1. INTRODUCTION

ITT, Turistične agencije, Marija Šepetavc Turković, s.p. ("ITT Travel", "SLS Travel", "GoExclusive Club", "we", "our", or "us") is committed to protecting the privacy, confidentiality, and security of personal data. This Privacy Policy explains how we collect, use, process, store, disclose, transfer, and protect personal data obtained through our websites, booking systems, membership platforms, travel services, communications, applications, and business activities. We process personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
• Slovenian Personal Data Protection Act (ZVOP-2)
• Slovenian tourism legislation
• Slovenian accounting and tax legislation
• Applicable European Union legislation
• Other applicable national laws and regulations.

By accessing our websites, using our services, registering as a member, making a booking, submitting an enquiry, or otherwise interacting with us, you acknowledge that your personal data may be processed in accordance with this Privacy Policy.

2. WHO WE ARE

ITT, Turistične agencije, Marija Šepetavc Turković, s.p. is a travel company registered in the Republic of Slovenia. The company operates under the brands:

• SLS Travel
• GoExclusive Club
• ITT Travel Agency

and provides:

• Tailor-made journeys
• Package travel arrangements
• Luxury travel experiences
• Group travel
• Educational travel
• School trips
• Erasmus programmes
• Incentive travel (MICE)
• Corporate travel
• Yacht charters
• Cruises
• Accommodation reservations
• Transfers and transportation services
• Destination Management Company (DMC) services
• Travel consulting
• Event organisation
• Membership services

3. SCOPE OF APPLICATION

This Privacy Policy applies to:

• www.sls.travel
• www.goexclusive.club
• www.itt-travelagency.com

and any future:

• Mobile applications
• Customer portals
• Booking engines
• Membership platforms
• Reservation systems
• Digital products
• Online services

operated by us.

4. DATA CONTROLLER

ITT, Turistična agencije, Marija Šepetavc Turković, s.p. Trg komandanta Staneta 8 1000 Ljubljana Slovenia Tax Number (DŠ): 46401962 Email: marija@itt-travelagency.com

5. CATEGORIES OF PERSONAL DATA WE COLLECT

5.1 Information You Provide Directly

We may collect:

• Full name
• Date of birth
• Gender
• Nationality
• Residential address
• Email address
• Telephone number
• Passport information
• Identity document details
• Visa information
• Emergency contact details
• Billing information
• Payment information
• Travel preferences
• Membership information
• Communication preferences
• Customer service requests
• Correspondence records

5.2 Information Collected Automatically

When you visit our websites, we may automatically collect:

• IP address
• Browser type
• Device information
• Operating system
• Referral source
• Website activity
• Session information
• Cookie identifiers
• Language preferences
• Usage statistics

5.3 Information Obtained From Third Parties

We may receive information from:

• Travel agencies
• Tour operators
• Hotels
• Airlines
• Cruise companies
• Transportation providers
• Educational institutions
• Corporate clients
• Event organisers
• Business partners
• Parents or legal guardians
• Publicly available sources
• Social media platforms

6. SPECIAL CATEGORIES OF PERSONAL DATA

Where necessary for the provision of travel services, we may process:

• Medical conditions
• Disabilities
• Mobility assistance requirements
• Dietary requirements
• Allergy information
• Pregnancy-related travel information
• Accessibility requirements

Such information is processed only:

• With your explicit consent
• To protect your vital interests
• Where legally required
• Or where otherwise permitted under applicable law.

You may withdraw consent at any time; however, withdrawal may affect our ability to provide certain requested services.

7. PURPOSES OF PROCESSING

Personal data may be processed for:

• Travel reservations
• Accommodation bookings
• Transportation arrangements
• Cruise bookings
• Yacht charter arrangements
• Membership administration
• Customer account management
• Customer support
• Processing payments
• Issuing invoices
• Fraud prevention
• Security monitoring
• Marketing communications
• Website administration
• Event management
• Educational travel administration
• Corporate travel services
• Compliance with legal obligations
• Internal reporting and business management

8. LEGAL BASIS FOR PROCESSING

We process personal data based on:

• Performance of a contract
• Compliance with legal obligations
• Legitimate interests
• Consent
• Protection of vital interests
• Public interest obligations where applicable.

9. TRAVEL SERVICES AND RESERVATIONS

To provide travel-related services, we may process personal data required for:

• Travel reservations
• Airline tickets
• Hotel bookings
• Cruises
• Yacht charters
• Transfers
• Travel insurance arrangements
• Visa assistance
• Group travel management
• Educational travel
• Erasmus programmes
• Emergency support services

Providing accurate personal data is essential for completing reservations and travel arrangements. Failure to provide required information may prevent the issuance of tickets, vouchers, insurance policies, visas, accommodation confirmations, or other travel services.

10. GOEXCLUSIVE CLUB MEMBERSHIP

When registering as a member of GoExclusive Club, we may process:

• Membership information
• Travel interests
• Destination preferences
• Wishlist information
• Saved experiences
• Loyalty information
• Communication preferences
• Booking history

This information is used to personalise member services, recommendations, and customer experience.

10.1 BUSINESS PARTNER DATA

We may process personal data relating to:

• Travel agencies
• Hotels
• DMC partners
• Tourism suppliers
• Corporate representatives
• Service providers
• Contractors
• Business contacts

for the purpose of establishing, maintaining, and managing commercial relationships.

10.2 AUTOMATED DECISION-MAKING AND PROFILING

We may use travel preferences, booking history, destination interests, membership information, and website interactions to personalise communications, recommendations, and offers. However, we do not use solely automated decision-making processes that produce legal effects or similarly significant consequences without human involvement.

11. ACCOUNT DELETION

Members may request deletion of their account by contacting: marija@itt-travelagency.com Certain information may continue to be retained where required by:

• Accounting legislation
• Tax legislation
• Fraud prevention obligations
• Contractual obligations
• Regulatory requirements
• Legitimate business interests

12. MARKETING COMMUNICATIONS

Where consent has been provided or where otherwise permitted by law, we may send:

• Newsletters
• Travel offers
• Event invitations
• Membership updates
• Destination information
• Promotional campaigns

You may unsubscribe at any time. Every marketing communication contains an unsubscribe mechanism.

13. PHOTOGRAPHY, VIDEO, AND PROMOTIONAL CONTENT

During tours, cruises, educational programs, school trips, Erasmus programs, incentive travel, yacht charters, events, and other travel experiences organized by ITT, Turistične agencije, Marija Šepetavc Turković, s.p., photographs, video recordings, and other promotional materials may be created for marketing, promotional, editorial, educational, and business purposes. By making a reservation, participating in a travel program, or accepting our General Terms and Conditions, travellers acknowledge and agree that photographs and video recordings may be taken during the course of the travel service and may be used by ITT Travel, SLS Travel, and GoExclusive Club in connection with their business activities. Such materials may be published through:

• Company websites
• Social media platforms
• Newsletters
• Promotional brochures
• Presentations
• Marketing campaigns
• Printed materials
• Digital publications
• Trade fairs and industry events
• Other business and promotional channels.

Individuals who do not wish to appear in photographs or video recordings used for promotional purposes must notify us in writing prior to the commencement of the travel service, event, or program. Upon receipt of such written notification, we will make reasonable efforts to respect the request and avoid the use of identifiable images where reasonably possible. This provision shall be read together with our General Terms and Conditions and forms part of the contractual relationship between the traveller and ITT, Turistične agencije, Marija Šepetavc Turković, s.p.

14. SHARING OF PERSONAL DATA

14.1 Travel Suppliers

We may share personal data with:

• Hotels
• Airlines
• Cruise companies
• Yacht operators
• Transportation providers
• Tour guides
• DMC partners
• Insurance providers
• Visa service providers

Certain suppliers may act as independent data controllers and process personal data in accordance with their own privacy policies.

14.2 Technology Providers

We may engage:

• Hosting providers
• CRM systems
• Reservation systems
• Booking engines
• Email service providers
• Cloud storage providers
• Payment processors

14.3 Public Authorities

We may disclose personal data to:

• Immigration authorities
• Border authorities
• Customs authorities
• Courts
• Law enforcement agencies
• Regulatory authorities

where legally required.

15. INTERNATIONAL TRANSFERS AND THIRD COUNTRIES

As an international travel company, we may transfer personal data to suppliers, partners, and service providers located both within and outside the European Economic Area (EEA). Such transfers may involve countries classified as third countries under applicable data protection legislation. Where personal data is transferred to countries that do not benefit from an adequacy decision issued by the European Commission, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs)
• Adequacy Decisions
• Approved transfer mechanisms
• Explicit consent where necessary
• Other legally recognised safeguards.

16. COOKIES AND TRACKING TECHNOLOGIES

Our websites may use cookies and similar technologies for:

• Website functionality
• Security
• Analytics
• Performance monitoring
• Personalisation
• Marketing activities.

Further information is available in our Cookie Policy.

17. ANALYTICS AND THIRD-PARTY SERVICES

We may use:

• Google Analytics
• Google Maps
• Google Ads
• Meta Pixel
• LinkedIn Insight Tag
• YouTube
• External booking systems
• Reservation engines
• Payment gateways.

Such providers may process information in accordance with their own privacy policies.

18. SOCIAL MEDIA

We maintain profiles on:

• Facebook
• Instagram
• LinkedIn
• YouTube
• WhatsApp Business
• Other social media platforms.

Interactions with these services are governed by the privacy policies of the relevant platform providers.

19. DATA RETENTION

Personal data is retained only for as long as necessary for the purposes for which it was collected. Certain records may be retained longer where required by law. Examples include:

• Accounting records
• Tax records
• Invoices
• Contracts
• Reservation documentation
• Customer correspondence.

Such records may be retained for up to ten (10) years or longer where required by applicable legislation.

20. SECURITY MEASURES

We implement appropriate technical and organisational measures including:

• SSL/TLS encryption
• Secure hosting environments
• Access controls
• Password protection
• Employee confidentiality obligations
• Security monitoring
• Data minimisation practices.

Although we take reasonable steps to protect personal data, no system can guarantee absolute security.

21. PERSONAL DATA BREACH MANAGEMENT

In the event of a personal data breach, we will take appropriate measures in accordance with GDPR and applicable laws. Where required, we will notify:

• The competent supervisory authority; and/or
• Affected individuals

without undue delay and within legally prescribed deadlines.

22. CHILDREN'S PRIVACY

We may process children's personal data where necessary for:

• School trips
• Educational travel
• Erasmus programmes
• Youth travel
• Family travel.

Such processing is carried out only with appropriate authorisation from parents, legal guardians, schools, or responsible organisations.

23. YOUR RIGHTS UNDER GDPR

You have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent
• Lodge a complaint.

24. RESPONSE TIME FOR REQUESTS

We will respond to valid requests without undue delay and, in any event, within one month of receipt. Where requests are particularly complex or numerous, this period may be extended by up to two additional months as permitted by GDPR.

25. SUPERVISORY AUTHORITY

If you believe your personal data has been processed unlawfully, you may lodge a complaint with: Information Commissioner of the Republic of Slovenia Dunajska cesta 22 1000 Ljubljana Slovenia Website: www.ip-rs.si We encourage individuals to contact us first so that we may attempt to resolve concerns directly.

26. CHANGES TO THIS PRIVACY POLICY

We reserve the right to amend this Privacy Policy from time to time. The latest version will always be published on our websites. Changes become effective upon publication unless otherwise stated.

27. CONTACT INFORMATION

ITT, Turistične agencije, Marija Šepetavc Turković, s.p. Trg komandanta Staneta 8 1000 Ljubljana Slovenia Email: marija@itt-travelagency.com Websites: www.sls.travel www.goexclusive.club www.itt-travelagency.com For privacy-related enquiries, please use the subject line: "Privacy Request" or "GDPR Request"