Privacy Policy

This Privacy Policy aims to inform users of the Kendair platform, operated depending on the payment method by Travela SARL and Kendair Ltd, about how their personal data is collected, used, protected and retained. Kendair is an online travel agency allowing users to: • Book international flights • Book hotels worldwide • Make payments via Mobile Money Bookings are made without a mandatory account. The user books as a guest and receives all travel documents by email. Travela SARL and Kendair Ltd undertake to ensure the protection and security of personal data in accordance with applicable principles, including the GDPR where it applies.

Traveller: Any person using or considering using Kendair services Travel provider: Airlines, hotels, transport providers Platform: The Kendair website, mobile application and other digital services Payment service: Services for processing financial transactions via Mobile Money or card where available Travel service: Online booking and payment services offered by Kendair

Controllers: Travela SARL for Mobile Money; Kendair Ltd (Company No. 17255610, England and Wales) for card payments where available Product: Kendair Activity: Online flight and hotel booking platform Travela SARL address: 24/26 Avenue de l'Équateur, Blvd 30 Juin, Gombe Commune, Kinshasa, Democratic Republic of Congo Registered office Kendair Ltd: 128 City Road, London EC1V 2NX, United Kingdom Registered email Kendair Ltd: contact@kendair.com Support: bookings@support.kendair.com Telephone: +243 962 933 656 Kendair acts as an intermediary between travellers and travel service providers (airlines, hotels, etc.).

4.1 Personal information For each booking, we collect: • First and last name • Email address • Telephone number • Date of birth • Nationality • Passport information (if required for an international flight) 4.2 Booking information • Destination and travel dates • Flight and hotel information • Number of passengers • Booking history 4.3 Payment information Mobile Money telephone number, transaction identifier and payment history. Payment data is processed by secure third-party providers. Kendair does not directly store sensitive payment information. 4.4 Data concerning other people When you make a booking for other people, you are responsible for informing them that their data is communicated to Kendair. 4.5 Information collected automatically IP address, device used, browser, browsing data and visit duration. This information may be collected through cookies.

• Performance of a contract: booking flights or hotels • User consent: marketing communications • Legal obligation: retention of accounting or tax data • Legitimate interest: fraud prevention, service improvement

Personal data is used to: • Process flight and hotel bookings • Transmit information to partners (airlines, hotels) • Process payments through partner providers • Provide customer service and send confirmations and travel documents • Prevent fraud • Improve our services • Comply with legal obligations Users' personal data is not used to train third-party artificial intelligence models, nor sold to third parties for commercial purposes.

Your data may be shared with: • Travel service providers: airlines, hotels, partner agencies • Technical processors: hosting providers, Mobile Money payment providers, analytics tools • Companies affiliated with Travela SARL and Kendair Ltd • Public authorities: where required by law These processors process data only according to the instructions of Travela SARL or Kendair Ltd, depending on the entity responsible for the transaction.

Personal data may be transferred to countries outside the user's country of residence to make a booking with a foreign hotel or airline. Appropriate protection measures are put in place: standard contractual clauses, ISO/IEC 27001-certified hosting providers.

Data type — Retention period Booking data — 5 years after the end of the trip Payment data — 10 years (tax obligations) Marketing data — 3 years after the last contact Technical data (cookies, logs) — 13 months maximum

Travela SARL and Kendair Ltd implement technical and organisational measures: • Encryption of sensitive data (AES-256) • Secure transmission using the HTTPS/TLS protocol • Limited and restricted access for authorised employees • Information security systems and fraud monitoring • Regular security audits

11.1 Consent management During your first visit to the platform, a consent banner is displayed. You may accept, refuse or customise cookie categories at any time. 11.2 Types of cookies used • Essential cookies: necessary for the platform to operate • Analytics cookies: to analyse use of the site • Preference cookies: to remember your choices • Advertising cookies: to personalise content (with your consent)

With your consent, Kendair may send travel offers and promotions. Each communication contains an immediate unsubscribe link, effective within a maximum period of 48 hours. You may also unsubscribe at any time by contacting bookings@support.kendair.com.

Kendair may use automated processes to improve travel recommendations and detect fraudulent behaviour, based solely on platform data. Users' data is not transmitted to third-party artificial intelligence systems.

To protect users and the platform, Kendair may analyse certain data to detect fraudulent transactions, prevent abuse and secure payments.

Users have the following rights: • Right of access to data • Right to rectification of inaccurate data • Right to erasure (right to be forgotten) • Right to restriction of processing • Right to object to processing • Right to data portability To exercise these rights, contact: bookings@support.kendair.com Users in the DRC may contact the competent national data protection authority. European users may contact the CNIL or the local authority in their country.

In the event of a data breach likely to create a risk for users, the entity responsible for the transaction will notify the competent authorities and affected users within 72 hours, in accordance with applicable legal obligations.

Even in the absence of a current booking, Kendair may send administrative communications such as security alerts or important information concerning your account.

Travela SARL and Kendair Ltd may amend this policy to reflect legal, technological or service-related changes. The updated version will be published on the platform and users will be notified of substantial changes.

Support: bookings@support.kendair.com Registered email Kendair Ltd: contact@kendair.com Telephone: +243 962 933 656 Travela SARL address: 24/26 Avenue de l'Équateur, Blvd 30 Juin, Gombe Commune, Kinshasa, Democratic Republic of Congo Registered office Kendair Ltd: 128 City Road, London EC1V 2NX, United Kingdom