PARAGON LUXURY VILLAS & PARAGON SKI CHALETS — PRIVACY POLICY

Effective Date: August 2026

Operating Websites: paragonluxuryvillas.com | paragonskichalets.com

1. ABOUT THIS PRIVACY POLICY & DATA CONTROLLER

This Privacy Policy explains how PARAGON LUXURY VILLAS LTD (trading as Paragon Luxury Villas and Paragon Ski Chalets, hereinafter referred to as “Paragon”, “we”, “us”, or “our”) collects, uses, stores, discloses, and protects your personal data.

This policy applies when you interact with our websites, make enquiries, request bespoke advisory services, sign booking agreements, make direct payments, or utilize our luxury concierge services.

Data Controller Identification:

• Legal Entity: PARAGON LUXURY VILLAS LTD

• Company Registration Number: 12435740 (Registered in England & Wales)

• Registered Office Address: Yew Tree House, Lewes Road, Forest Row, England, RH18 5AA

• Privacy & Compliance Email: info@paragonluxuryvillas.com

We act as a Data Controller under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR) 2016/679, and the Swiss Federal Act on Data Protection (FADP).

2. DUAL DYNAMICS: HOW WE OPERATE & PROCESS PAYMENTS

Depending on whether you book a luxury villa or a ski chalet, Paragon operates under two specific financial and agency models:

1. Direct Payment Handling (Primarily Luxury Villas): For approximately 99% of Paragon Luxury Villa bookings, Paragon collects and processes booking fees, deposits, balance payments, and refundable security deposits directly from guests via bank transfer or PCI-DSS compliant credit card gateways.

2. Introductory Agency & Principal Direct Payment (Primarily Ski Chalets): For approximately 95% of Paragon Ski Chalet bookings, Paragon acts as an introductory booking agent. In these cases, guest booking funds and contract data are transmitted directly to, or processed on behalf of, the independent Property Principal (the chalet owner, chalet operator, or destination management company holding the master accommodation contract).

3. THE PERSONAL DATA WE COLLECT ABOUT YOU

We collect personal data necessary to provide luxury accommodation sourcing, process financial transactions, and deliver bespoke concierge services. We categorize this data as follows:

• Identity Data: Full names, titles, dates of birth, passport numbers, nationality, and government ID copies for all members of your traveling party.

• Contact Data: Email addresses, residential addresses, primary phone numbers, and emergency contact details.

• Financial & Transaction Data: Payment card details, bank account details, transaction histories, payment receipts, and billing addresses. (Note: Card data is processed securely via PCI-DSS compliant payment gateways. We do not store raw CVV security codes).

• KYC & Anti-Money Laundering (AML) Data: For high-value bookings (exceeding £50,000 / €50,000 / CHF 50,000), we collect proof of identification, proof of residential address, and source-of-funds documentation required under UK, EU, and French TRACFIN regulations.

• Booking & Stay Preference Data: Guest names, dietary preferences or severe allergies, equipment sizes (height, weight, shoe size for ski hire), ski ability levels, pool heating requirements, flight details, childcare/nanny requirements, and special itinerary requests.

• Technical & Usage Data: IP address, device type, browser settings, time zone, and browsing activity collected via essential and analytical web cookies.

4. HOW WE COLLECT YOUR PERSONAL DATA

• Direct Interactions: When you fill in enquiry forms on our websites, sign digital booking contracts, correspond with our advisory team by phone or email, or transfer booking funds to us.

• Property Principals & In-Resort Partners: Data received from independent property owners, chalet operators, or destination managers confirming booking details or fulfilling concierge requests.

• Automated Technologies: Technical data collected automatically when you visit paragonluxuryvillas.com or paragonskichalets.com through cookies and server logs.

5. LAWFUL BASES FOR PROCESSING YOUR DATA

Under UK/EU GDPR and Swiss FADP, we must have a valid legal basis to process your personal data:

6. DISCLOSURE & SHARING OF YOUR PERSONAL DATA

To deliver high-end luxury accommodation and resort services across international destinations (including France, Switzerland, Austria, Italy, Spain, Greece, the Caribbean, and the UK), we share relevant data only with necessary third parties:

1. Independent Property Principals & Chalet Operators: When booking a chalet or villa where the contract is with a third-party principal, we share guest names, party numbers, arrival details, and stay preferences so they can host your stay.

2. In-Resort Service Providers: Local ski pass offices, ski equipment suppliers, private chef agencies, transfer/chauffeur companies, yacht charters, and nanny providers hired to fulfill your requested concierge services.

3. Payment Processors & Banking Partners: PCI-DSS compliant credit card processors and regulated commercial banks used to process rental payments, hold security deposits, or verify financial transactions.

4. Regulatory, Legal & Tax Authorities: Law enforcement, anti-money laundering bodies (such as French TRACFIN or UK NCA), local municipality tax authorities (for Tourist Tax / Taxe de Séjour compliance), and legal advisers where mandated by law.

5. Technical Infrastructure Providers: Encrypted cloud hosting platforms, customer relationship management (CRM) systems, and digital contract execution tools.

7. INTERNATIONAL DATA TRANSFERS

Because our portfolio includes luxury properties located in the UK, the European Economic Area (EEA), Switzerland, and worldwide, processing your booking requires transferring personal data across international borders.

• Transfers to Switzerland: Data transfers between the UK/EU and Switzerland are legally recognized under statutory Adequacy Decisions granted by the European Commission and the UK Government (reflecting the Swiss Federal Act on Data Protection – FADP).

• Transfers Outside the UK/EEA: When transferring data to non-adequate jurisdictions (e.g., Caribbean or international villa locations), we ensure data transfers are protected under Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements (IDTAs), or are strictly limited to what is required for the performance of your booking contract.

8. DATA SECURITY & RETENTION

• Security: We employ strict technical and organizational safeguards—including SSL encryption, restricted administrative access, firewall security, and secure payment processing—to protect your personal information against unauthorized access, loss, or alteration.

• Retention Limits: We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Under UK tax, corporate, and anti-money laundering legislation, financial transactions, booking records, and KYC compliance documents are retained for 6 to 7 years following the end of the booking relationship.

9. YOUR LEGAL RIGHTS

Under UK GDPR, EU GDPR, and the Swiss FADP, you hold the following statutory rights regarding your personal data:

• Right of Access: Request a copy of the personal data held about you (Subject Access Request).

• Right to Rectification: Request correction of inaccurate or incomplete personal records.

• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, subject to legal/statutory record-keeping retention requirements.

• Right to Restrict or Object: Object to direct marketing or processing based on legitimate interests.

• Right to Data Portability: Request the transfer of your data to another organization in a structured, machine-readable format.

• Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise any of your rights, please email our privacy team at info@paragonluxuryvillas.com.

10. COOKIES & THIRD-PARTY LINKS

Our websites use essential operational cookies for security and site navigation, as well as optional analytical cookies to evaluate site traffic and improve performance. You can manage your cookie preferences through your browser settings.

Our websites may contain links to external third-party sites (e.g., tourism boards, local venues, or partner airlines). We do not control external content and are not responsible for the privacy practices of external websites.

11. AMENDMENTS TO THIS PRIVACY POLICY

We review and update this Privacy Policy periodically to reflect legal, technical, or operational updates. Any updates will be published directly on paragonluxuryvillas.com and paragonskichalets.com with a revised effective date.