PRIVACY NOTICE - Shelly European Partner Event 2026

PRIVACY NOTICE

Shelly European Partner Event 2026 - Personal Details Form (Hotel Registration)

Nixe Palace Hotel, Mallorca, Spain  |  27-29 October 2026

In force as of: 07.06.2026

This Privacy Notice explains how your personal data is collected and processed when you complete the Personal Details Form for the Shelly European Partner Event 2026. We request these details to ensure a smooth and efficient check-in process at the hotel where you will be staying. As this personal data is collected directly from you, we provide the relevant information in accordance with Articles 12 and 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”).

Please review this information carefully before submitting the form.

The controller of your personal data is Shelly Europe Ltd., UIC 202320104, with its seat and registered address at No 51 Cherni Vrah Blvd., building 3, floors 2 and 3, Sofia, Bulgaria ("Shelly", "we", "us"). Shelly Europe Ltd. is the organiser of the event.

Our Data Protection Officer (DPO) will respond to any query regarding the processing and protection of your personal data. You can contact the DPO by email at dpo@shelly.com. The DPO can also be reached by post at: Shelly Europe Ltd., 51 Cherni Vrah Blvd., building 3, floors 2 and 3, Sofia 1407, Bulgaria.

This notice applies solely to the processing of personal data collected through the Personal Details Form used to prepare your hotel registration and check-in.

We collect only the data you provide through the Personal Details Form. The mandatory fields are those the hotel requires in order to register you as a guest and prepare your check-in; the optional fields help us coordinate travel and on-site logistics.

3.1. Mandatory information

•    First name and surname(s), as shown on your travel document;

•    Residential address - street address, city, postal code and country;

•    Document type (passport or national identity card);

•    Passport or national identity card number;

•    Date of birth;

•    Nationality;

•    Phone number (including country code);

•    Email address;

•    Expected arrival date and expected departure date.

3.2. Optional information

•    Approximate arrival time;

•    Approximate departure time.

Please note: we ask for the details of your identity document only because the hotel requires them in order to register you as a guest. We do not ask you to upload or send a copy or scan of your passport or identity card, and you should not provide one.

We process your personal data for the following purposes and on the following legal bases under Article 6 GDPR:

Legitimate interests: where we rely on Article 6(1)(f) GDPR, the legitimate interests we pursue are the effective organisation, administration and delivery of the event, including the accommodation we arrange and provide for you as our invited partner. We have weighed these interests against your rights and freedoms and consider that, having confirmed your attendance at an event at which we arrange your stay, you would reasonably expect this processing. We collect only the details the hotel requires, we do not use them for any unrelated purpose, and we delete them shortly after your stay. You may object at any time as described in Section 8.

We share your personal data only as necessary to arrange your accommodation and deliver the event, with the following recipients:

5.1. Recipients acting as independent controllers

The following recipients receive your data in order to provide their own services to you and determine the purposes and means of their own processing. They therefore act as independent (separate) controllers and process your data under their own privacy policies and their own responsibility under the GDPR:

•    Nixe Palace Hotel - the accommodation provider in Mallorca, in order to register you as a guest, prepare your check-in and provide rooms and on-site services, and in order to meet its own legal and regulatory obligations relating to the registration of guests, including any reporting to the competent authorities and any retention required of it by law. The hotel's own processing, including how long it keeps your data, is governed by its own privacy policy and is outside our control.

•    Shelly Group affiliates involved in hosting and inviting partners.

5.2. Recipients acting as processors

Personal data may also be disclosed to competent public authorities and regulators where required by applicable law, regulation or court order.

The event and the hotel are located in Spain, and Shelly and the main group entities are established in the European Union; the data you submit for your hotel registration therefore remains within the European Economic Area (EEA). For more information about these safeguards, or to obtain a copy, please contact dpo@shelly.com

We keep the data you submit through this form only for as long as necessary to arrange your hotel registration and deliver the event. We delete the details of your identity document promptly once your check-in has been completed, and in any event no later than 14 days after the conclusion of the event.

Where your data has been provided to the hotel, the hotel retains it independently of us for as long as it is required to do so under the obligations applicable to it, in accordance with its own privacy policy. We cannot delete data held by the hotel on your behalf; requests concerning the hotel's own processing should be addressed to the hotel.

We will not delete data where, and for as long as, its retention is required by applicable law (for example accounting obligations) or where legal, administrative or judicial proceedings are pending at the time of expiry, in which case the data is retained until those obligations or proceedings conclude and is then securely deleted.

Subject to the conditions and exceptions in the GDPR, you have the following rights in relation to your personal data:

•    Access (Art. 15) - to obtain confirmation of whether we process your data and a copy of it.

•    Rectification (Art. 16) - to have inaccurate data corrected or incomplete data completed.

•    Erasure / 'right to be forgotten' (Art. 17) - to have your data deleted in the cases provided by law.

•    Restriction (Art. 18) - to request that we restrict processing in certain circumstances.

•    Data portability (Art. 20) - where processing is based on consent or a contract and carried out by automated means, to receive your data in a structured, commonly used, machine-readable format.

•    Object (Art. 21) - to object at any time to processing based on our legitimate interest; we will then stop unless we demonstrate compelling legitimate grounds, or the processing is needed for legal claims.

•    Not be subject to automated decision-making (Art. 22) - see Section 10.

8.1. Objecting to processing

You may object at any time to our processing of your data on the basis of our legitimate interest by contacting dpo@shelly.com. Please note that if you object before your details have been provided to the hotel, we will not be able to complete your hotel registration on your behalf, and you may need to provide your details directly to the hotel at check-in.

8.2. Lodging a complaint

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) of the Republic of Bulgaria, or with the supervisory authority in your EU Member State of habitual residence, place of work or place of the alleged infringement.

8.3. How to exercise your rights

Unless otherwise stated above, you can exercise your rights by sending a written request to dpo@shelly.com

Providing the mandatory form fields is not a statutory or contractual requirement on you, but it is necessary in order for us to arrange your registration at the hotel in advance. If you do not provide the mandatory information, we will not be able to complete your hotel registration on your behalf, and you may be required to provide these details directly to the hotel on arrival, which may delay your check-in. Providing the optional fields (approximate arrival and departure times) is entirely voluntary.

You are not subject to automated decision-making. In the event that automated decision-making, including profiling, is applied, you will receive essential information about the logic used and the intended consequences of this processing.

We may update this Privacy Notice where necessary. The version in force is the one published with the Personal Details Form and identified by the date stated above.