Privacy Statement

Identification of the Data Controller

This Privacy Policy governs the processing of personal data carried out by:

• GALAXY EXPEDITIONS GALAXYEXP S.A.S. Trade name Galaxy Cruises

Ecuadorian companies that are part of GALAXY GROUP and operate under the same tourism business activity.

• Address: De Los Motilones N40-802 and N40J (Quito – Ecuador)
• Tax Identification Number (RUC): 2091767777001
• Data Protection Contact Email: info@galaxycruises.com

Personal Data We Collect

Depending on the services contracted, we may collect:

• Full name
• Passport number or identification document number
• Date of birth
• Nationality
• Email address
• Telephone number
• Travel information
• Billing information
• Dietary preferences
• Relevant medical information (allergies, mobility limitations, or other conditions necessary for the provision of the service)

Purposes of Processing

What do we use your data for?

Personal data is processed for the following purposes:

• Manage reservations and provide tourism services.
• Coordinate itineraries, transportation, and accommodation.
• Comply with legal obligations before competent authorities.
• Process payments through authorized platforms.
• Send information related to your trip.
• Improve our services and the operation of the website.
• Send commercial information when consent has been granted or a contractual relationship is in force.

Legal Basis for Processing

We process your personal data based on:

• The performance of a contract.
• Compliance with legal obligations.
• The protection of vital interests, especially in situations related to the health or safety of the passenger.
• Our legitimate interest in improving our services and customer experience.
• Your consent, when required by applicable regulations.

Transfer and Disclosure of Data

Do we share personal data?

Yes. Your data may be shared when necessary for the provision of the service with:

• Airlines.
• Hotels.
• Tour guides and tour operators.
• Immigration and administrative authorities.
• Technology providers (Internal systems for reservation, passenger and operations management).
• Payment platforms.
• Public entities such as the SRI or IESS, when required by legal obligation.

In some cases, these third parties may be located outside Ecuador. In such situations, GALAXY adopts reasonable measures necessary to ensure appropriate and secure processing.

Data Retention

How long do we retain your personal data?

Your personal data will be retained for the period strictly necessary to fulfill the purposes for which it was collected, including:

• The provision of the contracted service.
• Compliance with legal and accounting obligations.
• Requirements from competent authorities.

Once these purposes have been fulfilled and the applicable legal retention periods have expired, personal data will be securely deleted or anonymized.

Rights of Data Subjects

What rights do you have regarding your personal data?

As the data subject, you may exercise the following rights:

• Access your personal data.
• Request the correction of inaccurate or incomplete data.
• Request the update of your data.
• Request the deletion of your data when applicable in accordance with the applicable regulations.
• Object to the processing of your data in the cases provided by law.
• Request the portability of your personal data.

Requests to exercise these rights may be sent to: info@galaxycruises.com

We will respond to your request within the timeframes established by the applicable regulations.

Information Security

GALAXY CRUISES adopts reasonable technical and organizational measures to protect personal data against loss, misuse, unauthorized access, or alteration.

Use of Cookies

We use cookies to:

• Improve the user experience.
• Analyze website traffic.
• Personalize content and offers.

You may configure your browser to reject or delete cookies at any time.

Data Protection Officer

GALAXY CRUISES has a Personal Data Protection Officer responsible for overseeing regulatory compliance.

María Belén Cañas

mbcanas@in-legal.com.ec

Policy Updates

GALAXY CRUISES may update this Policy when necessary. The current version will always be available on the website.