Privacy Policy

1. Who we are

The fenuaholidays.com platform, the Fenua Holidays mobile application, and associated interfaces (including the Tiki Bot assistant) are published by:

SAS Fenua Holidays

Share capital: 200,000 XPF

Registered office: Lotissement Miri N°21 — Résidence Rahiti, Appt 1 — 98718 Punaauia, French Polynesia

Postal address: BP 42199 — 98713 Papeete, Tahiti

RCS Papeete 2640 B — TAHITI number G53243

Email: info@fenuaholidays.com

Fenua Holidays is the data controller for personal data collected via the Platform, within the meaning of applicable regulations. For data transmitted to providers in connection with a booking, Fenua Holidays and the relevant provider act as joint data controllers, in accordance with the terms defined in the agreement concluded with each provider.

Fenua Holidays has not appointed a Data Protection Officer (DPO); the point of contact for any questions regarding personal data is info@fenuaholidays.com.

2. Who this policy applies to

This policy applies to any person whose personal data Fenua Holidays processes:

• travelers ("Reva"): visitors creating an account, making a booking, or using Tiki Bot;
• providers ("Fa'atere"): representatives and personnel of partner companies listed on the Platform, as well as prospected providers;
• visitors to the website and subscribers to our communications (newsletter, pre-launch lists);
• any person who contacts us (form, email, social media).

3. Applicable legal framework

Fenua Holidays' data processing is governed by amended law n° 78-17 of January 6, 1978 (the "Data Protection Act"), applicable in French Polynesia since June 1, 2019, which makes the rules of Regulation (EU) 2016/679 ("GDPR") applicable. The GDPR also applies directly to processing concerning persons located in the European Union.

The competent supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr.

4. Data we collect

4.1 If you are a traveler (Reva)

• User account: last name, first name, email address, phone number, password (encrypted), country of residence, language, date of birth (only for activities subject to age restrictions).
• Bookings: stay or activity dates, number and composition of participants, stated preferences, information required for certain activities (e.g., required skill level, declared medical restrictions for activities that require them), booking number, e-voucher.
• Payment: Fenua Holidays never stores your bank details. Payment information is processed and encrypted by the Banque de Tahiti's secure payment solution, in accordance with applicable banking standards. We only retain the transaction reference and status.
• Solidarity credit: your credit amount and allocation choice among partner associations.
• Exchanges: Tiki Bot conversations, support messages, published reviews (Pearl rating system).
• Browsing: technical data (IP address, device type and browser, pages viewed) and cookies — see section 12.

4.2 If you are a provider (Fa'atere)

• Identification: company name, name and professional contact details of the representative and operational contacts, TAHITI number, licenses and insurance.
• Contractual and financial: bank details for payouts, specific conditions, booking and payment history.
• Content: product listings, photos, descriptions, rates, and availability entered in your interface.
• Prospecting: for providers not yet partners, professional contact details collected from public sources (website, directories, social media) or during direct meetings (tourism fairs, field visits).

4.3 If you are a visitor or subscriber

• Forms: the information you enter when contacting us.
• Newsletter and pre-launch lists: email address, collected with your consent (double opt-in registration), and email interaction data (opens, clicks).
• Browsing: cookies and technical data — see section 12.

5. Why we use your data

We never sell your personal data. We do not use it for third-party programmatic advertising.

6. Tiki Bot and artificial intelligence

Tiki Bot is the Platform's conversational assistant. When you use it:

• your exchanges are processed to respond to you (recommendations, cultural context, booking assistance) and may be retained for up to 2 years to improve service quality;
• rate and contractual information communicated by Tiki Bot comes exclusively from data entered by providers, with source citation;
• no decision producing legal effects concerning you is made in a fully automated manner: a booking is only concluded with your express validation, and human support remains available (info@fenuaholidays.com).

We recommend that you do not share sensitive data with Tiki Bot (health, religion, etc.) that is not strictly necessary for your request.

7. Who has access to your data

Your data is accessible, within the limits of their needs, to the following parties:

Partner associations of the solidarity credit receive no personal data from travelers: only the allocated amounts are communicated to them.

Each subcontractor is bound by a contract compliant with Article 28 of the GDPR.

8. Transfers outside French Polynesia and the European Union

Some of our technical service providers are located outside French Polynesia and outside the European Union, notably Solal & Co Ltd in Mauritius (development and maintenance). These transfers are governed by appropriate safeguards within the meaning of Articles 44 et seq. of the GDPR.

9. How long we retain your data

At the end of these periods, data is deleted or irreversibly anonymized.

10. Your rights

You have the following rights over your data: access, rectification, erasure, restriction of processing, objection (in particular to prospecting, at any time and without justification), portability, withdrawal of your consent at any time (without affecting the lawfulness of processing already carried out), and the right to define post-mortem directives regarding the fate of your data.

To exercise your rights: info@fenuaholidays.com, specifying the subject of your request. Proof of identity may be requested in cases of reasonable doubt. We will respond within one month, extendable by two months for complex requests.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL (www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

11. Security

Fenua Holidays implements appropriate technical and organizational measures: encrypted communications (HTTPS), encrypted passwords, payment fully delegated to the Banque de Tahiti's secure solution, compartmentalized access, logging, and confidentiality commitments from our technical service providers.

In the event of a data breach likely to pose a risk to your rights and freedoms, Fenua Holidays notifies the CNIL within 72 hours and, in the event of a high risk, informs you directly.

12. Cookies and trackers

On your first visit, a banner allows you to accept, refuse, or configure cookies by category:

• Essential cookies: necessary for the operation of the Platform (session, booking cart, security) — exempt from consent;
• Audience measurement cookies: used for traffic statistics;
• Marketing cookies: where applicable, notably pixels linked to social media campaigns.

You can change your choices at any time via the "Manage cookies" link in the page footer. Validity of your choice: 6 months. Maximum cookie lifespan: 13 months.

13. Minors

Booking on the Platform is reserved for adults with the legal capacity to contract. Data of minor participants in a stay or activity is collected only under the responsibility of the adult making the booking, and only to the extent necessary for the service.

14. Changes to this policy

We may update this policy to reflect changes to the Platform or to regulations. Any substantial change will be notified to you by email or by a visible notice on the Platform, with the update date. The current version is the one published on fenuaholidays.com.

15. Contact

SAS Fenua Holidays — BP 42199 — 98713 Papeete, Tahiti, French Polynesia

Email: info@fenuaholidays.com