HBX GROUP PRIVACY POLICY

Version 5.0

Latest version: June, 2026

In accordance with applicable data protection regulations, this Privacy Policy aims to help you understand how HBX Group processes your personal data depending on the type of data subject.

1. DATA CONTROLLER

The controller of the personal data you have provided us with is HBX International Group PLC (hereinafter "HBX Group"), with registered office at 7th Floor Tower 42, 25 Old Broad Street, London, EC2N 1HN.

2. DATA PROTECTION OFFICER (DPO)

HBX Group has a Global Data Protection Officer to respond to queries, requests or clarifications regarding the processing of personal data. You can contact DPO at  dataprotection@hbxgroup.com or at our postal address, mentioned in section 9. 

3. HOW DO WE OBTAIN YOUR PERSONAL DATA?

The personal data processed will be that which you provide to us through the various channels made available to you by HBX Group.

For compliance and Know Your Business (KYB) activities, we may obtain personal data from third parties (such as service providers) for fraud detection and prevention purposes.
    
When you visit the HBX Group website, various technologies are used to collect and store information, which may include the use of cookies or similar technologies to identify your browser or device. You can obtain more information in our Cookie Policy).

4. DATA PROCESSING ACCORDING TO THE TYPE OF DATA SUBJECT

The categories of data, purposes and applicable legal basis are detailed below according to each data subject.

Note on legitimate interest: when legitimate interest is the legal basis, we ensure your interests, fundamental rights and freedoms do not override our legitimate interests through a balancing assessment. You may request more information by contacting our DPO (section 9).

5. WHEN AND WHY DO WE COMMUNICATE YOUR DATA TO THIRD PARTIES?

Personal data may be disclosed to the recipients groups below, only for the purposes described and using only the data categories necessary for each case:

HBX Group shares your personal data only with suppliers and third parties essential for providing contracted services, all under confidentiality agreements and legal requirements. We will not share your data with any other third parties without your consent, except when required by law or contract. If in the future sharing data becomes necessary, HBX Group will notify you promptly.

Note on legitimate interest: when legitimate interest is the legal basis, we ensure your interests, fundamental rights and freedoms do not override our legitimate interests through a balancing assessment. You may request more information by contacting our DPO (section 9).
 

6. INTERNATIONAL DATA TRANSFERS

HBX Group works with suppliers outside the European Economic Area, the UK, and Switzerland if their data protection regulations are deemed equivalent by relevant authorities. If suppliers are in countries without such equivalence, HBX Group ensures all required privacy safeguards are in place after verifying local laws. Sometimes, your data is transferred abroad when necessary for booking or fulfilling contracts, such as sharing details with hotels or partners in your chosen destination.

Safeguards may include contractual clauses, extra guarantees, or binding corporate rules approved by data protection authorities. For EEA citizens, these clauses are available here. Regulations also permit us to transfer your data internationally when needed to deliver requested services.

We also inform you that HBX Group has companies outside the European Union, the United Kingdom or Switzerland. In such cases, HBX Group requires these companies to comply with appropriate measures to protect your personal data in accordance with European regulations. 

For more information about your privacy guarantees, or the destination countries to which we need to transfer your data in order to fulfil our contractual obligations to you, you can contact HBX Group at the addresses indicated in section 9 of this Privacy Policy. 
 

7.    AUTOMATED DECISIONS

HBX Group does not make decisions that may affect you based solely on the automated processing of your personal data. All decision-making processes related to the processing purposes described above are carried out with human intervention.

The profiling indicated for candidate management purposes will in no case be used in decision-making by our organisation that may have legal effects on you or that may significantly affect you.

8.    DATA RETENTION PERIOD

We will only retain your personal data for as long as we need it for the purposes for which we collect it and to comply with legal, financial, commercial or reporting requirements, or until you withdraw your consent. In some circumstances, we may anonymise personal data so that it is no longer identifiable and we can continue to use it. When we no longer need the personal data, we will delete or destroy it securely.

HBX Group will retain the data collected for the above purposes for the duration of your relationship with HBX Group and, even thereafter, until the expiry of any legal liability arising therefrom.

9.    HOW CAN YOU EXERCISE YOUR RIGHTS?

You may exercise, with respect to the data collected, the rights of access, rectification, object, deletion, limitation and portability of data, in accordance with the regulations on data protection and withdraw your consent, as well as the right to define directives regarding the fate of your data after your death. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

These rights may be exercised by sending a communication:
●    By email to dataprotection@hbxgroup.com with the subject line "Personal Data"; or
●    By post with proof of receipt by HBX Group, indicating "Data Protection" on the envelope, addressed to the following address:
o    DPO: Camí Son Fangos, 100, Palma de Mallorca, Spain
o    Company: 7th Floor Tower 42, 25 Old Broad Street, London, EC2N 1HN

Furthermore, if you believe that the processing of your personal data violates the regulations or your privacy rights, you may file a complaint:
●    By post or email to the addresses indicated above, or 
●    To the UK Data Protection Authority, the Information Commissioner's Office (ICO) at www.ico.org.uk, or
●    To another personal data protection authority, for example, the competent authority in your usual place of residence, place of work or where the infringement took place. The contact details of the main data protection authorities can be found here.
 

10.    CHANGES, MODIFICATIONS AND UPDATES

HBX Group reserves the right to revise this Privacy Policy at any time it deems appropriate, in order to reflect regulatory changes, best practices or to update personal data processing activities. You will be informed of such updates in accordance with regulatory requirements, should your rights be significantly affected as a result of such modification or update.