information may be processed directly by Squarespace, Supabase, Google, Hotjar, Meta, TikTok or another website, portal, hosting, security or analytics provider rather than being directly visible to Beyond.

7. Special-Category Personal Data

GDPR Article 9 provides additional protection for certain types of personal data, including health data and data revealing religious or philosophical beliefs.

Beyond may need to process limited special-category information in connection with some trips. This may include:

• medical conditions relevant to safe participation;
• allergies;
• accessibility information revealing health status;
• medication relevant to an emergency;
• pregnancy information voluntarily disclosed because relevant to participation;
• injuries;
• mobility limitations;
• dietary information revealing a health condition; or
• dietary information revealing religious or philosophical beliefs.

Beyond does not require or seek a complete medical history. Only information reasonably relevant to the stated purpose should be collected.

8. Health and Safety Information

8.1 When it is collected

Detailed health and safety information is generally not collected during the initial booking process. Beyond may request relevant information later through a Participant Information Form or similar pre-departure process.

8.2 Ordinary legal basis

Where a Traveller voluntarily provides health information to Beyond for trip preparation, accommodation, dietary, accessibility or safety purposes, Beyond will normally rely on Article 6(1)(a) GDPR - consent, together with Article 9(2)(a) GDPR - explicit consent for special-category information. Consent will be requested separately from acceptance of the Travel Contract.

8.3 Emergencies

Where a Traveller is physically or legally incapable of giving consent and processing is genuinely necessary to protect their vital interests or those of another natural person, Beyond may rely on the relevant vital-interests provisions, including Article 9(2)(c) GDPR.

8.4 Legal claims

Where special-category information becomes relevant to the establishment, exercise or defence of a legal claim, processing may be carried out under Article 9(2)(f) GDPR.

8.5 Consequences of not providing relevant information

Providing health information is generally voluntary. However, where information is objectively necessary to determine whether an activity can be performed safely or to make a requested accommodation, Beyond may be unable to provide that specific accommodation or allow participation in that particular activity if the necessary information is not available. Any such decision must remain proportionate and consistent with the Travel Contract and applicable law.

9. Emergency Contact Information

Travellers may be asked to provide an emergency contact. Beyond may process the emergency contact's name, relationship to the Traveller, telephone number, email address where available, and relevant communications in the event of an emergency.

Purpose

To allow Beyond to contact an appropriate person where reasonably necessary in connection with the Traveller's health, safety or emergency situation.

Legal basis for holding and using the emergency contact

Article 6(1)(f) GDPR - Beyond's and the Traveller's legitimate interest in effective emergency communication. In a serious emergency, Article 6(1)(d) GDPR concerning vital interests may also apply.

Article 14 transparency

Because emergency-contact information is ordinarily received from the Traveller rather than directly from the emergency contact, Article 14 GDPR applies unless an exemption is available. Beyond will provide the required privacy information within the applicable Article 14 period: within a reasonable time and no later than one month after obtaining the details, or earlier where the data are first used to communicate with the emergency contact or first disclosed to another recipient. Beyond will normally use a neutral one-time message or another appropriate transparency method. This is not marketing and does not subscribe the emergency contact to anything.

The transparency message may identify the Traveller who supplied the details, explain that the recipient has been named as an emergency contact, link to or provide the relevant privacy information, state the limited emergency purpose, and explain how the recipient can request removal if they do not wish to remain listed. Where the emergency contact informs Beyond that they do not wish to be listed, Beyond will remove their emergency-contact details unless another lawful basis requires temporary retention and will ask the Traveller to nominate another contact where appropriate.

Where the emergency contact already has the required information, or another Article 14(5) exemption lawfully applies, Beyond may not need to provide a separate notice.

10. Other Travellers Booked by Someone Else

Where a lead Traveller provides personal information relating to another Traveller, Beyond may process that information to administer the group booking.

Where the additional Traveller is themselves a party to or beneficiary of the relevant travel arrangement, contractual necessity may apply. Where Article 6(1)(b) does not directly apply to that person, processing may be based on Beyond's legitimate interest in administering the booking and providing the travel services requested on their behalf.

Beyond will provide Article 14 information to the additional Traveller where required. The person making the booking should not provide information about another Traveller which is unnecessary for the booking.

11. Website Enquiries

Where you submit a contact form or otherwise contact Beyond about a possible trip, we may process your name, email, telephone number, intended destination or trip, travel preferences and message content.

Purpose

To respond to the enquiry and, where relevant, take steps towards entering into a contract.

Legal basis

Article 6(1)(b) GDPR where the enquiry concerns pre-contractual steps requested by you. For general communications not directed towards entering into a contract, Beyond may rely on Article 6(1)(f) GDPR and its legitimate interest in responding to people who contact the business.

Retention

Where no contract follows, enquiry records will ordinarily be deleted or anonymised no later than one year after the last meaningful communication, unless longer retention is reasonably necessary because of a complaint, dispute, legal requirement or security issue.

12. Beyond Portal, Customer Accounts and Internal Administration

Beyond operates the Beyond Portal, its own customer and administration system. The Portal provides customer-facing functions for account creation, authentication, trip applications, bookings and access to trip and contract information. It also contains a restricted staff/admin area used to manage those travel services and customer relationships. Beyond determines the purposes of this processing and remains the data controller.

The Portal uses third-party technical infrastructure, including Supabase for authentication, database and backend services, together with application-hosting, content-delivery and security providers where needed. Those providers process personal data in accordance with their applicable roles and contractual data-protection arrangements.

Purpose

• create and manage the account;
• authenticate users;
• administer bookings;
• administer trip applications and Traveller records;
• manage payment/invoicing status, contractual records, rooming and other operational trip information;
• allow authorised Beyond staff to perform customer-service, operational, finance, compliance and security tasks through the restricted internal area;
• display contractual documents;
• store trip information;
• provide support;
• maintain security;
• identify accepted contract versions; and
• make relevant booking functionality available.

Legal basis

Article 6(1)(b) GDPR where the account is necessary to provide requested contractual services. Security-related processing may additionally rely on Article 6(1)(f) GDPR and Beyond's legitimate interest in protecting accounts, systems and customers against misuse or unauthorised access.

Retention

Account-only information will normally be retained while the account is active. Where a user closes an account, account-only data which are not required for another lawful purpose will normally be deleted or anonymised within 90 days. Inactive accounts with no current booking, application or other ongoing purpose may be reviewed and deleted or anonymised in accordance with Beyond's retention procedures. Closure of an account does not require Beyond to delete contractual, accounting, complaint, fraud/security or legal records which Beyond is lawfully required or entitled to retain.

13. Booking and Traveller Contracts

Beyond processes booking information to receive bookings, establish availability, conclude the Traveller Contract, administer payments, provide package-travel information, arrange services, communicate with the Traveller, process amendments, process cancellations, provide assistance and perform contractual obligations.

Legal basis

Article 6(1)(b) GDPR - performance of the Travel Contract or pre-contractual steps requested by the Traveller. Where a statutory obligation applies, Article 6(1)(c) GDPR may additionally apply.

14. Electronic Contract Evidence

Beyond's online contracting system may retain records including account identifier, booking reference, date/time of acceptance, accepted Traveller Contract version, accepted GTC version, Privacy Notice version supplied, mandatory package-travel information supplied, acceptance record, selected options, payment status and technical evidence reasonably necessary to establish the transaction.

Purpose

• demonstrate what was presented and accepted;
• maintain accurate business records;
• comply with legal obligations;
• investigate disputed bookings;
• deal with chargebacks;
• establish or defend contractual claims; and
• protect Beyond and Travellers from fraud or misunderstanding.

Legal basis

Article 6(1)(b), Article 6(1)(c) and/or Article 6(1)(f) GDPR, depending on the specific record and purpose.

Retention

Contractual and booking evidence will ordinarily be retained for at least the period during which contractual claims may be asserted, normally five years under the general Hungarian civil limitation regime, unless a longer legal retention period applies. Where records are also accounting documents, the longer accounting retention period applies. Where a dispute or proceeding is pending, relevant records may be retained until final resolution and expiry of any associated legal retention period.

15. Travel Documents and Identification Information

Some destinations, accommodations, carriers or authorities may require additional Traveller identification. Beyond may therefore request, where genuinely necessary, passport name, nationality, passport number, passport expiry date, date of birth or other required travel-document data.

Legal basis

Article 6(1)(b) GDPR where required to perform the contracted travel service. Article 6(1)(c) may apply where processing is required by law.

Data minimisation

Beyond will not routinely request copies of passports where recording limited passport information is sufficient.

Retention

Unless a longer legal or supplier requirement applies, passport/travel-document information retained by Beyond solely for operational trip purposes should normally be deleted within 30 days following completion of the relevant trip.

16. Trip Operation and Supplier Coordination

Beyond shares limited Traveller information with suppliers where necessary to provide the package. Recipients may include hotels, villas, guesthouses, guides, transport companies, drivers, boat operators, activity operators, restaurants, caterers, local travel partners and other suppliers forming part of the package.

Examples

• A hotel may require the Traveller's name and room allocation.
• A driver may require the Traveller's name, telephone number and arrival time.
• A boat operator may require the Traveller's name and relevant certification.
• A caterer may require allergy or dietary information.

Legal basis

For ordinary personal data: Article 6(1)(b) GDPR - performance of the Travel Contract. For special-category information, an applicable Article 9 basis must also exist.

Data minimisation

Suppliers should receive only the data reasonably necessary for the service they are providing.

17. Flight and Arrival Information

Where Beyond arranges or coordinates transfers, Travellers may provide airline, flight number, airport, arrival/departure time and related transport information.

Purpose

Trip coordination and transfer administration.

Legal basis

Article 6(1)(b) GDPR.

Retention

Information retained solely for trip operation will ordinarily be deleted within 30 days following completion of the trip, unless required in connection with a complaint, disruption, insurance issue or legal claim.

18. Dietary Requirements

Beyond may collect dietary information closer to departure. Where dietary information merely states a preference, ordinary personal-data rules apply. Where dietary information reveals a health condition, allergy, religious belief or philosophical belief, it may constitute special-category data. In those circumstances, Beyond will rely on an applicable Article 9 legal basis, normally explicit consent where information is voluntarily supplied for trip arrangements.

19. Payments by Bank Transfer

Where a Traveller pays by bank transfer, Beyond may process payer name, bank-account details visible to the recipient, payment reference, amount, currency, date and payment status.

Purpose

Receiving, identifying, reconciling and refunding payments and maintaining contractual/accounting records.

Legal basis

Article 6(1)(b) GDPR for contractual payment administration and Article 6(1)(c) GDPR for statutory accounting obligations.

Beyond's account-keeping bank is OTP Bank Nyrt. OTP processes information in accordance with its own legal obligations as a financial institution.

20. Card Payments - SimplePay

Where Beyond makes online card payment available, the payment transaction is processed through SimplePay. Számlázz.hu is used separately for invoicing and related invoice/payment administration.

Current provider: SimplePay Zrt., registered office: 1138 Budapest, Váci út 135-139., Building B, 5th Floor, Hungary. Company Registration Number: 01-10-143303. Tax Number: 32835155-2-44.

Data flow

Information necessary to initiate and reconcile payment may be transferred to or exchanged with SimplePay. Card information entered directly into the SimplePay payment environment is processed by SimplePay. Beyond does not ordinarily receive complete card numbers, CVV/CVC codes or card authentication credentials.

Legal roles

SimplePay may act as an independent data controller for payment-processing activities for which it determines the purposes and means in accordance with payment law and its own privacy notice. The exact legal allocation of roles is determined by applicable law and the relevant service agreements, rather than merely by the label used in this Privacy Notice.

21. Számlázz.hu and Invoicing

Beyond uses KBOSS.hu Kft. / Számlázz.hu for invoicing, pro-forma/payment-request administration and related invoice/payment records. KBOSS.hu Kft. is registered at 1031 Budapest, Záhony utca 7., Hungary (Company Registration Number: 01-09-303201). Information processed may include name, billing address, email address, tax number where required, product/service description, invoice or payment-request amount, currency, payment status and document details.

Legal basis

Article 6(1)(c) GDPR - compliance with Hungarian tax and accounting obligations.

Retention

Accounting documentation subject to Hungarian accounting law must generally be retained for at least eight years. This retention obligation applies to the accounting records which must legally be retained. It does not mean that every category of Traveller information is automatically retained for eight years.

22. Accountant

Beyond currently uses Exigopen Kft., 2030 Érd, Platánfa utca 65., Hungary, for accounting services. Exigopen may receive or access relevant invoices, payment records, accounting information, customer names, billing addresses and other information necessary to provide accounting services. Processing is limited to information reasonably necessary for accounting, tax and related compliance.

23. Google Workspace

Beyond uses Google Workspace, including services such as Gmail, Google Drive and Google Meet. These services may process personal data contained in emails, contracts, trip records, customer-support correspondence, internal files and online meeting information.

The relevant Google entity may act as processor and/or independent controller depending on the specific service and processing activity. Beyond will use Google services in accordance with the applicable contractual and data-protection arrangements.

24. Website and Beyond Portal Technology

Beyond uses Squarespace Ireland Limited for public-facing website functions, which may include website hosting, website forms, content management, cookie controls and Squarespace Email Campaigns. The Beyond Portal is separate from Squarespace and is operated by Beyond as its customer and administration system.

The Beyond Portal uses Supabase Pte. Ltd. for authentication, database and related backend infrastructure. Supabase may process account, application, booking, Traveller, authentication, database, security and technical information on Beyond's behalf under the applicable service terms and data-processing arrangements. The portal may also rely on application-hosting, content-delivery and security infrastructure providers which process limited technical request, logging and security data. Use of those providers does not change the fact that the Beyond Portal is operated as Beyond's own system. Where any technology provider processes personal data outside the EEA, the international-transfer rules in Section 51 apply.

25. Transactional Communications

Beyond may send operational communications necessary for the provision of a trip even where a Traveller has not subscribed to marketing. These may include booking confirmations, invoices, payment reminders, contractual notices, itinerary information, meeting instructions, visa or entry information, safety updates, trip changes, emergency communications and customer-support correspondence.

Legal basis

Article 6(1)(b) GDPR and, where applicable, Article 6(1)(c). Transactional communication does not become optional marketing merely because it is sent by email.

26. Newsletter and Direct Marketing

Beyond may use Squarespace Email Campaigns or another email-marketing provider to send Beyond news, upcoming trip announcements, trip offers, promotions and similar marketing content. Marketing subscription is optional and is not a condition of booking a trip.

Legal basis

Article 6(1)(a) GDPR - consent. Under Section 6 of Act XLVIII of 2008, electronic direct marketing to a natural person generally requires the recipient's prior, clear and express consent, subject to the statutory exceptions.

Marketing consent record

Beyond records the information reasonably necessary to demonstrate a valid marketing consent, including the subscriber's name, email address, consent status, the wording and purpose of the consent, date and time, source of consent and withdrawal information. Where an age-restricted advertisement would be involved, any additional identification information required by Hungarian advertising law will be requested only where necessary.

Withdrawal

Consent may be withdrawn at any time, free of charge. Each marketing email will provide an appropriate unsubscribe facility. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Upon withdrawal, the address will be removed from active marketing use promptly. Only minimal evidence reasonably necessary to demonstrate compliance with a withdrawal or prevent an unlawful re-subscription may be retained where there is an appropriate legal basis.

27. Photographs and Video

Section 2:48 of the Hungarian Civil Code generally requires the person's consent both to make an identifiable image or audio recording and to use it, subject to statutory exceptions including genuine crowd recordings and recordings of public appearances in public life.

Accordingly, booking a Beyond trip does not automatically constitute photo/video consent.

27.1 Consent

Closer to the trip, Beyond may ask the Traveller separately whether they consent to Beyond taking identifiable photographs/video of them and using selected photographs/video for stated promotional purposes. Such purposes may include Beyond's website, social media, paid advertising, brochures, presentations and other Beyond promotional content.

27.2 Legal basis

Article 6(1)(a) GDPR - consent, together with the consent required under applicable Hungarian civil law.

27.3 Refusing consent

Declining marketing-photo/video consent does not affect the Traveller's booking or participation. Beyond will make reasonable efforts not to intentionally create or use identifiable promotional portraits of a Traveller who has declined.

27.4 Lawful exceptions

Nothing in this section limits a recording which applicable law permits without individual consent, such as a genuine crowd recording falling within the Civil Code exception.

27.5 Withdrawal

Consent may be withdrawn for future use. Beyond will stop new consent-based uses after withdrawal within a reasonable implementation period. Withdrawal does not retrospectively make lawful prior use unlawful and may not make it practically possible to recall material already lawfully printed, distributed or irreversibly incorporated into completed content.

28. Reviews and Testimonials

Where Beyond publishes an identifiable Traveller review or testimonial, the data may include name, image, trip attended and review/testimonial content. Publication will normally be based on consent under Article 6(1)(a) GDPR. The Traveller may withdraw consent to future publication.

29. Social Media Communications

Beyond maintains profiles on platforms including Facebook, Instagram and TikTok. If you follow Beyond, send a direct message, comment, react, tag Beyond or otherwise interact with our profile, Beyond may receive information made available through that interaction.

Legal basis

Where the communication concerns a potential booking, Article 6(1)(b) GDPR may apply. For ordinary page administration, moderation and engagement, Article 6(1)(f) GDPR may apply, based on Beyond's legitimate interest in operating and communicating through its social-media channels.

The relevant social-media provider also processes personal data under its own privacy terms. Depending on the specific function, Beyond and the platform may act as separate controllers or, in legally defined circumstances, joint controllers.

30. WhatsApp

Beyond may offer WhatsApp for convenient operational communication. Information processed may include telephone number, profile details made available through WhatsApp, message content and attachments.

WhatsApp is not the exclusive channel for exercising legal rights or sending formal notices which must be available through another appropriate method. Information required to be provided on a durable medium will be provided by an appropriate method such as email, downloadable documentation or the customer account rather than relying solely on temporary messaging.

31. Google Analytics

Beyond uses Google Analytics to understand website performance and visitor behaviour. Depending on configuration and consent, data may include pages visited, approximate location, browser/device information, referral source, session information, events, cookie or device identifiers and website interactions.

Legal basis

For non-essential analytics tracking: Article 6(1)(a) GDPR - consent. Beyond will configure analytics according to the visitor's consent choice.

32. Google Tag Manager

Beyond uses Google Tag Manager to deploy and manage website technologies. Tag Manager may control whether analytics and advertising tags are activated. The use of Tag Manager does not eliminate the requirement for the underlying tag to have a lawful basis. Tags relating to non-essential analytics or advertising will therefore be configured to respect the visitor's consent choices.

33. Google Ads

Beyond uses Google Ads for advertising, conversion measurement and potentially remarketing. Depending on consent and configuration, information may include advertising identifiers, cookie identifiers, ad-click identifiers, conversion events, browser/device information, website interaction and campaign information.

Legal basis

Consent under Article 6(1)(a) GDPR where advertising tracking requires consent.

34. Meta - Facebook and Instagram Advertising

Beyond uses or intends to use Meta advertising tools associated with Facebook and Instagram. This may include the Meta Pixel. Depending on consent and configuration, Meta may receive information concerning visits to the Beyond website, pages viewed, actions/events, purchases or booking conversions where configured, browser/device information and advertising identifiers.

Legal basis

Where tracking is non-essential: consent under Article 6(1)(a) GDPR. Special-category Traveller information will not intentionally be supplied to Meta for advertising or targeting.

35. TikTok Advertising

Beyond uses or intends to use TikTok advertising and measurement technologies, including the TikTok Pixel or equivalent tools. Depending on configuration and consent, information may include website visit, page/event information, browser/device details, advertising identifiers, conversion information and campaign attribution information.

Legal basis

Consent under Article 6(1)(a) GDPR where non-essential tracking is involved. Beyond will not intentionally provide health, allergy or other special-category Traveller information to TikTok for advertising.

36. Hotjar

Beyond uses Hotjar for website experience analytics and usability analysis. Depending on the enabled functions, Hotjar may process information including page visits, mouse movements, clicks, scrolling, device information, browser information, country-level location, feedback responses and interaction information.

Legal basis

Consent under Article 6(1)(a) GDPR for non-essential Hotjar tracking.

Sensitive pages

Beyond will configure Hotjar so that it does not intentionally capture sensitive form contents and will not use Hotjar session recording on pages used to collect health or other special-category Traveller information.

37. Cookies and Similar Technologies

Section 155(4) of Act C of 2003 on Electronic Communications requires clear and comprehensive information and, subject to applicable exceptions, the user's consent before information is stored on or accessed from their terminal equipment.

Strictly necessary technologies

• website operation;
• login;
• customer accounts;
• security;
• session management;
• fraud prevention;
• remembering privacy choices; and
• functions specifically requested by the visitor.

Where applicable law allows strictly necessary technologies to operate without consent, they may be used on that basis.

Analytics technologies

• Google Analytics;
• Hotjar.

Advertising technologies

• Google Ads;
• Meta;
• TikTok.

38. Cookie Consent

Beyond operates non-essential analytics and advertising tracking on a consent-first basis.

The website preference interface provides clear choices for non-essential technologies, including the ability to reject non-essential tracking and manage preferences. Analytics and advertising consent is not bundled into acceptance of a Travel Contract, and refusing non-essential tracking does not prevent ordinary access to the website or booking functionality.

Relevant non-essential tracking is blocked until the visitor gives the applicable consent. Consent choices can be changed later through the available privacy or cookie settings.

39. Cookie Preference Records

Beyond or its consent-management technology may store consent status, categories accepted/rejected, date/time, consent version and technical evidence needed to demonstrate and respect the user's preference.

Legal basis

Article 6(1)(c) GDPR where necessary to meet legal consent obligations and/or Article 6(1)(f) where necessary to demonstrate and respect privacy choices. Consent records will be retained only for an appropriate period necessary for those purposes.

40. Advertising Safety and Sensitive Information

Beyond does not intentionally send health information, allergies, emergency details, passport details or other sensitive Traveller information from portal forms to advertising platforms.

To reduce this risk, Beyond uses technical and organisational measures where appropriate, including:

• excluding sensitive account pages from advertising pixels;
• avoiding health terms or sensitive personal data in tracking events;
• suppressing form-field collection;
• avoiding sensitive information in advertising URL parameters; and
• restricting tag-manager triggers.

This is an important technical component of Beyond's data minimisation and privacy-by-design obligations.

41. Fraud Prevention, Security and Abuse

Beyond may process appropriate account, booking, technical and transaction information to detect suspected fraud, identify duplicate or abusive bookings, investigate payment disputes, detect unauthorised account access, protect accounts, maintain system security, investigate suspicious behaviour and protect Beyond's legal rights.

Legal basis

Article 6(1)(f) GDPR - Beyond's legitimate interests in preventing fraud, securing its services and protecting customers and the business.

42. Automated Processing

Beyond's systems may use routine automation for matters such as availability checks, booking confirmations, customer-account operation, payment-status updates, email delivery, security signals and fraud alerts.

At present, Beyond does not use solely automated profiling to make subjective decisions about a Traveller's personality, health, suitability or desirability as a customer.

If Beyond uses a solely automated decision which falls within Article 22 GDPR because it produces legal or similarly significant effects, it will do so only where an Article 22 exception applies and will provide the safeguards required by law. Where a decision is necessary to enter into or perform a contract, Article 22(2)(a) may permit such processing, subject to safeguards including the right to obtain human intervention, express a view and contest the decision.

43. Complaints

Beyond may process complainant identity, contact details, booking data, complaint content, photographs or documents supplied, correspondence, investigation notes and Beyond's response.

Legal basis

Article 6(1)(c) GDPR - compliance with Hungarian consumer-protection obligations. Other information may additionally be processed under Article 6(1)(f) where necessary for legal claims.

Retention

Hungarian consumer law currently requires complaint records and responses to be retained for three years.

44. Legal Claims

Beyond may process and retain relevant personal data where reasonably necessary to establish, exercise, investigate, negotiate or defend legal claims.

Legal basis

Article 6(1)(f) GDPR - Beyond's legitimate interest in protecting its legal rights. Where special-category data is involved, Article 9(2)(f) GDPR may apply.

Records subject to a legal hold or active dispute may be retained beyond an otherwise applicable standard retention period until the matter and relevant limitation periods have been resolved.

45. Authorities and Legal Obligations

Beyond may disclose personal data to courts, police, prosecutors, tax authorities, consumer-protection authorities, tourism authorities, data-protection authorities, immigration/border authorities where legally required, or another authority authorised by law.

Legal basis

Article 6(1)(c) GDPR where disclosure is legally required. Where disclosure is not mandatory but is necessary to establish or defend a legal claim or protect a vital interest, another lawful basis may apply.

46. Professional Advisers and Insurers

Beyond may disclose information to lawyers, accountants, auditors, insurance providers, insolvency-protection providers, claims handlers and other professional advisers where reasonably necessary. The legal basis depends on the purpose and may include legal obligation, contractual necessity or legitimate interests. Only relevant information should be disclosed.

47. Business Contacts and Suppliers

Beyond processes names, business email addresses, telephone numbers, job titles and communications relating to suppliers, contractors and professional partners.

Purpose

To arrange and manage supplier relationships, communicate about trips and administer contracts.

Legal basis

Where the contact person is themselves party to the contract, Article 6(1)(b) may apply. Where the individual acts on behalf of another company, Article 6(1)(f) GDPR applies based on Beyond's legitimate interest in conducting business and managing contractual relationships.

48. Legal Basis: Legitimate Interests

Where Beyond relies on Article 6(1)(f) GDPR, it will consider the legitimate interest being pursued, whether processing is necessary for that purpose, the nature of the data, the reasonable expectations of the person concerned, the impact on their rights and freedoms, and appropriate safeguards.

Relevant legitimate interests may include fraud prevention, account security, responding to general enquiries, supplier communications, protecting legal rights, keeping appropriate evidence, improving operational processes and managing ordinary business communications.

A data subject may object to legitimate-interest processing in accordance with Article 21 GDPR.

49. Main Recipients and Service Providers

Not every provider receives every category of information.

50. Processors, Independent Controllers and Joint Controllers

Third parties do not all perform the same legal role. A provider may act as a processor where it processes information on Beyond's documented instructions; an independent controller where it determines its own processing purposes and legal obligations; or a joint controller where Beyond and another entity jointly determine certain purposes and means of processing.

A third party's legal role depends on the processing it actually performs, the applicable law and the relevant contracts. Where Article 28 GDPR applies, Beyond uses processors subject to appropriate data-processing obligations.

51. International Transfers - Technology Providers

Some providers and subprocessors process data outside the European Economic Area. Where GDPR Chapter V applies, Beyond will use an appropriate mechanism, including where relevant:

• European Commission adequacy decisions;
• the EU-US Data Privacy Framework;
• Standard Contractual Clauses;
• Binding Corporate Rules;
• another Article 46 safeguard; or
• an applicable Article 49 derogation.

Data subjects may contact Beyond for further information concerning applicable transfer safeguards where required by law.

52. International Transfers - Overseas Trips

Beyond organises travel outside the EEA. Accordingly, personal data may need to be transferred to a supplier located in the destination country. For example, a hotel in Tonga cannot provide accommodation unless it knows who is staying there.

Where the destination does not benefit from an adequacy decision and Article 46 safeguards are not reasonably available for an isolated operational transfer, Beyond may rely, where the strict legal conditions are satisfied, on the Article 49 derogations concerning transfers necessary for performance of a contract between the data subject and Beyond or conclusion/performance of a contract concluded in the data subject's interest between Beyond and another person.

Such derogations will be used only where legitimately necessary and not as a blanket substitute for appropriate safeguards.

53. Data Retention

Beyond does not apply one blanket retention period to all information. Data is retained according to its purpose, legal basis, legal retention requirements and applicable limitation periods.

Exceptions

Data may be retained longer where:

1. a law requires longer retention;
2. a complaint is ongoing;
3. a legal claim is pending or reasonably anticipated;
4. an insurance matter is unresolved;
5. fraud or security investigation requires retention;
6. an authority requires preservation; or
7. another lawful retention basis applies.

Where only part of a record remains necessary, Beyond should retain only the relevant portion where reasonably practicable.

54. Health Information Retention

Health, allergy and other sensitive information collected solely for ordinary trip operation will generally be deleted within 30 days after completion of the trip.

Relevant information may be retained longer where necessary because of an accident, medical emergency, complaint, insurance claim, legal dispute or another lawful legal requirement. Where consent is withdrawn and no other lawful basis applies, consent-based processing will cease.

55. Data Minimisation

Beyond will not intentionally collect personal information merely because it might conceivably become useful. Forms and workflows should request only information reasonably necessary for the stated purpose. This is particularly important for passport data, health information, dietary information, emergency contacts and advertising/tracking information.

56. Security

Beyond implements appropriate technical and organisational measures proportionate to the nature of the data and risks involved. These may include:

• controlled user access;
• individual staff accounts;
• multi-factor authentication where available and appropriate;
• password/security controls;
• access limited by role;
• use of reputable cloud providers;
• confidentiality obligations;
• access reviews;
• secure backups;
• security updates;
• incident procedures; and
• restrictions on sensitive information.

No online system can be guaranteed to be absolutely secure. Accordingly, this Privacy Notice does not represent that unauthorised access or a security incident can never occur. Beyond's obligation is to apply security measures appropriate to the risk as required by applicable law.

57. Access Within Beyond

Only persons who reasonably require personal data for their work should have access to it. This may include management, authorised operational staff, customer service, finance/accounting staff, trip leaders where needed, authorised contractors and professional advisers. Access to the restricted internal area of the Beyond Portal is granted according to role and operational need rather than merely because a person works with Beyond.

Sensitive health information must not be made available to personnel merely because they have general access to customer records. Access should follow a need-to-know principle. Beyond may keep appropriate portal access, security and administrative audit records to protect accounts, investigate incidents and establish relevant staff/admin actions.

58. Personal Data Breaches

Beyond maintains a process for assessing and responding to personal-data breaches. Where a breach is likely to result in risk to individuals' rights and freedoms, GDPR Article 33 requires notification to the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where a breach is likely to result in a high risk to an affected person, Beyond will notify that person where GDPR requires it. Not every technical incident constitutes a legally notifiable personal-data breach.

59. Records and Accountability

Beyond maintains appropriate internal records of processing where required. Because Beyond regularly processes customer data and may process health information, its internal compliance framework includes an Article 30 Record of Processing Activities where required. These internal compliance records are separate from this customer-facing Privacy Notice.

60. Provision of Data - Mandatory or Optional

Some personal information is required to provide the requested service. For example, a name and contact details are needed to administer a booking; billing information may be legally required for invoicing; payment information is needed to receive payment; certain travel-document information may be required for a supplier; and certain safety information may be required to safely provide a specific activity.

If required data is not provided, Beyond may be unable to conclude or perform the relevant service.

Other information is entirely optional. In particular, newsletter consent, advertising-cookie consent and marketing photo/video consent are not conditions of booking.

Where health information is requested, Beyond will explain why it is being requested and what may happen if information essential to safe participation is not supplied.

61. Rights of Data Subjects

Subject to the conditions and limitations contained in the GDPR, you may have the following rights.

61.1 Right of access

You may request confirmation whether Beyond processes your personal data and, where applicable, receive access to that data and the information required by Article 15 GDPR.

61.2 Right to rectification

You may request correction of inaccurate personal data and completion of incomplete information.

61.3 Right to erasure

You may request deletion where the conditions of Article 17 GDPR apply. The right to erasure is not absolute. For example, Beyond is not required to delete an invoice which it remains legally obliged to retain.

61.4 Right to restriction

You may request restriction of processing in the circumstances stated in Article 18 GDPR.

61.5 Right to portability

Where processing is automated and based on consent or contract, you may have the right to receive personal data which you supplied in a structured, commonly used and machine-readable format and, where technically feasible, transmit it to another controller.

61.6 Right to object

Where processing relies on Article 6(1)(f) legitimate interests, you may object for reasons relating to your particular situation. Beyond must then stop that processing unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms or processing is necessary for legal claims.

61.7 Direct marketing

You may object to direct marketing at any time. Following such objection, Beyond will stop using the relevant personal data for direct marketing.

61.8 Withdrawal of consent

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

62. Exercising Your Rights

Requests may be sent to info@beyondtrailsandtales.com.

Beyond may request reasonable information necessary to verify your identity where there is legitimate doubt concerning the person making the request. Beyond will not request unnecessary identification documents merely because a data-subject request has been made.

GDPR generally requires Beyond to respond without undue delay and no later than one month after receipt, with a possible extension of up to two further months for complex or numerous requests, provided the individual is informed within the initial month. Requests are ordinarily free of charge. A reasonable fee or refusal is permitted only in the circumstances allowed by GDPR, including where a request is manifestly unfounded or excessive.

63. Rights Relating to Automated Decisions

Where Article 22 GDPR applies to a solely automated decision with legal or similarly significant effects, you have the rights and safeguards required by law. Where the relevant decision falls within the contractual or consent exceptions, safeguards include the right to request human intervention, express your point of view and contest the decision.

64. Supervisory Authority

You have the right to lodge a complaint with a competent supervisory authority. In Hungary, the authority is:

Hungarian National Authority for Data Protection and Freedom of Information Nemzeti Adatvédelmi és Információszabadság Hatóság - NAIH Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary Postal address: 1363 Budapest, Pf. 9. Email: ugyfelszolgalat@naih.hu (general customer-service contact; formal proceedings cannot generally be initiated by ordinary email) Telephone: +36 1 391 1400 Website: www.naih.hu

Depending on the circumstances, a data subject may also be entitled to lodge a complaint with another competent EU/EEA supervisory authority.

65. Judicial Remedies and Compensation

Nothing in this Privacy Notice limits any right to judicial remedy, seek enforcement of GDPR rights or claim compensation where the requirements of applicable law are met.

66. Minors

Some Beyond trips may permit minors. A minor Traveller does not create or hold their own Beyond customer-portal account for a package booking; their booking and relevant personal data are managed through the accompanying parent or legal guardian's account. Beyond applies additional safeguards having regard to the child's age, circumstances and the nature of the processing.

Where processing relies on consent and the minor cannot legally provide the relevant consent themselves, Beyond obtains consent or authorisation from the appropriate parent, guardian or other person legally authorised to provide it. For consent-based information-society services to which Article 8 GDPR applies, the relevant threshold is 16 years unless applicable law provides otherwise.

Particular care is taken with minors' health data, photographs/video, marketing, advertising and online account access. Minor Traveller information is not intentionally used to build advertising audiences.

67. No Sale of Traveller Data

Beyond does not sell Traveller databases or Traveller personal information as a standalone commercial product.

This does not prevent legitimate disclosures to processors, suppliers, advertising platforms used in accordance with consent, advisers, payment providers or authorities as described in this Privacy Notice.

68. Changes in Service Providers

Technology and travel suppliers may change over time. Beyond may replace a processor, service provider, bank, analytics tool, supplier or other recipient where this is lawful.

A change of provider does not by itself require consent unless the underlying processing itself requires consent or the change materially alters the purposes or lawful basis. Beyond will update this Privacy Notice where required to maintain transparent information regarding its data processing.

69. Changes to this Privacy Notice

Beyond may update this Privacy Notice because of legislative changes, regulatory guidance, changes in business operations, changes in website functionality, changes in service providers, security developments or new processing activities.

The current version and effective date will be displayed on the website.

Publishing a new Privacy Notice does not retrospectively manufacture consent for processing which legally required prior consent. Where a new or materially different processing activity requires consent, Beyond will obtain that consent separately.

70. Version Control and Booking Records

Where a Privacy Notice is made available during an online booking, Beyond's systems may record the version which was presented to the Traveller.

The Traveller is not required to "accept" the Privacy Notice as though it were contractual terms. The booking declaration may instead confirm that the Privacy Notice was made available before booking. This record may be retained as evidence that the required transparency information was provided.

71. Contact

For any question concerning this Privacy Notice or the processing of personal data:

Beyond Trails and Tales Kft.

1126 Budapest, Márvány utca 50., 3rd Floor, Door 3

Hungary

Email: info@beyondtrailsandtales.com

Website: www.beyondtrailsandtales.com

END OF PRIVACY & DATA PROTECTION NOTICE