Trastain may collect the following information from users of our platform: • First name and last name • Street address, area, city, and governorate • Phone and contact numbers • Email address • GPS location (mobile app and website) • Date of birth • Profile photo (Collectively referred to as "Personally Identifiable Information" or "PII") In addition, Trastain may collect information regarding account holders' past bookings, favorite properties, saved searches, customer service inquiries, property/host reviews, wish lists, and certain social networking preferences (e.g., pages you "Like" or "Recommend"). Trastain also uses web analytics software to track and analyze traffic on the platform in connection with advertising and promotion of Trastain services. Trastain may publish these statistics or share them with third parties without including PII.

To build trust and ensure safety within our community of Hosts and Guests, Trastain may collect identity verification information, including: • Government-issued ID (National ID card, passport) • Selfie photograph for facial verification • Property ownership documents (for Hosts) • Background check information (to the extent permitted by Egyptian law) This information is used solely for verification purposes and is stored securely in compliance with PDPL requirements.

To support MENA cultural preferences, Trastain offers unique features like 'female-only' stays and 'family-only' properties. To enable these features, we may collect what is considered "Sensitive Personal Data" under Egypt's PDPL: • Gender • Family status (traveling with family, solo traveler, etc.) • Cultural or religious accommodation preferences Important: This sensitive data is subject to stricter legal requirements under the PDPL: 1. Explicit Written Consent: We will only process this data with your explicit, written consent obtained through a separate, clearly marked checkbox. 2. Purpose Limitation: This data is used exclusively for enabling cultural preference filters and will not be used for any other purpose. 3. Right to Withdraw: You may withdraw your consent at any time through your account settings. 4. PDPC Licensing: Trastain will obtain the required license from the Personal Data Protection Centre (PDPC) for processing sensitive data.

Non-Personally Identifiable Information (or "Non-PII") is aggregated information, demographic information, and any other information that does not reveal your specific identity. We and our third-party service providers may collect Non-PII from you, including: • MAC address and device identifiers • Computer/device type and screen resolution • Operating system version • Internet browser type and version • Demographic data (e.g., general location, preferred language) We may aggregate PII in a manner such that the end-product does not personally identify you or any other user. For example, by using PII to calculate the percentage of our users in a particular governorate or city.

IP Addresses are the Internet Protocol addresses of the devices you are using. Your IP Address is automatically assigned to your device by your Internet Service Provider (ISP). This number is identified and logged automatically in our server log files whenever users visit the platform, along with the time(s) of such visit(s) and the page(s) that were visited. Collecting IP Addresses is standard practice on the Internet. We use IP addresses for purposes such as calculating platform usage levels, helping diagnose server problems, administering the platform, and for security and fraud prevention.

Trastain uses PII to: • Create and manage users' Trastain accounts • Communicate with users about Trastain services, bookings, and support inquiries • Facilitate bookings between Guests and Hosts • Process payments and payouts through our payment partners (e.g., Paymob) • Offer users additional services, promotions, and special offers • Personalize search results and property recommendations using AI • Verify user identities and prevent fraud • Enforce Trastain Terms of Service and community standards • Comply with legal obligations under Egyptian law Users may opt-out of receiving promotional communications from Trastain by visiting their account settings page or using the unsubscribe link in any promotional email.

Trastain uses Artificial Intelligence (AI) and machine learning to enhance your experience: • Personalized Recommendations: Our AI analyzes your search history, booking patterns, and preferences to suggest properties that match your needs. • Smart Pricing (for Hosts): AI-powered dynamic pricing suggestions based on demand, seasonality, and local events. • Fraud Detection: Automated systems monitor transactions and user behavior to detect and prevent fraudulent activity. • AI Co-Host (Customer Support): 24/7 AI-powered support in Arabic and English to answer common questions. Your Rights: You have the right not to be subject to decisions based solely on automated processing that significantly affect you. For critical decisions (e.g., account suspension), Trastain ensures human review and oversight.

To register for an account, we require you to supply us with your email address. We use your email address to: • Confirm your bookings and reservations • Communicate with you in case of booking issues • Send important account and security notifications • Provide customer support If you supply us with your email address, you may later access it, update it, modify it, and delete any inaccuracies by accessing your account through "My Account" settings. We communicate part of your contact information (name, phone number) with the Host from whom you have made a booking. We do not sell and will not divulge your personal contact information to third parties other than as specified in this Privacy Policy without your permission unless we are legally entitled or obliged to do so.

When you make a booking through Trastain, you are required to select a method of payment. Trastain partners with Paymob and other licensed payment providers to process transactions securely. Important Security Information: • PCI DSS Compliance: Our payment gateway is fully PCI DSS (Payment Card Industry Data Security Standard) certified. • Encryption: All card information is transmitted using 128-bit or higher encryption technology. • No Storage of Full Card Details: Trastain does not store your full credit/debit card information. Only tokenized references are kept for recurring payments if you opt-in. • Multiple Payment Options: We support credit/debit cards, mobile wallets, Fawry, and bank transfers. Payment information is processed in accordance with Paymob's Privacy Policy and Egyptian banking regulations.

Personal information required during the booking process includes name, address, phone number, email address, number of guests, and check-in/check-out dates. This information is used to: • Complete and confirm your reservation • Share necessary details with the Host to prepare for your stay • Notify you of your booking status and any changes • Process payments and refunds Personal information collected at our platform will be shared with Hosts when processing your booking. We have agreements with all Hosts restricting further disclosure or misuse of personal information provided to them by us. Your personal information will not be shared with any business partners or affiliates without your permission, except as required by law.

When you visit our platform, our server sends your device a "cookie." This cookie is a small packet of information that identifies you as a user of our system. Trastain uses cookies to: • Remember users on the platform and enhance user experience • Identify returning users and provide user-specific information (login status, language preference, currency) • Remember your search preferences and recently viewed properties • Analyze platform performance and improve our services Cookies do not deliver viruses and can only be read by the server that sent them. You can decline cookies by modifying your browser settings. However, you may not be able to use all features of our platform if cookies are disabled. To learn more about cookies, please visit: http://www.allaboutcookies.org/

We may disclose your information to: • Hosts and Guests: To facilitate bookings, we share relevant information between parties (name, phone number, booking details, property address after confirmation). • Service Providers: Third parties involved in payment processing (Paymob), identity verification, customer support, and platform hosting. • Legal Authorities: If required by law, court order, or to protect our legal rights, prevent fraud, or ensure user safety. • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity. Trastain does not sell your personal information to third parties. User-generated content posted through the platform (such as property reviews, ratings, and public profile information) may be viewed by other users and the general public. Accordingly, Trastain cannot ensure the privacy of any PII included in such user-generated content.

Egypt's PDPL restricts the transfer of personal data outside of Egypt. Trastain may need to transfer your data internationally in limited circumstances (e.g., when you book a property managed by an international company or when using cloud services). We will only transfer data outside Egypt when: • The recipient country has an adequate level of data protection (as determined by the PDPC) • We have obtained the required license from the Personal Data Protection Centre (PDPC) • You have provided explicit consent after being informed of the transfer and its risks • The transfer is necessary to perform a contract for your benefit (e.g., completing a booking)

We don't sell or rent your personal information to third parties for their marketing purposes without your explicit consent. We may combine your information with information we collect from other sources to improve and personalize our services, content, and advertising. If you do not want to receive marketing communications from us via email, SMS, or push notifications, you can: • Use the unsubscribe link in any marketing email • Adjust your notification preferences in "My Account" settings • Contact us at privacy@trastain.com We only send marketing communications to users who have specifically consented to receive them.

Our platform has secure pages to collect user information, and critical data is stored in encrypted form. We use various technical and management practices to help protect the confidentiality, security, and integrity of data stored on our system: • SSL/TLS Encryption: Our servers use Secure Sockets Layer (SSL) and Transport Layer Security (TLS) encryption technology. • PCI DSS Compliance: All payment processing is PCI DSS certified through our partners. • Access Controls: Strict access controls limit who can view your personal information within our organization. • Regular Audits: We conduct regular security audits and vulnerability assessments. Unfortunately, no data transmission over the Internet can be guaranteed to be 100% secure. Please do not send us sensitive information through unencrypted email. If you believe your account security has been compromised, please contact us immediately.

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and resolve disputes. Data Type / Retention Period: • Account Information: Duration of account + 1 year after deletion • Transaction Records: Minimum 5 years (per Egyptian banking regulations) • Identity Verification Documents: Duration of account + 3 years • Communication Records: 2 years from last interaction • Marketing Preferences: Until consent is withdrawn

Under Egypt's Personal Data Protection Law No. 151 of 2020, you have the following rights: • Right to be Informed: Know what data is collected and how it is used • Right of Access: Request a copy of your personal data • Right to Rectification: Correct inaccurate or incomplete data • Right to Erasure: Request deletion of your data (subject to legal retention requirements) • Right to Restrict Processing: Limit how your data is used • Right to Data Portability: Receive your data in a structured, machine-readable format • Right to Object: Object to processing for marketing or other purposes • Right to Withdraw Consent: Withdraw your consent at any time To exercise these rights, contact our Data Protection Officer at dpo@trastain.com.

At Trastain, we provide you with the option to delete your account. Please note that if you have any pending bookings, active stays, or outstanding amounts due, you will not be able to delete your account until these are resolved. To delete your account: 1. Open the Trastain mobile app or visit www.trastain.com 2. Navigate to "My Account" > "Settings" 3. Select "Account Info" 4. Click on "Delete Your Account" 5. Follow the on-screen instructions to confirm deletion Please note: Deleting your account will delete your personal data. However, we may be required to retain some information to comply with legal obligations, for fraud prevention, or to defend against legal claims. Once deleted, your data cannot be recovered.

Our platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. In compliance with the PDPL Executive Regulations, processing personal data of children under 15 years old requires explicit consent from a parent or legal guardian. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take steps to delete that information promptly.

This Privacy Policy does not address, and we are not responsible for, the privacy practices of any third parties, including our affiliates and any third party operating any website or service to which our platform contains a link. The inclusion of a link on our platform does not imply endorsement of the linked site by Trastain. We encourage you to review the privacy policies of any third-party sites you visit.

As required by Egypt's PDPL, Trastain has appointed a Data Protection Officer (DPO) who is registered with the Personal Data Protection Centre (PDPC). The DPO is responsible for: • Monitoring Trastain's compliance with the PDPL • Conducting regular data protection assessments • Acting as the primary contact for data subjects and the PDPC • Handling data subject rights requests • Notifying the PDPC of data breaches within 72 hours • Maintaining records of data processing activities

Trastain may change this Privacy Policy at any time by publishing the new version on our website and mobile application. For material changes, we will notify you via email or through a prominent notice on our platform before the changes become effective. Your continued use of Trastain after such modifications constitutes your acceptance of the revised Privacy Policy.

Registered Members: You can update your personal information at any time by logging into your account and accessing "My Account" > "Account Info" where you can update your name, contact details, saved addresses, and payment methods. Guests (Non-Registered Users): Users who browse without registering cannot view or change their details on the platform. Any changes affecting a booking should be communicated directly to Trastain customer support or the Host.

This Privacy Policy is available in both English and Arabic. In the event of any discrepancy between the two versions, the Arabic version shall prevail for users in Egypt.

This Privacy Policy is governed by and construed according to the laws of the Arab Republic of Egypt. Any controversy, claim, or dispute arising out of or relating to this Privacy Policy shall be finally settled by the competent courts in Cairo, Egypt.

All comments, queries, and requests relating to our use of your information are welcomed and should be addressed to: Trastain Trastain for Tourism Marketing 44 Ahmed Mohamed Ibrahim St., Nasr City, Cairo, Egypt General Inquiries: info@trastain.com Privacy Concerns: privacy@trastain.com Data Protection Officer: dpo@trastain.com Customer Support: support@trastain.com Website: www.trastain.com