Effective Date: 01/01/2021

At Starboard Holdings LTD, (“Starboard”, “we,” or “us”), we have established a Privacy Policy to protect the information that we secure for business purposes. We are committed to protecting the personal information that we have obtained about you. This Privacy Policy describes how we collect, use, share, and protect your personal information. By accessing or using our website or services, you acknowledge that you have read, understood, and agree to this policy. If you cannot agree to this policy, then please do not use our website or services. To further understand our policy, please review the following details:

We may collect your personal information when you contact our customer care team for returns and exchange purposes. This information may include identifiers such as your name, email address, mailing address, credit card number, and expiration date. Applicants for employment, employees on board, and employees in our corporate office may be asked to provide us with their first name, last name, email address, and phone number.

Our Web Hosting Provider may collect some information, such as which of the pages on our website that you access, the frequency of access, and what you click on while on our website. Our Web Hosting Provider may collect information about the device you are using to access the website, such as, operating system, application version number, browser, and IP addresses.

We only use your personal information to provide you with our return and exchange services when you contact our customer care team. We use personal information to process your application for employment and to serve as your employer. We also use your personal information to comply with regulatory requirements, prevent fraud, enforce this Privacy Policy and any other agreements you have entered with us, for any purpose for which you provide consent, and for any other legitimate business purposes.

We comply with Federal and State requirements related to the protection and use of your personal information. This means that we may share personal information when required by law or legal process, and we will endeavor to ask for and obtain your permission in such situations. We may also be required to obtain your authorization before disclosing certain types of personal information.

We may share personal information if we believe it is necessary in order to detect, investigate, prevent, or act against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person.

If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, your personal information may be sold or transferred as part of such a transaction as permitted by law and/or contract. We cannot control how such entities may use or disclose such personal information.

We may share your personal information as appropriate to carry out any other legitimate business purposes permitted by law, such as sharing with our service providers and other partners that provide support to us when providing services to you.

The website may contain links to outside services and resources, the availability and content of which Starboard does not control. We are not responsible for examining or evaluating, and we do not warrant the offering of these services and resources or the content of these websites. Starboard does not assume any responsibility or liability for the actions, products, and content of these and any other websites. Any concerns regarding any such services or resources should be directed to the service or resource.

In order to protect your personal information, we maintain physical, electronic, and procedural safeguards, which we review regularly in keeping with technological advances. We restrict access to your personal information. Unfortunately, no security system is 100% secure, thus we cannot ensure the security of all personal information you provide to us via our interactions.

Our services are not intended for use by children. We do not knowingly collect personal information from children under the age of 13 years. Please contact us if you believe we may have unknowingly collected information from a child under 13 years of age, and we will take steps to delete any such personal information.

If you are a California Consumer, you have certain rights with respect to the collection, use, transfer, and processing of your “Personal Information”, as defined by the California Consumer Privacy Act (CCPA). We reserve the right to limit these rights where permitted under applicable law, including where your identity cannot be reasonably verified or to the extent your rights adversely affect the rights and freedoms of others. To exercise any of the rights below, please contact us via the contact information below. Only you or a person registered with the California DMEAST #42754657 v1 3 Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information.

In the preceding 12 months, we have not sold Personal Information about consumers.

In the preceding 12 months, we have not sold Personal Information about minors.

Individual Rights
Right to Know About Personal Information Collected, Disclosed, or Sold

You have the right to request that Starboard disclose the Personal Information it collects, uses, and discloses about you to third parties. There are two types of Right to Know requests you can make:

1. Right to Know (Abbreviated Request): If you make a Right to Know (Abbreviated Request), you will receive the following information about you:
   1. The categories of Personal Information collected in the past 12 months,
   2. The categories of sources from which the Personal Information was collected ,
   3. The business or commercial purpose(s) for which the Personal Information was collected or sold ,
   4. The categories of third parties with whom Personal Information has been shared ,
   5. The categories of Personal Information sold in the preceding 12 months, and for each category identified, the categories of third parties to which Starboard sold that particular category of Personal Information, and
   6. The categories of Personal Information disclosed for a business purpose in the preceding 12 months, and for each category identified, the categories of third parties to whom it disclosed that particular category of Personal Information.
2. Right to Know (Specific Pieces of Information Request): If you make a Right to Know (Specific Pieces of Information Request), you will receive the following information about you:
   1. Specific pieces of Personal Information collected about you.

This information will be provided to you free of charge, unless Starboard determines that your request is manifestly unfounded or excessive. You may request this information twice in a 12-month period.

Right of Deletion
You have the right to request that Starboard and our service providers delete any Personal Information about yourself that Starboard has collected from you upon receipt of a verifiable request. This right is subject to exceptions.

Right to Opt Out of the Sale of Information
California Consumers have the right to opt-out of the sale of Personal Information by a business that sells Personal Information. Starboard does not sell any Personal Information of California Consumers.

Submitting Requests
You may submit a request through email at datarequests@starboardcruise.com

Verifying Requests
Starboard provides California Consumers with the ability to submit requests through our request email address. Starboard must verify that the person requesting information or deletion is the California Consumer about whom the request relates in order to process the request. To verify a California Consumer’s identity, we may request up to up to three pieces of Personal Information about you when you make a request to compare against our records. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in your request to verify your identity and will delete any information you provide after processing the request. Starboard reserves the right to take additional steps as necessary to verify the identity of California Consumers where we have reason to believe a request is fraudulent.

Authorized Agent
Consumers may use an authorized agent to submit their request. The authorized agent must be registered with the California Secretary of State and be authorized to submit requests on behalf of a consumer. If you are an authorized agent and a consumer has given you signed permission to submit a request on his or her behalf, please send a copy of your signed permission by the consumer to Starboard. Failure to submit proof of signed permission may result in Starboard denying the consumer’s request. Starboard will require the consumer to verify his or her identity and directly confirm with Starboard that the consumer has provided you with permission to submit the request.

Right to Equal Service
Starboard will not discriminate against you because you exercised any of your rights, including, but not limited to, by:

1. Denying goods or services to you.
2. Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
3. Providing a different level or quality of goods or services to you.
4. Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

This section of our Privacy Policy provides certain required information to persons located in the European Union (“EU”), a European Economic Area (“EAA”) member state, or Switzerland. Before Starboard collects any Personal Data, as defined by the General Data Protection Regulation (“GDPR”), you are entitled to the information in this section of our Privacy Policy as required by the GDPR.

Legal Bases for Processing Personal Data
Starboard will only process your Personal Data when Starboard has a lawful basis for doing so. Starboard will collect and process your Personal Data as necessary for the performance of a contract to which you are a party or because Starboard has another legitimate interest in doing so relating to Starboard’s business purposes arising from your relationship with Starboard. Starboard may also seek your prior consent or rely on some other lawful basis to process your Personal Data.

Rights of Users Located In The EU
If you use our sites and are located in the EU, EAA, or Switzerland, you are entitled by law to access, correct, amend, or delete Personal Data about you that we hold. A list of these rights is below. Please note that these rights are not absolute and certain exemptions may apply to specific requests that you may submit to us.

1. The right to access. You have the right to ask us for copies of your Personal Data. When making a request, please provide an accurate description of the Personal Data to which you want access. We may charge a reasonable fee based on administrative cost.
2. The right to rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
3. The right to erasure. You have the right to ask us to erase your Personal Data in certain circumstances, including your Personal Data must be erased to comply with a legal obligation under EU or member state law.
4. The right to restrict processing. You have the right to ask us to restrict the processing of your Personal Data in certain circumstances, including: (i) when the accuracy of the Personal Data is brought into question, or (ii) DMEAST #42754657 v1 6 when we no longer need the Personal Data for the purposes of the processing but you require such Personal Data for the establishment, exercise, or defense of a legal claim.
5. The right to data portability. You have the right to ask that we transfer the Personal Data you gave us from one organization to another, or give it to you.
6. The right to lodge a complaint with the supervisory authority. If you believe your rights under the GDPR have been violated, the GDPR gives you the right to file a complaint with your supervisory authority. A list of supervisory authorities is available here: http://ec.europa.eu/justice/dataprotection/bodies/authorities/index_en.html.
7. The right to withdraw consent. If Starboard obtains your written consent to collect and process your Personal Data, you can subsequently withdraw such consent as to any further processing of information by contacting us.
8. Automated decision-making. To the extent that Starboard engages in decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or which significantly affects you, you have the right not to be subject to such decision-making.

To exercise these rights please contact us at datarequests@starboardcruise.com. For your protection, we may need to verify your identity before responding to your request. In the event that we refuse a request, we will provide you a reason as to why.

Right to Object to Processing
You have the right to object to the processing of your Personal Data that is based on legitimate interests. If you make such an objection, we will cease to process the Personal Data unless we can demonstrate compelling legitimate grounds for the processing which override your interests or which override your rights and freedoms, or we can demonstrate the processing is for the establishment, exercise, or defense of legal claims. You can object to the processing of your Personal Data by contacting us at datarequests@starboardcruise.com

Cross-Border Transfers of Personal Data
Personal Data that you provide while in the EU, an EAA member state, or Switzerland will be transferred to the United States. The GDPR permits such transfer when necessary for the performance of a contract between you and Starboard, if Starboard obtains your explicit consent to such transfer, or if it is Starboard’s legitimate interest to transfer the Personal Data. The laws in the United States may not be as protective of your privacy as those in your location. If we transfer Personal Data from the EU, we will provide an appropriate safeguard such as binding corporate rules, standard data protection clauses, or your consent.

Retention of Your Personal Data
We will retain your Personal Data until the Personal Data is no longer necessary to accomplish the purpose for which it was provided. We may retain your Personal Data for longer periods for specific purposes to the extent that we are obliged to do so in accordance with applicable laws and regulations, to protect you, other people, and us from fraud, abuse, an unauthorized access, as necessary to protect our legal rights, or for certain business requirements.

Starboard’s most current Privacy Policy will be available on our website or at the bottom of the homepage. You are encouraged to review it periodically to familiarize yourself with our Privacy Policy and how it may apply to your personal situation. If there are any material changes or amendments to the Privacy Policy, we will notify you by posting an updated Privacy Policy to the website.

For additional information or questions, please contact us at: customerprivacy@starboardcruise.com