This Privacy Policy explains how Bilemon Hospitality Services & Technology, S.L. collects, uses, stores and protects personal data. Data Controller Bilemon Hospitality Services & Technology, S.L. Tax Identification Number: B56924483 Registered office: Av. Diagonal 106, 08005 Barcelona, Spain Email: support@bilemon.com Website: www.bilemon.com Bilemon is a financial intelligence and profitability platform designed for vacation rental property managers, agencies and short-term rental companies.

This Privacy Policy applies to personal data processed through: The Bilemon corporate website. The Bilemon software platform and customer accounts. Contact, demo and information request forms. Email, telephone and customer support communications. Training sessions, webinars and events. Commercial and professional relationships. Recruitment and job application processes. PMS, financial, banking and third-party integrations activated by customers. A separate Cookie Policy explains the technologies used to store or access information on users’ devices.

Depending on the circumstances, Bilemon may act as either a data controller or a data processor. Bilemon as Data Controller Bilemon acts as a data controller when it determines why and how personal data is processed, including when managing: Website visitors. Demo and contact requests. Customer accounts and contracts. Billing and administration. Marketing communications. Training and event registrations. Suppliers and professional partners. Job applications. Website security and analytics. Bilemon as Data Processor Bilemon normally acts as a data processor when a customer uploads, connects or otherwise makes personal data available through the platform. This may include information relating to: Property owners. Guests and booking contacts. Employees and operational teams. Suppliers and service providers. Property portfolios. Reservations and transactions. PMS records. Revenue, expenses and cost allocations. Bank account identifiers and transaction information provided through authorized integrations. In these cases, the Bilemon customer remains responsible for determining the purposes and lawful basis of the processing. Bilemon processes the data according to the customer’s documented instructions and the applicable Data Processing Agreement.

Depending on the relationship with Bilemon, we may process the following categories of personal data. Identification and contact information Name, surname, job title, company, professional email address, telephone number, country and preferred language. Account information Username, customer organization, permissions, user role, account settings and authentication information. Commercial and contractual information Demo requests, proposals, contracts, services purchased, communications, support requests and customer relationship history. Billing and financial information Company billing details, tax identification numbers, invoices, payment status and transaction records. Bilemon does not intentionally request full payment card credentials through ordinary website forms. Technical and usage information IP address, browser type, device information, access dates, activity logs, session information, errors and platform usage data. Recruitment information Curriculum vitae, professional experience, education, skills, contact details and other information voluntarily provided during a recruitment process. Customer platform data Customers may connect or upload booking, property, owner, cost, revenue, PMS, supplier and financial data. The exact categories depend on how each customer configures and uses Bilemon. Please do not provide special-category personal data unless it is strictly necessary, lawfully processed and expressly agreed with Bilemon.

Responding to enquiries and demo requests Steps taken before entering into a contract, consent or legitimate interest Creating and managing customer accounts Performance of a contract Providing the Bilemon platform and services Performance of a contract Customer onboarding, support and training Performance of a contract Invoicing, accounting and tax compliance Contractual and legal obligations Improving services and correcting technical problems Legitimate interest in improving and securing the service Preventing fraud, misuse and security incidents Legitimate interest and legal obligations Sending newsletters and commercial information Consent or an existing business relationship where permitted by law Managing webinars, events and training registrations Consent or performance of the requested service Managing job applications Consent and steps taken at the candidate’s request Establishing, exercising or defending legal claims Legitimate interest and legal obligations Analytics and non-essential cookies Consent obtained through the cookie management system Where processing is based on consent, consent may be withdrawn at any time without affecting processing carried out before its withdrawal. Providing certain information is necessary to enter into a contract, create an account or provide the requested service. If the required information is not provided, Bilemon may be unable to complete the request or provide the service.

Bilemon may send information about its platform, services, training, financial resources, Industry Insights and related professional content. Marketing communications will be sent: With the recipient’s consent. Within an existing customer relationship, where legally permitted. Based on another valid legal basis permitted by applicable law. Every electronic marketing communication will provide a clear way to unsubscribe. Bilemon may retain minimal information on a suppression list after an unsubscribe request to ensure that no further marketing communications are sent.

Bilemon may receive information from third-party services selected or authorized by its customers, including: Property management systems. Booking platforms. Banking and financial data providers. Accounting systems. Payment providers. Customer relationship management tools. Communication and support platforms. Customers are responsible for ensuring that they have the necessary legal basis and permissions to connect these systems and make personal data available to Bilemon. The use of third-party services may also be governed by the privacy terms of those providers.

Bilemon does not sell personal data. Personal data may be accessed by service providers that support the operation of the website, platform and business, including providers of: Cloud hosting and data storage. Software infrastructure. Customer support and communication tools. Email and CRM services. Website analytics. Scheduling and video-conferencing services. Accounting and invoicing. Cybersecurity and monitoring. PMS, banking and data integrations. Legal, tax and professional advice. These providers may process personal data only to provide their contracted services and must comply with appropriate confidentiality, security and data protection obligations. Information may also be disclosed: When required by law. In response to a lawful request from a public authority. To establish, exercise or defend legal claims. In connection with a merger, restructuring, acquisition or transfer of business, subject to appropriate safeguards.

Some technology providers may process personal data outside the European Economic Area. Where an international transfer takes place, Bilemon will use an appropriate legal mechanism, such as: An adequacy decision adopted by the European Commission. European Commission Standard Contractual Clauses. Another valid safeguard recognized under applicable data protection law. Additional technical, contractual or organizational measures may be implemented where necessary. EU data protection requirements continue to apply when personal data is transferred outside the European Economic Area, and Standard Contractual Clauses may be used to provide appropriate safeguards.

ersonal data will be kept only for as long as necessary for the purpose for which it was collected. The following general criteria apply: Customer and account information is retained throughout the contractual relationship and subsequently for applicable legal limitation periods. Billing, tax and accounting records are retained for the periods required by applicable law. Contact and demo requests are retained for the time required to respond and follow up on the request. Marketing information is retained until consent is withdrawn or the recipient objects. Recruitment information is retained for a maximum of 12 months, unless the candidate consents to a longer period or a different legal obligation applies. Security and activity logs are retained for a limited period proportionate to security, audit and fraud-prevention requirements. Customer platform data is retained during the customer relationship and is returned or deleted according to the contract and Data Processing Agreement. Data may be blocked and retained for longer when necessary to comply with legal obligations or defend legal claims. Residual copies may remain temporarily in secure backup systems until they are overwritten in accordance with Bilemon’s backup cycle.

Bilemon applies appropriate technical and organizational measures designed to protect personal data against: Unauthorized access. Accidental or unlawful destruction. Loss or alteration. Unauthorized disclosure. Misuse. Security incidents. Measures may include access controls, role-based permissions, authentication procedures, encryption where appropriate, backups, activity logging, supplier assessment and staff confidentiality obligations. No online system can guarantee absolute security. Users and customers are responsible for protecting their passwords, devices and account credentials and for notifying Bilemon of any suspected unauthorized access.

Depending on the circumstances, individuals may exercise the following rights: Access, to obtain confirmation of whether their personal data is being processed. Rectification, to correct inaccurate or incomplete information. Erasure, to request deletion when the data is no longer required or another legal condition applies. Restriction, to request that processing be limited in certain circumstances. Objection, particularly where processing is based on legitimate interest or relates to direct marketing. Portability, to receive certain data in a structured, commonly used and machine-readable format. Withdrawal of consent, at any time where processing is based on consent. Protection from solely automated decisions, where such decisions produce legal or similarly significant effects. These rights are recognized under the GDPR and Spanish data protection law. Requests may be sent to: support@bilemon.com Subject: Data Protection Request Bilemon may request reasonable information to verify the identity of the applicant. When Bilemon processes personal data solely on behalf of a customer, the request may need to be addressed to that customer as the data controller. Bilemon will provide reasonable assistance in accordance with its contractual and legal obligations. Individuals also have the right to lodge a complaint with the: Spanish Data Protection Agency, Agencia Española de Protección de Datos, AEPD Before submitting a complaint, individuals are encouraged to contact Bilemon so that the matter can be reviewed and resolved.

Bilemon uses technical cookies required for the website and platform to function. Subject to the user’s consent, Bilemon may also use preference, analytics or marketing cookies. Non-essential cookies will not be activated until the user has provided valid consent through the cookie management tool, where required by law. Users may accept, reject or modify their cookie preferences at any time. More information should be provided in the separate Cookie Policy.

Unless expressly stated in a specific service notice, Bilemon does not make decisions producing legal or similarly significant effects based solely on automated processing. The platform may calculate indicators, categorize data, identify financial patterns or generate business information. These outputs are designed to support professional analysis and decision-making and should be reviewed by authorized users.

Bilemon’s website and services are intended for businesses and professionals and are not directed at children. Bilemon does not knowingly collect personal data directly from children through its website or commercial services. If such information is identified, it will be reviewed and deleted where appropriate.

The website may contain links to external websites, booking systems, scheduling tools, social networks or other third-party services. Bilemon is not responsible for the privacy practices of those independent third parties. Users should review their privacy policies before providing personal information.

Bilemon may update this Privacy Policy to reflect: Changes in its services. New integrations or providers. Legal or regulatory developments. Changes in its data-processing activities. Security or operational improvements. The updated version will be published on the website with a revised “Last updated” date. Where changes are material, additional notice may be provided to affected customers or users.

Questions, requests or complaints concerning this Privacy Policy or the processing of personal data may be sent to: Bilemon Hospitality Services & Technology, S.L. Av. Diagonal 106, 08005 Barcelona, Spain Email: support@bilemon.com Subject: Data Protection