PRIVACY POLICY

The data controller is Pontos LLC, registered in Delaware, USA, doing business as Anakata. Our yacht is operated in Ecuador by LUMABEDA TOURS C. LTDA., which also processes your data to operate your expedition as data processor.

Privacy contact: info@anakata.co

2.1 Contact and booking data: name, email, phone number, country and city of residence, billing details, booking history and how you heard about us, and, if applicable, your tax identification number for invoicing.

2.2 Identity document data: full name as shown on your passport, date of birth, nationality, passport number and expiry date. You may also upload a photo of your passport through our booking system.

2.3 Emergency contact: name, relationship and phone number of a person we can contact in an emergency.

2.4 Sensitive personal data: medical conditions, medications, mobility needs and allergies relevant to your safety on board, and dietary requirements that may reveal health conditions. We ask for this data through a separate consent in our booking system or pre-expedition questionnaire. Providing it is optional, but if you choose not to, we may not be able to assess whether the expedition is suitable for you or cater for your needs safely.

2.5 Preferences: information you share in our pre-expedition questionnaire, such as cabin layout, pillow preference and/or level of activity and celebration preferences.

2.6 Payment data: card payments are processed directly by our payment providers. Anakata never stores your full card details.

2.7 Website and advertising data: cookies, usage data and similar technologies, including advertising pixels, as described in our Cookie Policy. Advertising cookies and pixels are only activated after you give your consent through the cookie banner on our website, where you can also change your choices at any time.

2.8 Communications and feedback: records of your emails, calls, WhatsApp messages and other communications with us, and your responses to our post-expedition surveys and review invitations.

2.9 Incomplete bookings: if you start a booking but don't complete it, we keep the details you entered so you can resume it and so we can follow up with you. We let you know about this from the first step of the booking.

2.10 Photos and video: during your expedition, our crew and guides may take photos and videos of activities in which you may appear. We will only use images that identify you in our marketing with your consent (see section 4).

2.11 Onboard Wi-Fi: if you use our onboard Wi-Fi, we collect technical data such as your device identifier, connection times and data usage to provide and secure the service. We do not monitor the content of your browsing.

2.12 Security cameras: our yacht has security cameras in public areas for the safety of guests and crew.

2.13 Consent records: when you accept our terms or give consent, we record the date, time, IP address and version of the document you accepted.

2.14 Travel advisor data: if you are a travel advisor, we process your name, agency, contact details, bookings, and commission and payment details to manage our relationship with you and your agency.

We collect personal data:

• Directly from you, when you make an inquiry, book, complete our pre-expedition questionnaire, travel with us or contact us.
• From the lead guest, who provides the details of everyone in the same booking.
• From your travel advisor, if you book through one.
• Automatically, when you use our website, through cookies and similar technologies (see our Cookie Policy), as long as you have given us your consent.
• From advertising and social media platforms, when you interact with our ads or pages.

If you give us personal data about another person, such as a travel companion, a child or your emergency contact, you confirm that you are authorized to do so and that you have shown them this Privacy Policy.

Where we rely on our legitimate interests, we have balanced them against your rights. You can object to this processing at any time (see section 11).

Personalization. With your marketing consent, we may group contacts by country, interests and booking history to personalize our communications and advertising, including similar audiences on advertising platforms, using only encrypted (hashed) contact details. We never share medical, passport or trip data with advertising platforms, and we do not make decisions with legal or similarly significant effects based solely on automated processing. You can object at any time.

We share only the data each recipient needs, and only for the purposes above:

• Airlines, when we book domestic flights for you, and the Galápagos, port and maritime authorities, for the passenger list, the Transit Control Card (TCT), park entrance fees and the departure clearance (zarpe).
• Our yacht operating companies in Ecuador and our crew, to operate your expedition. Medical and dietary information is shared only with the crew members who need it.
• Service providers who process data on our behalf, such as our booking system and CRM, cloud hosting, payment processing, email, messaging and telephone services, and artificial intelligence tools that help us manage inquiries. They are located in the United States, the United Kingdom and the European Union, and are bound by contract to protect your data.
• Hotels, transfer companies, guides and other suppliers you book through us, limited to what they need to provide the service.
• Medical and emergency providers, such as doctors, hospitals, medical evacuation services and your insurer, if you need medical assistance.
• Analytics providers, to understand how our website is used.
• Advertising platforms, with your consent, to measure our advertising and reach similar audiences, as described in section 4 and in our Cookie Policy.
• Your travel advisor, if you booked through one.
• Professional advisers and insurers, such as lawyers, accountants, auditors and our insurance companies.
• Authorities, courts and law enforcement, when required by law or to protect the rights and safety of guests, crew or others.
• A buyer or successor, if Anakata is involved in a merger, acquisition or sale of all or part of its business. Your data would remain protected under this policy.

We do not sell, rent, or disclose your personal data to third parties in exchange for money or other considerations.

6.1 We use passport copies only to verify your details, book your flights and complete the requirements of the Galápagos authorities. We share them only with the airline or authority that requires them.

6.2 Passport copies are stored securely and accessible only to authorized members of our reservations and operations teams. They are retained for 90 days after your expedition ends, or longer where reasonably necessary to handle claims or respond to lawful requests from competent authorities, and securely deleted thereafter.

We collect data about children under 18 only from their parent or legal guardian, who provides consent on their behalf. Airlines require passport copies for children aged 11 and under, which we obtain from the booking system for this purpose only. Our website is not directed at children, and we do not knowingly collect personal data directly from them.

Pontos LLC dba Anakata is based in the United States and operates in Ecuador, so your data is processed in both countries and, where our service providers are located, in other countries that may not offer the same level of protection as your home country. Data of guests in the European Union is stored on servers located in the European Union. When we transfer your data to other countries, we use the safeguards required by law, such as the European Commission's Standard Contractual Clauses (EU) and the UK International Data Transfer Addendum (UK), with supplementary security measures, and the safeguards required by Ecuador's LOPDP. You can request a copy of these safeguards by contacting us.

After these periods, data is deleted or anonymized. Deleted data may remain in backups for a limited time, where it is not used for any purpose. If an incident occurs on board, we may keep the related data for longer while it is needed to investigate it or to establish, exercise or defend legal claims.

We use appropriate technical and organizational measures to protect your data, such as encryption, access controls limited to authorized staff, and secure servers. Our service providers are contractually required to apply equivalent protections. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you and the relevant authorities as required by law.

Please share passport details only through the channels our team indicates, and not through public messaging apps or social media.

You have the right to access, correct or delete your data, to receive a copy of it in a portable format, to object to or restrict its processing, and to withdraw your consent at any time. Withdrawing consent does not affect processing already carried out. Some data cannot be deleted while your booking is active or while we are legally required to keep it.

You can unsubscribe from marketing at any time using the link in our emails or by contacting us. You can also object to processing based on our legitimate interests, including profiling for marketing.

To exercise your rights, contact info@anakata.co. We may need to verify your identity before responding to your request. You may also exercise your rights through an authorized representative. We will respond within 15 days under the LOPDP, or one month under the GDPR and UK GDPR, extendable where permitted by law.

You may also complain to Ecuador's Superintendency of Personal Data Protection or, if you are in the EU or the UK, to your national data protection authority.

If you interact with us on social media, the platform's own privacy policy also applies. If you tag us or use our hashtags, we will ask your permission before sharing your post on our channels. Our website may link to third-party websites, which have their own privacy practices.

This policy is available in English and Spanish. Both versions are equally valid.

We may update this policy. The current version is always available at anakata.co/privacy, and significant changes will be communicated by email. We may ask you to accept the updated version before your next booking.