The controller of personal data collected via the Website is: SCI Hotel Mandji Boulevard du Gouverneur Chavannes Port-Gentil, Republic of Gabon Telephone: +241 11 55 72 34 / +241 65 05 03 60 Email: infos@cityhotelmandji.com Hotel Mandji is responsible for determining the purposes and means of processing personal data collected in connection with the use of the Website and its services.

In connection with the use of the Website and the services offered, Hotel Mandji may collect the following categories of personal data: Identification data: - Surname and first name - Email address - Telephone number - Nationality (where applicable) Data relating to stays: - Desired arrival and departure dates - Desired room type - Number of adults and children - Special requests and preferences Browsing data: - IP address - Browser type and version - Operating system - Pages viewed and duration of visits - Cookie data (see dedicated section) Communication data: - Content of messages sent via the contact form - History of exchanges by email or telephone Hotel Mandji does not collect any sensitive data (ethnic origin, political opinions, religious beliefs, health data, etc.).

Personal data collected is processed for the following purposes: - Booking request management: processing, confirmation and monitoring of room and service bookings. - Responding to contact requests: processing messages sent via the contact form or by email. - Service improvement: statistical analysis of Website traffic to optimise user experience and services offered. - Commercial communication: sending special offers, promotions and Hotel Mandji news (only with the prior consent of the User). - Customer relationship management: stay monitoring, complaint management and after-stay service. - Compliance with legal obligations: retention of data necessary to comply with tax, accounting and regulatory obligations.

The processing of personal data is based on the following legal grounds: - Performance of a contract or pre-contractual measures: when processing is necessary for the management of a booking or information request made by the User. - Consent: when the User gives their explicit consent to receive commercial communications or for the use of non-essential cookies. - Legitimate interest: when processing is necessary for the legitimate interests of Hotel Mandji, in particular improving its services and the security of the Website. - Legal obligation: when processing is required by a legal or regulatory provision applicable in the Republic of Gabon.

Personal data collected may be transmitted to the following recipients: - Authorised Hotel Mandji staff: staff members authorised to process data in the course of their duties (reservations department, management, reception). - Technical service providers: providers ensuring Website hosting (Vercel Inc.), technical maintenance (BAO PROD) and analytical tools (Google Analytics). - Payment partners: banking institutions and payment service providers for the processing of financial transactions. - Competent authorities: administrative or judicial authorities authorised, upon request and within the framework of legal obligations. Hotel Mandji ensures that its service providers and partners offer sufficient guarantees regarding the protection of personal data.

Certain personal data may be transferred outside the Republic of Gabon, in particular to: - The United States of America: in connection with the hosting of the Website by Vercel Inc. (Walnut, CA, USA) and the use of Google Analytics services. These transfers are carried out in compliance with applicable regulations on the protection of personal data. Hotel Mandji ensures that the recipients of these transfers offer an adequate level of protection of personal data, in particular through appropriate contractual clauses or recognised certifications.

Personal data is retained for a period proportionate to the purposes for which it was collected: - Booking-related data: retained throughout the commercial relationship, then archived for a period of five (5) years from the last stay, in accordance with legal obligations relating to accounting and taxation. - Contact request data: retained for a period of two (2) years from the last exchange. - Newsletter data: retained until the User withdraws their consent (unsubscription). - Browsing data and cookies: retained for a maximum period of thirteen (13) months. - Complaint-related data: retained for a period of five (5) years from the settlement of the complaint. Upon expiry of these periods, data is deleted or irreversibly anonymised.

The Website uses cookies and trackers to ensure its proper functioning and improve the browsing experience. Strictly necessary cookies: - Session cookies: maintain the User's browsing session. - Language preference cookies: remember the language chosen by the User (French, English, Spanish). These cookies are essential for the operation of the Website and do not require the User's consent. Analytical cookies (Google Analytics): - Used to measure Website traffic (number of visitors, most viewed pages, visit duration, etc.). - Data is collected anonymously and in aggregate. - IP address is anonymised before any storage. Functional cookies: - Remember User preferences for a personalised experience (language, previous search dates). The User may manage their cookie preferences at any time via their browser settings. Refusing certain cookies may limit access to certain features of the Website.

In accordance with applicable regulations in the Republic of Gabon regarding the protection of personal data, the User has the following rights: - Right of access: obtain confirmation that personal data concerning them is being processed and obtain a copy. - Right of rectification: request the correction of inaccurate or incomplete personal data. - Right of erasure: request the deletion of their personal data, subject to legal retention obligations. - Right to restriction of processing: request the temporary suspension of the processing of their data in certain cases. - Right to data portability: receive their personal data in a structured, machine-readable format, and transmit it to another data controller. - Right to object: object at any time to the processing of their data for commercial prospecting purposes. - Right to withdraw consent: withdraw their consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal. To exercise these rights, the User may send their request by post or email to the following address: Email: infos@cityhotelmandji.com Post: SCI Hotel Mandji, Boulevard du Gouverneur Chavannes, Port-Gentil, Gabon Hotel Mandji undertakes to respond to any request within a maximum period of thirty (30) days from receipt of the request. Proof of identity may be requested to verify the identity of the applicant.

Hotel Mandji implements appropriate technical and organisational measures to ensure the security and confidentiality of personal data collected and to protect it against any unauthorised access, alteration, disclosure or destruction. These measures include in particular: - Encryption of communications via the HTTPS protocol (SSL/TLS certificate). - Restriction of access to personal data to authorised staff only. - Implementation of regular backup procedures. - Staff awareness of best practices regarding data protection. However, no security system being infallible, Hotel Mandji cannot guarantee the absolute security of data. In the event of a personal data breach likely to create a high risk for the rights and freedoms of data subjects, Hotel Mandji undertakes to inform the data subjects and competent authorities as soon as possible.

Hotel Mandji offers a newsletter service allowing Users to receive by email information about special offers, events and hotel news. Subscription to the newsletter is optional and based on the free and explicit consent of the User. The email address provided during subscription is used exclusively for sending the newsletter. The User may unsubscribe from the newsletter at any time: - By clicking the unsubscribe link in each email. - By sending an email to: infos@cityhotelmandji.com with the subject line "Newsletter unsubscription". Unsubscription takes effect immediately and the associated data is deleted within thirty (30) days.

Hotel Mandji reserves the right to modify this Privacy Policy at any time in order to comply with regulatory developments or changes in its data processing practices. Any significant modification will be brought to the attention of Users by updating the "last updated" date at the top of this page. Hotel Mandji invites Users to regularly consult this page to take note of any modifications. Continued use of the Website after the publication of a modified Privacy Policy constitutes acceptance of the new provisions.

For any question relating to this Privacy Policy, the processing of your personal data or to exercise your rights, you may contact the Data Protection Officer of Hotel Mandji: SCI Hotel Mandji Attention: Data Protection Officer Boulevard du Gouverneur Chavannes Port-Gentil, Republic of Gabon Telephone: +241 11 55 72 34 / +241 65 05 03 60 Email: infos@cityhotelmandji.com We are committed to handling your request with diligence and confidentiality.