Customer Documents

CUSTOMER PRIVACY POLICY Version 1.0 –April 2026

Katanbooking Ltd. (“Katanbooking”, “we”, “us” or “our”) recognises that trust is fundamental to the use of our Platform. Protecting your Personal Data is therefore an essential part of how we design, operate and continuously improve our services.

This Customer Privacy Policy explains how we collect, use, process, store and share Personal Data when you access or use the Katanbooking Platform, including our website, features, tools and services. These services include, in particular, user account functionality, search and discovery tools, AI-powered recommendations, booking and payment processes, communication tools, customer support, and related platform operations.

Katanbooking processes Personal Data in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 and the laws of the Republic of Cyprus.

This Privacy Policy also explains your rights in relation to your Personal Data and how you can exercise those rights.

Katanbooking operates as an intermediary online marketplace that enables independent Providers to offer Provider Services, which may include activities, experiences, equipment rentals, transportation-related services and other tourism or leisure services, to Customers and Participants. Katanbooking does not provide or perform Provider Services itself.

Where Personal Data is shared with a Provider in connection with a Booking, such Provider may process that Personal Data as an independent Controller where necessary to deliver the relevant Provider Service, comply with legal, regulatory, safety or insurance obligations, communicate with the Customer or Participants in relation to the Booking, or otherwise as permitted under applicable law. Katanbooking does not control such processing, and it is subject to the Provider’s own privacy practices.

1. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

“Customer” means any individual who accesses or uses the Katanbooking Platform to browse, search, request, book or pay for Provider Services. Where a Customer is a legal entity, this Privacy Policy applies to Personal Data relating to individuals acting on its behalf, including representatives, employees, contact persons and Participants.

“Participant” means any individual who takes part in or receives Provider Services included in a Booking, whether or not that individual is the Customer who made or paid for the Booking.

“Provider” means an independent service provider offering Provider Services through the Katanbooking Platform.

“Provider Services” means any services, activities, experiences, rentals, transportation-related services or other offerings made available by Providers through the Platform.

“Booking” means a reservation or request for Provider Services made through the Katanbooking Platform, whether confirmed instantly or subject to Provider acceptance.

“Katanbooking Platform” or “Platform” means the online marketplace operated by Katanbooking, including its website, systems, tools, communication features and related services.

“Personal Data” means any information relating to an identified or identifiable natural person, as defined under the GDPR.

“Processing” means any operation or set of operations performed on Personal Data, including collection, recording, storage, structuring, use, disclosure, transmission, restriction or deletion.

“Controller” means the natural or legal person which determines the purposes and means of the processing of Personal Data.

“Processor” means a natural or legal person which processes Personal Data on behalf of the Controller.

“Stripe” means Stripe Payments Europe Limited and/or its affiliated entities, or any replacement or additional payment service provider used by Katanbooking for payment processing.

“AI Recommender” means Katanbooking’s AI-based or algorithmic systems that analyse user inputs, preferences, behaviour or contextual information in order to suggest or prioritise relevant Provider Services or content.

2. Controller and Contact Details

The Controller responsible for the processing of Personal Data described in this Customer Privacy Policy is:

Katanbooking Ltd. Akropoleos 82, 2nd Floor Akropoli, 2012 Nicosia, Cyprus Company registration number: HE 435484

For any questions, requests or concerns relating to this Privacy Policy or the processing of your Personal Data, you may contact us at:

Email: support@katanbooking.com

Katanbooking will handle all privacy-related requests in accordance with applicable data protection laws.

You also have the right to lodge a complaint with the competent supervisory authority in Cyprus:

Office of the Commissioner for Personal Data Protection

https://www.dataprotection.gov.cy

3. Scope of the Policy

This Privacy Policy applies to the processing of Personal Data of individuals who interact with the Katanbooking Platform, including Customers, visitors, registered users and Participants included in a Booking.

This Privacy Policy also applies where Personal Data is processed in connection with Bookings made through booking channels, distribution partners or other third parties designated or authorised by Katanbooking, to the extent that Katanbooking processes such Personal Data as a Controller.

This Privacy Policy covers Personal Data processed by Katanbooking in its capacity as a Controller in connection with the operation of the Platform, including browsing, account creation, bookings, payments, communications, support, and related services.

For the avoidance of doubt, this Privacy Policy does not govern the processing of Personal Data by Providers where they process such data independently for their own purposes. This includes, in particular, processing carried out by Providers in connection with the delivery of Provider Services, operational coordination, safety requirements, insurance, compliance with legal or regulatory obligations, or internal business purposes.

In such cases, Providers act as independent Controllers, and the processing of Personal Data is subject to the Provider’s own privacy policy and practices.

4. Personal Data We Collect

Katanbooking collects and processes Personal Data depending on how you interact with the Platform, the services you use, and the context in which such interaction takes place. The categories of Personal Data we process are limited to what is necessary for the operation of the Platform, the facilitation of Bookings, and the provision of related services.

When you access or use the Katanbooking Platform, certain technical and usage-related information may be collected automatically. This may include your IP address, device type, browser and operating system, language preferences, as well as information about how you navigate and interact with the Platform, including pages visited, timestamps and related technical logs. This information is used to ensure the proper functioning, security and performance of the Platform, as well as to detect and prevent misuse.

Where you create and use an account, Katanbooking processes account-related information such as your name, email address, telephone number, login credentials (stored in a secure, hashed format), account settings, and account activity, including login history. This information is necessary to establish and manage your account and to enable access to Platform functionality.

In connection with a Booking, Katanbooking processes information required to facilitate and manage the Booking. This may include details of the selected Provider Services, date and time, number of Participants, booking status, confirmations, cancellations and changes, as well as contact details and any information necessary to fulfil the Booking. Where you make a Booking on behalf of other individuals, we may also process Personal Data relating to Participants, including names, contact details where provided, and any relevant attributes or requirements necessary for the delivery of the Provider Service. You are responsible for ensuring that you have the authority to provide such data.

To enable payments and related financial operations, Katanbooking processes transaction-related information, including payment status, transaction identifiers, billing details and limited payment-related information received from payment service providers. Katanbooking does not store full payment card details. Payment processing is carried out by authorised third-party payment providers, including Stripe.

Katanbooking may also process Personal Data contained in communications made through the Platform or with our support teams. This includes messages exchanged between Customers and Providers, customer support requests, dispute or complaint information, and any content, documents or materials voluntarily provided in connection with such communications. Where applicable, we may also process information submitted as part of reviews or other user-generated content, including ratings, comments and associated materials.

In addition, Katanbooking may process data related to your communication preferences, including newsletter subscriptions, consent records, and interactions with marketing communications, as well as records of opt-in and opt-out choices.

To improve user experience and enhance the relevance of the Platform, Katanbooking may process information relating to your preferences, search behaviour, browsing activity, booking history and interactions with the Platform. This information may be used in connection with AI-based or algorithmic systems designed to suggest or prioritise relevant Provider Services or content.

Finally, Katanbooking may process information collected through cookies and similar technologies, including session data, identifiers, analytics data and performance-related information, as further described in our Cookie Policy.

5. Why We Process Personal Data and Legal Bases

Katanbooking processes Personal Data only where there is a lawful basis to do so under the General Data Protection Regulation (EU) 2016/679. The purposes for which Personal Data is processed, and the corresponding legal bases, are set out below.

Katanbooking processes Personal Data to operate the Platform and provide its core functionality, including account management, search and discovery, and the facilitation and management of Bookings between Customers and Providers. Such processing is necessary for the performance of a contract or in order to take steps at your request prior to entering into a contract.

In order to facilitate payments, refunds and related financial operations, Katanbooking processes Personal Data in cooperation with authorised third-party payment providers, including Stripe. This processing may also be required to comply with applicable legal and regulatory obligations, including financial reporting, fraud prevention and anti-money laundering requirements. Accordingly, the legal basis for such processing may include the performance of a contract, compliance with legal obligations, and Katanbooking’s legitimate interests in maintaining secure and reliable payment flows.

Katanbooking also processes Personal Data to share relevant Booking information with Providers, where necessary to enable the delivery of Provider Services. This processing is an essential part of the contractual relationship between the Customer and the Provider and is therefore based on the performance of a contract.

Personal Data is further processed to provide customer support, respond to inquiries, handle complaints and disputes, and maintain appropriate records of such interactions. Depending on the context, this processing is based on the performance of a contract or Katanbooking’s legitimate interests in ensuring the proper functioning of the Platform and maintaining service quality.

Katanbooking processes Personal Data to ensure the security and integrity of the Platform, including detecting and preventing fraud, abuse, unauthorised use and other harmful activities. This processing is based on Katanbooking’s legitimate interests in protecting its Platform, its users and its business operations.

We also process Personal Data to send transactional and service-related communications, such as booking confirmations, reminders, updates and operational notifications. Such communications are necessary for the performance of a contract.

Where permitted by applicable law, Katanbooking may process Personal Data to send marketing communications, including newsletters and information about services similar to those you have used. Where required, such processing is based on your consent. You may withdraw your consent or opt out of marketing communications at any time.

Katanbooking may process Personal Data to personalise content, improve search functionality and provide AI-powered recommendations tailored to your preferences and behaviour. Depending on the nature of such processing, the legal basis may be Katanbooking’s legitimate interests in improving user experience or your consent, particularly where personalisation relies on certain tracking technologies.

In addition, Katanbooking processes Personal Data to comply with applicable legal obligations, including tax, accounting, regulatory and reporting requirements. Such processing is based on compliance with legal obligations under applicable law.

Finally, Katanbooking may process Personal Data for analytics, testing, product development and Platform improvement purposes. This includes analysing how users interact with the Platform in order to enhance functionality, performance and overall user experience. Such processing is based on Katanbooking’s legitimate interests, or on your consent where required.

6. Booking and Provider Data Sharing

In order to facilitate Bookings and enable the proper delivery of Provider Services, Katanbooking shares certain Personal Data with the relevant Provider at the appropriate stage of the booking and service delivery process.

Such data sharing is limited to what is necessary for the performance of the Booking and may include, in particular, the Customer’s name, contact details where required, Booking details, number of Participants, relevant timing and logistical information, and any special requests or requirements provided by the Customer. Where necessary for safety or operational reasons, this may also include information relevant to participation requirements.

This sharing of Personal Data is essential to enable the Provider to prepare for and deliver the Provider Service and is carried out on the basis of the performance of a contract.

Providers are required to use such Personal Data only for purposes directly related to the delivery of the relevant Provider Service, compliance with applicable legal and regulatory obligations, safety requirements, insurance or liability management, and necessary communication with the Customer or Participants in connection with the Booking.

For the avoidance of doubt, where a Provider processes Personal Data for its own purposes in connection with the provision of Provider Services, including operational, legal, safety, insurance or compliance purposes, the Provider acts as an independent Controller. Katanbooking does not control such processing and is not responsible for the Provider’s handling of Personal Data, which is governed by the Provider’s own privacy policy and practices.

Where technically feasible and operationally appropriate, Katanbooking may restrict, mask or proxy direct contact details exchanged between Customers and Providers. However, limited information may become visible to Providers where necessary for check-in, operational coordination, safety or delivery of the Provider Service.

7. Payments and Stripe

Katanbooking facilitates payments for Bookings through authorised third-party payment service providers, including Stripe Payments Europe Limited (“Stripe”) and, where applicable, Stripe Connect or other equivalent payment infrastructure.

For the avoidance of doubt, Katanbooking does not hold Customer funds and does not provide regulated payment services. Payments are processed by authorised third-party payment service providers in accordance with their own terms, privacy policies and applicable law.

Payment processing is carried out by such providers in accordance with their own terms and privacy policies. Depending on the context, Stripe may act as an independent Controller in relation to certain payment processing activities, including regulatory compliance, fraud prevention and financial transaction processing, and may also act as a Processor where it processes data on behalf of Katanbooking.

Katanbooking does not collect or store full payment card details. Payment information is transmitted directly to the payment service provider through secure channels.

Katanbooking may process limited payment-related information necessary to support the operation of the Platform. This may include payment status, transaction identifiers, Booking-related financial records, refund status, and payout-related information. Such processing is carried out for purposes including Booking management, customer support, accounting, fraud prevention, dispute resolution and compliance with legal and regulatory obligations.

Where required, Personal Data relating to payments may also be shared with payment service providers, financial institutions, or other authorised entities in connection with transaction processing, fraud detection, chargebacks, or compliance with applicable law.

8. AI Recommender and Personalisation

Katanbooking may use automated, algorithmic or AI-assisted tools (the “AI Recommender”) to enhance the user experience on the Platform and to improve the relevance of Provider Services presented to Customers.

Such systems may analyse information including user inputs, selected preferences, search queries, browsing behaviour, location, dates, group size, booking history and interactions with the Platform in order to suggest, prioritise or personalise Provider Services, content or search results.

The use of the AI Recommender is intended to support discovery and decision-making by presenting more relevant options. It does not replace user judgment and does not produce decisions that have legal or similarly significant effects on the user.

For the avoidance of doubt, AI-generated or algorithmically generated recommendations do not constitute legal, financial, medical, safety or professional advice. The final decision to select, book or participate in any Provider Service remains solely with the Customer.

Where the use of personalisation involves the processing of Personal Data beyond what is strictly necessary for the operation of the Platform, Katanbooking relies on its legitimate interests in improving user experience, unless applicable law requires consent, in which case such consent will be obtained.

9. Customer Support, Chat, Reports and Disputes

Katanbooking processes Personal Data in connection with communications and interactions between Customers, Providers and Katanbooking, including through messaging tools available on the Platform, customer support channels and other communication methods.

This may include the processing of messages exchanged between Customers and Providers, support requests, inquiries, complaints, reports, dispute submissions, and any related information, including documents, images, attachments or other materials voluntarily provided in connection with such communications.

Katanbooking may access, review, store and analyse such communications where necessary to provide customer support, facilitate Bookings, assist in resolving disputes, ensure compliance with Platform rules, protect the safety of users, prevent fraud or misuse of the Platform, and support the establishment, exercise or defence of legal claims.

Such processing is carried out on the basis of the performance of a contract and, where applicable, Katanbooking’s legitimate interests in maintaining the integrity, safety and proper functioning of the Platform.

10. Reviews and User Content

The Katanbooking Platform may allow Customers to submit reviews, ratings and other content in relation to Provider Services (“User Content”).

Where such functionality is available, Katanbooking may process and display certain Personal Data as part of User Content. This may include, for example, a Customer’s first name, rating, review text, and details of the relevant Provider Service. Such information may be made publicly available on the Platform and, where applicable, may be used in connection with the promotion and presentation of Provider Services.

The submission of reviews and User Content is voluntary. By submitting such content, you acknowledge that the information you provide may be visible to other users and may be associated with your Booking or experience.

Customers may request the removal or modification of their User Content at any time. Katanbooking will assess such requests in accordance with applicable law. Notwithstanding the foregoing, Katanbooking may retain certain information where necessary for legitimate purposes, including the prevention of fraud or misuse, compliance with legal obligations, the protection of the Platform and its users, or the establishment, exercise or defence of legal claims.

Reviews and other User Content are also subject to the content, moderation and usage rules set out in the General Terms and Conditions.

11. Cookies and Tracking Technologies

Katanbooking uses cookies and similar tracking technologies to ensure the proper functioning, security and performance of the Platform, and to improve user experience.

Certain cookies are strictly necessary for the operation of the Platform and are required to enable core functionality, including user authentication, account access, booking processes, security features and the storage of user preferences. These technologies are essential for the use of the Platform and cannot be disabled without affecting its functionality.

Katanbooking may also use analytics cookies and similar technologies to understand how users interact with the Platform, to measure performance, and to improve functionality and user experience. Where required by applicable law, such technologies are used only with your consent.

In addition, Katanbooking may use marketing or advertising technologies to deliver relevant content and to measure the effectiveness of marketing activities. These technologies are used only where you have provided consent, where such consent is required under applicable law.

Further information about the use of cookies and tracking technologies, including details of specific providers and your available choices, is provided in our Cookie Policy and through the cookie preference tools made available on the Platform.

12. Marketing Communications

Katanbooking may use your Personal Data to communicate with you in connection with your use of the Platform.

Certain communications are strictly necessary for the provision of our services. These include, in particular, booking confirmations, reminders, updates relating to Provider Services, changes or cancellations, payment and refund notifications, and other operational or service-related messages. Such communications are an integral part of the Platform and do not constitute marketing.

Where permitted by applicable law, Katanbooking may also use your contact details to send marketing communications, including newsletters, promotional offers and information about Provider Services or features that may be of interest to you.

Where required, such communications will be sent only on the basis of your prior consent. In certain circumstances permitted under applicable law, Katanbooking may rely on its legitimate interests to send communications relating to services similar to those you have previously used (so-called “soft opt-in”).

You may opt out of receiving marketing communications at any time by using the unsubscribe link included in such communications, adjusting your account settings where available, or contacting Katanbooking directly. Opting out of marketing communications will not affect your ability to receive service-related communications necessary for the performance of your Bookings or the operation of your account.

13. Service Providers and Processors

Katanbooking may engage carefully selected third-party service providers and partners to support the operation, security and improvement of the Platform.

These third parties may process Personal Data on behalf of Katanbooking as Processors, or, where applicable, act as independent Controllers in accordance with their own legal obligations and privacy policies.

Such service providers may include, in particular, providers of cloud infrastructure and hosting services (such as AWS or equivalent providers), payment service providers (including Stripe), email delivery services, authentication and identity management providers, analytics and performance monitoring tools, customer support and communication platforms, as well as external IT service providers, developers, consultants, legal advisors, auditors and accounting service providers.

Where such providers act as Processors, Katanbooking ensures that they process Personal Data only on documented instructions and subject to appropriate contractual safeguards, including confidentiality obligations and data protection requirements in accordance with applicable law.

Where third-party providers act as independent Controllers, including in particular payment service providers, they process Personal Data in accordance with their own terms and privacy policies.

Katanbooking takes reasonable steps to ensure that all service providers processing Personal Data implement appropriate technical and organisational measures to protect such data and to ensure compliance with applicable data protection laws.

14. International Data Transfers

Katanbooking may transfer Personal Data to third parties located outside the European Economic Area (“EEA”) where this is necessary for the operation of the Platform, including in connection with the use of service providers, payment infrastructure, analytics tools, communication systems or other technical services.

Such transfers may involve, for example, cloud infrastructure providers, payment service providers (including Stripe), authentication and identity management providers, analytics providers, communication tools or other technology partners, some of which may process Personal Data in jurisdictions outside the EEA.

Where Personal Data is transferred to countries that have not been recognised by the European Commission as providing an adequate level of data protection, Katanbooking ensures that appropriate safeguards are in place in accordance with the General Data Protection Regulation (EU) 2016/679. These safeguards may include, in particular, the use of Standard Contractual Clauses approved by the European Commission, reliance on adequacy decisions, or the implementation of other lawful transfer mechanisms and supplementary measures where required.

Where third-party providers act as independent Controllers, such transfers are carried out in accordance with their own legal obligations and privacy frameworks. Katanbooking takes reasonable steps to ensure that any such transfers are limited to what is necessary and are carried out in compliance with applicable data protection laws.

15. Data Retention

Katanbooking retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including the operation of the Platform, the facilitation of Bookings, the provision of customer support, compliance with legal obligations, and the protection of Katanbooking’s legal rights and interests.

The retention period applicable to Personal Data may vary depending on the nature of the data and the purpose of processing.

Account-related data is generally retained for the duration of the Customer’s account and for a reasonable period thereafter, to allow for account management, reactivation, support, and compliance purposes.

Personal Data relating to Bookings, transactions, payments, accounting and financial records may be retained for the period required under applicable tax, accounting and regulatory laws.

Personal Data processed in connection with customer support, disputes, complaints or claims may be retained for as long as necessary to resolve the relevant matter and for a reasonable period thereafter in order to establish, exercise or defend legal claims.

Technical and usage-related data, including logs and diagnostic information, is typically retained for a limited period necessary to ensure system security, performance and monitoring.

Records relating to marketing preferences, including consent and opt-out requests, may be retained for as long as necessary to demonstrate compliance with applicable legal requirements.

Where a Customer deletes their account, Katanbooking will take reasonable steps to delete or anonymise Personal Data associated with that account, except where retention is required or permitted under applicable law, including for legal, regulatory, accounting, fraud prevention or dispute resolution purposes.

16. Security

Katanbooking implements appropriate technical and organisational measures designed to protect Personal Data against unauthorised access, accidental loss, alteration, disclosure or destruction.

Such measures include, where appropriate, the use of encryption, secure data transmission protocols, access controls, authentication mechanisms, and restrictions on access to Personal Data to authorised personnel only. Katanbooking also applies organisational safeguards, including internal policies, staff training, confidentiality obligations and procedures governing the handling of Personal Data.

In addition, Katanbooking relies on secure hosting infrastructure, monitoring systems, and backup and recovery processes to ensure the availability, integrity and resilience of the Platform and the data it processes.

While Katanbooking takes reasonable steps to protect Personal Data, no system can be guaranteed to be completely secure. Users are also responsible for maintaining the confidentiality of their account credentials and for taking appropriate steps to protect their own information.

17. Children and Minors

The Katanbooking Platform is intended for use by individuals who have the legal capacity to enter into binding agreements.

Bookings involving children or minors may be made through the Platform; however, such bookings must be made by a parent, legal guardian or another authorised adult acting on behalf of the minor. The person making the Booking is responsible for providing accurate information and ensuring that all Participants, including minors, meet the applicable requirements for the relevant Provider Service.

Katanbooking does not knowingly permit the independent use of the Platform by children below the age at which they may lawfully provide consent for data processing under applicable law, without the involvement of a parent or guardian.

Where Personal Data relating to children is processed, such processing is limited to what is necessary for the purpose of facilitating the Booking, ensuring safety, meeting operational requirements and complying with applicable legal obligations.

18. Your Rights under GDPR

Under the General Data Protection Regulation (EU) 2016/679, you have certain rights in relation to your Personal Data, subject to the conditions and limitations set out in applicable law.

You have the right to request access to the Personal Data that Katanbooking processes about you and to obtain information about how such data is used.

You have the right to request the correction of inaccurate or incomplete Personal Data.

You may request the deletion of your Personal Data in certain circumstances, for example where the data is no longer necessary for the purposes for which it was collected, subject to applicable legal and regulatory retention requirements.

You have the right to request the restriction of processing in specific situations, including where the accuracy of the data is contested or where processing is no longer necessary but you require the data for the establishment, exercise or defence of legal claims.

Where applicable, you may have the right to receive the Personal Data you have provided to Katanbooking in a structured, commonly used and machine-readable format and to transmit that data to another controller.

You have the right to object to the processing of your Personal Data where such processing is based on Katanbooking’s legitimate interests, including the right to object at any time to processing for direct marketing purposes.

Where the processing of your Personal Data is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

You also have the right to lodge a complaint with a supervisory authority. In Cyprus, the competent authority is:

Office of the Commissioner for Personal Data Protection Website: https://www.dataprotection.gov.cy

To exercise your rights or for any questions relating to the processing of your Personal Data, you may contact Katanbooking using the contact details provided in this Privacy Policy.

19. Automated Decision-Making and Profiling

Katanbooking may use automated systems and tools to support the operation, security and functionality of the Platform. This may include, for example, systems used for fraud prevention, risk assessment, account security, transaction monitoring, content relevance, search optimisation and AI-based recommendations.

Such systems may analyse certain Personal Data and behavioural signals in order to detect suspicious activity, prevent abuse, improve Platform performance and enhance the user experience.

Katanbooking does not, as a general rule, make decisions based solely on automated processing that produce legal or similarly significant effects on Customers.

However, certain automated processes may affect the availability of specific Platform features or transactions. For example, payment service providers, including Stripe, or fraud prevention systems may automatically block, delay or decline a transaction where it is assessed as high-risk or potentially fraudulent. In such cases, the relevant decision may be made by the payment service provider or as part of integrated risk management systems.

Where applicable under the General Data Protection Regulation (EU) 2016/679, you may have the right to request human intervention, to express your point of view, and to contest such decisions.

20. Changes to this Privacy Policy

Katanbooking may update or amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, Platform functionality, data processing practices or business operations.

The most current version of this Privacy Policy will always be available on the Katanbooking Platform.

Where changes are material, Katanbooking will take reasonable steps to notify users, for example by means of a notice on the Platform, via email, or through the user account interface, where applicable.

Your continued use of the Platform after such updates take effect constitutes your acknowledgment of the revised Privacy Policy, to the extent permitted by applicable law.