Danube Voyage Privacy Policy — Boutique Wellness & Medical Travel Concierge Data Controller (Operator): Danube Voyage L.L.C-FZ Meydan Free Zone (Meydan FZ), Dubai, United Arab Emirates Last updated / Effective date: 16 January 2026 Danube Voyage L.L.C-FZ (“Danube Voyage”, “we”, “us”) respects your privacy. This Privacy Policy explains what personal data we collect, why and how we use it, when we may share it, and what rights you have. Important medical note: Danube Voyage is not a medical provider. We do not provide medical services, diagnosis, treatment, prescriptions, or medical advice. We provide travel coordination and concierge services and liaise with independent licensed providers (clinics, physicians, wellness centers, etc.). 1) Data Controller and contact Danube Voyage L.L.C-FZ Meydan Free Zone (Meydan FZ), Dubai, United Arab Emirates Privacy contact email: info@danubevoyage.com 2) What data we collect We may collect the following categories of data: 2.1. Data you provide directly Contact details: name, phone, email, messenger handle, country/city of residence. Request/trip details: intended dates, budget, preferences, request for a clinic/program/format. Communications: message content, communication history, call recordings (where applicable and lawful). Health data (sensitive data): only if you voluntarily provide it for selection/coordination purposes (e.g., symptoms, goals, limitations, diagnoses/tests, medications). 2.2. Technical data IP address, device/browser type, language, pages viewed and time spent, referral source. Cookies and analytics identifiers (if enabled). 3) Sources of data Directly from you: website, forms, email, WhatsApp/Telegram, phone calls. From partner providers: only within coordination and only when necessary (e.g., appointment/booking confirmation). 4) Purposes and legal bases We process personal data to: respond to your inquiry and communicate with you; coordinate your trip and concierge tasks (logistics, scheduling, bookings, service support); share the minimum necessary data with the providers you choose/confirm so they can deliver their services; protect website security and prevent abuse; comply with applicable legal requirements and protect rights/claims; analyze website performance and improve the service (if analytics tools are enabled). Legal bases: your consent (including for sensitive data), performance of actions at your request / contractual steps, legitimate interests (security, fraud prevention, service improvement), and legal obligations. 5) Explicit consent for health data (sensitive data) If you provide health-related information or other sensitive data, you provide explicit consent for Danube Voyage to process it strictly for coordinating your request/trip and liaising with the independent providers you choose. You may withdraw consent by emailing info@danubevoyage.com . Withdrawal may make further coordination impossible if the service cannot be provided properly without such data. 6) Who we share data with We do not sell personal data and do not share it for third parties’ independent marketing. We may share data only to the extent necessary for the purposes above: 6.1. Independent providers (third parties) clinics, physicians, wellness centers, hotels, carriers, insurers, and other providers you select/confirm for your trip. Important: such providers typically become independent data controllers for your data and process it under their own policies and rules. 6.2. Processors (technical and operational) hosting/servers, CDN, monitoring, log systems; analytics tools (if enabled); communications tools (email service providers, etc.). 7) International data transfers Danube Voyage is based in the UAE. When coordinating trips and using technical vendors, data may be processed/transferred to other countries. We carry out such transfers only when necessary for the purposes of processing and with consideration of applicable UAE personal data requirements. 8) Data retention We retain data: inquiries and communications: up to 24 months after the last interaction to complete requests and protect rights/claims; longer only where required by law or necessary to protect rights (disputes, claims, compliance); after retention periods, data is deleted or anonymized. 9) Security We apply reasonable technical and organizational measures to protect data from unauthorized access, loss, and unlawful processing (access controls, encrypted channels, logging, permission limits). 10) Cookies and analytics The website may use cookies: strictly necessary cookies for website functionality; analytics cookies (if enabled). You can restrict cookies in your browser settings. Disabling certain cookies may affect website functionality. 11) Children The website and services are not intended for individuals under 18. We do not knowingly collect children’s data. If such data is identified, it will be deleted within a reasonable time. 12) Your rights Subject to applicable law, you may request: access, correction, deletion; restriction of processing, cessation of processing in certain cases; information about processing and data portability where applicable. Requests should be sent to info@danubevoyage.com . 13) Changes to this Policy We may update this Policy. The new version becomes effective as of the date it is published on the website. APPENDIX A — TECHNICAL PROVIDER (WEZAYND) / DATA PROCESSOR Role WEZAYND L.L.C-FZ acts solely as a Data Processor on behalf of Danube Voyage L.L.C-FZ and processes data only for technical enablement of the website/publishing/hosting/logging/monitoring/page automation and related functions, under the Controller’s documented instructions. Sub-processors WEZAYND may engage sub-processors (hosting, CDN, monitoring, analytics) solely for technical service delivery. No independent use WEZAYND does not use lead/inquiry data for its own marketing purposes and does not sell data. Cross-border processing Data may be processed in countries where technical vendors operate. Such processing/transfers are handled with consideration of applicable UAE personal data requirements. Processor details WEZAYND L.L.C-FZ (License 2539310.01, Formation 2539310) Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.