Effective Date: [To be inserted]

INTRODUCTION

Navari Lifestyle Management, LLC (“Navari,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website and services. Capitalized terms not defined in this Privacy Policy have the meanings given in the Client Service Agreement and Website Terms of Service.

By creating an account, clicking “I Accept,” or using our services, you agree to this Policy. If you just browse without signing up, only our cookie practices (Section 8) and automatic data collection (Section 2) apply to you.

This Policy is part of our Website Terms of Service and Client Service Agreement. In the event of any conflict between this Privacy Policy and other Navari agreements regarding data collection, use, or protection, this Privacy Policy controls. For all other matters, the hierarchy set forth in your Client Service Agreement applies.

We record when you accept this Policy (with a timestamp and IP address). You can request a copy of your consent record anytime at [privacy email].

QUICK SUMMARY

INFORMATION WE COLLECT

Information You Provide Directly

We collect information you provide when you:

Information We Collect Automatically

When you visit our website, we automatically collect:

1. Device and Browser Information: IP address, browser type, device type, operating system

2. Usage Information: Pages viewed, links clicked, time spent on site, referring website

3. Cookies and Tracking: Session cookies, analytics cookies (see Section 8)

Information from Third Parties

We may receive information from:

1. Travel Vendors: Booking confirmations, changes, or cancellations

2. Payment Processors: Transaction confirmations

3. Public Sources: If you inquire through a third-party platform

Booking on Behalf of Others

Authorized Travelers

If you book travel for others (“Authorized Travelers” as defined in your Client Service Agreement), you represent that you have authority to provide their personal information and that they have consented to our collection and use of their information as described in this Policy. You are responsible for ensuring all Authorized Travelers review this Privacy Policy.

Group Travel

If you’re organizing group travel, you’re confirming each group member has agreed to share their information with us and with the hotels, airlines, and other vendors needed for the trip. For health information or special needs, we may ask those travelers to sign acknowledgment forms directly.

Sensitive Information

We may collect sensitive information you choose to provide, including health conditions, medical information, dietary restrictions, allergies, and accessibility needs, to accommodate your travel requirements. Providing this information is optional. If you choose not to provide it, we may be unable to fulfill certain special requests, but you are not required to disclose sensitive information to use our basic services. We will share this sensitive information with Third-Party Vendors only as necessary to fulfill special requests you have made (such as dietary accommodations or accessibility arrangements).

IMPORTANT NOTICE REGARDING COMMUNICABLE DISEASE: Neither Navari’s professional liability insurance nor general liability insurance covers claims related to communicable disease exposure. This exclusion applies regardless of where or how exposure occurs. See your Client Service Agreement and the Liability Waiver for additional disclosures regarding communicable disease risks. You are strongly encouraged to obtain travel insurance with communicable disease coverage.

HOW WE USE YOUR INFORMATION

We use your information to:

Legal Basis for Processing (for EEA/UK Residents)

We process your information based on:

1. Contract Performance: To provide travel services you requested

2. Legitimate Interests: To improve our services, prevent fraud, ensure security

3. Legal Obligations: To comply with tax, financial, and regulatory requirements

4. Consent: For marketing communications (you can withdraw anytime)

HOW WE SHARE YOUR INFORMATION

With Third-Party Vendors

We share your information with Third-Party Vendors (as defined in your Client Service Agreement)-including hotels, airlines, tour operators, transportation providers, and activity providers-to complete your bookings. This includes:

1. Names, contact information, passport details

2. Special requests (dietary needs, accessibility, celebrations)

3. Payment information (as needed for booking)

Third-Party Vendors are independent businesses, not employees, agents, or partners of Navari. Their use of your information is governed by their own privacy policies, not ours. We are not responsible for how they handle your data. The one exception: if we knew (or should have known) a vendor had serious data security problems and used them anyway, we’re responsible for that choice. See your Client Service Agreement for additional information about Third-Party Vendor relationships.

With Third-Party Service Providers

We also share information with Third-Party Service Providers (as defined in the Website Terms of Service), the technology companies that help us run our business.

We require these providers to protect your information, but we can’t guarantee they’ll always comply. Our liability for their data breaches is limited (see Section 5).

For Legal Reasons

We may share your information when required by law or when we genuinely believe it’s necessary to:

1. Respond to valid legal requests (subpoenas, court orders)

2. Enforce our agreements (only sharing what’s truly necessary)

3. Protect against serious, immediate threats to safety

4. Prevent fraud or security threats

5. Cooperate with law enforcement

If we receive a civil legal request for your information, we’ll try to let you know before responding unless the law prevents us or it would interfere with an investigation.

Business Transfers

If Navari is acquired, merged, or undergoes a business transition, your information may be transferred to the successor entity.

With Your Consent

We may share information for other purposes with your explicit consent.

HOW WE PROTECT YOUR INFORMATION

Security Measures

We implement reasonable security measures, including:

1. Encryption: Secure transmission (SSL/TLS)

2. Access Controls: Limited employee access on need-to-know basis

3. PCI-DSS Compliance: Payment card data is processed through PCI-DSS compliant processors. We do not store your full card numbers on our systems.

4. Regular Updates: Security patches and monitoring

Cyber Insurance

We carry $1,000,000 in cyber liability insurance covering network security issues, privacy claims, incident response, and certain cyber crimes. Like all insurance, it has exclusions: it doesn’t cover technology fraud, some regulatory fines, or communicable disease exposure. This disclosure is for informational purposes and does not create any rights in third parties to our insurance coverage.

Insurance Limitations.

While we maintain professional liability, general liability, and cyber liability insurance, these policies contain exclusions and limitations. Our professional liability insurance excludes bodily injury, property damage, and tour operating services. Our general liability insurance excludes claims arising from violations of statutes related to personal data, communicable disease, and cyber incidents. Regulatory fines and penalties may not be covered by any policy. These disclosures are for informational purposes and do not create any direct rights against our insurers.

No Absolute Security

No system is 100% secure. While we take reasonable precautions, we can’t guarantee your data will never be compromised. If something does happen, our cyber insurance covers up to $1,000,000 for qualifying claims. Beyond insurance, our direct liability is capped at the greater of the fees you paid us in the past 12 months or $25,000. These caps don’t apply if we were grossly negligent, acted with willful misconduct, or committed fraud. You are responsible for protecting your account credentials and notifying us immediately if you suspect unauthorized access.

Fraud Prevention

We will never request sensitive information (such as passwords or full payment card numbers) via email. Before transferring funds based on email instructions, always verify by calling our confirmed phone number. We will never ask you to wire funds to personal accounts, change payment instructions by email alone, or purchase gift cards as payment. See the Website Terms of Service for additional fraud prevention guidance.

If We Have a Data Breach

We’ll notify you as required by law. For Florida residents, that means within 30 days of confirming a reportable breach (unless law enforcement asks us to delay). We’ll tell you what happened, what information was affected, and what you can do to protect yourself. We will also notify applicable regulatory authorities as required by law.

Data Retention

We keep your information only as long as we need it:

Active Clients

For the duration of our relationship plus legal retention periods

Former Clients

We keep tax-related records for 7 years (IRS requirement). If you haven’t filed any claims within the 1-year window in your Client Service Agreement, we may delete or anonymize other personal information sooner.

Marketing

Until you opt out or we determine it’s no longer needed

We regularly review what we’re keeping and delete information we no longer need.

YOUR RIGHTS AND CHOICES

Access and Correction

You may request access to or correction of your personal information by contacting us at [privacy email].

Data Export

Want a copy of your data? Just ask. We’ll send it to you in a common format (like CSV or PDF) within 30 days. Contact [privacy email].

Deletion

You can ask us to delete your information. We’ll do it unless we need to keep certain records for:

1. Tax compliance (per IRS rules) or Florida Seller of Travel requirements

2. Active or anticipated legal matters, or an active booking

3. Ongoing fraud investigations

If we can’t delete everything, we’ll tell you why and delete whatever we can.

Marketing Opt-Out

You may opt out of marketing emails by:

1. Clicking “unsubscribe” in any marketing email

2. Contacting us at [privacy email]

You cannot opt out of transactional emails (booking confirmations, service updates).

Cookie Preferences

You can control cookies through your browser settings. Note that disabling cookies may affect website functionality.

Do Not Track

Our website does not currently respond to “Do Not Track” browser signals.

ADDITIONAL RIGHTS FOR CERTAIN RESIDENTS

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

To exercise these rights, contact us at [privacy email] with “California Privacy Rights” in the subject line.

Verification

We will verify your identity before processing requests.

Authorized Agent

You may designate an authorized agent to submit requests on your behalf.

EEA/UK Residents (GDPR)

If you are in the European Economic Area or United Kingdom, you have additional rights under GDPR:

1. Access: Request a copy of your personal data

2. Rectification: Correct inaccurate data

3. Erasure: Request deletion (subject to legal requirements)

4. Restriction: Limit processing in certain circumstances

5. Portability: Receive your data in machine-readable format

6. Object: Object to processing based on legitimate interests

7. Withdraw Consent: Withdraw consent for marketing at any time

8. To exercise these rights, contact us at [privacy email].

9. Data Controller: Navari Lifestyle Management, LLC is the data controller for your information.

10. Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

Other Jurisdictions

If your jurisdiction provides additional privacy rights, please contact us to discuss.

Other States: Privacy laws are evolving. If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with privacy legislation, you may have additional rights. Contact us at [privacy email] to discuss what applies to you.

COOKIES AND TRACKING TECHNOLOGIES

What We Use

Third-Party Cookies

Third parties (such as Google Analytics) may place cookies on your device. We do not control their cookies — their privacy policies govern.

Managing Cookies

Most browsers allow you to control cookies through settings. Disabling cookies may limit website functionality.

Photos and Media

We’ll ask your permission before using photos or videos of you in our marketing. You can set your preferences when you sign up or book, and change them anytime by emailing [privacy email]. You may change your preferences at any time by contacting us at [privacy email]. We will not use your image in marketing materials without your consent. For adventure activities, the Liability Waiver has specific consent options. Photos taken by hotels, airlines, or other vendors are governed by their policies, not ours.

Medical Records

For adventure activities, you may be asked to authorize access to medical records related to injuries pursuant to the HIPAA authorization in the Liability Waiver. Medical records obtained pursuant to that authorization are governed by its terms, not this Privacy Policy, with respect to access, use, and disclosure. However, we will apply the security measures described in Section 5 to protect such medical information. The HIPAA authorization has a three-year duration and may be revoked in writing; revocation does not affect uses or disclosures made before revocation. We use medical information only for coordinating your care, documenting incidents, and if necessary, for legal proceedings.

CHILDREN’S PRIVACY

Our services are not directed to individuals under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from someone under 18 without parental consent, we will delete it promptly.

Parents or guardians may provide information about children in their care for travel purposes, but they’re responsible for that information and the child’s account activity. When you give us a child’s information, you’re confirming you have legal authority to do so. For international travel or high-risk activities, we may ask for proof of your relationship. Only adults 18 and older can create accounts, sign agreements, or book travel.

INTERNATIONAL DATA TRANSFERS

For Residents Outside the U.S.

Navari is based in the United States. If you are outside the U.S., your information will be transferred to and processed in the U.S., which may have different data protection laws than your country. By using our services, you consent to this transfer.

For EEA/UK residents

We use European Commission-approved Standard Contractual Clauses and other legal safeguards to protect your data when it’s transferred to the U.S. Want a copy of these safeguards? Email [privacy email].

Fine Print

Governing Law

This Policy is governed by Florida law, without regard to conflict of law principles.

Dispute Resolution

BY USING OUR SERVICES, YOU AGREE TO RESOLVE DISPUTES ABOUT THIS POLICY THROUGH BINDING ARBITRATION—NOT IN COURT. YOU’RE GIVING UP YOUR RIGHT TO A JURY TRIAL AND TO JOIN CLASS ACTIONS. You can opt out within 30 days by sending written notice to the address in Section 13. See our Website Terms and Client Service Agreement for full details.

Severability

If any part of this Policy is found unenforceable, the rest remains in effect. We’ll interpret the unenforceable provision as narrowly as needed to make it valid.

No Waiver

If we don’t immediately enforce any part of this Policy, that doesn’t mean we’ve waived our right to enforce it later.

Assignment

We may assign our rights and obligations under this Policy in connection with a merger, acquisition, or sale of assets. You cannot assign your rights without our written consent.

Entire Agreement

This Policy, together with our Website Terms of Service, Client Service Agreement, and any other agreements you sign with us, constitutes the complete agreement regarding your privacy. It supersedes any prior discussions or representations about data practices.

CHANGES TO THIS POLICY

We may update this Policy from time to time. Changes will be posted on our website with an updated Effective Date. For material changes, like how we collect, use, or share your information, or changes to liability limits or dispute resolution procedures, we will provide at least 30 days’ notice by email and website posting before they take effect. For material changes, we’ll ask for your consent before they take effect. If you don’t agree, you can close your account and request deletion of your information (see Section 6). The version of this Policy that was in effect when you last used our services will continue to apply to information we collected before the change. For minor updates, your continued use means you accept them.

CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or your data practices:

Navari Lifestyle Management, LLC | 4440 PGA Blvd Suite | 600 Palm Beach Gardens, FL 33410

Email: [privacy email] Phone: [To be inserted]

We’re registered with the Florida Department of Agriculture and Consumer Services (this doesn’t mean the state endorses us). Verify our registration at 1-800-HELP-FLA or FloridaConsumerHelp.com.

Florida Seller of Travel: ST-[INSERT NUMBER].

Accessibility: If you need this Policy in an alternative format due to a disability, please contact us and we’ll work to accommodate your needs.

Last Updated: [To be inserted]