Privacy Policy Last updated: 10 October 2026

1. Who we are SeasonHop is an online platform connecting seasonal hospitality workers with employers across Europe. For the purposes of the General Data Protection Regulation ("GDPR"), SeasonHop is the controller of your personal data. Contact: [email protected]

2. Who this policy applies to This Privacy Policy applies to users of the SeasonHop platform, including: Workers Employers Visitors who interact with the Platform SeasonHop is intended only for people aged 18 or older. We do not knowingly collect personal data from anyone under 18.

3. What personal data we collect Depending on how you use the Platform, we may collect: Account data Name Email address Password hash Account type Account status and registration timestamps Worker profile data Profile details, work preferences, experience, qualifications, languages, availability, nationality, location preferences, and similar information you choose to provide Profile photos and gallery uploads Employer profile and listing data Business name, location, contact details, property profile, accommodation information, job listings, and related uploaded photos Business verification data: legal entity name, registered address, company register, trade-licence or VAT number, the authorised contact person, and documents provided to prove them (Terms of Service, section 6A.9) Hire reports: which worker was hired, for which role and from when (Terms of Service, section 6A.4) Communication data Messages exchanged through the Platform Support or account-related correspondence sent to us Technical and security data IP address Browser and device information Log and security event data Timestamps and activity related to account access and Platform use Legal and administrative data Records of account actions, moderation actions, and acceptance of legal documents such as Terms of Service and Privacy Policy versions, where implemented Safety data Results of automated safety checks (which account, which check, when), reports made by users, and evidence kept in fraud investigations An internal blocklist of email addresses, domains and phone numbers used by accounts removed for fraud or serious breaches of our Terms of Service

4. How we collect data We collect personal data: Directly from you when you register, complete your profile, upload content, send messages, or contact us Automatically when you use the Platform, including through server logs and essential technical mechanisms needed to run the service

5. Why we process your data and legal basis Under GDPR, we must have a valid legal basis for processing. Purpose Legal basis Creating and managing your account Performance of a contract, Article 6(1)(b) GDPR Displaying profiles and listings to other users Performance of a contract, Article 6(1)(b) GDPR Enabling messaging and core marketplace functionality Performance of a contract, Article 6(1)(b) GDPR Providing support and responding to requests Performance of a contract and legitimate interests, Article 6(1)(b) and 6(1)(f) GDPR Securing the Platform, preventing abuse, fraud, and unauthorised access Legitimate interests, Article 6(1)(f) GDPR Automated safety checks of messages, registrations, profiles and job offers against our blocklist, and keeping the blocklist Legitimate interests, Article 6(1)(f) GDPR: protecting workers and employers from fraud, impersonation and the harvesting of personal data Verifying the business identity of employers Performance of a contract and legitimate interests, Article 6(1)(b) and 6(1)(f) GDPR Recording hire reports and, once fees apply, invoicing employers Performance of a contract with employers, Article 6(1)(b) GDPR, and legal obligation for accounting records, Article 6(1)(c) GDPR Warning users who may have been contacted by a fraudulent account Legitimate interests, Article 6(1)(f) GDPR Maintaining technical logs and service integrity Legitimate interests, Article 6(1)(f) GDPR Complying with legal obligations Legal obligation, Article 6(1)(c) GDPR

We use analytics and marketing cookies only if you accept them (section 11). We do not use your personal data for advertising profiling. We send emails about your account and the Platform, including job suggestions that match your profile. You can unsubscribe from job suggestions at any time using the link in each email.

6. How we use your data We use your personal data to: Create and maintain user accounts Operate worker and employer profiles Display relevant information to other users of the Platform Allow workers and employers to find and contact each other Host and display uploaded photos and other content Secure the Platform and investigate misuse — this may include reviewing message content where a user has been reported for conduct that violates our Terms of Service, where we have reasonable grounds to suspect abuse, fraud, harassment, or other harmful behaviour Communicate with you about your account or support requests Enforce our Terms and protect users and the Platform Comply with legal obligations We do not sell your personal data. Automated safety checks To protect users from fraud, we automatically check chat messages when they are sent, registrations and employer profiles when they are saved, and job offers submitted through the quick job offer form. The check compares the content with a short internal list of email addresses, domains and phone numbers linked to accounts we have removed for fraud or serious breaches of our Terms of Service. It does not interpret the meaning of messages, it is not used for advertising or profiling, and no person reads your messages as part of it. If a check is triggered, the message, registration, profile change or job offer is not completed. Because this can prevent you from using the Platform, you have the right to obtain human review, to express your point of view and to contest the decision: write to [email protected] and a person will review it. Apart from these checks, we do not use automated decision-making that produces legal or similarly significant effects.

7. Who can see your data Because SeasonHop is a two-sided marketplace, some information you provide is intentionally visible to other users. Worker data visible to employers This may include, depending on what the Platform displays: First name and profile details Work experience, qualifications, languages, preferences, and availability Profile photos and gallery images Messages sent through the Platform Employer data visible to workers This may include: Employer and business profile information Job listing details Accommodation and property photos Messages sent through the Platform Please only include information you are comfortable sharing within the Platform context.

8. Who we share data with and operator details We share personal data only where necessary. Platform operator The Platform is operated by: Matic Strancar Lozice 12 5272 Podnanos Slovenia [email protected] Infrastructure providers We currently use infrastructure operated on Hetzner, including our own PostgreSQL-backed application environment. Email providers We use Brevo (France) and Zoho (EU data centre) to send and receive operational, account and support emails. Analytics and marketing If you accept the corresponding cookies, PostHog (EU instance) and Meta Platforms Ireland Ltd. receive data as described in section 11. Users affected by fraud If an account is removed for fraud, we may tell users whom that account contacted what happened and how to protect themselves. We share only what is needed for that warning. Legal or regulatory disclosures We may disclose personal data where required by law, court order, or binding request from a competent authority, where necessary to establish, exercise, or defend legal claims, or to the police or other competent authorities where we become aware of information giving rise to a suspicion of a criminal offence that threatens the life or safety of a person. Business transfer If SeasonHop is sold, merged, or reorganised, personal data may be transferred as part of that transaction, subject to applicable law. We do not currently use payment processors in the live Platform.

9. International transfers We aim to process and store data within the EEA where possible. Where personal data is transferred outside the EEA, for example to Meta in the United States if you accept marketing cookies (section 11), we ensure an appropriate safeguard is in place, such as Standard Contractual Clauses or another lawful transfer mechanism under GDPR.

10. Data retention We retain personal data only as long as necessary for the purposes described in this policy. Data type Retention period Active account and profile data For as long as the account remains active Closed account and profile data Up to 12 months after closure or deletion request Message data Up to 12 months after account closure, unless longer retention is necessary for dispute handling, abuse prevention, or legal claims Technical and security logs As reasonably necessary for security, troubleshooting, and service integrity Legal compliance records As long as required by applicable law Results of automated safety checks Up to 12 months Blocklist entries and evidence from fraud investigations As long as needed to protect users from the same actor and to establish, exercise or defend legal claims; we review blocklist entries at least every 24 months Business verification data and hire reports For as long as the employer account is active and up to 12 months after closure; invoices and related records for as long as accounting and tax law requires

Where retention is no longer necessary, we will delete or anonymise personal data unless we are legally required or otherwise permitted to keep it longer.

11. Cookies and similar technologies

SeasonHop uses cookies and comparable device-storage technologies to keep the Platform functional and, where you agree, to understand how the Platform is used and to measure the reach of our worker recruitment. We group cookies into three categories:

**Strictly necessary** — required for the service to work. These keep you signed in, protect your account, and persist your language preference. They are set without consent under Article 5(3) of the ePrivacy Directive.

**Analytics** — help us understand which pages and features are used, so we can improve SeasonHop. We use PostHog on its EU instance. These cookies are only set after you accept them.

**Marketing** — measure the reach of advertisements and posts that bring workers and employers to SeasonHop. We use Meta Pixel (Facebook). These cookies are only set after you accept them, and using them transfers limited data (your IP address and browser fingerprint) to Meta Platforms Ireland Ltd. with onward transfer to the United States under Meta's Standard Contractual Clauses.

Cookies we set

Your controls

You can change your choices at any time via the "Cookie settings" link in the SeasonHop footer. You can also refuse all non-necessary cookies on first visit with a single click. Declining does not affect your ability to use SeasonHop — only analytics and marketing measurement are switched off.

If you prefer to withdraw all consent at the browser level, you can clear site data for seasonhop.com from your browser settings, which also expires the strictly-necessary session cookie and signs you out.

We may add or remove cookies as the Platform evolves. Material changes will trigger a fresh consent request.

12. Your rights under GDPR Subject to applicable law, you have the right to: Access your personal data Correct inaccurate or incomplete data Request deletion of your data Restrict processing Object to processing based on legitimate interests Receive your data in a portable format where applicable Withdraw consent where processing is based on consent Lodge a complaint with a competent supervisory authority To exercise any of these rights, contact us at [email protected]. If you are based in the EEA, you may also lodge a complaint with the supervisory authority in your country of residence. As SeasonHop is operated from Slovenia, the primary supervisory authority is the Information Commissioner of the Republic of Slovenia (ip-rs.si).

13. Data security We take appropriate technical and organisational measures to protect personal data, including: Password hashing Encrypted connections in transit where applicable Access controls Infrastructure and operational security measures appropriate to the size and nature of the service No system can guarantee absolute security. If you believe your account or data may have been compromised, contact us immediately at [email protected].

14. Third-party links The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those third parties.

15. Changes to this Privacy Policy We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version on the Platform and, where appropriate, notify users through the Platform or by email.

16. Contact For questions or requests regarding this Privacy Policy, contact us at: Email: [email protected]