Privacy Policy

Last Updated: December 29, 2025

1. INTRODUCTION
   • This Privacy Policy is intended to explain, among other things, how we at Kiftzuba Park, which is operated by Tzuba Tourism Agricultural Cooperative Society Ltd. (hereinafter: “Kiftzuba”, “we”, “us”, “our”), collect and use personal information about you (hereinafter: “you”, “your”) that will be collected by us, as part of your use of our website available at https://kiftzuba.co.il/ or at any other domain as it may be from time to time (hereinafter: the “Website”); upon your arrival at the park and during your visit; and when you contact us in any way (collectively: the “Services”).
   • For the purpose of this Privacy Policy, “Personal Data” means any information or data relating to an identified or identifiable natural person (such as your name, email address, telephone number, etc.), including “Personal Information” and/or “Especially Sensitive Information” as defined under the Israeli Protection of Privacy Law, 5741-1981.
   • Please note that certain services provided by us may be subject to additional terms and conditions, including regarding privacy protection, which will be presented to you at the time of joining and/or using them.
   • This Privacy Policy forms an integral part of our Terms of Use.
   • We recommend reading the terms of this Privacy Policy carefully before using the Website and/or the Services. By accessing or using the Website, receiving Services from us, and/or contacting us in any manner, you acknowledge that you agree to the terms of this Privacy Policy in full, as may be updated from time to time, including the collection, processing, and retention of Personal Data about you by us, as well as its sharing with third parties, all as detailed below. If you do not agree with the terms of this Privacy Policy, you must immediately cease all use of the Website and/or the Services.
   • The division of this Privacy Policy into sections and headings is for convenience only and shall not affect its interpretation.

2. PROCESSING OF PERSONAL DATA
   • You are not under any legal obligation to provide us with any Personal Data. The provision of Personal Data is entirely voluntary and subject to your informed consent. Notwithstanding the foregoing, please be advised that failure to provide certain required information may result in our inability to offer some or all of the Services to you. For instance, without payment information, we will be unable to process your ticket reservation, and without contact details, we may be unable to respond to your inquiries.
   • You hereby represent and warrant that all information you provide to us is true, accurate, complete, clear, and up to date. In the event that you provide us with Personal Data relating to third parties, you further represent and warrant that you have obtained all necessary consents and authorizations from such third parties to disclose their Personal Data for the purposes set forth in this Privacy Policy, and that you have duly informed them of the terms and contents of this Policy, or, alternatively, that you are their legal guardian and authorized to act on their behalf.
   • Our Website is not intended for minors under the age of 18; if you are a minor, you are requested not to use our Website. We do not intend to collect or process Personal Data about minors, except to the extent that such information is required for the provision of the Services. Where such collection is required, it will always be with the consent of the minor’s parent or legal guardian.

3. CATEGORIES OF PERSONAL DATA WE COLLECT

We collect and process the following categories of Personal Data:

• Reservation Information. When reserving tickets for the Park through the Website, our customer service center, or at the ticket counters, you will be required to provide, and we will collect, one or more of the following details: your full name, telephone number, email address, date of arrival at the Park, and the number and types of tickets included in your order. If you pay by credit card, we will collect the last four digits of your credit card and a token received from the payment providers (note: full credit card details are processed and stored exclusively by PCI-compliant third-party payment providers).

If you choose to enter a discount voucher or coupon code from a specific club with which we have an arrangement, we will be able to identify you as a member of that club.

3.2. Health and Accessibility Information. Pregnant women in their sixth month or later are entitled to free entry to the Park. Individuals with disabilities or special needs are eligible for discounted admission and, in certain cases, a queue-exemption bracelet. To receive these benefits, you will be required to present the relevant documentation and certificates.

• Private Events. When engaging with us to hold a private event at the Park, such as a “Fun Day” for organization employees and their children, a group experience for kindergartens and schools, or a birthday celebration, you will be required to provide the following information: full name, telephone number, email address, event date, and event type.

It is further clarified that if you arrive at the Park as part of a private event organized by a specific group, we will also collect information regarding your affiliation with that group.

• Automatically Collected Data. When you access or use the Website, we may automatically collect certain technical and usage information, including, but not limited to, your Internet Protocol (IP) address, browser type, operating system, pages visited, duration of visits to each page, and other related data. This information is collected through cookies and similar tracking technologies, as further detailed in our separate Cookies Policy: https://kiftzuba.co.il/מדיניות-עוגיות/.
• Contact and Correspondence. When you use the “Contact Us” form available on our Website, you will be required to provide certain information, including your full name, telephone number, and email address. Additionally, you will also be required to enter your inquiry or message in the designated text box. Please be advised that any information submitted in this text box will be transmitted to us as is. Therefore, we kindly ask that you provide only the information necessary for handling your request. Should you choose to include Personal Data relating to yourself (or to any third party) in this text box, you hereby acknowledge and agree (or confirm that you have obtained the relevant individual’s consent) to our collection, processing, and use of such Personal Data in accordance with this Privacy Policy. The foregoing shall apply, mutatis mutandis, to any other method of communication you may use to contact us, including but not limited to email correspondence, WhatsApp, or communications via our official social media channels.
• Call Recordings. Telephone calls received by our call center may be recorded for purposes of quality assurance, employee training, and service enhancement. Please note that any information disclosed during such calls will be recorded and stored by us. Accordingly, we kindly request that you share only information necessary for handling your inquiry. If you choose to disclose Personal Data about yourself (or about others) during the call, you hereby acknowledge and agree (or confirm that you have obtained the consent of the relevant individual) to our collection, processing, and use of such Personal Data in accordance with this Privacy Policy.
• CCTV Cameras. We use CCTV cameras in public areas at the Park to ensure the safety and security of visitors, staff, and property.
• Kiftzova Loyalty Club. We operate a unique members’ loyalty club (hereinafter: the “Club”). In order to enroll in the Club, you must provide your full name, telephone number, email address, and month of birth. By completing the membership registration process, you expressly consent to receiving marketing communications from us, subject to the provisions of Section 4.4 below.
• Photos and Social Media. We may publish photos of you taken during your visit subject to your consent. Additionally, by tagging or mentioning our official social media accounts (e.g., on Instagram or Facebook) or posting directly to our page, you hereby grant us your consent to share, display, reproduce, or otherwise use the tagged or mentioned content on our official channels and Website.
• Supplier Information. When engaging with suppliers or service providers, we may collect Personal Data relating to their representatives (where the supplier or service provider is a legal entity) or directly from the supplier or service provider (where the supplier or service provider is an individual). Such Personal Data may include, without limitation, the individual’s full name, contact information, place of employment, professional qualifications, and identification number. The provision of this information is voluntary; however, failure to provide the requested information may result in the Company being unable to establish or continue the business relationship with the supplier or service provider.

4. PURPOSES OF PROCESSING PERSONAL DATA

We process Personal Data collected from or about you solely in accordance with this Privacy Policy and applicable data protection laws. The processing of your Personal Data is carried out for the following purposes:

• Operation and Maintenance of our Website. To enable your access to and use of the Website, to operate, monitor, and maintain its functionality, to ensure its proper performance, to identify and resolve technical issues, and to continuously improve and develop it.
• Provision of Services, Operation of Our Activities, and Business Development. We use your information to operate our activities, provide and improve our Services, and develop new offerings. This includes identifying usage trends and visitor patterns on the Website, evaluating the effectiveness of our advertising campaigns, assessing the performance of third parties acting on our behalf), and forecasting Park occupancy rates.
• Customer Relations and Operational Communications. To facilitate communications with you regarding your reservations, inquiries, or requests; to provide timely updates, notifications, and information regarding our Services, Terms of Use, or this Privacy Policy; and to send you operational messages such as order confirmations, service updates, or other administrative communications.
• Marketing and Direct Communications. The contact information you provide upon registration for the (as detailed in Section 3.8 above), may be used, subject to your explicit consent, to send you marketing communications and promotional materials, in accordance with the provisions of the Israeli Communications Law (Telecommunications and Broadcasting), 5742‑1982, and to send you direct mailings in accordance with the Protection of Privacy Law, 5741‑1981.

You may unsubscribe from marketing and/or direct mailing lists at any time by clicking the unsubscribe link included in each message or by contacting us using the details provided in Section 12 below. Please note that even after unsubscribing, we may continue to send you messages that we are legally required or permitted to send without your consent.

• Safety and Security. To ensure the safety and security of you, other visitors, suppliers, and our employees during your stay at our premises.
• Information Security and Fraud Prevention. To maintain the security and integrity of our systems and data, detect, prevent, and investigate fraud, misuse, or any other unlawful or unauthorized activity.
• Disclosure to Third Parties. We may share Personal Data with third parties as described in Section 5 below, when necessary for the operation of our business or the provision of our Services.
• Creation of Aggregated, Anonymous, or Statistical Data to analyze trends, generate statistical insights, and develop, improve, and tailor our Services and those of third parties with whom we engage.
• Compliance with Legal and Regulatory Obligations. To comply with applicable legal, regulatory, and governmental requirements, including responding to lawful requests, court orders, or regulatory investigations.
• Establishment, Exercise, and Defense of Legal Rights. We may process Personal Data as necessary to protect, establish, exercise, or defend our legal rights, interests, operations, property, and security, as well as those of our visitors, employees, and third parties. This includes, without limitation, asserting or defending against legal claims, seeking legal remedies, and mitigating or preventing potential damages or liabilities.

5. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

We may disclose or otherwise transfer your Personal Data to third parties, whether located in Israel or in other jurisdictions (including jurisdictions that may not provide the same level of data protection under Israeli law):

• Service Providers. We may share Personal Data with third-party service providers who assist us in operating and managing our business, our services, and the Website. Such providers may include information technology (IT) and cloud storage providers, as well as professional advisors such as legal counsel, auditors, and insurers. These third parties are granted access to Personal Data solely for the purpose of performing services on our behalf.
• Loyalty Clubs. You may purchase tickets to the Park through customer loyalty clubs with which we have established specific arrangements. Please note that the purchase of tickets, discount vouchers, or coupon codes through such clubs is subject to the respective terms of use and privacy policies of those third parties. In certain circumstances, including but not limited to legal disputes, we may disclose your Personal Data to the loyalty club through which your order was placed.
• Related Entities. We may disclose Personal Data to our affiliated entities, as such entities may be from time to time, including Kibbutz Tzuba, Tzuba Winery Agricultural Cooperative Society , and Tzuba Chocolate Farm Agricultural Cooperative Society Ltd. Such disclosure may also occur in connection with other services offered by us that are not governed by this Policy (including, for example, Tzuba Hotel).
• Corporate Transactions. In the event of a merger, acquisition, reorganization, sale, transfer, or assignment of our business, assets, or shares (in whole or in part), or in the context of bankruptcy or liquidation proceedings, Personal Data may be transferred to the acquiring or successor entity as part of such a transaction, including in the context of negotiations leading up to such transactions.
• Legal and Regulatory Compliance. We may disclose Personal Data to competent authorities, regulators, or courts when required by law, regulation, judicial order, or governmental request, or when such disclosure is necessary to comply with our legal obligations.
• Legal Proceedings and Enforcement of Rights. We may disclose Personal Data to the extent necessary to investigate, establish, exercise, or defend against legal claims, or in connection with actual or potential legal proceedings involving you, Kiftzuba, or any third party, including for the purpose of enforcing our Terms of Use or any other contractual or legal rights.
• Data Analytics and Marketing Partners. We may disclose Personal Data to third-party analytics, marketing, and advertising service providers who assist us in enhancing, optimizing, and personalizing our Services, marketing campaigns, and overall user experience.
• With Your Consent. We may disclose your Personal Data to third parties in any manner that is consistent with, and subject to, your explicit consent.

Note: The disclosure or transfer of Personal Data to third parties is limited to the purposes set forth in this Policy and only to the extent we, in our sole discretion, deem necessary. Notwithstanding the foregoing, nothing in this Section shall be construed to restrict or limit our right to disclose, transfer, or otherwise use aggregated or anonymized data that does not personally identify you.

6. HOW DO WE KEEP YOUR PERSONAL DATA SECURE?
   • We implement industry‑standard information security measures to protect the Personal Data in our possession, in accordance with applicable laws and regulations. These measures include, among others, technical, organizational, and physical safeguards designed to maintain confidentiality, privacy, and prevent unauthorized access to or use of Personal Data. We periodically review and update these mechanisms to ensure their continued effectiveness.
   • While we make reasonable efforts to protect your Personal Data, the transmission of information over the Internet and its storage on cloud-based servers can never be completely secure. You therefore acknowledge and agree that we cannot guarantee the absolute protection of Personal Data collected about you, nor can we ensure that unauthorized access, disclosure, alteration, or loss will never occur.
   • Payment transactions are processed securely through third party payment providers that comply with the Payment Card Industry Data Security Standard (PCI DSS), which are solely responsible for securing your payment details in accordance with their respective terms of use and privacy policies. We have no control over the information security practices of such payment providers and shall not be liable for any direct or indirect damage or loss of any kind arising from or related to the payment processing.

7. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?
   • Retention Period. As a general rule, we retain your Personal Data for as long as necessary to fulfill the purposes described in this Privacy Policy or for a longer period if permitted and/or required by applicable law.
   • Backup Data. Information stored in backup systems may be retained for longer periods of time.
   • Non‑Identifiable Data. Anonymized or aggregated data that does not identify you personally may be retained indefinitely, unless prohibited by law.

8. WHAT RIGHTS DO YOU HAVE REGARDING YOUR PERSONAL DATA?

You have the right to request access to the Personal Data we retain in our databases and to request that we update, correct, or delete any information that is inaccurate, incomplete, unclear, or out-of-date, subject to applicable law. To exercise your rights, you may contact us using the contact details provided in Section ‎12 below.

9. LINKS TO THIRD-PARTY WEBSITES AND PLATFORMS

The Website may contain links to external websites or platforms operated by third parties. Once you click on such a link and are redirected to a third‑party website or platform, we have no control over or responsibility for the information transferred to or collected by that third party, nor over the way such information is used.
We strongly recommend that you carefully review the terms of use and privacy policy of any third‑party website or platform you visit.

10. CHANGES TO THIS PRIVACY POLICY

We reserve the right to update or modify this Privacy Policy from time to time, at our sole discretion and without obligation to provide prior or subsequent notice. Any updates will take effect upon publication of the revised Privacy Policy on the Website, with the date of the latest revision indicated at the top of this document. We encourage you to review this Policy periodically. Your continued use of the Website or the Services after any modification or update to these terms shall be deemed to constitute your acceptance of such revised terms.

11. GOVERNING LAW AND JURISDICTION

This Privacy Policy and any dispute arising out of or in connection with it shall be governed by and construed in accordance with the laws of the State of Israel. The competent courts of the Jerusalem District shall have exclusive jurisdiction over any such dispute.

12. CONTACT INFORMATION

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your Personal Data, please contact us by email at avil@tzuba.co.il.

13. DATA CONTROLLER DETAILS

Data Controller: Tzuba Tourism Agricultural Cooperative Society Ltd. 570043984

Phone: +972-2-5347952

Email: kif@tzuba.co.il

Postal Address: Kibbutz Tzuba, D.N. Judean Hills 90870000, Israel