At Rumo, we respect your privacy. We operate a business-to-business (B2B) lead generation service. To provide this service to our clients, we process limited amounts of publicly available personal data.

This notice explains what data we collect, why we collect it, and your rights under the UK General Data Protection Regulation (UK GDPR).

We collect information that individuals have voluntarily chosen to make publicly visible on their social media profiles. This data typically includes:

• Handle / Username
• Display Name
• Public Bio / Profile Description
• Follower and Following Counts
• Publicly stated location (if provided in the bio)
• Engagement metrics on public posts (e.g., whether an account frequently comments on specific topics).

We do not access, scrape, or process private accounts, direct messages, hidden follower lists, or any non-public data.

Under the UK GDPR, we must have a "lawful basis" to process your data. We process this publicly available data based on our Legitimate Interests (Article 6(1)(f) UK GDPR).

Our legitimate interest is to identify public profiles that demonstrate a strong professional, entrepreneurial, or topical interest in the travel industry. We compile this information to help established travel recruitment businesses (our clients) connect with individuals who may be interested in relevant professional opportunities.

We share curated lists of these public profiles (a "Leads Manifest") securely with our clients. Our clients are established travel recruitment businesses.

We retain the data we collect only for as long as necessary to compile and deliver the Leads Manifest to our client.

After delivery, Rumo retains a secure copy of the data for a maximum of 90 days for audit, support, and dispute-resolution purposes. After this 90-day period, the data is securely deleted from our systems.

Under the UK GDPR, you have the right to:

• Be informed about how your data is being used (which is the purpose of this notice).
• Access the data we hold about you.
• Request deletion (erasure) of your data.
• Object to our processing of your data based on legitimate interests.