Thank you for your interest in fijianhost.com. The protection of your personal data is important to us. We comply with the statutory provisions on data protection and data security. We are subject to the provisions of the 2013 Constitution of Fiji, the Cybercrime Act of Fiji 2021, and international data protection standards including the General Data Protection Regulation (GDPR) where applicable. Accordingly, we are entitled in particular to collect and use personal data to the extent necessary to enable you to use our website at www.fijianhost.com, including all services and functions contained therein.

Below you will find information on what personal data we collect when you use our website and the services and functions contained therein, and how we use it and for what purposes.

1. Name and address of the person responsible

1.1 The responsible person within the meaning of applicable data protection laws is:

Bula Host Pte Ltd Lot 17 Velau Drive, Kinoya, Suva, Republic of Fiji Contact: orisi@fijianhost.com Phone: +679 8639060

2. General information on data processing

2.1 General information on data processing

As a matter of principle, we process personal data of our users only insofar as this is necessary for the provision of a functional website as well as our contents and services. The processing of personal data of our users is regularly carried out only with the consent of the user. An exception applies in those cases where it is not possible to obtain prior consent for factual reasons and the processing of the data is permitted by legal regulations.

2.2 Legal basis for the processing of personal data

2.2.1 Insofar as we obtain consent from the data subject for processing operations involving personal data, your consent serves as the legal basis under applicable data protection laws.

2.2.2 When processing personal data that is necessary for the performance of a contract to which the data subject is a party, contract performance serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

2.2.3 Insofar as processing of personal data is necessary for the fulfillment of a legal obligation to which our company is subject, legal compliance serves as the legal basis.

2.2.4 In the event that vital interests of the data subject or another natural person make processing of personal data necessary, vital interests serve as the legal basis.

2.2.5 If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, legitimate interests serve as the legal basis for the processing.

2.3 Data deletion and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may take place beyond this if this has been provided for by Fijian or international regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

3. Provision of the website and creation of log files

3.1 Description and scope of data processing

3.1.1 Each time our platform is called up, our system automatically collects data and information from the computer system of the calling computer.

3.1.2 The following data is collected in this process:

• a. IP address;
• b. Date and time of the request;
• c. Time zone difference to Greenwich Mean Time (GMT);
• d. Content of the request (specific page);
• e. Access status/HTTP status code;
• f. Amount of data transferred in each case;
• g. Web page from which the request comes;
• h. Browser type and version;
• i. Operating system and its interface; and
• j. Language and version of the browser software.

3.1.3 We cannot assign this data to specific persons. We do not combine this data with other data sources.

3.2. Purpose of data processing

3.2.1 . The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The storage also takes place in order to ensure the functionality of the website. In addition, we use the data to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

3.2.3 . These purposes are also our legitimate interest in data processing.

3.3. Duration of storage

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. Beyond that, the data is deleted after seven days at the latest. Storage beyond this is possible. In this case, the IP addresses of the users are deleted or anonymized, so that an assignment of the calling client is no longer possible.

3.4 Possibility of objection and elimination

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the platform. Consequently, there is no possibility of objection on the part of the user.

4. Use of cookies

4.1. Description and scope of data processing

4.1.1 In addition to the data mentioned above, cookies are stored on your computer when you use this platform. Cookies are small text files that are stored on your hard drive assigned to the browser you are using and through which we receive certain information. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the website as a whole more user-friendly and effective.

4.1.2 This website uses the following types of cookies:

a. Essential Cookies: Essential cookies enable basic functions and are necessary for the proper functioning of the platform

b. Statistics Cookies: Statistics Cookies collect information anonymously. This information helps us understand how our visitors use our platform.

4.1.3 In addition to these persistent cookies, there are also transient cookies.

4.1.4 Transient cookies are automatically deleted when you close the browser. These include in particular the session cookies. These store a so-called session ID, with which various requests of your browser can be assigned to the common session. This allows your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close the browser.

4.1.5 Persistent cookies, on the other hand, are deleted automatically after a specified duration, which may differ depending on the cookie. You can configure these persistent cookies according to your wishes via our cookie banner, which is displayed to you when you access our website for the first time.

4.2 Legal basis for data processing

The legal basis for the processing of personal data using cookies is your consent and our legitimate interests in providing platform functionality.

4.3 Purpose of the data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our platform cannot be offered without the use of cookies. Analysis cookies are used for the purpose of improving the quality of our platform and its content. They are only set with your consent. Through the analysis cookies, we learn how the website is used and can thus constantly optimise our offer.

4.4 Duration of storage, possibility of objection and elimination

Cookies are stored on the user's computer and transmitted from it to our platform. Therefore, you as a user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies through your browser settings. Cookies that have already been stored can be deleted at any time.

5. Newsletter

5.1 Description and scope of data processing

5.1.1 On our website there is the possibility to subscribe to a free newsletter about Fijian homestay experiences and cultural or social activities. When you register for the newsletter, the data from the input form is transmitted to us.

5.1.2 We verify your consent to receive our newsletter by email using the double opt-in procedure. This means that we first request active confirmation of your consent to receive the newsletter by email to the email address you provided before we start sending it.

5.1.3 No data will be passed on to third parties in connection with the processing of data for the dispatch of newsletters. The data is used exclusively for sending the newsletter.

5.2 Legal basis for data processing

The legal basis for the processing of data after registration for the newsletter is your consent.

5.3 Purpose of data processing

The collection of the user's email address serves to deliver the newsletter. The collection of other personal data during the registration process serves to prevent misuse of the services or the email address used.

5.4 Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, the user's email address will be stored as long as the subscription to the newsletter is active.

5.5 Possibility of objection and removal

The subscription to the newsletter can be cancelled by the affected user at any time. For this purpose, a corresponding link can be found in each newsletter. If you revoke your consent, we will delete this data and no longer send you newsletters.

6. Registration as Vulagi (Guest) or Taukei (Host)

6.1 Description and scope of data processing

6.1.1 On our website, we offer users the opportunity to register as either Vulagi (guests) seeking homestay accommodations or Taukei (hosts) offering authentic Fijian homestay experiences. During registration, users provide personal information including email address and other required details. The data is entered in an input form and transmitted to us and stored.

6.1.2 For Taukei registration, additional verification data is collected including:

a. Business registration documentation;

b. Tax registration information (FRCS);

c. Financial account details for payments; and

d. Property and cultural authenticity verification.

6.1.3 If you use social login options (Google/Facebook), information about your use of our platform may be transmitted to the selected provider.

6.2 Legal basis for data processing

The legal basis for the processing of data is your consent. If the registration serves the fulfillment of a contract or the implementation of pre-contractual measures, contract performance serves as additional legal basis.

6.3 Purpose of data processing

Registration is necessary for accessing our homestay booking and hosting services. For Taukei, verification ensures authentic cultural experiences and compliance with Fijian business regulations.

6.4 Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For registration data related to contract fulfillment, this occurs when the data is no longer required for contract implementation. Even after contract conclusion, we may need to store personal data to comply with contractual or legal obligations.

6.5 Possibility of objection and removal

As a user, you have the option to cancel your registration at any time through account deletion. You can have the data stored about you changed at any time. If the data is required for contract fulfillment, early deletion is only possible insofar as contractual or legal obligations do not oppose deletion.

7. Use of our platform to offer or book homestay accommodations

7.1 Description and scope of data processing

7.1.1 When you book or host accommodations via our platform, it is necessary for contract conclusion that you provide personal data required for processing your booking or hosting offer. Mandatory data necessary for contract processing are marked separately; other information is voluntary.

7.1.2 For payment processing, we work with approved international payment providers such as Visa and Mastercard. While for Fijian financial institutions and mobile payment providers we work with Vodafone mPaisa, Digicel MyCash, and Sole payment systems.

7.2 Legal basis for data processing

The legal basis for data processing is contract performance.

7.3 Purpose of data processing

The provision of data is necessary for processing your booking or hosting arrangements. We may also process the data to inform you about other homestay opportunities or send technical information.

7.4 Duration of storage

We are required by Fijian commercial and tax law to store your address, payment and booking data for required retention periods. After periods without business contact, we will restrict processing, meaning your data will only be used to comply with legal obligations.

7.5 Possibility of objection and removal

You have the option to have data stored about you changed at any time. If data is required for contract fulfillment or pre-contractual measures, early deletion is only possible insofar as contractual or legal obligations permit.

8. Contact form and email contact

8.1 Description and scope of data processing

8.1.1 A contact form is available on our platform for electronic contact. When you use this option, the data entered in the input form is transmitted to us and stored. Alternatively, you can contact us via the provided email address, in which case personal data transmitted with the email will be stored.

8.1.2 Data will not be passed on to third parties and is used exclusively for processing the conversation.

8.2 Legal basis for data processing

The legal basis for data processing is your consent. If email contact aims at contract conclusion, contract performance serves as additional legal basis.

8.3 Purpose of data processing

Processing personal data from the contact form serves solely to process your inquiry. For email contact, this constitutes necessary legitimate interest in processing the data.

8.4 Duration of storage

Data will be deleted when no longer required for the purpose collected. For contact form and email data, this occurs when the conversation with you has ended and the matter has been conclusively resolved.

8.5 Possibility of objection and removal

You can revoke your consent to personal data processing at any time. If you contact us by email, you can object to storage of your personal data at any time, though this would prevent continuation of the conversation.

9. Use of mapping services

9.1 Description and scope of data processing

On our platform, we may use mapping services to display homestay locations and help users navigate to accommodations. When accessing pages with integrated maps, information about your website use (such as IP address) may be transmitted to mapping service providers.

9.2 Legal basis for data processing

The legal basis for using mapping services is your consent.

9.3 Purpose of data processing

Mapping services display homestay locations and facilitate navigation to accommodations.

9.4 Duration of storage

We do not have detailed information about storage duration at mapping service providers.

9.5 Possibility of objection and removal

You can revoke your consent at any time through our consent management system.

10. Social media integration

10.1 Description and scope of data processing

Our website may include social media plugins and sharing functions. When you interact with these features while logged into your social media accounts, information may be transmitted to social media providers and associated with your profiles.

10.2 Legal basis for data processing

The legal basis for social media integration is your consent.

10.3 Purpose of data processing

Social media integration facilitates content sharing and helps promote authentic Fijian homestay experiences.

10.4 Duration of storage

We do not receive knowledge of transmitted data content or its use by social media providers. Please refer to respective social media privacy policies for detailed information.

10.5 Possibility of objection and removal

You can avoid data transmission by logging out of social media accounts before visiting our website, or by adjusting settings in our consent management system.

11. Rights of the data subject

If personal data is processed about you, you are a data subject and entitled to the following rights

11.1 Right of information

You may request confirmation whether personal data concerning you is being processed by us, and if so, request information about processing purposes, data categories, recipients, storage duration, and other relevant details.

11.2 Right to rectification

You have a right to rectification and/or completion if processed personal data concerning you is inaccurate or incomplete.

11.3 Right to restriction of processing

You may request restriction of processing under specific conditions, including when you contest data accuracy or object to processing.

11.4 Right to erasure

You may request erasure of personal data concerning you under specific circumstances, including when data is no longer necessary for original purposes or when you withdraw consent.

11.5 Right to information

If you assert rights to rectification, erasure, or restriction, we must inform all recipients of such changes unless this proves impossible or involves disproportionate effort.

11.6 Right to data portability

You have the right to receive personal data you provided in a structured, commonly used, machine-readable format, and to transmit this data to another controller.

11.7 Right to object

You have the right to object to processing based on legitimate interests, including profiling. For direct marketing purposes, you have an absolute right to object.

11.8 Right to revoke consent

You have the right to revoke your data protection consent at any time. Revocation does not affect the lawfulness of processing carried out based on consent before revocation.

11.9 Automated decision-making

You have the right not to be subject to decisions based solely on automated processing that produces legal effects or similarly significantly affects you.

11.10 Right to complain

You have the right to lodge a complaint with a supervisory authority if you consider that processing of personal data concerning you infringes applicable data protection laws.

12.Changes to this Privacy Policy

The further development of the Internet and our platform may affect the handling of personal data. We therefore reserve the right to amend this privacy policy within the framework of applicable data protection laws. The current version is always available under the heading 'Privacy Policy' on our platform.

• Document Version: 001/25

• Last Revised: 27 May 2025

• Effective From: 2 June 2025