PRIVACY & DATA PROTECTION POLICY Ahvi Oy / City Home Finland This Privacy & Data Protection Policy describes how Ahvi Oy / City Home Finland (hereinafter referred to as the “Company” or “Controller”) processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable legislation. 1. DATA CONTROLLER Ahvi Oy / City Home Finland Business ID: 2724580-9 Email: info@cityhomefinland.fi Location: Tampere, Finland 2. DATA SUBJECTS This register applies to: – guests booking and using accommodation services – corporate and contract customers – users of the website and online check-in services 3. PERSONAL DATA COLLECTED We collect and process only personal data necessary for providing accommodation services, which may include: – first and last name – email address – phone number – nationality – date of birth – identification details (passport or ID number, where required by law) – booking details (arrival and departure dates, apartment, number of guests) – payment and invoicing information (payments are processed via third-party providers) – communication and customer service records related to the booking The Company does not store full credit or debit card details. 4. PURPOSE OF DATA PROCESSING Personal data is processed for the following purposes: – managing reservations and providing accommodation services – guest identification and compliance with legal obligations – communication before, during, and after the stay – invoicing and payment processing – customer service and complaint handling – security and prevention of misuse – compliance with statutory obligations 5. LEGAL BASIS FOR PROCESSING Personal data is processed based on one or more of the following legal grounds: – performance of a contract (accommodation agreement) – compliance with a legal obligation – legitimate interest of the Controller (customer relationship management, communication, service development) – consent of the data subject, where specifically requested 6. DATA RETENTION Personal data is stored only for as long as necessary: – booking and customer data as required by accounting and other applicable laws – communication and customer service data for as long as necessary to manage the customer relationship – identification data only where required by law and only for the legally mandated period Data is securely deleted or anonymized when no longer required. 7. DATA DISCLOSURE AND TRANSFERS Personal data is disclosed only when necessary and only to trusted parties, such as: – booking platforms and payment service providers (e.g. Airbnb, Booking.com) – accounting and IT service providers – authorities, where required by law The Company does not sell or rent personal data to third parties. Data is primarily processed within the EU/EEA. If data is transferred outside the EU/EEA, appropriate safeguards are applied in accordance with GDPR. 8. DATA SECURITY Personal data is protected by appropriate technical and organizational measures, including: – secure systems and access controls – restricted access to personal data – encrypted connections where applicable – confidentiality obligations for staff and partners 9. RIGHTS OF THE DATA SUBJECT Data subjects have the right to: – access their personal data – request correction of inaccurate or incomplete data – request deletion of personal data where permitted by law – restrict or object to data processing – request data portability – withdraw consent at any time, where processing is based on consent Requests must be submitted in writing via email to the Controller. 10. COOKIES The website may use cookies to ensure functionality and improve user experience. Cookie settings can be managed through the user’s browser. 11. CHANGES TO THIS POLICY The Company reserves the right to update this Privacy & Data Protection Policy. The most current version will always be available on the Company’s website. Ahvi Oy / City Home Finland Business ID: 2724580-9 Contact: info@cityhomefinland.fi

We will retain your personal data as long as needed for the purpose they were originally collected for, as long as we are legally obligated or until we receive a request for erasure. After this your personal data will either be erased completely or made anonymous by modifying them irreversibly.