Privacy Policy — World of Blue Effective date: August 4, 2026 World of Blue Hospitality LLC ("we," "us," "our") operates the World of Blue mobile application (the "App"). This policy explains what we collect, how we use it, and the choices you have. We follow GDPR, CCPA, and Apple's App Store privacy requirements as they apply. 1. Who we are World of Blue Hospitality LLC 2 Meadowlands Plaza, East Rutherford, NJ 07073, USA Phone: +1 (201) 896-0500 Email: privacy@theworldofblue.com 2. Information we collect Information you give us when you use the App: - Name, email, phone number (account) - Reservation and event details (rooms, dates, guests, payment status) - Service requests (housekeeping, amenities, wake-up calls, dining orders) - Messages you send to the front desk - Optional preferences (pillow type, room temperature, dietary, accessibility, special requests) - Survey responses and ratings Information collected automatically: - Network, device, and app information, such as IP address, device type, OS version, and app version - Product interaction analytics about screens visited, feature use, outcomes, and failure categories. After sign-in, these analytics are associated with your account identifier. Information from hotel systems and service providers: - Reservation data from our property management system (StayNTouch) Hosted online check-in: When available and you choose online check-in, StayNTouch's hosted check-in experience may collect identity documents, contact details, arrival details, and payment information that StayNTouch requires to verify identity, determine check-in eligibility, handle payment or a deposit, and operate your stay. The App opens that hosted experience and does not receive or store identity-document images or full payment card numbers submitted there. Earlier in-app check-in: Earlier versions of the App offered an in-app check-in flow. If you used that flow, the App collected identity, arrival, and preference information and an identity-document image when you chose to upload one. We used AWS Textract to extract identity information from the image, and optional payment-method setup used Stripe. We retained only limited card details returned by Stripe, such as the card brand and last four digits; we did not store full payment-card numbers. Historical check-in submissions and identity-document images may remain in access-controlled cloud systems. We do not sell your personal information. We do not trade your data for advertising. We do not use your data to train external advertising networks. 3. How we use your information - To provide the services you request (room access, dining, concierge, event tools, transportation) - To respond to your messages and resolve service issues - To process payments and folio charges - To send you transactional notifications (your room is ready; your shuttle leaves in 15 min) - To send you marketing about World of Blue events, offers, and stays — only with your opt-in consent. You can withdraw consent any time. - To operate and improve the App using product interaction analytics associated with your account identifier after sign-in - To meet our legal obligations (tax, regulatory, fraud prevention) These analytics are not used to track you across other companies' apps or websites. 4. Sharing your information We share your information only with: - Our property management and hosted check-in provider (StayNTouch) and event-management software (Amadeus Delphi) to deliver your stay and event - Service providers used for the earlier in-app check-in flow: AWS Textract processed identity-document images to extract identity information, and Stripe handled optional payment-method setup - Service providers under written contract (email delivery, SMS delivery, cloud hosting, and product analytics, including PostHog) that are bound to use your data only to provide services to us - Law enforcement or regulators when legally required We do not sell, rent, or share your information for cross-context behavioral advertising. 5. Your rights Wherever you live, you can: - Access the information we hold about you - Correct or delete it - Withdraw marketing consent - Export your data in a portable format - Object to processing for marketing purposes If you live in the European Union, the United Kingdom, or California, you have additional rights under GDPR and CCPA. To exercise any right, email privacy@theworldofblue.com. We respond within 30 days. You can request deletion of your core App account at any time from Settings → Delete account, or by emailing the address above. Deletion of the core App account is separate from deletion of hotel reservation and folio records, legacy check-in submissions and identity-document images, and records maintained by StayNTouch, Stripe, or other providers; it does not automatically delete those records or send deletion requests to those providers. Contact us if you also want us to evaluate deletion of those records. We will honor applicable deletion rights subject to lawful retention requirements. 6. Security and retention We use technical and organizational safeguards, including access controls and encryption in transit, to protect information handled by the App. The App does not receive or store identity-document images or full payment card numbers submitted through StayNTouch's hosted check-in experience. We may retain some App, hotel, and legacy check-in records for legitimate operational or legal reasons, including providing hotel services, preventing fraud, resolving disputes, and meeting accounting, tax, regulatory, and other legal obligations. Retention periods vary by record and applicable requirements. Marketing-only data is retained until you withdraw consent. 7. Children's privacy The App is intended for users 16 years and older. We do not knowingly collect information from children under 16. If you believe a child has shared information with us, contact us and we will delete it. 8. International transfers Our servers and providers are primarily based in the United States. If you use the App from another region, your data will be transferred to the U.S. We use standard contractual clauses where required. 9. Changes to this policy We will notify you of material changes through the App and via email. The current version always lives on the in-app Privacy screen and at the hosted URL referenced from our app-store listings. 10. Contact privacy@theworldofblue.com World of Blue Hospitality LLC 2 Meadowlands Plaza, East Rutherford, NJ 07073, USA