We at Kiwi.com take your privacy very seriously. Currently, we comply with the Regulation No. 2016/679, the General Data Protection Regulation, also known as GDPR , which sets the highest privacy and data protection standard in the world. In this Privacy Policy we explain what data we collect from you, why we collect it, how we use it and with whom we might share it. It also explains what rights you as a data subject have and how you can fulfill them. This Privacy Policy applies to any data processing done by us in connection to the use of our services, both through our website www.kiwi.com and through our mobile applications for iOS and Android. Some terms that we use in this Privacy Policy What Personal Data do we collect? For what purposes do we use your Personal Data? Who do we share your Personal Data with and why? Protecting your personal data How long do we store your Personal Data? How to access and control your Personal Data? Cookies & Similar technology Transferring your data outside of the European Economic Area Complaint with the supervisory authority Contacting us and exercising your rights Specifics for residents of selected countries Data Protection Officer Changes to this Privacy Policy We, as the Data Controller, are the company Kiwi.com s.r.o. , with a registered office at Rohanské nábřeží 678/25, 186 00, Prague 8-Karlín, Czech Republic, Company ID No.: 29352886, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 387231, Tax ID No. CZ29352886. Some terms that we use in this Privacy Policy Personal Data: any information relating to a directly or indirectly identified or identifiable natural person. That means that if we possess means to identify either you or even the device you’re using, any information that we can connect to you will be treated as Personal Data. Data Controller: someone that determines the purposes and means of processing Personal Data. For example, we are a Data Controller when we process your Personal Data for the purposes stated in this Privacy Policy.If you choose to book a ticket through our website or app, we will be sending your Personal Data to another Data Controller – the carrier or the provider of other services – who will again use your Personal Data for its own purposes. Each Data Controller should have a Privacy Policy such as this one where you can learn about how your Personal Data is processed. You can see the overview of Data Controllers with whom we might share the data below. Data Processor: a third party that only helps to achieve the purposes determined by the Data Controller. For example, we as a Data Controller use many third-party services to which we outsource some parts of our activities that we don’t do ourselves for various reasons such as cost-efficiency. A Data Processor is only allowed to process your Personal Data according to our documented instructions. Third Countries: countries in which the GDPR regime is not applicable. Currently, by Third Countries, we mean all countries that lie outside of the European Economic Area. What Personal Data do we collect? We collect your Personal Data directly from you, either when you provide us your Personal Data or gather them by ourselves when you use our services or you are in touch with us. Depending on the processing purpose, we may process the following categories of Personal Data: For what purposes do we use your Personal Data? Whenever you access our website or app, we process your Personal Data for the purposes defined below: When you order any of our services, we will continue to process your Personal Data for the purposes explained above. The scope of the processed Personal Data for these purposes will, however, also include the Information about your Booking(s) and Information about your requests and your communication with us. Besides this, we will process your Personal Data for the following purposes: If someone orders a service from Kiwi.com for you (for example, books a flight ticket with your name), we will process your Personal Data, even if you’re not a direct customer. Your Personal Data will be processed for the following purposes: Who do we share your Personal Data with and why? Sharing data with other Data Controllers In some cases, we will share your Personal Data with third parties for their purposes. For example, we send your data to the carriers with which you, through our brokerage services, enter into a contract of carriage and whose identity will be made known to you before you enter into the agreement with us or with a provider of other services under the same conditions. In some cases, we also share your Personal Data with the operators ticket marketplaces, such as the Global Distribution Systems. This means that your Personal Data may be disclosed to selected carriers or providers of other services in Third Countries. You can learn more about transferring your data to Third Countries here . Each selected carrier and provider of other services will treat your Personal Data in accordance with their own Privacy Policy (which is published on every carrier’s website). Disclosure of Personal Data to all service providers will be done in accordance with the applicable Personal Data laws and regulations. If you give us your consent through our cookie settings, we will share some of your data with our partners for marketing purposes. We also share certain data with Google Ireland Limited, as a provider of advertising and analytics services. Google Ireland Limited may process this data for the purposes of advertising personalization and measuring advertising effectiveness. For more information on how Google Ireland Limited processes personal data, please visit Google’s Privacy & Security Center. Sharing Data with Data Processors There are many activities that we need completed but can’t do by ourselves. Therefore, we use third-party partners to help us. In many such situations, the partners logically couldn’t manage without your Personal Data. Because of this, we share it with them. However, in all cases like this, we remain controllers of your Personal Data and they act as processors. That means that even though they are in possession of your data, they can only process it for our purposes and we are always in charge of it. They cannot under any circumstances use the data for their own purposes or to use the data in a way that would go against our agreement. Furthermore, we only use partners that have given us sufficient guarantees that they comply with the legal requirements and that your data will be always kept safe. Protecting your personal data Kiwi.com implements technical and organisational measures designed to protect your personal data, including sensitive data such as health and financial information, against unauthorised access, disclosure, alteration and loss. Our information security programme is aligned to ISO/IEC 27001:2022 and subject to continuous automated monitoring. Your data is protected in transit and at rest using industry-standard encryption. Access to systems that process personal data is restricted through centralised identity management with multi-factor authentication, granted on a least-privilege basis and revoked when personnel leave. Endpoint devices used to access data have full-disk encryption and malware protection enforced. We continuously scan our infrastructure and applications for vulnerabilities, monitor for security threats, and maintain audit logging across our cloud platforms. Our security measures are reviewed and updated on an ongoing basis to address emerging threats. Kiwi.com implements technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR, to protect personal data against unauthorised access, disclosure, alteration and loss. Our information security programme is aligned to ISO/IEC 27001:2022 and is subject to continuous automated control monitoring and periodic internal review. Our cardholder data environment is independently assessed against PCI DSS v4.0.1 by a Qualified Security Assessor, resulting in a Report on Compliance and Attestation of Compliance. Encryption and pseudonymisation Personal data is encrypted in transit using current TLS protocols with strong cipher suites across our customer-facing services. Personal data is encrypted at rest in our cloud storage and database services, using volume, object and database-level encryption. Cryptographic keys are managed using dedicated cloud key management services, governed by our Cryptography Policy, which defines approved algorithms and key lifecycle and rotation requirements. Pseudonymisation and data masking are applied where appropriate to reduce the identifiability of personal data, including in non-production environments. Full-disk encryption is required on managed endpoint devices issued to personnel. Encryption and pseudonymisation Personal data is encrypted in transit using current TLS protocols with strong cipher suites across our customer-facing services. Personal data is encrypted at rest in our cloud storage and database services, using volume, object and database-level encryption. Cryptographic keys are managed using dedicated cloud key management services, governed by our Cryptography Policy, which defines approved algorithms and key lifecycle and rotation requirements. Pseudonymisation and data masking are applied where appropriate to reduce the identifiability of personal data, including in non-production environments. Full-disk encryption is required on managed endpoint devices issued to personnel. Access control Access to systems containing personal data is governed through centralised identity management with single sign-on. Multi-factor authentication is required for access to production systems and privileged accounts. Access is granted on a least-privilege, role-based basis, subject to documented approval, and is revoked through our offboarding process when personnel leave. Access rights are subject to review at planned intervals. Password standards defining minimum length and complexity are applied through our identity provider. Privileged and administrative account use is restricted, logged and monitored. Access to systems containing personal data is governed through centralised identity management with single sign-on. Multi-factor authentication is required for access to production systems and privileged accounts. Access is granted on a least-privilege, role-based basis, subject to documented approval, and is revoked through our offboarding process when personnel leave. Access rights are subject to review at planned intervals. Password standards defining minimum length and complexity are applied through our identity provider. Privileged and administrative account use is restricted, logged and monitored. Network and infrastructure security Cloud infrastructure is segmented using private networks, firewalls and security group policies. Administrative access is restricted to authorised paths. Container and Kubernetes workloads are deployed on hardened node configurations with network policies applied. Infrastructure configuration is monitored against defined security baselines using cloud security posture management, and deviations are raised for remediation. Network and infrastructure security Cloud infrastructure is segmented using private networks, firewalls and security group policies. Administrative access is restricted to authorised paths. Container and Kubernetes workloads are deployed on hardened node configurations with network policies applied. Infrastructure configuration is monitored against defined security baselines using cloud security posture management, and deviations are raised for remediation. Vulnerability and threat management Vulnerability scanning is performed across source code repositories, container images and cloud infrastructure. Identified vulnerabilities are recorded, prioritised by severity and tracked to remediation against defined service levels. Endpoint detection and response and cloud security posture monitoring operate across our estate, with alerts triaged by our security team. Malware protection and screen-lock policies are applied to managed endpoint devices. Vulnerability and threat management Vulnerability scanning is performed across source code repositories, container images and cloud infrastructure. Identified vulnerabilities are recorded, prioritised by severity and tracked to remediation against defined service levels. Endpoint detection and response and cloud security posture monitoring operate across our estate, with alerts triaged by our security team. Malware protection and screen-lock policies are applied to managed endpoint devices. Logging and monitoring Audit logging records administrative and configuration activity across our cloud platforms. Logs are centrally aggregated, retention is governed by our Data Management Policy, and access to log data is restricted. Infrastructure and application monitoring includes alerting on security-relevant events, supported by a centralised security information and event management capability. Logging and monitoring Audit logging records administrative and configuration activity across our cloud platforms. Logs are centrally aggregated, retention is governed by our Data Management Policy, and access to log data is restricted. Infrastructure and application monitoring includes alerting on security-relevant events, supported by a centralised security information and event management capability. Secure software development A documented Secure Software Development Lifecycle Policy governs how security is built into design, development, testing and release. Code changes are subject to peer review and automated security checks within our development pipelines prior to deployment. Development, test and production environments are separated. Secure software development A documented Secure Software Development Lifecycle Policy governs how security is built into design, development, testing and release. Code changes are subject to peer review and automated security checks within our development pipelines prior to deployment. Development, test and production environments are separated. Governance, training and third parties Kiwi.com maintains an approved suite of information security policies covering access control, cryptography, data management, incident response, risk management, secure development, third-party management and physical security. Each is formally approved and reviewed at least annually. Personnel complete mandatory security and privacy awareness training on joining and annually thereafter, with role-specific training for personnel in scope of GDPR and PCI DSS obligations. We maintain a documented risk register and conduct risk assessments at planned intervals, with risks reviewed and treated by accountable owners. Third parties that process personal data on our behalf are subject to our Third-Party Management Policy. Vendors are assigned a risk level, are required to enter into data processing agreements containing appropriate security obligations, and are subject to ongoing review. We seek independent assurance, such as recognised certifications or audit reports, from vendors handling personal data at elevated risk. Governance, training and third parties Kiwi.com maintains an approved suite of information security policies covering access control, cryptography, data management, incident response, risk management, secure development, third-party management and physical security. Each is formally approved and reviewed at least annually. Personnel complete mandatory security and privacy awareness training on joining and annually thereafter, with role-specific training for personnel in scope of GDPR and PCI DSS obligations. We maintain a documented risk register and conduct risk assessments at planned intervals, with risks reviewed and treated by accountable owners. Third parties that process personal data on our behalf are subject to our Third-Party Management Policy. Vendors are assigned a risk level, are required to enter into data processing agreements containing appropriate security obligations, and are subject to ongoing review. We seek independent assurance, such as recognised certifications or audit reports, from vendors handling personal data at elevated risk. Resilience, continuity and incident response Documented and approved Incident Response and Business Continuity / Disaster Recovery plans define how we detect, respond to and recover from security incidents and disruptions, including our obligations to notify supervisory authorities and data subjects where required. Backup and recovery arrangements are in place to restore the availability of and access to personal data in a timely manner following an incident. The effectiveness of our technical and organisational measures is evaluated through continuous control monitoring, internal review and periodic testing, and measures are updated to address emerging threats and regulatory requirements. Resilience, continuity and incident response Documented and approved Incident Response and Business Continuity / Disaster Recovery plans define how we detect, respond to and recover from security incidents and disruptions, including our obligations to notify supervisory authorities and data subjects where required. Backup and recovery arrangements are in place to restore the availability of and access to personal data in a timely manner following an incident. The effectiveness of our technical and organisational measures is evaluated through continuous control monitoring, internal review and periodic testing, and measures are updated to address emerging threats and regulatory requirements. How long do we store your Personal Data? In general, we will process your Personal Data until we don’t need it for any of the purposes defined in this Privacy Policy. Usually, we process your Personal Data for the duration of statutory limitation period, which is generally 3 years, plus an additional 1 year because of the time reserve necessary for delayed deliveries of notices and our additional actions. For the purpose of legal obligations fulfillment, we process your Personal Data for the duration required by the applicable law, e.g. 10 years for archiving of invoices. For the purpose of your Kiwi.com user account, we will store your Personal Data for 5 years after the last action you performed by you while logged in. For the purpose of personalized offers, you will periodically get email offers from us, and in every email, there will be a clear and easy way to unsubscribe and therefore object to this type of processing. We will keep and use your Personal Data for this purpose until you unsubscribe. How to access and control your Personal Data? We want you to always be in control of your Personal Data. To this end, you have certain rights that allow for it. Under certain conditions, you may: gain access to all your data that we use or processing, and even get a copy of all of it, ask us to delete your data, correct the data that we are processing if you think that there are mistakes,

restrict the data processing, object to processing, receive your Personal Data in a commonly used and machine-readable format or to transmit this data to a different provider. You can exercise your rights by sending us an email with your request through this form: kiwi.com/privacy/rights . Please note, that in order to ensure the safety of your Personal Data, we will only comply with the requests that are sent from the email address used during the booking or ordering of a service. If someone else did the booking for you, we will request that you provide additional information to us (Booking ID, etc) to ensure that you are really the owner of the Personal Data in concern. Access your Personal Data At any time, you have the right to ask us whether we process your Personal Data and to get the following information: Purposes for which we process your Personal Data, Categories of your Personal Data we’re processing, List of third-parties with whom we share your Personal Data, in particular when these third-parties are based in Third Countries Duration that we plan to process your Personal Data, or at least how we determine the retention period Your rights as a data subject according to the GDPR Your right to lodge a complaint with a supervisory authority Where we received your data in cases where we didn’t get the data straight from you, If applicable, any information about automated decision making that you may be subject to When the data was transferred to a Third Country and what safeguards apply according to the GDPR Also, on your request, we will provide you with a full copy of all the Personal Data about you that we’re processing. The first copy is for free. However, for any further copies we may charge you a fee to cover our administrative costs. You can also request your data in a commonly used format for the sake of data portability. Delete your Personal Data You have also the right to have your data completely deleted (or more precisely, irreversibly anonymised) if one of the following situations applies to you: we no longer need your Personal Data for any of the purposes defined in this Privacy Policy you’ve successfully objected to the processing according to the Art. 21 of the GDPR and we have no other purpose for which we need your Personal Data, we’ve processed your Personal Data unlawfully, or there is a legal obligation that obliges us to delete your Personal Data. However, you don’t have the right to request the deletion of your Personal data, if the processing is necessary for: exercising the right of freedom of expression and information, compliance with a legal obligation that obliges us to keep the Personal Data, or we need the Personal Data for the establishment, exercise or defence of legal claims Correct your Personal Data If you feel that any Personal Data that we’re processing about you is not accurate, you can let us know and we will do our best to correct it. Please note that we cannot correct the data in our databases that are connected to your ticket. If we would do that, it wouldn’t change it on the part of the carriers or providers of other services and we couldn’t pair it together. If you want to change the details on your ticket, you can always do it in the Manage My Booking section on Kiwi.com. Restrict processing of your Personal Data Under certain conditions, we will restrict the processing of your Personal Data. This means that we will make sure that they are not being processed for any other purpose than to archive it or to move it to a secure archive. You have the right to request this restriction if: you challenged the accuracy of your Personal Data (we will continue processing it once this is resolved), we’ve processed your Personal Data unlawfully but instead of deletion, you only request restriction, the only remaining purpose for processing your Personal Data is the establishment, exercise or defence of legal claims, or you’ve objected to data processing according to the Art. 21 Para 1 of the GDPR and we’re assessing whether your request is justified Object to processing of your Personal Data You can object against any purpose for which we’re processing your Personal Data based on the legal ground of legitimate interest. When you object against processing for any marketing purposes, we will stop using your Personal Data for this purpose immediately. If you protest against any other purpose based on a legitimate interest, we will stop processing your Personal Data for this purpose, unless we can prove that our legitimate grounds for processing it override your individual interests, rights and freedoms. Get your Personal Data portable Lastly, you have the right to obtain your Personal Data processed (based on either consent or necessity for a conclusion or performance of a contract) in a commonly used and machine-readable format and have the right to transmit that data to another controller of your choice. Cookies & Similar technology Cookies are small text files placed on your device that allow us to remember certain information about you for multiple purposes, such as delivering the functionalities of the website and app, Product development, service improvement, and business development, Kiwi.com Account, Online advertisement, Marketing analytics, Information Security, Fraud prevention and Sharing information with metasearch engines. Basically, on our site, you will encounter three types of cookies: Cookies that are strictly necessary for the operation of our website and provision of our services (these cannot be turned off), So-called “performance cookies”, i.e. cookies that we use for statistics in order to improve our services, Cookies that we use for marketing purposes. You can turn off the cookies that are used for statistics and marketing purposes by setting your cookie preferences here . You may always check and modify your preferences when it comes to digital advertising on the web pages of the Digital Advertising Alliance (DAA), at http://optout.aboutads.info/ , or on the web pages of the European Interactive Digital Advertising Alliance (EDAA), at http://www.youronlinechoices.com/ . Other tracking technologies used in our app (SDKs) Cookies used by our partners During your booking journey, you may, depending on your selected itinerary, interact with the domain of Ryanair in order to finalize your booking. Where this is the case, Ryanair will use cookies necessary for the functionality of their website accessed as part of the booking journey. Data collected through these cookies on Ryanair’s websites will be used by Ryanair only and will not be shared with Kiwi.com. If you have already customized your cookie preferences on any of Ryanair’s websites, please be aware that these preferences will not be shared with us and will not apply when accessing these domains through Kiwi.com. For more information on Ryanair’s Cookie and Privacy Policy please see Ryanair’s Privacy Policy and Ryanair’s Cookie Policy. Transferring your data outside of the European Economic Area If we need to, we may transfer your Personal Data outside of the EEA. This will happen when you want to book a ticket with a carrier from a Third Country or when you order a service from a provider based in a Third Country. Naturally, we need to transfer your data to these third parties because without it, the provision of ordered services would not be possible. We may also transfer your Personal Data outside of the EEA to Data Processors located in Third Countries. For transfers to recipients in countries where we cannot rely on the decision of the adequate level of protection according to Art. 45 of the GDPR or appropriate safeguards according to the Art. 46 of the GDPR, we will transfer your Personal Data based on the exception in the Art. 49 Para. 1 Lett. b) of the GDPR. Each selected carrier or service provider will treat Your Personal Data in accordance with its own Privacy Policy (which is published on every carrier’s website). Disclosure of Personal Data to other service providers will be done in accordance with the applicable Personal Data laws and regulations. Complaint with the supervisory authority Data Protection is a serious matter and the rules are quite difficult to implement correctly. No one is perfect, and it may happen that we make a mistake. If you feel that we mishandled your Personal Data, please turn to us first and we promise that we will try our best to resolve the situation. You can always approach us with any privacy or data protection related issue through this form: www.kiwi.com/privacy/questions . Nevertheless, at any time, you have the right to lodge a complaint with a supervisory authority. If you are from the EU, you can complain at the authority in the member state of your residence, in the member state where you work or in the member state of the alleged infringement. Generally, the complaints will be handled by the Czech Office for Personal Data Protection. You can learn more on http://www.uoou.cz . If you are a US customer, please refer to the section "Specifics for Residents of Selected States" below to learn if there are any particular provisions that apply to you regarding the submission of a complaint. Contacting us and exercising your rights To exercise your rights related to your Personal Data, you can use this form: kiwi.com/privacy/rights . Specifics for residents of selected countries No matter where you live, we assure your privacy is protected. For selected countries and states, there are some differences and supplements to this Privacy Policy, which might be applicable to you under conditions specified here. For customers of Kiwi.com, Inc. In some cases specified in our Terms and Conditions (i.e. you are US Consumer under the criteria specified in our Terms and Conditions), our services are provided to you through our US company. If that is your case the following specific provisions are applicable to the processing of your Personal Data. Your Personal Data is processed by company Kiwi.com, Inc., with a registered office at 500 East Broward Boulevard, Suite 900, Fort Lauderdale, Florida 33394, United States, as a Data Controller. Company Kiwi.com s.r.o. operates as a Data Processor and all other Data Processors specified in this Privacy Policy operate as Data Sub-Processors. These specific provisions do not apply to the processing of Personal Data for all the purposes related to Users and for the purpose of “User account — saved traveler” where the Personal Data are processed by Kiwi.com s.r.o. For residents of California These specific provisions are applicable to you if you are a resident of California. We comply with the California Consumer Privacy Act (the “CCPA”) which sets the highest privacy and data protection standards in the United States. For information about our processing of your Personal Data, you can always check out this Privacy Policy. You have a right to request information on how we process your Personal Data and be provided with their copy. We will provide you with the first two copies in a 12-month period for free. You also have a right to request the deletion or correction of your Personal Data. You can find more information about your rights and how to exercise them in this Privacy Policy (sections ‘How to access and control your Personal Data?’ and ‘Contacting us and exercising your rights’). If you decide to exercise any of your rights, we will require you to verify your identity, e.g., by proving your ownership of your email address. If your rights are requested by an authorized agent, we will require your written authorization and the verification of your and the agent’s identity. We will never discriminate against you or treat you unfavorably because you exercised any of your rights. We may offer you a financial incentive in the form of a coupon, credits, or any other form of discount in exchange for your subscription to marketing messages. The specifics of the particular incentive shall be displayed to you as a part of the offer to subscribe. We deem the value of your subscription to be equal to the value of incentive provided to you based on our assumption of additional spending. If you decide to accept our offer, you may always cancel it without any limitations of your rights. You can find more information in this Privacy Policy (section ‘For what purposes do we use your Personal Data?’). We do not sell your Personal Information within the meaning of CCPA. For residents of Virginia, Texas, Connecticut, Colorado, Utah, and Montana: You can exercise the rights you have under your respective state privacy laws (data correction, data deletion, etc.) by submitting a request to us. You can find more information about your rights and how to exercise them in this Privacy Policy (sections ’How to Access and Control Your Personal Data?’ and ’Contacting Us and Exercising Your Rights’). We will respond to your request promptly, within the maximum period set by your state legislation. Please note that we may extend this period if necessary, based on the complexity and number of requests received. In such a case, we would notify you within the initial response period and provide reasons for the extension. We will respond to your request free of charge in the following cases: If you are a resident of Virginia and you ask for information for the first or second time in a year. If you are a resident of Connecticut, Colorado, Utah, or Montana and you ask for information for the first time within any twelve-month period. If you are a resident of Texas, we will provide you with information free of charge at least twice a year. Please note that in some cases, we may charge a fee or even decline your request. However, we will only do so on the grounds set by the law to which you are subject (e.g., if the requests are manifestly unfounded or the primary purpose is not to exercise a right). You can appeal our decision regarding your request in the same manner you sent us the request. We will respond to your appeal as soon as possible, no later than by the deadline set by the state law that applies to you. If you are a resident of Connecticut, Montana, or Texas and we deny your appeal, you may submit a complaint to the Attorney General. We will provide you with the online mechanism or another method of contact through which you can contact the Attorney General to submit a complaint. If you are from Colorado and have concerns about the appeal’s outcome, you may also contact the Attorney General. We may process your Personal Data for the purpose of targeted advertising, but you can easily opt out of this data processing via this link: https://www.kiwi.com/en/pages/cookies_settings , under the section "Marketing & Advertisement." We respect your privacy and will never discriminate against you or treat you unfavorably because you have exercised any of your rights. We do not sell your Personal Data to any third party, nor do we engage in profiling that would result in decisions producing legal or similarly significant effects for you. Data Protection Officer With regard to all issues related to processing of your Personal Data and to the exercise of your rights related to your Personal Data, you may also contact our Data Protection Officer. View contact details. Oliver Švolík Data Protection Officer of Kiwi.com privacy-dpo@kiwi.com Changes to this Privacy Policy As our business evolves, the way we process Personal Data might change as well. In case of such changes, we will also update this Privacy Policy to comply with the principles of transparency. If future changes affect you, we will notify you via email. This Privacy Policy is effective from: 7th September, 2026.