Spirit of Bhutan

ACCESS TO PERSONAL DATA

The confirmation of the reservation implies the introduction into the system, by the CLIENTS, or by the TRAVEL AGENT, by automated or non-automated means, of personal identification data, and data related to credit and debit cards, which will be used to facilitate and enable the contracting and reservation of the specific services that make up the CLIENT's request, as well as to provide information regarding products and services of COTUR S.A, hereinafter referred to as COTUR. Under no circumstances will information be requested about philosophical or political convictions, party or union membership, religious faith, private life, racial or ethnic origin as well as data relating to health and sexual life, including genetic data. The Processing of Personal Data is carried out in strict compliance with the legislation on the protection of personal data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council, and/or any legislation that regulates, amends or replaces said legislation, collectively referred to as the "General Data Protection Regulation" (hereinafter referred to as GDPR). Any personal data that CLIENTS may disclose to COTUR will be understood as obtained, processed, and transmitted in strict compliance with the GDPR. By providing their personal data, CLIENTS declare that they authorize and consent to the processing of their data by COTUR for the purposes of facilitating and enabling the contracting and reservation of the specific services that make up their request, as well as to receive information regarding products and services provided by COTUR. Your data will be retained for a period of one year from the date of collection of your consent or if you express otherwise. COTUR declares and guarantees that it has implemented, is equipped, and will continue to implement the necessary technical and organizational security measures to ensure the security of personal data provided to it, in order to prevent its alteration, loss, treatment, and/or unauthorized access, taking into account the current state of technology, the nature of the data stored, and the risks to which they are exposed. If the CLIENT wishes to exercise the rights of access, rectification, cancellation, or opposition granted to them by the GDPR, they must send an email to privacy@cotur.co.mz or cancel through the means available in the Newsletter reception.

PROCESSING OF PERSONAL DATA

Personal Data obtained through registration, by automated or non-automated means, are incorporated into an application owned by COTUR. COTUR employees access information in files with password-protected access, the record of which is documented. Changes to existing data in the files are possible with a record of the date of the person responsible for the change. Personal Data are processed with the legally required level of protection to ensure their security and to prevent their alteration, loss, treatment, or unauthorized access, taking into account the state of the technology. The CLIENT is aware of and accepts that Internet security measures are not impregnable. COTUR has technical peripheral control infrastructures that comply with security requirements and acts in accordance with the standards of the Payment Card Industry Data Security Standard (PCI DSS). Credit card data is used only for payment processing, and after the transaction is completed, it is deleted from our records, except when the CLIENT has authorized us to retain it. For security reasons applicable in certain countries, it is mandatory to include information regarding data such as name, passport number, gender, age, nationality in flight reservations. This information contained in the reservation may, under applicable law, namely based on Directive (EU) 2016/680 of the European Parliament and of the Council, be accessed by the competent authorities of the countries of origin or destination, for the purposes of prevention, investigation, detection, or repression of criminal offenses or the enforcement of criminal sanctions, and the free movement of such data and Directive (EU) 2016/681 of the European Parliament and of the Council.

COTUR accessing any personal data, undertakes to:

• Protect CLIENTS' personal data through legally required security measures of a technical and organizational nature in order to prevent alteration, loss, treatment, or unauthorized access, in accordance with the state of the technology at any given time, the nature of the data, and the possible risks they are exposed to;

• Use or apply the data exclusively for the purposes duly provided;

• Ensure that the data are used only for the provision of the service, being obliged to maintain the duty of confidentiality. If there is a possibility that the information may be disclosed to third parties, they must be obliged to maintain the proper confidentiality in accordance with what is provided in this document.

COOKIES

Cookies are small files that are stored on the CLIENT's computer and serve only to identify the computer accessing the website. These files do not contain any personal information. Cookies generally have a limited lifespan. No cookie can extract information from the CLIENT's hard drive, steal personal information, or read cookies created by other providers. Thanks to cookies, COTUR can recognize properly registered CLIENTS, as long as they use the same equipment and browser, without having to register on each visit to access the areas and services reserved exclusively for them. The CLIENT is free to reject our cookies if the browser allows it, but by doing so, may compromise the full functionality of the websites used. For more information about cookies, including to find out which cookies have been installed and how they can be managed and deleted, visit http://www.allaboutcookies.org Specific information about third-party cookies Google Analytics can be obtained at http://bit.ly/2jN54Z0. We are not responsible for the content and accuracy of the terms and conditions of use, privacy policies, and cookie policies of the aforementioned third parties. You can configure your browser not to accept cookies and the aforementioned websites explain how you can remove them. However, not accepting cookies may result in incorrect execution of some Website functionalities. None of the cookies used are essential for the use of the Website, for a particular functionality, or for improving the performance of the Website. The use of cookies by COTUR aims to analyze the use of the Website and allow you to have a smooth browsing experience; at no time do we collect Personal Data through cookies.

PURPOSE OF DATA

The personal data that we process through this page will be used solely for the following purposes:

(i) Specific to the activity linked to a travel agency, wholesaler, and retailer;

(ii) Supplying to the stakeholders in the services requested by the user for the realization of the reservation / service contracted by the User;

(iii) Management, administration, provision, expansion, and improvement of the services that the user decides to subscribe and register or use adapting these services to the preferences and tastes of the user;

(iv) Verifying credit cards and other types of cards used in payment and indicated by the User;

(v) Studying the use of services by users;

(vi) Verifying, maintaining, and developing systems and statistical analysis;

(vii) Advertising, promotion, and commercial prospecting activities, if duly authorized and consented to by the User;

(viii) Sending survey forms to which the user is not obliged to respond;

(ix) Sending SMS messages for direct sales, advertising, or related to the contracted service, if duly authorized and consented to by the User.

The user may consent to COTUR processing their Personal Data for the purpose of determining their profile and offering them suitable products and services. These services may be COTUR's own or third-party services.

(i) National and international competent authorities in tourism, terrorism, or offenses that violate human rights;

(ii) Any legal entity subsidiary or participated by COTUR or the company that provided the contracted service (hotels, water, land, rail, air transportation company, rental, etc.), so that they can use them for the correct provision of each service requested by the CLIENT.On the other hand, the CLIENT consents to access the information related to the service contracted with COTUR in order to offer additional services to the one contracted. Failure to respond to the data, considered mandatory, will imply the impossibility of accessing the service for which the data were requested. COTUR may disclose CLIENT information to third parties solely for the purpose of completing the requested reservation and for administrative reasons in accordance with the legislation in force for the realization of trips / services to certain countries. Any data collected by automated or non-automated means will be transmitted, in accordance with the provisions of the GDPR, to the entities involved to contract the required services to the extent absolutely necessary for the realization of the intended reservation / service and for compliance with the legislation of the destination countries. If you do not agree with the above conditions, COTUR will not be able to contract with you and consequently will not be able to accept your reservation.