Manuel Antonio, Costa Rica +506 2777-0170 | reservations@karahe.com

PRIVACY POLICY

LAST UPDATED: May 2018

Karahe Hotel

Hotel Karahe. (referred to herein as “KARAHE,” “we,” and “us“) is committed to protecting your privacy and wants you to be familiar with how we collect, use, and disclose Personal Information (as defined below). References to “KARAHE,” “we” and “us” throughout this Policy, depending upon the context, collectively refer to KARAHE and any subsidiary of KARAHE, including but not limited.

By using this website or a mobile application (“Site”), including text message, providing Personal Information (as defined below) to KARAHE, or otherwise indicating your consent to receipt of marketing or other information from us, you consent to all actions taken by us with respect to your Personal Information as set forth in this Policy. If you do not agree to the terms and conditions of this Policy, please do not use the Site or provide any Personal Information to KARAHE through our Site or otherwise.

While this Policy is intended to describe the broadest range of our information processing activities globally, those activities may be more limited in some jurisdictions based on the restrictions of their laws. To the extent any of the activities described herein are not permitted under the laws of your country, state, or province, you agree that the remaining portions of this Policy that are permissible shall apply to the maximum extent permitted by law.

PERSONAL INFORMATION WE COLLECT

KARAHE may collect “Personal Information” from you, meaning information that identifies you as an individual or from which you may be identified. For example, we may collect:

contact information, such as your name, mailing address, e-mail address, and telephone number;

credit card number or other payment account number, billing address, and other payment and billing information (“Payment Information”);

Karahe (“Karahe“) online user account details, profile or password details and any frequent flyer or travel partner program affiliation;

records and copies of your correspondence if you contact us;

information necessary to fulfil special requests (e.g., health conditions that require specific accommodation);

guest stay information, including the hotels where you have stayed, date of arrival and departure, and goods and services purchased;

information collected through the use of closed circuit television systems, card key and other security systems; and

in limited cases, information relating to the credit of customers.

We may collect Personal Information from a variety of sources including:

through the Site;

through reservation and call centers;

through social media and brand channels (e.g. Facebook, Twitter);

from KARAHE Travel Agencies and from Licensed Hotels, Affiliates, or other third parties; or

when you otherwise voluntarily provide it to us

We may also combine Personal Information we collect with publicly available Personal Information and Personal Information we receive from others or cross-reference with others. The collection and use of Personal Information, whether separately or combined, is done in accordance with and for the purposes described in this Policy.

If you voluntarily share “Sensitive Information” (e.g., Personal Information related to your health) with us, that information will only be used as necessary to fulfill special requests (e.g. health conditions that require specific accommodations). For example, if you voluntarily convey a health-related need to us, we may store and use that information in order for a Licensed Hotel to provide a room with appropriate amenities. We do not collect or store Sensitive Information unless it is voluntarily provided by you. By providing such Sensitive Information, you expressly consent to our collection, processing and storage of that information in accordance with the terms of this Policy.

HOW WE USE THE PERSONAL INFORMATION WE COLLECT

KARAHE collects Personal Information about guests, visitors to the Site, and others, so that we can provide an experience that is responsive to the needs of such individuals. KARAHE may collect, use, and disclose Personal Information for one or more of the following purposes:

Fulfillment of Reservation or Information Requests. To fulfill your requests such as completing a credit card transaction or booking a reservation at any Licensed Hotel worldwide through our central reservation system, or responding to your requests that we send marketing, informational or other newsletters to you (and to personalize such newsletters and the Site to your preferences). For example, when you make a reservation through KARAHE’s central reservation system, we may collect Payment Information from you, and may use and disclose such Payment Information to fulfill your reservation. KARAHE maintains a worldwide accessible website, call centers, and database computers in the Costa Rica and other locations around the world, which are intended to help KARAHE conduct business and to facilitate the operation and maintenance of its central reservation system.

Administrative and Other Communications. To send you important information regarding the Site, changes to our terms, conditions, and policies, or other administrative information (e.g., information about your travel reservations, such as reservation confirmations and pre-arrivalcommunications). We may also use your Personal Information to determine whether you are eligible for and/or inform you, if you have provided your consent, to send marketing communications or tell you about products, programs, enhancements, events, special offers, and services of KARAHE, KARAHE Subsidiaries, and third parties (including Licensed Hotels and Affiliates) that might be of interest to you. For more information, see the “Your Choices” section of this Policy below.

Promotions. To operate promos, contests, or other marketing or promotional activities (collectively, “Promotions“). We typically ask you for certain Personal Information when you enter or participate in such Promotion and, if applicable, win a prize, get a discount, and we use such Personal Information to administer the Promotion. Participation in these Promotions is completely voluntary, and you have a choice whether to disclose your Personal Information. You should carefully review the rules, if any, of each Promotion in which you participate, as it may contain additional important information about KARAHE’s use of your Personal Information. To the extent that the Promotion’s rules concerning the treatment of your Personal Information conflict with this Policy, the Promotion’s rules shall control.

Surveys. To conduct or facilitate surveys and to ask for your responses to questionnaires in order to provide better products and services to guests and Site visitors. Completion of any surveys or questionnaires is strictly voluntary.

Customer Care. To track, process, and respond to customer care inquiries and to enhance and improve the customer’s experience. We may also transmit your Personal Information to third party service providers, Affiliates, and Licensed Hotels to allow those third parties to track, process, and respond to customer care inquiries.

Internal Business Purposes. For our internal business purposes, such as data analysis, audits, developing new products, enhancing the Site, improving our services, identifying usage trends and visiting patterns, determining the effectiveness of our Promotions, and meeting contractual obligations (e.g., a contractual obligation with regard to earning or redeeming points or miles through our travel agency partners).

Our Legal Duties. To comply with legal and regulatory requirements or demands in accordance with applicable law, a court order, subpoena, or other legal process.

E-mails to Friends. To permit you to forward information about our products, services, and Hotels to another individual, such as a friend or co-worker. If you wish to use this feature, you may be required to provide to us, and we may use, the applicable individual’s name and e-mail address to facilitate your sending of such messages to such individual (and any Personal Information ‒ such as your name and your email address ‒ provided in connection with sending such information, will be disclosed to such individual). By using this functionality, you affirm that you are entitled to use and to provide to us the recipient’s name and e-mail address for this purpose. We will not seek to use the recipient’s Personal Information for any purpose other than to allow the e-mail to be sent, unless we disclose such other purpose to you at the time that you provide such Personal Information to us or unless we have separately collected such Personal Information through other means.

Additional Uses. We may also use your Personal Information in other ways as described when you provide such information to us or for other purposes with your consent.

HOW WE SHARE AND DISCLOSE PERSONAL INFORMATION

KARAHE Subsidiaries. We may share your Personal Information with KARAHE Subsidiaries so that they may use such Personal Information for the purposes described in this Policy. KARAHE Subsidiaries are required to protect your Personal Information consistent with this Policy. KARAHE is the entity that is responsible for the management of such jointly used Personal Information.

Third-Party Service Providers. KARAHE relies on numerous third-party service providers to provide certain products and services on our behalf, including reservation services, credit card/payment processing and billing, IT services, customer care, e-mail delivery services, text messaging services, communication and delivery of promotional and marketing materials via e-mail, direct mail, and text message, administering guest surveys and Promotions, administration, data analysis, and other similar services. We may share your Personal Information for the purpose of enabling these third parties to provide such services or as otherwise necessary for the ongoing operation of KARAHE’s business, including operation of programs such as Karahe. When we do outsource the processing of your Personal Information to third parties or provide your Personal Information to third party service providers, we require those third parties to protect your Personal Information with reasonable security measures and to limit their use only to the purposes for which we have disclosed it to them.

Promotions. Personal Information submitted in connection with Promotions may be shared with third- party sponsors of such Promotions (irrespective of whether such Promotions are hosted by us), or otherwise in accordance with the rules applicable to such Promotion.

Assignment. In the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of KARAHE’s or the KARAHE Subsidiaries’ business, assets, or stock (including in connection with any bankruptcy or similar proceedings), we may transfer any and all information that we collect pursuant to this Policy. Any successor, assignee, or transferee may use your Personal Information as described in this Policy.

Social Networking Forums. KARAHE may make available interactive services (e.g., message boards, forums, and blogs) through which you may post information and materials on the Site. Please note that any information you disclose through such services becomes public information and may be available to visitors to the Site and to the general public. We urge you to exercise discretion and caution when deciding to disclose your Personal Information, or any other information, through these services. If you choose to voluntarily disclose your personal Information through such a forum it may be available to the public and might be used by others for any purpose.

Law Enforcement; Emergencies; Compliance. We may disclose your Personal Information: (i) when we have reason to believe that it is necessary to identify, contact, or bring legal action against persons or entities that may be causing injury to you, KARAHE, KARAHE Subsidiaries, Hotels, Affiliates, or others; (ii) when we believe that applicable law or regulation (including laws and regulations outside your country of residence) requires it; (iii) as mandated by subpoena, court order, or legal process; (iv) to establish or exercise our legal rights, defend against legal claims, or protect our operations or those of any KARAHE Subsidiaries, Hotels, or Affiliates; (v) to protect the rights, privacy, safety, or property of KARAHE, KARAHE Subsidiaries, Hotels, Affiliates, you, or others; (vi) to investigate, prevent, or take action regarding suspected illegal activities, (vii) to investigate, prevent, or take action regarding suspected fraud, (viii) to investigate, prevent, or take action regarding situations involving potential threats to the physical safety of any person, (ix) to investigate, prevent, or take action regarding violations of our Terms Of Use or other agreements or policies, or (x) as otherwise required or permitted by law.

Responsibility When Information Is Transferred. If a service provider that receives Personal Information from us about an EU data subject or Swiss data subject takes an action that is contrary to the principles of the EU-US Privacy Shield or Swiss-US Privacy Shield, we shall be liable for those actions unless we prove that we are not responsible for causing them.

NON-PERSONAL INFORMATION

KARAHE may also collect “Non-Personal Information,” meaning aggregated and/or anonymized information, demographic information, and any other information that does not reveal your specific identity. Because Non-Personal Information does not personally identify you, we may use and share such information with KARAHE Subsidiaries, Hotels, Affiliates, and other third parties for any purpose, including without limitation to facilitate and improve your ongoing access to and use of our Site, to best tailor our services to suit personal interests, to analyze visiting patterns, enhance and improve customer service, and for our other business purposes. As you navigate the Site, we and our service providers may collect certain Non-Personal Information such as your computer type (Windows or Macintosh), screen resolution, OS version, Internet browser, and Internet browser version using automatic data collection technologies.

In addition, we may engage third party tracking and advertising providers to act on KARAHE’s behalf to track and analyze your usage of our Site through the use of such automatic data collection technologies. These third parties collect and share with us, as we may request, Site usage information about visits to our Site, measure and research the effectiveness of our advertisements, track page usage and paths followed during visits through our Site, help us target and track use of our Internet banner advertisements on our Site and on other sites, and track use of other links from our marketing partners’ sites to our Site. We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

COOKIES

We may also collect information related to cookies. A cookie is a simple text file that is stored on your computer or mobile device by a website’s server. It contains anonymous information, for example a unique identifier and the name of the website, as well as some numbers and digits. Cookies allow a website to remember your preferences, and items you have placed in your shopping cart. Most browsers will tell you how to stop accepting new cookies, how to be notified when you receive a new cookie, and how to disable existing cookies. The “Help” function within your browser should tell you how to do this. Alternatively, you can visit www.allaboutcookies.org, which gives comprehensive information on how to disable cookies on a wide variety of desktop browsers. If you disable or refuse cookies, please note that some parts of this Site may then be inaccessible or not function properly.

IP ADDRESSES

Your IP address is a number that your Internet Service Provider automatically assigns to the computer that you are using to access the Site. This number is identified and logged automatically in our server log files whenever users visit the Site, along with the time of each visit and the page(s) that were visited. Collecting IP addresses is standard practice on the Internet and is done automatically by many websites. We use IP addresses for purposes such as calculating Site usage levels, helping diagnose server problems, validation of a legitimate user session via Google® captcha and administering the Site. Please note that we treat IP addresses, server log files, and related information as Non-Personal Information, except when we are required to do otherwise under applicable law.

DO NOT TRACK

Your web browser may let you choose your preference as to whether you want to allow websites to collect information over time about your online activities across different websites or online services. At this time, the Site does not respond to such “Do Not Track” or similar preferences you may have configured in your web browser, and the Site may continue to collect information in the manner described in this Policy. However, as stated in the “Non-Personal Information” section above, we do allow you to exercise some choice in the information collected by adjusting your browser’s cookie settings.

THIRD-PARTY SITES

The Site may contain links to third-party websites. These linked sites (which may include the websites of Hotels, Affiliates, and various Karahe partners or other third parties) are not under KARAHE’s control, and we are not responsible for the privacy practices or the contents of any such linked site (or any link contained in any linked site). We provide such links only as a convenience, and the inclusion of a link on the Site does not imply endorsement of the linked site by KARAHE or the KARAHE Subsidiaries. If you decide to access any of the third-party websites linked to this Site, you do so entirely at your own risk and subject to the terms and conditions of use and privacy policies for such websites. If you provide any Personal Information through any such third-partywebsite, your Personal Information will be treated in accordance with the privacy policy of that third party.

SECURITY

Because the security of your Personal Information is important to us, we have implemented security measures that provide reasonable precautions against the unauthorized access, disclosure, alteration, or destruction of Personal Information. The Personal Information we collect from you online is stored by us and/or our service providers and protected through a combination of physical and electronic access controls, firewall technology, and other reasonable security measures. Nevertheless, such security measures cannot prevent all loss, access, misuse, or alteration of Personal Information. Where required by law, we will notify you of any such loss, access, misuse, or alteration of Personal Information that may affect you, so that you can take the appropriate actions to protect your rights. We may decide to notify you by mail, email, or telephone where permitted by law.

Please do not send us your Payment Information or Sensitive Information through e-mail or any undesignated area (e.g., submission of your credit card number in a “comment” field). If you have reason to believe that your interaction with us is no longer secure (e.g., if you feel that the security of any account you might have with us has been compromised), you must immediately notify us of the alleged problem by contacting our Customer Care Department as set forth below in this Policy. Please note that, if you choose to notify us via physical mail, this will delay the time it takes for us to respond to the alleged problem.

YOUR CHOICES

You may always choose what Personal Information (if any) you wish to provide to us. However, if you choose not to provide certain details, some of your experiences with us may be affected. For example, we cannot take a reservation without a name, and if we cannot disclose your Personal Information, we may be unable to provide you with all or certain reservation services, other services, or membership-program-related benefits. Similarly, if we cannot disclose your Personal Information to other third parties, such as Karahe partners (e.g., tour agencies, transportation companies, airlines, card issuers and other third parties), we may not be able to provide all of the available membership program services to you.

In some jurisdictions, data privacy or other laws may require us to obtain your consent before we send you information that you have not specifically requested. In certain circumstances, your consent may be implied (e.g., where communications are required in order to fulfil your requests and/or where you have volunteered information for use by us). In other cases, we may be required to seek your consent expressly (e.g., where the information collected is regarded to be Sensitive Information under local regulations).

If you do not wish for us to use your contact information to promote our own or third parties’ products or services, you can opt-out of any or all such promotional communications or withdraw your previous consent by contacting our Customer Care Department as set forth in the “Contacting Us” section of this Policy below. If you have received a promotional e-mail from us and no longer wish to receive such e-mails going forward, you may opt-out by using the unsubscribe function in the e-mailyou have received from us. Please note that when you unsubscribe from receiving promotional e- mails from us, your contact details will be “suppressed” rather than deleted. This will ensure that your request is recorded and retained unless you provide a later consent that overrides it.

If you have a Karahe account, we ask you to indicate your communication preferences at the time you become a member of the Krahe program. Once you have indicated your preferences, you can change them by logging into your account.

Please note that if you opt-out as described above, we will not be able to remove your Personal Information from the databases of Hotels, Affiliates, or other third parties with which we have already shared your Personal Information.

ACCESS, DELETION & MODIFICATION

KARAHE may allow you to review certain Personal Information through the Site or through other online means. Information about the availability of online means for reviewing your Personal Information is generally available at the Site or on the printed materials where such type of Personal Information was first submitted.

Pursuant to applicable law, you may have the right to request access, deletion or changes to the Personal Information we maintain about you and, where appropriate, request that we update such Personal Information you believe is incomplete, inaccurate or out of date. You can also inquire whether we maintain Personal Information that relates to you. Although KARAHE will attempt in good faith to respond to your request, we may not be able to provide, delete, or change your

Personal Information in all circumstances. For example, KARAHE may not be able to change, provide, or delete Personal Information about you if it would impose an undue burden or expense, or require KARAHE to also change information relating to another person. In addition, in some circumstances pursuant to applicable law, you may have the right to request that we cease using Personal Information about you on the grounds that such Personal Information was acquired by unjust means or used in violation of law. KARAHE will honor such requests as required and within the time specified by applicable law and, where permitted by law, may charge an appropriate fee to cover the costs of responding to your request.

To make one of the requests listed above, please complete and submit this Request Form. Please be sure to include your full name, address, telephone number, e-mail address. We use this information to ascertain your identity to determine whether we have any Personal Information regarding you, or in case we need to contact you to obtain any additional information.

DATA RETENTION AND MINIMIZATION

KARAHE only collects Personal Information that it believes is necessary to perform the services that you seek from KARAHE and to exercise its rights and comply with its obligations as otherwise outlined in this Policy. We will keep your Personal Information only as long as we need it for the purposes for which we collect it or as otherwise permitted by law.

NOTE REGARDING THE USE OF THE SITE BY MINORS

The Site is not directed to minors (as defined by applicable law), and we request that such individuals do not provide Personal Information through the Site. If we learn we have collected or received Personal Information from a minor under the age of 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a minor under the age of 13, please contact our Customer Care Department as set forth in the

“Contacting Us” section of this Policy.

EU-US PRIVACY SHIELD AND SWISS-US PRIVACY SHIELD

KARAHE complies with the U.S.-EU Privacy Shield and the U.S.-Swiss Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Information from European Union member countries and Switzerland. KARAHE has submitted its self-certification that it adheres to the Privacy Shield principles of notice, choice, onward transfer, security, data integrity, access, and enforcement. To learn more about the Privacy Shield program, and to view KARAHE’s certification once it is approved by the U.S. Department of Commerce, please visit http://www.privacyshield.gov. Please note that a violation of KARAHE’s commitment to Privacy Shield may be investigated by the Federal Trade Commission and/or the United States Department of Commerce.

If you feel that KARAHE has mishandled your Personal Information in violation of the Privacy Shield Privacy Principles, please contact KARAHE through its Customer Care Department with a written description of your complaint. After receiving such written description, a representative from KARAHE’s Customer Care Department will contact you to set up a time and manner to discuss your complaint. KARAHE is dedicated to addressing all legitimate complaints about its adherence to this Policy and the Privacy Shield Privacy Principles and will make a good faith effort to engage in communications to address such complaints. For unresolved complaints under the Privacy Shield Privacy Principles, KARAHE has agreed to participate in the JAMS EU Privacy Shield Program, an independent dispute resolution program. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed by KARAHE, please visit the JAMS Program Website at https://jamsadr.com/file-an-eu-us-privacy-shield-or-safe-harbor-claim for more information and/or to file a complaint. If your complaint is not resolved by KARAHE, or through the JAMS process, under limited circumstances a binding arbitration option may be available before a Privacy Shield Panel, or you may have the right to lodge a complaint with your local data protection agency.

JURISDICTIONAL / DATA TRANSFER ISSUES

The Site and KARAHE are operated from the Costa Rica in accordance with laws of the Costa Rica, and visitors to our Site, those who provide us Personal Information, and those who otherwise indicate their consent to the receipt of marketing or other information from us, should be aware that the laws of the United States may differ from those of your country of residence. KARAHE does not represent or warrant that the Site or any part thereof is appropriate or available for use in any particular jurisdiction. Those who choose to access the Site do so on their own initiative and at their own risk and are responsible for complying with all local laws, rules, and regulations. We may limit the Site’s availability, in whole or in part, to any person, geographic area or jurisdiction we choose, at any time and in our sole discretion. By submitting any Personal Information to us, you consent to the transfer of such Personal Information to and the processing of such Personal Information in countries other than your country of residence, including countries that may provide a different level of data security than in your country of residence, including the United States, where KARAHE is located. In addition, if we need to transfer any Personal Information to Licensed Hotels, Affiliates, or other third parties pursuant to this Policy, please be advised that such entities may or may not be located in countries that are considered “adequate” pursuant to the EU-US Privacy Shield, Swiss-US Privacy Shield or other laws.

CALIFORNIA USERS: YOUR CALIFORNIA PRIVACY RIGHTS

California’s “Shine the Light” law, Civil Code section 1798.83, requires certain businesses to respond to requests from California customers asking about the businesses’ practices related to disclosing personal information to third parties for the third parties’ direct marketing purposes. Alternatively, such businesses may have in place a policy not to disclose Personal Information of customers to third parties for the third parties’ direct marketing purposes if the customer has exercised an option to opt-out of such information sharing. We have such a policy in place. You may opt-out of information sharing or find out about any rights you may have under California Civil Code section 1798.83 by emailing KARAHE at reservations@karahe.com or by contacting our Customer Care

Department as set forth below under “Contacting Us.” Please note that in order to fulfil certain rewards, we must share your information with our KARAHE Subsidiaries, Affiliates or third party service providers. In addition, when you make a reservation or stay at a Hotel or through an Affiliate,

you are providing your information directly to that Licensed Hotel or Affiliate and the restrictions contained in this Section will not apply to KARAHE with respect to such information. Please follow the instructions provided to you by any third party service providers to unsubscribe from their messages. If you have opted-out as described above, and thereafter you elect to initiate a transaction that requires us to share your information with such third party again, then your previous opt-out preferences will not apply.

CONTACTING US

If you have any questions regarding this Policy, or would like to update your information or modify your communication preferences, please contact us by e-mail at reservations@karahe.com, by phone at 506-2777-0170, or write to us at the following address:

Karahe Hotel.

Playa Manuel Antonio, Puntarenas

Manual Antonio, Costa Rica 06350 Attn: Legal Department (KARAHE’s representative)

Please note that e-mail communications will not necessarily be secure; accordingly, you should not include Payment Information or Sensitive Information in your e-mail correspondence to us.

CHANGES TO THE POLICY

KARAHE reserves the right to change, modify, or amend this Policy at any time. The date this Policy was last revised is at the top of this page. If we make a material change to this Policy, we will indicate on the Site that our privacy practices have changed and will provide a link to the new policy. If we make material changes to how we use your Personal Information, we will notify you by e-mailto the e-mail address specified in your account (if applicable) and/or through a notice on the

Site’s home page, and we will provide you with an opportunity to opt-out of such new or different use. Any changes to the Policy will become effective upon our posting of the revised Policy on the Site. Use of the Site following such changes constitutes your acceptance of the revised Policy then in effect