Exhibit 4.2.

NEW YORK, NEW YORK,
October 21st, 2021

Decolar.com, Inc. and its affiliates
5201 Blue Lagoon Drive, Suite 927
MIAMI FL 33126

RE: IRREVOCABLE OFFER AMLOA 001/2021

Ref: Amendment to the Lodging Outsourcing Agreement

Dear Sir or madam,

Reference is hereby made to the Amended and Restated Lodging Outsourcing Agreement dated 15 November 2019 by and among Expedia, Inc., a Washington corporation (“Expedia”, “we”, “us” or “our”), Travel Reservations S.R.L, a Uruguay corporation, Decolar.com, Inc., a Delaware Corporation and each of the subsidiaries of Decolar Parent set forth therein (together “Decolar”) (the “LOA Agreement”).

We hereby present you with an offer to amend the LOA Agreement as set forth in Annex A.

This Offer shall terminate at 5:00 p.m. (New York City time) on October 28th, 2021 (the “Expiration Time”) unless accepted prior thereto.

This Offer shall be deemed unconditionally and irrevocably accepted by Decolar if Decolar sends to Expedia a letter accepting this Offer, issued in accordance with Section 15.9 of the LOA Agreement on or before the Expiration Time. Should this Offer be accepted, the terms and conditions attached as Annex A will be valid and binding.

Sincerely,

Expedia, Inc.

Name:

Title:

CERTAIN IDENTIFIED INFORMATION HAS BEEN EXCLUDED FROM THE EXHIBIT BECAUSE IT IS BOTH (i) NOT MATERIAL AND (ii) WOULD LIKELY CAUSE COMPETITIVE HARM TO THE COMPANY IF PUBLICLY DISCLOSED

[***] indicates the redacted confidential portions of this exhibit.

ANNEX A

AMENDMENT TO THE AMENDED AND
RESTATED LODGING OUTSOURCING AGREEMENT

This amendment letter (“Letter”) to the LOA Agreement is effective as of the Expiration Time of the Offer (the “Amendment Date”).

The Parties desire to amend the LOA Agreement on the terms of this Letter. In consideration of their continued performance of their respective obligations under the LOA Agreement, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree to amend the LOA Agreement on the terms set out below.

Reference is made to the letter dated 13 May 2021 whereby the parties agreed to add Viajes Beda, S.A. de C.V. and Transporturist, S.A. de C.V. (the “Best Day Group”) as Affiliates under the LOA Agreement.

“Hoteldo” is a B2B brand and distribution channel of the Best Day Group (“Hoteldo”). Hoteldo wishes to make Expedia Travel Products available to its Hoteldo partners.

From and after the Amendment Date, the Parties agree to amend the LOA Agreement as follows:

1.For the purposes of Section 2.1.9 of the LOA Agreement, Expedia acknowledges that Decolar, operating under the brand ‘Hoteldo’ (“Hoteldo”) operates an affiliate programme under which partners with whom it contracts (“Partners”) are permitted to integrate Hoteldo’s XML feed (“Hoteldo API”) onto their consumer facing websites (“Partner Sites”) or agent booking tools (“Partner Tools”) to access and book travel products on behalf of End Users or allow End Users to access and book travel products. Expedia agrees that Hoteldo may integrate Expedia Information and Expedia Travel Products into the Hoteldo API and make them available to its Partners subject to the following restrictions:

a.Decolar must ensure that each Partner is bound by and complies with obligations that are at least equivalent to those imposed on Decolar under the LOA Agreement and shall procure that the Partner enters into terms the same as or no less onerous than the terms of use for Partners (“Partner Terms of Use”) as set out in the launch requirements, as updated and notified to you from time to time;

b.Decolar shall be solely responsible for the actions and omissions of each Partner as if such actions are the actions and omissions of Decolar, including any liabilities for Taxes. In the event that Decolar becomes aware of any non-compliance by a Partner with the LOA Agreement or the Partner Terms of Use, or at any time upon Expedia’s request, Decolar will immediately disable the distribution of the Expedia Information and Expedia Travel Products to such Partner and/or cancel any and all Expedia-Sourced Travel Bookings booked via

the Hoteldo API, if Decolar or Partners breach Section 2.1.7 of the LOA Agreement;

c.Hoteldo agrees to integrate Expedia Information and Expedia Travel Products into the Hoteldo API via an exclusive profile dedicated to monitoring API shopping calls and booking travel products;

d.at Expedia’s request, Decolar shall promptly provide a list of current Partners;

e.Annex 1 hereto sets forth a list of restricted partners. Hoteldo may only make Expedia Information and Expedia Travel Products available to Partners who are not included in said list. In the event that any of Hoteldo’s existing Partners are restricted at any time, Hoteldo shall immediately disable the distribution of Expedia Information and Expedia Travel Products to such Partners;

f.In addition Decolar may only make Expedia Information and Expedia Travel Products available for display on:

i.Hoteldo’s Partner’s Site if such Partner Site is in a geography or adopts a type of business model which has been approved by us in advance. Such approval shall take place in a quarterly meeting between the parties where current and prospective Partners shall be discussed in good faith (including but not limited to geographical mix, business models and areas of growth) or on an ad hoc basis in writing;

ii.Hoteldo’s Partner’s Tool if the access to such Partner Tool is limited to employees and staff of the Partner (and so is not a third party booking tool used by external agents);

g.Decolar is solely responsible for any compensation payable to the Partner [***],

h.Decolar shall co-operate with Expedia to technically support the tracking and identification of Travel Bookings by Hoteldo, including but not limited to assisting with the setting up of an identification tag, and shall maintain said tag operational throughout the term;

i.Decolar shall procure that the terms and conditions of each Expedia Travel Product, as updated and notified to Decolar from time to time, are made available to each End User by Partners prior to concluding a Travel Booking;

j.Decolar will be responsible for any monies owed to us for Travel Bookings, including for Travel Bookings made by Partners;

k.Decolar may not cancel or amend any Travel Bookings made by Partners except on the express instruction of the End User

l.Decolar acknowledge that Expedia will not provide customer support to Partner agents and accordingly, Decolar shall ensure that Partner agents do not contact Expedia directly;

m.Partner shall have no right to re-distribute Expedia Information and Expedia Travel Products and so Decolar shall procure that Partners only make Expedia Information and Expedia Travel Products available on the Partner Site and/or Partner Tool itself and via no other medium or channel whatsoever including their own API or allowing the Partner Tool to be accessed by agents other than employees and staff of the Partner. Should Expedia identify that a Partner has breached this section, it shall inform Decolar and Decolar shall promptly suspend said Partner’s access to the Expedia Information and Expedia Travel Products;

n.Decolar shall use all reasonable endeavours to procure that each Partner shall display and use Expedia Travel Products for the sole purpose of procuring a Travel Booking on the Partner Sites and/or Partner Tools and for no other purpose whatsoever; and

o.upon discontinuing access or termination of a Partner for any reason, Decolar shall use all reasonable endeavours to procure that such Partner ceases to display on the Partner Sites and/or Partner Tools and promptly destroy or delete from all of the Partner’s systems and/or devices any and all originals, copies, reproductions, adaptations, extracts and/or summaries of Expedia Travel Products and Expedia Information.

2.The definition of “Notice” in the LOA Agreement shall be amended to read as follows:

““Notice” has the meaning set forth in Section 15.9.”

3.Section 15.9 in the LOA Agreement shall be amended and replaced with the following:

“15.9 Notices. Any notice, consent or approval required or permitted to be given in connection with this Agreement (in this Section 15.9 referred to as a “Notice”) shall be in writing and shall be sufficiently given if delivered (whether in person, by courier service or other personal method of delivery), or if transmitted by facsimile or through e-mail:

(a)    in the case of a Notice to Decolar at:

Travel Reservations S.R.L

Ruta 8, Km. 17,500, Oficina 300, Local 318, Montevideo,

Uruguay

c/o Despegar.com.ar S.A.

Av. Jujuy 2013, C1247ABI CABA

Buenos Aires, Argentina

Attention: Mariano Jorge Scagliarini

Email: mariano.scagliarini@despegar.com / contratos@despegar.com

With a copy (which shall not constitute notice) to:

Simpson Thacher & Bartlett LLP
425 Lexington Avenue

New York, New York 10017

Attention: Juan Francisco Mendez
Email: jmendez@stblaw.com

(b)    in the case of a Notice to Expedia at:

1111 Expedia Group Way W.

Seattle WA 98119

Tel: (425) 679-3644

Fax: (425) 679-7251

Attention: General Counsel

Email: bdzielak@Expedia.com

Any Notice delivered or transmitted to a Party as provided above shall be deemed to have been given and received on the day it is delivered or transmitted; provided, however, that it is delivered or transmitted on a Business Day prior to 5:00 p.m. local time in the place of delivery or receipt. If the Notice is delivered or transmitted after 5:00 p.m. local time or if the day is not a Business Day, then the Notice shall be deemed to have been given and received on the next Business Day. Any Party may, from time to time, change its address by giving Notice to the other Party in accordance with the provisions of this Section 15.9.”

4.All capitalized terms, where not defined in this Letter, shall have the meanings set out in the LOA Agreement.

5.Other than as set forth in this Letter and any prior or subsequent amendment and/or waiver of the LOA Agreement, all other terms and conditions of the LOA Agreement remain in full force and effect, and this Letter in no way amends, alters, modifies, or otherwise changes the terms and/or conditions of the LOA Agreement unless otherwise expressly stated. In the event of any conflict or inconsistency between the provisions of the LOA Agreement and this Letter, this Letter will take precedence.

6.This Letter shall be governed by and construed in accordance with the Laws of the State of New York applicable to agreements made and to be performed entirely within such State, without regard to the conflict of Laws principles of such State.

7.Except as otherwise expressly stated herein, this Letter may be amended only in writing signed by Decolar and Expedia.

Annex 1

Restricted List

[***]

NEW YORK, NEW YORK,
June 07, 2022

Decolar.com, Inc. and its affiliates
5201 Blue Lagoon Drive Suite 927
MIAMI FL 33126

RE: IRREVOCABLE OFFER AMLOA 003/2022

Ref.: Amendment to the Amended and Restated Lodging Outsourcing Agreement

Dear Sir or madam,

We address to you on behalf of Expedia, Inc., a Washington corporation (“Expedia”) in connection with the Amended and Restated Lodging Outsourcing Agreement dated November 15, 2019 (the “Agreement”), entered by Expedia, Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”), Travel Reservations S.R.L., a Uruguay corporation, and each of the subsidiaries of Decolar set forth in the Agreement (“Decolar”). Pursuant to our previous discussions, we hereby present you with this Offer in order to amend certain clauses of the Agreement on the terms set out in Annex A.

This Offer shall terminate at 5:00 p.m. (New York time) on June 10th, 2022 (the “Expiration Time”), unless accepted prior thereto.

This Offer shall be deemed unconditionally and irrevocably accepted by Decolar if Decolar sends to Expedia a letter accepting this Offer, on or before the Expiration Time. Should this Offer be accepted, the terms and conditions attached as Annex A will be valid and binding.

Sincerely,

Expedia, Inc.

Name:

Title:

CERTAIN IDENTIFIED INFORMATION HAS BEEN EXCLUDED FROM THE EXHIBIT BECAUSE IT IS BOTH (i) NOT MATERIAL AND (ii) WOULD LIKELY CAUSE COMPETITIVE HARM TO THE COMPANY IF PUBLICLY DISCLOSED.

[***] indicates the redacted confidential portions of this exhibit.

ANNEX A

AMENDMENT TO AMENDED AND
RESTATED LODGING OUTSOURCING AGREEMENT

This amendment (“Amendment”) to the Amended and Restated Lodging Outsourcing Agreement (the “Agreement”), dated as of November 15, 2019 by and among Expedia, Inc., a Washington corporation, Travel Reservations S.R.L, a Uruguay corporation (“Decolar”), Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”) and each of the subsidiaries of Decolar Parent set forth therein, is effective as of the Expiration Time of the Offer (the “Amendment Date”) (the “Parties”).

The Parties desire to amend the Agreement on the terms of this Amendment. In consideration of their continued performance of their respective obligations under the Agreement, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree to amend the Agreement on the terms set out below.

All capitalized terms, where not defined in this Amendment, shall have the meanings set out in the Agreement. From and after the Amendment Date, the Parties agree to amend the Agreement as follows:

1.A new Section 2.4 shall be added as follows:

2.4 TravelAds

2.4.1 The parties agree that Decolar may participate in an accommodation advertising programme known as TravelAds sponsored listings (“TravelAds”). In order to participate, Decolar will make a call to the Expedia API known as a ‘sponsored list call’ and Expedia will return in accordance to the call made by Decolar a ranked order of Travel Supply Providers for Expedia Travel Products located in the Expedia Territory, or agencies acting on their behalf, which have successfully bid for a TravelAd via the auction model on the TravelAds platform. Decolar will display any such Travel Supply Providers (and corresponding Expedia Information) in the correct ranked order received in the Expedia API (save that, provided the ranked order is preserved, not all Travel Supplier Providers must be displayed meaning Decolar can display Travel Suppliers ordered first and third only, provided such order is preserved). Expedia will also provide advertising copy content for Decolar to use for such display, although such usage is in Decolar’s sole discretion.

2.4.2 Decolar agrees to use reasonable endeavours to integrate TravelAds in the Decolar Travel Solution for Expedia Covered Lodging Supply no later than within [***] (“Phase 1 Go Live Date”). Failing to do so, Expedia reserve the right to withdraw its interest to enable Travel Ads service to Decolar. Expedia agrees to use reasonable endeavours to provide all necessary documentation and specifications for Decolar to integrate TravelAds in the Decolar Travel Solution for Decolar Travel Products (“Phase 2”) no

later than the date which is [***] from the Phase 1 Go Live Date (“Documentation Delivery Date”).

2.4.3 For any Consumed Travel Booking for which a TravelAd applied, in addition to the Marketing Fee Payments under this Agreement, for [***] from the Phase 1 Go Live Date, Expedia shall pay Decolar an amount equal to [***]% of the cost per click (“CPC”) received from the Travel Supplier after Expedia has deducted [***]% of the CPC for Expedia’s cost of providing such advertising (“TravelAds Revenue”). The parties shall review the TravelAds Revenue in good faith and agree the amount which shall apply for the period after [***] from the Phase 1 Go Live Date. The TravelAds Revenue shall be paid [***] in arrears at the same time as the Marketing Fee Payments due under this Agreement. For the avoidance of doubt, the TravelAds Revenue shall not include revenue for any clicks for which Expedia or its Corporate Affiliates do not receive payment, for example, due to promotional and goodwill credits which are provided to a Travel Supply Provider in Expedia’s sole discretion. Expedia may (no earlier than [***] from the Phase 1 Go Live Date) adjust deduction set out in this paragraph to take into account additional costs or losses incurred by Expedia or its Corporate Affiliates in connection with TravelAds.

2.4.4 Decolar shall use appropriate mechanisms to detect and blacklist users engaged in click-fraud, in order to reduce the instances of click-fraud for which deductions would be needed. For the purpose of this clause, click fraud is bot activity, or other click fraud, including systematic activity, such as shopping bots or similar activity, and malicious activity.

2.4.5 In addition, the following terms shall apply:

(a)    Expedia shall be the sole provider of accommodation advertising in the form of sponsored search listings on the Decolar Travel Solutions in the Expedia Territory; meaning Decolar may not utilise any third party to provide accommodation advertising in the form of sponsored search listings on the Decolar Travel Solutions in the Expedia Territory but may contract with accommodation providers directly for such advertising services.

(b)    Decolar may only display TravelAds on their customer facing Decolar Travel Solutions operated by Decolar and shall not be provided to any Decolar Partner(s).

(c)    Decolar will comply with all applicable law when participating in TravelAds and displaying any ranked Travel Suppliers and advertising content, including using any required tagging or badging of advertising.

(d)    Decolar will return to Expedia in the Expedia API: the session ID for any display; the position of each TravelAd in Decolar’s organic search results; and any performance data required by Expedia in connection with each TravelAd for the purposes of ensuring accuracy and continuity of reporting to advertising and

publishing partners, including but not limited to any associated bookings. If Decolar fails to do so, it shall not accrue or be entitled to receive any TravelAds Revenue.

(e)    Decolar will not use the content or Expedia Information it accesses via the Expedia API for any purposes other than to perform its obligations under this Agreement.

(f)    Expedia makes no representations or warranties with regard to TravelAds or the integration of TravelAds and Expedia expressly disclaims all implied warranties, obligations, and liabilities with respect thereto.

(g)    Both parties reserve the right in their sole discretion to cease to make available or display TravelAds (as applicable), on [***] notice to the other party, for any or no reason, and without liability. Likewise, each party further reserves the right to cease to immediately make TravelAds available or to display TravelAds without liability to address: a) regulatory or legal requirements, b) in the case of force majeure; c) or in the case that external factors make the TravelAds Revenue not viable.

NEW YORK, NEW YORK,
October 27, 2022

Decolar.com, Inc. and its affiliates
5201 Blue Lagoon Drive Suite 927
MIAMI FL 33126

RE: IRREVOCABLE OFFER AMLOA 002/2022

Ref.: Amendment to the Amended and Restated Lodging Outsourcing Agreement

Dear Sir or madam,

We address to you on behalf of Expedia, Inc., a Washington corporation (“Expedia”) in connection with the Amended and Restated Lodging Outsourcing Agreement dated November 15, 2019 (the “Agreement”), entered by Expedia, Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”), Travel Reservations S.R.L., a Uruguay corporation, and each of the subsidiaries of Decolar set forth in the Agreement (jointly, “Decolar”). Pursuant to our previous discussions, we hereby present you with this Offer in order to amend certain clauses of the Agreement on the terms set out in Annex A.

This Offer shall terminate at 5:00 p.m. (New York time) on November 03, 2022 (the “Expiration Time”), unless accepted prior thereto.

This Offer shall be deemed unconditionally and irrevocably accepted by Decolar if Decolar sends to Expedia a letter accepting this Offer, on or before the Expiration Time. Should this Offer be accepted, the terms and conditions attached as Annex A will be valid and binding.

Sincerely,

Expedia, Inc

Name:

Title:

CERTAIN IDENTIFIED INFORMATION HAS BEEN EXCLUDED FROM THE EXHIBIT BECAUSE IT IS BOTH (i) NOT MATERIAL AND (ii) WOULD LIKELY CAUSE COMPETITIVE HARM TO THE COMPANY IF PUBLICLY DISCLOSED.

[***] indicates the redacted confidential portions of this exhibit.

ANNEX A

AMENDMENT TO AMENDED AND
RESTATED LODGING OUTSOURCING AGREEMENT

This amendment (“Amendment”) to the Amended and Restated Lodging Outsourcing Agreement (the “Agreement”), dated as of November 15, 2019 by and among Expedia, Inc., a Washington corporation, Travel Reservations S.R.L, a Uruguay corporation (“Decolar”), Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”) and each of the subsidiaries of Decolar Parent set forth therein, is effective as of the Expiration Time of the Offer (the “Amendment Date”) (the “Parties”).

The Parties desire to amend the Agreement on the terms of this Amendment. In consideration of their continued performance of their respective obligations under the Agreement, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree to amend the Agreement on the terms set out below.

All capitalized terms, where not defined in this Amendment, shall have the meanings set out in the Agreement. From and after the Amendment Date, the Parties agree to amend the Agreement as follows:

1.A new Section 5.1.4 shall be inserted as follows:

“5.1.4 Cross-Border Data Transfers. The Parties agree to comply with the following provisions, to the extent applicable to each Party: (a) to the extent that and for so long as Privacy Shield is a recognised method of transfer by the European Commission, Privacy Shield shall be the agreed mechanism for cross-border transfers of data originating from the European Union to us in the United States, and (b) to the extent and for so long as Privacy Shield is not a valid method of transfer, the SCCs shall apply to such transfers. To the extent applicable to each Party, they agree to enter into the SCCs as set out in https://www.expediagroup.com/who-we-are/corporate-standards/partner-privacy-data-handling-requirements/default.aspx (“SCC Inserts”) and those terms are hereby incorporated into this Agreement by reference. Any capitalised terms used in this Section 5.1.4 and not defined in this Agreement shall have the meaning given to them in the SCC Inserts.”

NEW YORK, NEW YORK,
November 18th, 2022

Decolar.com, Inc. and its affiliates
5201 Blue Lagoon Drive Suite 927
MIAMI FL 33126

RE: IRREVOCABLE OFFER AMLOA 005/2022

Ref.: Second Amendment to the Amended and Restated Lodging Outsourcing Agreement

Dear Sir or madam,

We address to you on behalf of Expedia, Inc., a Washington corporation (“Expedia”) in connection with the Amended and Restated Lodging Outsourcing Agreement dated November 15, 2019 (the “Agreement”), entered by Expedia, Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”), Travel Reservations S.R.L., a Uruguay company, and each of the subsidiaries of Decolar set forth in the Agreement (jointly, “Decolar”). Pursuant to our previous discussions, we hereby present you with this Offer in order to amend certain clauses of the Agreement on the terms set out in Annex A.

This Offer shall terminate at 5:00 p.m. (New York time) on November 30th (the “Expiration Time”), unless accepted prior thereto.

This Offer shall be deemed unconditionally and irrevocably accepted by Decolar if Decolar sends to Expedia a letter accepting this Offer, on or before the Expiration Time. Should this Offer be accepted, the terms and conditions attached as Annex A will be valid and binding.

Sincerely,

Expedia, Inc.

Name:

Title:

CERTAIN IDENTIFIED INFORMATION HAS BEEN EXCLUDED FROM THE EXHIBIT BECAUSE IT IS BOTH (i) NOT MATERIAL AND (ii) WOULD LIKELY CAUSE COMPETITIVE HARM TO THE COMPANY IF PUBLICLY DISCLOSED.

[***] indicates the redacted confidential portions of this exhibit.

ANNEX A

[SECOND] AMENDMENT TO AMENDED AND
RESTATED LODGING OUTSOURCING AGREEMENT

This second amendment (“Amendment”) to the Amended and Restated Lodging Outsourcing Agreement (the “Agreement”), dated as of November 15, 2019 by and among Expedia, Inc., a Washington corporation, Travel Reservations S.R.L, a Uruguay company, Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”) and each of the subsidiaries of Decolar Parent set forth therein (jointly, “Decolar”), is effective as of the Expiration Time of the Offer (the “Amendment Date”) (the “Parties”).

The Parties desire to amend the Agreement on the terms of this Amendment. In consideration of their continued performance of their respective obligations under the Agreement, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree to amend the Agreement on the terms set out below.

All capitalized terms, where not defined in this Amendment, shall have the meanings set out in the Agreement. From and after the Amendment Date, the Parties agree to amend the Agreement as follows:

1.The following clause shall be added to Section 5.1.3 of the Agreement as a new sub-Section

5.1.3 (c):

“Notwithstanding any other terms in the Agreement (including, without limitation, restrictions on disclosure of Customer Personal Data to third parties), Decolar agrees that Expedia may share certain Initiative Data (defined below) solely with [***] as part of the Initiative (defined below). Expedia shall require [***] to agree to written terms that (i) limit the use of the Initiative Data to use in connection with the Initiative, which shall be considered confidential information and (ii) are at least as protective of the Initiative Data as the terms of this Agreement. The “Initiative” is a data sharing initiative being carried out amongst Decolar, Expedia, and [***] with the purpose of increasing bookings of applicable Expedia Sourced Travel Bookings through the Decolar Application or Decolar Platform. “Initiative Data” means Gross Booking Value, Room Revenue, net room nights (“NRN”), average daily rate (“ADR”), booking window, length of stay (“LOS”), and rate plan mix, and any other data agreed upon by the parties in writing (which for the purposes of this Section may be via email). The Parties agree to participate, in good faith, as reasonably requested by the other Party in discussions among Decolar, Expedia and [***] regarding the Initiative.

NEW YORK, NEW YORK,
June 12, 2023

Decolar.com, Inc. and its affiliates
5201 Blue Lagoon Drive Suite 927
MIAMI FL 33126

RE: IRREVOCABLE OFFER AMLOA 002/2023

Ref.: Amendment to the Amended and Restated Lodging Outsourcing Agreement

Dear Sir or madam,

We address to you on behalf of Expedia, Inc., a Washington corporation (“Expedia”) in connection with the Amended and Restated Lodging Outsourcing Agreement dated November 15, 2019 (the “Agreement”), entered by Expedia, Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”), Travel Reservations S.R.L., a Uruguay corporation, and each of the subsidiaries of Decolar set forth in the Agreement (jointly, “Decolar”). Pursuant to our previous discussions, we hereby present you with this Offer in order to amend certain clauses of the Agreement on the terms set out in Annex A.

This Offer shall terminate at 5:00 p.m. (New York time) on June 26, 2023 (the “Expiration Time”), unless accepted prior thereto.

This Offer shall be deemed unconditionally and irrevocably accepted by Decolar if Decolar sends to Expedia a letter accepting this Offer, on or before the Expiration Time. Should this Offer be accepted, the terms and conditions attached as Annex A will be valid and binding.

Sincerely,

Expedia, Inc.

Name:

Title: VP, Commercial Partnerships, Americas

CERTAIN IDENTIFIED INFORMATION HAS BEEN EXCLUDED FROM THE EXHIBIT BECAUSE IT IS BOTH (i) NOT MATERIAL AND (ii) WOULD LIKELY CAUSE COMPETITIVE HARM TO THE COMPANY IF PUBLICLY DISCLOSED.

[***] indicates the redacted confidential portions of this exhibit.

ANNEX A

AMENDMENT TO AMENDED AND
RESTATED LODGING OUTSOURCING AGREEMENT

This amendment (“Amendment”) to the Amended and Restated Lodging Outsourcing Agreement (the “Agreement”), dated as of November 15, 2019 by and among Expedia, Inc., a Washington corporation, Travel Reservations S.R.L, a Uruguay corporation (“Decolar”), Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”) and each of the subsidiaries of Decolar Parent set forth therein, is effective as of the Expiration Time of the Offer (the “Amendment Date”) (the “Parties”).

The Parties desire to amend the Agreement on the terms of this Amendment. In consideration of their continued performance of their respective obligations under the Agreement, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree to amend the Agreement on the terms set out below.

All capitalized terms, where not defined in this Amendment, shall have the meanings set out in the Agreement. From and after the Amendment Date, the Parties agree to amend the Agreement as follows:

1.A new Section 2.4 shall be added as follows:

2.4 Vrbo Properties. Expedia may make available to Decolar Travel Products via the separate client identification (“CIDs”) comprising of vacation rental properties which are also made available on Vrbo.com or connected websites (“Vrbo Properties”), under the terms of this Agreement and subject to the following:

2.4.1 Decolar will cooperate to ensure that separate CIDs are set up to allow Vrbo Transaction to be separately identified;

2.4.2 Decolar shall comply with the Expedia Specifications applicable to Vrbo Properties on the Expedia developer hub including but not limited to displaying the correct TSF levied by Vrbo; and Decolar shall allow Expedia to confirm Decolar’s compliance with the Expedia Specifications, either by allowing Expedia access to Decolar’s systems, or providing Expedia with alternative evidence to Expedia’s satisfaction;

2.4.3 Vrbo Properties shall be displayed solely on the Decolar Platform under any brand owned by Decolar and/or its affiliates, or white label template website that Decolar owns and controls (“WLT”) and not on any other Travel Solutions through which Decolar provides Travel Products to a third party. For the avoidance of doubt, they may not be redistributed to a Decolar Partner or otherwise pursuant to Section 2.1.9, including as part of the HotelDO API. It is also agreed that the exception for WLT shall only apply to WLTs where Decolar is the merchant of record, Decolar is providing customer support and it is a subdomain of a Decolar Travel Solution (e.g. partnerxxx.despegar.hotel. or as

Decolar may name the domain). Decolar shall remove Vrbo Properties from any WLT partner at any time upon our request;

2.4.4 Notwithstanding Section 8.6 of the Agreement, Decolar shall ensure that customer terms and conditions applicable to Vrbo Properties (as well as the applicable Vrbo privacy statement (as updated and notified to Decolar from time to time) (together, the “VrboT&Cs”), are made available to each End User in a durable format prior to concluding a Transaction. Decolar shall also ensure that any rental agreement, check-in instructions or other information provided to Decolar, is immediately passed to the End User;

2.4.5 Decolar shall not issue any form of tax invoice or payment receipt which may mislead End Users into believing that Decolar is the facilitator of the Vrbo Booking(s);

2.4.6 Where Decolar collects payment, it does so on behalf of Vrbo and Vrbo will be solely responsible for authorization of payments from the End User, and delivery of the TSF.

2.4.7 The Parties acknowledge and agree that whilst Decolar shall provide first line support to customers for Vrbo Properties, Expedia (or Vrbo) agents will, provide second line consultative support for customer care and if contacted by End Users, first line support directly to End Users; and

2.4.8. Decolar shall not display or advertise Expedia Information relating to Vrbo Properties on any metasearch site or other third-party medium or channel through which lodging and other travel products are marketed through side-by-side or similar price comparison;

2.4.9 Decolar shall integrate Expedia’s “Vrbo availability rapid API” into the Decolar Platform in order to reduce shopping calls to the API for non-available Vrbo Properties and to inform End Users of the minimum length of stay applicable to a Vrbo Property

2.4.10 Decolar acknowledges and agrees that Vrbo Properties shall be displayed as “vacation rentals” or “rentals” (i.e., not hotels) on the Decolar Platform. In addition, Decolar shall ensure that the following information (to be communicated to Decolar via the Expedia API) is visible to End Users when displaying Vrbo Properties:

i)    check-in instructions; special check-in instructions; fees;

ii)    Vrbo essential stay content (post-booking);

ii)    guest ratings;

iv)    house rules; and

v)    property registration number and private host registration.

2.A new section 2.5 shall be added as follows:

“ 2.5    Guest Reviews

“ 2.5.1 Guest Reviews may be included within the Expedia Information, and where Decolar accesses them, it must also ensure that:

(a)    Guest Reviews are solely displayed on the Decolar Platform under any brand owned by Decolar and/or its affiliates and not on any other Travel Solutions through which Decolar provides Travel Products to a third party. For the avoidance of doubt, they may not be redistributed to a Decolar Partner or otherwise pursuant to Section 2.1.9, including as part of the Hoteldo API;

(b)    any cache of Guest Reviews is refreshed every 48 hours, and Guest Reviews are displayed in a manner that is non-indexable by internet search engines;

(c)    they are not displayed on any French point of sale; and

(d)    the correct attribution (e.g. ‘Hotels.com Trusted Review’ or ‘Expedia.com Trusted Review’) is displayed as per the Expedia Specifications. Expedia grants Decolar a limited, non-exclusive, non-assignable, revocable and without right to grant sublicenses, license to use the Affiliate’ trademarks and logos that are depicted in Guest Reviews within the Expedia Information, solely for the purpose of displaying the Guest Reviews as permitted herein, and without edits, alteration, or modification.

2.5.2 Expedia reserves the right to remove or restrict Decolar’s access to Guest Reviews at any time on [***] days’ prior written notice.

2.5.3. Where Expedia has made Guest Reviews available to Decolar, Decolar agrees (upon Expedia request) to make available to Expedia and its Affiliates, and grant Expedia and its Affiliates any necessary licences in order to display, any guest reviews Decolar has for any accommodation for which we have Expedia Information.

2.5.4. Customers who provide Guest Reviews accept the terms and conditions of booking on one of the consumer brands of Expedia which contains a license for Expedia and its partners to use, reproduce, modify, adapt, translate, distribute and publish such Guest Reviews anywhere in the world.

2.2.5 Expedia will comply in accordance with applicable data protection laws with respect to requests from Customers in the event that they request to remove their Guest Reviews.

3.A new paragraph 3 of Schedule 3.1 shall be inserted as follows:

“For each Consumed Vrbo Transaction, Expedia shall pay Decolar a Marketing Fee equivalent to [***]% of Vrbo Gross Profit.”

4.Save as set out expressly in Amendment, the provisions of this Agreement shall apply equally to Vrbo Bookings as they do to non-Vrbo Bookings; and shall apply equally to Travel Products concerning Vrbo Properties as those concerning properties provided by other lodging suppliers.

5.Expedia hereby declares that Vrbo is part of the Expedia Group and that Expedia shall be fully responsible for the terms, conditions and obligations agreed to hereunder on behalf of Vrbo.

6.The following new definitions shall be added:

“Guest Reviews” means any reviews by customers for a given Expedia Travel Product included within Expedia Information;

“TSF” means the traveler service fee paid by the End User of a Vrbo Transaction, as set out in the API;

“Vrbo” means the relevant entity from the following: EG Vacation Rentals Ltd., HomeAway.com Inc., Bookabach Ltd., Stayz Pty Ltd., or HomeAway Emerging Markets Pty. Ltd., or any other Group Member of the above as identified in the Vrbo T&Cs for any given Booking;

“Vrbo Gross Profit” means an amount equal to (a) GBV or TSF received by Expedia or its Affiliates for a Consumed Vrbo Transaction excluding any and all Indirect Revenues, Service Fees, any Taxes and net of any amounts relating to fraud, cancellations, refunds or otherwise plus (b) Media Revenue less, (c) where applicable in relation to a Travel Booking, without duplication, Costs associated with any debit memo, replacement room nights, charge backs, and cancellation fees where applicable less; (d) the cost of providing the room accommodation reservation; less (e) where applicable in relation to a Travel Booking, without duplication, the product of (i) (A) where Expedia or its Affiliate processes a credit card for a Transaction, [***]% of GBV; plus (B) [***]% of GBV for Cost of Service. For Gross Profit based only on TSF, (d) shall not apply.

“Vrbo Transaction” means a Travel Booking of a Vrbo Property through the Expedia API.

NEW YORK, NEW YORK,
September 29, 2023

Decolar.com, Inc. and its affiliates
5201 Blue Lagoon Drive Suite 927
MIAMI FL 33126

RE: IRREVOCABLE OFFER AMLOA 003/2023

Ref.: Amendment to the Amended and Restated Lodging Outsourcing Agreement

Dear Sir or madam,

We address to you on behalf of Expedia, Inc., a Washington corporation (“Expedia”) in connection with the Amended and Restated Lodging Outsourcing Agreement dated November 15, 2019 (the “Agreement”), entered by Expedia, Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”), Travel Reservations S.R.L., a Uruguay corporation, and each of the subsidiaries of Decolar set forth in the Agreement (jointly, “Decolar”). Pursuant to our previous discussions, we hereby present you with this Offer in order to amend certain clauses of the Agreement on the terms set out in Annex A.

This Offer shall terminate at 5:00 p.m. (New York time) on October 13, 2023 (the “Expiration Time”), unless accepted prior thereto.

This Offer shall be deemed unconditionally and irrevocably accepted by Decolar if Decolar sends to Expedia a letter accepting this Offer, on or before the Expiration Time. Should this Offer be accepted, the terms and conditions attached as Annex A will be valid and binding.

Sincerely,

Expedia, Inc.

Name:

Title:

CERTAIN IDENTIFIED INFORMATION HAS BEEN EXCLUDED FROM THE EXHIBIT BECAUSE IT IS BOTH (i) NOT MATERIAL AND (ii) WOULD LIKELY CAUSE COMPETITIVE HARM TO THE COMPANY IF PUBLICLY DISCLOSED.

[***] indicates the redacted confidential portions of this exhibit.

ANNEX A

AMENDMENT TO AMENDED AND
RESTATED LODGING OUTSOURCING AGREEMENT

This amendment (“Amendment”) to the Amended and Restated Lodging Outsourcing Agreement (the “Agreement”), dated as of November 15, 2019 by and among Expedia, Inc., a Washington corporation, Travel Reservations S.R.L, a Uruguay corporation (“Decolar”), Decolar.com, Inc., a Delaware Corporation (“Decolar Parent”) and each of the subsidiaries of Decolar Parent set forth therein as amended, is effective as of the Expiration Time of the Offer (the “Amendment Date”) (the “Parties”).

The Parties desire to amend the Agreement on the terms of this Amendment. In consideration of their continued performance of their respective obligations under the Agreement, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties hereby agree to amend the Agreement on the terms set out below.

All capitalized terms, where not defined in this Amendment, shall have the meanings set out in the Agreement. From and after the Amendment Date, the Parties agree to amend the Agreement as follows:

1.Replacement of EAN.com LP with Expedia, Inc.

EAN.com LP shall be removed from the Agreement and the reference to EAN.com LP in Recital 3, section 2.1.2 and schedule 3.1.2 shall be replaced by Expedia, Inc. Accordingly, the definition of Expedia Parent and Expedia shall both mean Expedia, Inc.

2.Net remittance of Marketing Fees:

The following amendments shall be made to cater for net remittance of Marketing Fees (“Net Remittance Amendments”). It being agreed that the Net Remittance Amendments in this clause 2, shall only be effective once Decolar has undertaken such developments, to Expedia’s reasonable satisfaction, as Expedia notifies it are necessary in order for net remittance to be enacted, including but not limited to integrating a new set of API profiles/client identifications and enacting the changes for the Mexican point of sale as indicated in clause 3 of this Amendment. For the avoidance of doubt, this clause 2 shall only apply to Transaction Statements issued after the date such amendments are effective.

a.    Section 3.2.1 (Marketing Fee Payments) shall be amended to read as follows:

“3.2.1 Payment to Decolar. Expedia shall pay to Decolar the Marketing Fees owed to Decolar solely with respect to all Consumed Property-Collect Bookings for which Compensation has been received by Expedia and its Affiliates during a given calendar month (the “Marketing Fee Payment”) within [***] following the end of such calendar month.”

b.    A new Section 3.2.3 shall be inserted as follows:

“3.2.3. Net Marketing Fees. When paying the Transactions Statement pursuant to Section 3.3.1 Decolar shall remit the Net Room Revenue (being Room Revenue generated from Transactions with respect to Consumed Affiliate-Collect Bookings less the Marketing Fees) to Expedia and retain the Marketing Fees at source. As a result, Decolar will not receive Marketing Fees payment from Expedia with respect to Consumed Affiliate-Collect Bookings and instead will retain the amount of Marketing Fees.”

c.    Section 3.4.1 shall only be applicable to Property-Collect Bookings and so Marketing Fee Statements shall only be provided for the Marketing Fee Payment on Property-Collect Bookings.

d.    The Parties acknowledge that Gross Profit excludes any amounts relating to fraud, cancellations, refunds or otherwise and following the amendments set our herein, Transaction Statements may contain negative Marketing Fee values if the Gross Profit for any given Booking is negative due to fraud, cancellations, refunds or otherwise.

3.Mexican Point of Sale

The following changes shall be made with regard to Transactions on the Mexican point of sale:

a.In Section 2.1.2 the final two sentences, commencing “For any Expedia Travel Products made...” shall be deleted and replaced with:

“For any Expedia Travel Products made available or displayed to End Users on Decolar Travel Solutions with a Brazilian country code top-level domain (being .br or com.br or any variation thereof) (“Brazilian POS”) or a Mexican country-code top-level domain (being .mx or .com.mx or any variation thereof) (“Mexican POS”), Decolar shall ensure that any call to the Expedia API via the Decolar Application shall be made solely in Brazilian Real or Mexican Pesos, respectively.

If Decolar fails to comply with any of its obligations relating to the Brazilian POS or the Mexican POS under this Section, Expedia shall be entitled to withhold payment due to Decolar under the Agreement for an amount equal to any losses suffered by Expedia as a result of Decolar´s failure to comply with obligations relating to the Brazilian POS or the Mexican POS under this Section, or deduct and withhold on any payment for such amounts to Decolar in order to comply with its or its Affiliates’ obligations under applicable tax laws.”

b.Section 3.2.2. shall be amended as follows:

“3.2.2 All Payments made by Expedia to Decolar will be made in United States Dollars, Brazilian Real or Mexican Pesos (depending on the currency of the Transaction Statement) and sent via wire transfer to the Decolar bank account

specified in Despegar’s profile on Expedia’s portal (which Decolar may revise from time to time upon notice to Expedia).”

c.Section 3.3.1 shall be amended to insert a new part (ii) as follows and the existing part (ii) shall become part (iii):

“(ii) Transaction Statement for the Room Revenue generated from Decolar’s Consumed Travel Bookings booked on Decolar’s Mexican POS shall be stated in Mexican Pesos only; and”

d.Section 3.3.2 shall be restated to read as follows:

“3.3.2. Payment. Decolar shall pay to:

(i) Expedia the full Room Revenue amount for Bookings other than those on the Brazilian POS and the Mexican POS detailed on the Transaction Statement (the “USD Room Revenue Payment”) within [***] of the date of the Transaction Statement (or [***] with respect to Transactions for points of sale located in Argentina, provided that the Parties will discuss in good faith reducing such number of days based on improving economic conditions in Argentina) of the date of the Transaction Statement; and (ii) Expedia´s Brazilian Subsidiary the full Room Revenue amount for Brazilian POS Consumed Travel Bookings detailed on the Transaction Statement (the “BRL Room Revenue Payment”) within [***] of the date of the Transaction Statement;

(ii) unless otherwise notified by Expedia, Expedia’s Mexican Subsidiary for the full Room Revenue amount for Mexican POS Consumed Travel Bookings detailed on the Transaction Statement (the “MX Room Revenue Payment”), and together with the USD Room Revenue Payment and the BRL Room Revenue Payment, the “Room Revenue Payment”) within [***] of the date of the Transaction Statement. In the event that Expedia elects, at any time, not to have payment made to its Mexican Subsidiary for the full Room Revenue amount for Mexican POS Consumed Travel Bookings it shall notify Decolar and payments shall instead be made as if this Section 3.3.2 and 3.3.3 with regard to MX Room Revenue Payment did not exist.

Funds shall be paid by Decolar to Expedia, Expedia´s Brazilian Subsidiary (for Brazilian POS Consumed Travel Bookings) or Expedia´s Mexican Subsidiary (for Mexican POS Consumed Travel Bookings).

In the event that any Room Revenue Payment due in respect of a Transaction Statement is not received by Expedia, Expedia´s Brazilian Subsidiary (for Brazilian POS Consumed Travel Bookings) or Expedia’s Mexican Subsidiary (for Mexican POS Consumed Travel Bookings) in compliance with this provision, during the subsequent [***] period, Decolar shall take such steps as may be necessary to cure any failure to make such Room Revenue Payment within [***].

If, at the conclusion of such [***] period, any Room Revenue Payment due in respect of a Transaction Statement is not received by Expedia, Expedia´s Brazilian Subsidiary (for Brazilian POS Consumed Travel Bookings) or Expedia’s Mexican Subsidiary (for Mexican POS Consumed Travel Bookings) in compliance with this provision, in addition to Expedia’s rights under this Agreement and at Law, Expedia shall have the right to: (a) offset any such amounts due from any Payments due Decolar hereunder; (b) cancel all un-stayed bookings; (c) suspend Decolar’s access to Expedia’s Travel Products immediately and/or (d) to the extent not so offset pursuant to the preceding clause (a) or Section 3.3.4 recoup such amounts due by drawing upon the Letter of Credit at any time, pursuant to Section 3.6.4. In addition, Expedia may demand from Decolar adequate assurance of due performance if Expedia reasonably believes that there will be a fundamental non-performance of Decolar’s obligations hereunder. If Expedia has not received such adequate assurance within [***] from the date of delivery of its request then Expedia may deliver a statement to Decolar for all Transactions whether Consumed or not. Such statement shall be considered a Transaction Statement and shall be subject to the payment terms hereunder. Decolar acknowledges and agrees that Decolar is responsible for the payment of banking transfer fees in relation to the payment of the Transaction Statement. Expedia acknowledges and agrees that Expedia is responsible for the payment of banking transfer fees in relation to the receipt of payments related to the Transaction Statement.”

e.Section 3.3.3 shall be restated to read as follows:

“3.3.3. Notwithstanding the above, the Parties agree that the payment of Transaction Statements for Consumed Travel Bookings, that take place through or on:

(i)    any Brazilian POS and such Consumed Travel Bookings shall be paid in Brazilian Real;

(ii)    any Mexican POS and such Consumed Travel Bookings shall be paid in Mexican Pesos to the bank account stipulated in Schedule 3.3.3 unless otherwise notified by Expedia; and

(iii)    any other Decolar Travel Solution (other than the Brazilian POS and Mexican POS), shall be paid in United States Dollars.

In all cases, all payments made by Decolar to Expedia will be sent via wire transfer to the Expedia bank account specified in Schedule 3.3.3 or on the Transaction Statement (which Expedia may revise from time to time by Notice to Decolar) (the “Expedia Account”).”

f.A new Schedule 3.3.3 shall be inserted and will include details of Expedia’s Mexican, US and Brazilian bank accounts as follows:

[***]

The Parties agree that Expedia’s bank account in Brazil, Mexico and US may be updated in writing to the email addresses set out in Section 15.9.”

g.The final sentence of Section 5.1.1 shall be amended to remove the words: “that is governed by the GDPR (as defined in Schedule 5), if any” at the end of the Section.

h.A new Schedule 5 shall be inserted as per Appendix 1 of this Amendment and Section 5.1.4 added by way of amendment on 27 October 2022 shall be deleted.

i.Section 8.6(b) shall be amended to remove reference to ‘or Vacationspot, SL’ in part (1)

Schedule 5.1

Applicable data Protection laws

1.Definitions

For the purposes of this Schedule, the following terms will have the following meanings:

a)appropriate technical and organizational measures, personal data, and supervisory authority (or reasonably equivalent terms) shall each have the meaning given to them in the Applicable Data Protection Law;

b)Applicable Data Protection Law(s) means all data protection and privacy laws that apply to Customer Personal Data Processed under this Agreement (including, where applicable to each Party, EU Data Protection Laws and Brazilian Data Protection Law);

c)Brazilian Data Protection Law means Law num. 13.709 of august 14, 2018 (the “LGPD”) and any applicable national legislation made under or in connection with the LGPD;

d)Current Audit Report means a current version of the PCI DSS attestation of compliance and the SSAE 16 Audit Report, or its industry standard successor, for the Data Processor’s data centre providers;

e)Data Controller means an entity that determines the purposes and means of Processing personal data;

f)Data Processor means an entity that Processes personal data on behalf of a Data Controller;

g)Permitted Purpose means the purposes of (i) fulfilling Travel Bookings; (ii) providing customer support for Travel Bookings when applicable; (iii) using anonymized data to improve our services and user experience, including optimizing the booking experience for End Users; (iv) generating reports for Decolar for you, including commission statements and any further processing required for reconciliations, complaints handling and similar activities connected with servicing; (v) creating aggregated and anonymized reports for analytics, business intelligence and business reporting; (vi) fraud prevention; (vii) responding to law enforcement requests and tax audit requests; (viii) facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales); and (ix) otherwise complying with our the Parties’ obligations under this Agreement and applicable laws; and (x) for the determination, calculation, reporting of Travel Taxes and other applicable taxation purposes as may be required from time to time;

h)Process or Processing means any operation or set of operations that is performed upon Personal Data, whether or not by automatic means, including, without limitation, collection, recording, organization, structuring, storage, access, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, making available, alignment, combination, restriction, blocking, deletion, erasure, or destruction; 18488

i)Privacy Shield means the EU-US/ Swiss-US Privacy Shield certifications with the US Department of Commerce or replacement or supplementary certification mechanisms approved by the European Commission (or other relevant national authority) from time to time including the Data Privacy Framework approved by the European Commission on 10 July 2023;

j)Restricted Transfer Area means the European Economic Area, Switzerland or the United Kingdom;

k)Restricted Transfer Data means End User Data relating to a Travel Booking made via a point of sale intended by us to be accessed by individuals in a Restricted Transfer Area;

l)Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed; and

m)Standard Contractual Clauses/ SCCs means the approved European Commission’s Standard Contractual Clauses for the transfer of personal data from the European Union to third countries, as issued on 4 June 2021, as amended, replaced, supplemented, or superseded from time to time, and the full current version of which can be found following this link: https://commission.europa.eu/law/law-topic/data- protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

2.Relationship of the parties

1.1Both Parties agree to comply with Applicable Data Protection Laws in respect of the Processing of Customer Personal Data, as applicable to each Party.

1.2For any Customer Personal Data, Decolar shall be the Data Controller and Expedia shall be the Data Processor and this Schedule 5 sets out the scope, nature and purpose of processing by us as processor, the duration of the processing and types of personal data and categories of data subject.

3.The Data Controller’s responsibilities

1.1In its capacity as Data Controller, Decolar will in particular:

1.1.1comply with Data Protection Laws applicable to Decolar;

1.1.2satisfy a legal basis in order to make available the Customer Personal Data provided by Decolar to Expedia to process for the Permitted Purposes;

1.1.3cooperate with and provide reasonable assistance to Expedia to assist Expedia with its compliance with Applicable Data Protection Law in the course of its processing of Customer Data Personal in connection with this Agreement; and

1.1.4display and comply with lawful and up-to-date cookie notice, if applicable to Decolar.

4.The Data Processor’s responsibilities

1.1In its capacity as the Data Processor, Expedia (and its Affiliates, where applicable) will:

1.1.1process Customer Personal Data only on the Data Controller’s written instruction and in accordance with this Agreement and in accordance with Decolar’s privacy policies accepted by the End Users to the extent they have been shared with the Data Processor and do not conflict with the Permitted Purposes, and Data Controller hereby confirm that its documented instructions are for the Data Processor to process the Customer Personal Data as required in connection with the Permitted Purposes and necessary or further instructed in writing by the Data Controller in connection with the Agreement. The Data Processor shall inform the Data Controller if, in its opinion, an instruction infringes Applicable Data Protection Laws;

1.1.2upon termination or expiry of the Agreement or upon the Data Controller’s request, delete or return Customer Personal Data save that, in the event that the Data Processor is unable to destroy the Customer Personal Data (due to backup or legal reasons), the Data Processor shall continue to extend the protections of these requirements for the term determined by applicable laws and immediately terminate any further Processing of the Customer Personal Data without the Data Controller’s express prior written consent, except where and to the extent required by applicable law. The Data Processor obligations under these requirements to protect the security of Customer Personal Data shall survive termination of the Agreement;

1.1.3ensure appropriate operational and technical measures are in place to safeguard the Customer Personal Data against Security Incidents;

1.1.4notify the Data Controller without undue delay if the Data Processor determines the occurrence of any actual Security Incidents and shall provide the Data Controller with reasonable information and cooperation

so it can fulfil any data breach reporting obligations it may have under (and in accordance with the timescales required by) applicable Data Protection Laws;

1.1.5establish policies and procedures to provide all reasonable and prompt assistance to the Data Controller in responding to any and all requests, complaints, or other communications received from any individual who is or may be the subject of any Customer Personal Data Processed by the Data Processor;

1.1.6ensure that any person (including the Data Processor’s staff, agents and subcontractors) who are authorized to Process the Customer Personal is subject to a strict duty of confidentiality (whether a contractual or statutory duty) and shall not permit any person to Process the Customer Personal Data who is not under such a duty of confidentiality;

1.1.7maintain a record of processing activities carried out on Data Controller’s behalf as required by Applicable Data Protection Law;

1.1.8with regard to Restricted Transfer Data, assist the Data Controller at its cost to conduct data protection impact assessments to the extent such assessments are required by Applicable Data Protection Law, and if necessary, consult with relevant supervisory authorities or equivalent under Applicable Data Protection Laws; and

1.1.9not use Customer Personal Data to initiate contact with individuals who are the subject of the Customer Personal Data for any purpose other than in connection with the Permitted Purposes except where End Customer has expressly requested such contact or otherwise in accordance with Applicable Data Protection Law.

1.2If the Data Processor considers any request by the Data Controller for support or assistance under paragraph 4.1 to be excessive or unduly onerous, then it reserve the right to charge the Data Controller for such support to a reasonable level to be agreed by the Parties.

5.Sub-processors

1.1When acting as Data Processor, a list of subcontractors who may Process Decolar’s Customer Personal Data is listed at Expedia’s sub-processor website (https://support.ean.com/hc/en-us/articles/360000986389-EAN-Data-Services-Vendor-List, as updated from time to time) and Data Controller hereby confirms its approval of the Data Processor’s existing sub-processors. This sub-processor list shall contain a mechanism for Decolar to subscribe to notifications of any new sub-processors or changes to the sub-processor list. To receive updates or changes to this list, Decolar will subscribe using the mechanism provided. Expedia shall

only appoint third party vendors or service providers as sub-processors of the Customer Personal Data where it:

1.1.1enters into written contracts with such sub-processors which provide for data protection terms that are no less protective than the terms set out in this Schedule; and

1.1.2remain fully liable to Decolar for any breaches of the Agreement that are caused by the acts, errors and omissions of its sub-processors,

1.2Where Decolar has reasonable data protection grounds to believe that a sub-processor appointed by Expedia will render Expedia unable to fulfil its data protection obligations under this Schedule, it may, within [***] of receipt of notice of their appointment, object to Expedia’s appointment of such sub-processor, in which case Expedia will not allow that sub-processor to further access the Customer Personal Data until Decolar has agreed to the appointment or replacement of the subcontractor or until Decolar withdraws its objection.

6.Cross-border data transfers

1.1The Data Processor shall not (and shall not permit any sub-processor to) transfer Customer Personal Data outside the territory of origination unless it takes any required compliance measures to enable such transfer legally in accordance with Applicable Data Protection Laws. For example, such measures shall include the compliance with requirements of Chapter V of the LGPD in case of transfer of data outside of Brazil.

1.2To the extent applicable to each Party, the Data Controller and Data Processor agree that in respect of transfers of Customer Personal Data between the Data Controller and Data Processor (a) to the extent that and for so long as Privacy Shield is a recognized method of transfer by a relevant authority and to the extent applicable to each Party, Privacy Shield shall be the agreed mechanism for cross-border transfers of data originating from a Restricted Transfer Area to Data Processor in the United States if applicable to the Parties, and (b) to the extent and for so long as Privacy Shield is not a valid method of transfer in relation to any Restricted Transfer Data, the SCCs shall apply to such transfers if applicable to the Parties. The Data Controller and Data Processor hereby agree to enter into the SCCs as set out in https://www.expediagroup.com/who-we-are/corporate-standards/partner-privacy-data-handling-requirements/default.aspx marked “Rapid API - Processor SCCs” or similar term from time to time, and those terms are hereby incorporated into this Agreement by reference only to the extent applicable to each Party.

7.Data security

1.1Both parties shall:

1.1.1maintain appropriate technical and organizational measures to protect the Customer Personal Data they each process against a Security Incident; and

1.1.2in the event of a confirmed Security Incident, promptly notify the other party if the Security Incident affects Customer Personal Data that is also processed by the other Party under this Agreement, providing full details of the same. In such event, both Parties shall cooperate reasonably and in good faith to remedy or mitigate the effects of the Security Incident, and the reasonable costs of such cooperation shall be borne by the Party that suffered the Security Incident.

1.2Upon the Data Controller’s written request and no more than once a year, the Data Processor will provide the Data Controller its then Current Audit Report or meet with the Data Controller’s security team to discuss security questions that it may have; and/or complete a questionnaire provided by the Data Controller or a third party on its behalf regarding its compliance with this Schedule, provided that the Data Processor shall not be required to disclose information that is reasonably considered confidential to its business.

8.Additional Obligations

1.1For the purpose of this section: “sale/sell” and “share” will have the meaning given to it in Applicable Data Protection Law in the United States.

1.2To the extent that Customer Personal Data processed by the Data Processor is within the scope of Applicable Data Protection Law of the United States, Expedia will be deemed to be a “Service Provider” and references to processor in this Schedule 5 shall be construed accordingly for such purposes.

1.3The Data Processor (Expedia) will not process any Customer Personal Data outside of the direct business relationship between the Parties as outlined in this Agreement. Additionally, the Data Processor will not combine Customer Personal Data it receives from or on behalf of the Data Controller with any personal information it receive from another entity or that it collect from our own interactions with individuals, except where allowed under Applicable Data Protection Laws.

1.4If the Data Processor has access to de-identified Customer Personal Data, it will publicly commit to maintain and only use such de-identified data in such form. The Data Processor will not, and will allow any sub-processor to, re-identify any de-identified Customer Personal Data unless so instructed in writing by the Data Controller.

1.5For the purposes of Applicable Data Protection Law, the Data Processor acknowledges and agrees that it is not permitted to sell, share or rent the Customer Personal Data. The Data Processor and the Data Controller agree that the transfer

of any Customer Personal Data in accordance with this Agreement does not constitute a sale or sharing.

9.PCI

1.1The Data Controller warrants and represents that it shall:

1.1.1only obtain, use, transmit and store End User cardholder data to the extent required to comply with Data Controller’s obligations under this Agreement and the applicable data protection policy accepted by End Users;

1.1.2where Data Controller obtains, uses, transmits, stores or processes End User’s cardholder data, it shall comply with the PCI DSS as issued by the PCI Security Standards Council, as updated from time to time;

1.1.3provide Data Processor with a copy of its annual certification of compliance if requested by Data Processor; and

1.1.4promptly notify Data Processor of any breach of the PCI DSS or any personal data breach affecting End User cardholder data.