Hostelworld Regulatory News (HSW)

No

Category

Description and Impact

Management and Mitigation

Direction of change

1

Macro-economic Conditions

The Group's financial performance is largely dependent on the wider availability of, and demand for, travel services.

Travel services are enabled by the freedom of movement of people nationally and internationally without prohibitive restrictions. Moreover, it is supported by affordable air, ferry and train fares at significant scale, and similarly good access to accommodation.

The demand for travel services is influenced by a range of macroeconomic circumstances and their impact on consumers discretionary spending levels. Economic activity, employment levels, inflation, interest rates, currency movements and access to credit are among the factors that can impact travel demand.

Management and the Board regularly monitor a range of trading, market and economic indicators to

determine any risk to financial performance due to macroeconomic uncertainties, and any potential

mitigating actions required.

The Group's revenue and customer base is global, with a dispersed population of users, and a geographically dispersed set of destinations. While market conditions may decline in certain regions, the globally diversified nature of the business helps to mitigate this with circa 60% of destination markets in Europe and circa 40% in rest of world.

Rising inflation rates can impact customer discretionary spending and reduce their ability to travel. However, this is potentially offset by the evidence of pent-up demand across the industry as a result of an inability to travel through COVID-19.

In circumstances where events cause a material decline in consumer travel behaviours and patterns on a global scale, management will take necessary actions to conserve cash.

Increased

2

Impact of COVID-19, terrorism, geopolitical conflicts, and other uncontrollable events on leisure travel

There remains a risk of travel restrictions relating to new strains or waves of COVID-19. This could adversely affect the Group's business in impacted regions. We are also exposed to the ability of other businesses within the travel industry to meet increased demands as restrictions ease. Employee staff shortages and flight cancellations negatively impact our business.

The continued threat of terrorist attacks in key cities and on aircraft in flight may reduce the appetite of the leisure traveller to undertake trips, particularly to certain geographies, resulting in declining revenues.

Geopolitical conflicts, climate change, natural disasters or other adverse events outside of the control of the Group may also reduce demand for or prevent the ability to travel to affected regions.

Our target 18-34-year-old population tend to be flexible as to destination and are less risk adverse. Their trips tend to be a 'rite of passage' rather than a more discretionary or optional vacation resulting in less aversion to these risks and more flexibility in configuring trips around restrictions.

Decreased

3

People

The Group is dependent on its ability to attract, retain and develop creative, committed and skilled employees so as to achieve its strategic objectives. Due to the impact of the COVID-19 pandemic, the Group took actions to restructure the organisation which commenced in 2020 and concluded in 2022, to ensure the organisation is designed to optimally deliver our strategic priorities. Such restructures, which included reducing headcount, can impact employee morale and engagement levels.

The Group had been feeling the effects of the global increase in attrition related to COVID-19 ("the great resignation"), and although attrition has slowed in 2022, the Group is finding it increasingly difficult to remain competitive to attract talent, which has the potential to further disrupt the business.

The Group has a key dependency on attracting and retaining employees in engineering, quality assurance, product management and data roles to facilitate delivery of projects and maintain site and infrastructure stability. Identifying and securing top talent is becoming increasingly difficult in a competitive market. Due to the increased demands in terms of remuneration and benefits in the talent market, in addition to expectations around location and flexibility, particularly in the technology sector, there is a risk that attrition will rise again unless we continue to keep pace with the market and ensure our total reward offering for new and existing hires is on-par with the industry standard.

All of this presents several significant risks, including increased attrition, difficulty retaining valuable key employees, increased time to hire, weakening of our employer brand and therefore ability to attract high calibre talent, potential negative impact on employee morale, productivity and overall engagement, an adverse impact on our culture, and resource constraints; any of which could adversely impact our business and reputation.

The Group is taking meaningful action to retain employees and has implemented HR policies and people processes to enable retention of key talent; namely moving permanently to a hybrid working

model and the introduction of an Agile Working policy, a Working From Abroad policy, paid wellness days and volunteering days to promote engagement, flexibility and work-life blending.

The Group have recognised that an increased investment in career development and training of our people is key to employee engagement and in 2022 recruited a dedicated learning and development specialist within our HR team, with robust plans to support the development of individuals as well as the people management population across 2023.

Robust external benchmarking has ensured there is better understanding of the competitiveness of the reward offering. Employees identified as key talent/critical skills were awarded various retention plans in a bid to retain.

Having completed a headcount reduction in response to COVID-19, the Group closely monitor headcount. While larger technology companies were making announcements relating to significant headcount cuts, we avoided this and will continue to assess headcount needs in 2023.

The Group currently operates from five global offices, which provides flexibility for location of key talent, and has further increased its reach to attract talent by new locations in Germany, Spain and Italy. The Group also engages with a 3rd party 'Employer of Record' to be able to hire talent from countries where we don't have an entity.

A Non-Executive Director fulfils a workforce engagement role as set out in the 2018 UK Corporate Governance Code.

Increased

4

Data security

We are an innovative technology company dependent on sophisticated software applications and computing infrastructure.

The security of confidential business information we generate when engaging in e-commerce and the personal data we capture from customers and employees is essential to maintaining consumer and travel service provider confidence in our services. As an online platform, we are constantly exposed to cyber security related threats in the form of internal and external attacks or disruption on our systems or those of our third-party suppliers.

Our flexible hybrid working model, our work from anywhere policy as well as our engagement of contractors dispersed in various jurisdictions, increases the data security challenges faced by the business.

As the business pursues its social strategy and this strategy evolves, data security shifts into sharper focus with the extended categories of data shared.

In 2022, the migration of the e-commerce platform to the cloud was completed. The security risks of cloud computing vary depending on the delivery model used, but many of the risks extend into every type of cloud solution.

The Group's IT Platforms must comply with GDPR regulations and stay scalable, robust and reliable.

The Group takes the protection of our customer and employee personal data very seriously. We maintain controls and policies to comply with laws that apply to our business, address evolving security threats, and support business innovation and growth.

All employees undertake comprehensive IT security and data protection training at induction and complete annual refresher training.

We have a robust and comprehensive data privacy, security and protection compliance programme in place. We operate a supplier onboarding process that includes a detailed review of the data flows, GDPR considerations and interrogation of the integrity of the IT security of the supplier. We constantly risk assess our vendors, the personal data they process and the maturity of controls in relation to information security and data protection, and schedule periodic reviews of controls in place.

Our information security controls are aligned to leading industry standards, ISO27001:2017 and NIST Cyber Security Frameworks. We are PCI compliant with the guidelines of the payment card industry and are audited to these standards.

We have a data protection compliance framework in place that is aligned to our on-going obligations under the GDPR, ePrivacy Directive and other applicable laws. We have invested and continue to invest in our own data protection compliance resources to monitor and ensure compliance including a bespoke data privacy management software tool. We employ a Data Protection Officer (DPO) who is responsible for informing, advising and monitoring compliance on all matters relating to the protection of personal data in the Group. Our DPO is supported by designated data protection champions throughout the business.

Due to our hybrid working policy we continually assess the risks of remote access. We use Single Sign On and Multi Factor Authentication to ensure adequate protection.

We work closely with an expert solution provider in the architecture and provisioning of cloud services, as well as a certified security company for independent vulnerability and security scanning.

We work closely with our product teams to review evolutions in our social strategy to ensure privacy by design in respect of all projects and iterations of existing projects.

Unchanged

5

Cyber

The Group is susceptible to cyberattacks which could compromise the integrity of our systems and the security of our data. Cyberattacks by individuals, groups of hackers, and state sponsored organisations are increasing in frequency and sophistication and are constantly evolving. The Group expects this risk to become more difficult to manage as the tools and techniques used in such attacks become ever more sophisticated.

The recent move of internal systems to the cloud brings further cybersecurity challenges. There is a risk that the Group's current technical, administrative, and physical IT security framework may not be successful in safeguarding our information assets against cybersecurity attacks. This may result in bad actors stealing customer information, transaction data or other proprietary information. There is also a risk of infiltration of the Group's systems through cyberattacks carried out on third party vendors or contractors of the Group.

There is a risk that internal resources will not have the necessary skills to ensure that data and systems hosted in the cloud will not be exposed due to inexperience or misconfiguration.

There is a risk that insurance companies will impose limitations on cover to prevent adequate insurance protection in the event of a cybersecurity attack.

The Group expends significant resources to protect against cybersecurity breaches and regularly increase our security-related expenditures to maintain or increase our systems' security.

Due diligence is performed on all third-party vendors to ensure that sufficient and appropriate security controls exist to protect Hostelworld data and systems.

The Group have an arrangement in place with a specialist third party firm to monitor network activity and to detect, neutralise, and report any unusual activity to our corporate IT function.

IT policies, procedures, and cyber security initiatives are reviewed and updated regularly to address the changing regulatory environment, including data privacy regulations, and to mitigate the evolving cyber security threat.

Procurement processes have been developed to ensure that third party onboarding includes thorough due diligence prior to the execution of agreements. Cloud-relevant training has been identified and internal resources continue to be upskilled in this area.

Increased

6

Financial

The Group's activities expose it to a variety of financial risks. The Group's revenues and costs are impacted by rising inflation rates, which may also deter our customers from travelling.

Foreign exchange movements may impact travel decisions and travel patterns by customers, as travel from one market into another (operating with a different currency) becomes more expensive. Furthermore, the Group is exposed to translation risk which occurs if the Group has a surplus or deficit in a foreign currency which changes in value over time.

The Group has a €30m term loan facility in place with certain investment funds and accounts of HPS Investment Partners LLC (or subsidiaries or affiliates thereof). The Group's term loan facility creates repayment obligations and covenants, reporting to the involved brokers and lenders, and requires constant monitoring of our leverage position and liquidity metrics. The facility bears an interest at a margin of 9.0% per annum over EURIBOR. Increases in interest rates increases the cost of the facility. Without a return to strong trading levels it is not certain that the Group can meet the covenants set out under the term loan facility agreement.

The Group proactively manages financial risk by seeking to minimise potential adverse effects on its

financial performance.

Foreign exchange movements may impact travel decisions and travel patterns by customers, but typically there is a degree of inherent hedging. In a normal trading environment, USD revenue receipts approximate related USD marketing outflows which mitigates FX translation risk. The Group minimises holdings of excess non-euro currency above anticipated outflow requirements.

The Group has established a disciplined framework, including key ratios and KPIs, of forecasting and reporting which is regularly reviewed and challenged by management to ensure compliance with the loan facility's obligations and covenants, and affordability of repayment terms including interest.

Unchanged

7

Competition

The risks posed by competition could adversely impact our market share and future growth of the business. While we face a number of key risks under competition, in each the competitor we reference is likely to have more resources than we do to enable them to compete more effectively.

There is risk in relation to supply whereby competition from direct competitors, alternative accommodation operators, and disruptive new entrants may lead to a loss of key accommodation suppliers. They may achieve this through their ability to absorb revenue losses and/or additional costs in order to compete on price or bidding strategy, their ability to grow core inventory base (both in terms of property count and destination coverage), and their ability to enhance product features faster through depth of resources.

There is risk posed by Google or other large market players broadening their offering and becoming a direct competitor.

Changes in customer behaviour (for instance post COVID-19 a customer may prefer a private room to a public dorm) may lead to a loss in customer traffic and demand for our services and/or an increase in customer acquisition costs.

There is a risk that the hostels on which we are reliant give their supply as exclusive inventory to our competitors.

Our primary mitigation is the execution of our strategy and to capitalise on our unique market position.

We target new customer acquisition and grow the most profitable customer cohorts (with focus on Customer Lifetime Value/Customer Acquisition Cost) by optimising overall marketing investment. We strengthen the Group's core platform in order to improve its flexibility and the experience of our customers.

We focus on expanding our global footprint, meeting emerging demand while also strengthening our overall product offering.

We leverage the capabilities of our partnerships to ensure we are delivering best in class and the most advanced technology-based solutions for our customers and hostel partners.

We evaluate strategic opportunities to diversify away from exclusive dependence on OTA business and develop a broader experiential based travel offering to our customers.

We roll out commercial agreements to secure competitive rates and inventory across our property base. We make use of the "solo system" and "social cues" strategy to gain access to increased inventory and ward off other platforms from competing in this space.

Unchanged

8

IT Platforms and technological innovation

Over recent years the ever-increasing pace of change of new technology, new infrastructure, and new software offerings have changed how customers research, purchase, and experience travel. Notable shift changes include mobile networks, mobile applications, meta-search providers, display advertising, and social communities.

Unless we continue to stay abreast of technology innovation and change, we risk becoming irrelevant to the modern customer. Technology evolves rapidly, and updates can become quickly obsolete.

The Counter business currently sits outside the main Hostelworld.com development environment and needs to be consolidated which could mean a risk of disruption to service.

We focus on staying current with new trends in technology development and customer behaviour.

We invest a significant amount of our product and user experience functions on research and

development and interacting with similar companies both within and external to travel.

We leverage the capabilities of partnerships to ensure we are delivering best in class and the most advanced tech-based solutions for our customers and hostel partners.

The Group has continued with the ongoing modernisation of our underlying platform to enable us to support faster execution across our core platform. We will work on onboarding the Counter business into our Hostelworld development environment in 2023 so that it benefits from this modernisation and investment.

Increased

9

Third party reliance

We rely on hostel accommodation providers to supply us with our inventory. The majority of our revenue is generated by hostels who are connected to third party channels. If these channels do not make required updates that allow hostels access our latest features, we may fall behind competitive offerings. If these parties suffer from an outage, it will lead to a potential loss in supply.

Given COVID-19 and ongoing financial pressures, with our hostel partners in particular, there is increased risk of properties going out of business, no longer operating in the hostel category, or removing significant hostel elements from their properties.

We rely on a number of key third party providers in relation to systems and service providers. Any interruption in service from any of these providers may lead to a loss in revenue, loss in site and app functionality, increased input from customer services and engineer time, and ultimately if we experience multiple failures we risk reputational and brand damage.

The Group relies on payment processors and payment card schemes to execute certain components of the payments process. We generally pay these third parties interchange fees and other processing and gateway fees to help facilitate payments from customers to our travel service provider partners. There is a risk that the Group may not maintain its relationships with these third parties on favourable terms or that these transaction fees imposed by these providers are increased.

We focus on maintaining good relationships with hostels and vendors.

We work closely with hostel partners and hostel associations to monitor all key developments in the

market. We regularly temperature check the sector both broadly through mass communications and surveys or using more focused means including face to face meetings or one on one calls to ensure that our recorded data is as up to date as possible.

Risk assessment and due diligence controls are carried out in respect of each third-party provider.

We try to identify alternative providers where possible which includes consideration of the effort of transferring services. Material vendors are subject to an annual business review, which is coordinated by the dedicated internal procurement function, where all key risk areas are reviewed. In addition, all vendor contracts and requests must be processed through the Group's purchasing & contract review process.

For services providers we ensure contractual obligations dictate minimum functionality and speedy resolution of issues. We put alerts in place to immediately capture any downtime and replicate as much functionality as possible in-house.

The Group has made preparations in the event hostel partners and/or key service providers fail. The Group closely monitors the financial health of key suppliers and taking steps to mitigate risks.

Unchanged

10

Search engine algorithms

A large proportion of traffic to our websites is generated through internet search engines such as Google, from non-paid (organic) searches, and through the purchase of traffic from travel related user queries/searches (paid searches).

We therefore rely significantly on practices such as Search Engine Optimisation (SEO) and Search Engine Marketing (SEM) to improve our visibility in relevant search results. Search engines, including Google, frequently update and change the logic that determines the placement and display of results of a user's search, which can negatively impact placement of our paid and organic results in search results. Google algorithms have become very sophisticated. We also use algorithms to determine the optimal bid (price) for each user acquisition.

We risk being significantly behind in our marketing strategy. Particularly, in respect of paid searches, our costs to improve or maintain our placement in search results can increase. This could result in a decrease in bookings, and thus revenue, and an increase in costs. It could also result in having to replace free traffic with paid traffic, which would negatively impact margins.

Furthermore, the algorithms that determine our customer acquisition price are dependent on user level data that may not be provided where users do not consent. Since we are placing a bid for each relevant user query to be acquired, the granularity and precision is extremely important for efficient investment allocation.

Changes and developments in the algorithms can happen in a rapid fashion and it is critical for Hostelworld to remain up to date.

The Group invests heavily in recruiting and retaining key personnel with the requisite skills and capabilities in paid and non-paid searches.

This in-house expertise is supplemented by the deployment of leading technology tools and their continuous development to align and match changes in search engine algorithms.

The search marketing team works closely with Google to understand any changes in functionality to the Google Ads platform so that we can avail of any efficiencies in our search traffic. The Group participates in alpha and beta feature tests that give Hostelworld first mover advantage with new functionality that can help drive efficiency.

We continue to enhance our skillsets in house and capabilities by partnering with third party vendors to enhance our search engine optimisation.

Unchanged

11

Climate change, sustainability and corporate social responsibility

Climate change and sustainability continue to be areas of increased focus for the Group and are further evolving as areas of heightened concern with our internal and external stakeholders.

There is a request for more accountability from our customers, employees, and other stakeholders as to what the Group is doing to limit its direct and indirect impact on climate change.

Listing rule developments require tangible reporting on climate disclosures (by virtue of TCFD) including identified metrics and targets to measure the Group's progress on its sustainability journey. Other legal and regulatory requirements also impact reporting required from the Group and keeping abreast of all developments in the area is a key risk.

Physical climate change risks such as extreme weather events could affect our inventory competitiveness and results of operations. In addition, transitional climate change risks such as changes in stakeholder expectations, travel patterns, technologies, and policy and regulation may affect the Group and results of operations.

There is a risk that we do not meet shareholder expectations regarding our target setting and performance against creating a more sustainable operating environment.

We also know that our consumer base feels strongly about making sustainable travel choices and our hostels look to us for guidance in the area of sustainability, requiring us to help to support this group of stakeholders.

Climate change issues may impact travel decisions and travel patterns by customers but is mitigated to

the extent that our business is a global one, with a dispersed population of users, and a geographically

dispersed set of destinations. We take climate risk into consideration in our forecasting and budgeting processes. Further detail is included in the Viability Statement within the annual report and the Sustainability at Hostelworld report within the annual report.

For ESG and TCFD the related steercos received specific training from a third-party provider. We also engage with third parties' specialists for additional support where required, including monitoring the environment for any changes in requirements that could affect the Group.

As an e-commerce business based in five office locations around the world with 241 employees, whilst our Scope 1 and Scope 2 carbon footprint is relatively small, we recognise that the Group has a role to play in protecting our environment. We have set out the metrics and targets we use to monitor our footprint in the Sustainability at Hostelworld report within the annual report.

Our goal is to work with hostels on their own Staircase to Sustainability initiatives. We have begun to work on a hostel facing sustainability plan to address asks from both the consumer audience and the hostel partners. This work will see hostel efforts being showcased on the platform, allowing customers to see precisely what areas a hostel has made progress in. The first step in the execution of this work will be an educational programme for partner hostels to surface the bespoke framework we have created for the sector. We are also recognising efforts, in the areas of Community and Eco particularly, in our annual HOSCAR awards.

Increased

12

Regulation

Regulatory and legal requirements and uncertainties around these could subject the Group to business constraints, increased regulatory and compliance costs or otherwise harm our business.

Our business is global and highly regulated. We are exposed to issues regarding competition, licensing of local accommodation and experiences, language usage, web-based trading, consumer compliance, tax, intellectual property, trademarks, data protection and information security and commercial disputes in multiple jurisdictions.

The recommendations of the Task Force on Climate-Related Financial Disclosures (TCFD) place an onus on the Group to disclose its compliance. The Group needs to stay aware of all future regulation and policy changes within sustainability.

Payment Services Directive Two (PSD2) is an EU Directive that applies to payment services in the EU and regulates the authentication process for accepting credit cards, which the Group need to comply with. The Group is also subject to payment card association rules and obligations under our contracts with the card schemes and our payment card processors, including the Payment Card Industry Data Security Standard (PCI DSS).

The EU Package Travel Directive (the PTD) sets out broad requirements such as local registration, certain mandatory financial guarantees, disclosure requirements and other rules regulating the provision of travel packages and linked travel arrangements.

Changes to the rules regarding the use of "cookies" on our website and mobile applications have the potential to impact on our ability to serve our customers. Cookies are valuable tools for the Group that we use to enhance our customers' experiences and increase conversion. The GDPR and ePrivacy Directive require "opt-in" consent before certain cookies can be placed on a user's computer or mobile device.

The e-Commerce Directive currently means that the Group cannot be held liable for content merely published on its platform, however the Digital Services Act seeks to place greater obligations on companies in relation to content moderation as well as transparency reporting with the imposition of fines for non-compliance.

As the Group's social strategy evolves, the scope of content which may require moderation increases drastically. The development of social features also places greater focus on our GDPR compliance in relation to transparency, legitimacy of processing and data security and data retention.

The Group is also subject to new sign-up regulations including the DAC 7 EU Tax directive. Any addition of new regulatory material that needs to be collated upon sign up, will slow down the operations of GMT and could impact the number of properties added to the site each year. If there is a reclassification of what is a 'hostel' in any locality, this could impact how we choose to display property categorisations on our site. Also, even if a licence is collated upon sign up, the laws within each city can change, resulting in a closure of properties and removal of beds from Hostelworld.

The Group has an internal legal team and external legal advisors to advise the Group on current and

anticipated legal requirements. Our legal advisors monitor and advise on regulatory matters in locations in which we provide services with a particular focus on those areas where we have local operations.

Suitably experienced resources have been engaged to ensure consumer compliance requirements, compliance with the Listing Rules, the UK Financial Reporting Council Corporate Governance Code and the Market Abuse Regulations.

We have a clear TCFD governance structure in place, and we utilise third parties to monitor the landscape for any further climate and sustainability related changes which may impact the Group.

The Group have been working with the Central Bank of Ireland to ensure the Group is compliant with the PSD2 EU Directive.

We have appointed external insurance brokers to help us ensure we have the appropriate insurance in place on the best possible terms. In April 2022 we carried out an audit in conjunction with an independent insurance broker to ensure that our insurance policies and limits reflect the risk environment and reflect industry standard.

We have expanded our ability to offer customers their preferred method of payment in the most efficient manner on all our platforms.

The provisions of the Digital Services Act have been subject to a detailed review and the implications in relation to social functionality and customer review have been fully assessed and necessary processes are being updated in advance of statutory application.

The wider legal framework is also kept under review pertaining to online safety and media regulation requirements.

Unchanged

13

Business continuity

Failure in our IT systems or those on which we rely such as third party hosted services could disrupt availability of our booking engines and payments platforms, or availability of administrative services at our office locations.

Failure of business continuity planning (BCP) could result in significant disruption to service.

As an e-commerce organisation, the Group's BCP focuses on the continued operation of consumer facing products and related services to ensure our e-commerce trading systems can continue to process

bookings. The Group has worked with external advisors to produce robust documented business continuity and disaster recovery capabilities.

The ongoing modernisation programme of both Corporate IT and the website to cloud based services increases resilience to business interruption.

We updated our standard supplier terms to provide more robust and comprehensive contractual provisions regarding force majeure (covering epidemics/pandemics) and BCP (requiring suppliers to implement the provisions of our BCP at any time).

The Group's BCP and disaster recovery plan was successfully implemented to support the business in its response to COVID-19. Both this plan and the supporting backup and failover facilities are regularly reviewed to ensure their continued validity.

Unchanged

14

Brand and reputation

A central pillar of Hostelworld's strategy is the continued evolution of the app's social features which has functionality to fulfil the growing solo traveller market's need to meet other travellers.

Given strict cost discipline in place, there has been reduced spend on brand marketing over the last two years. This has undoubtedly impacted both brand consideration within the existing audience and brand recognition for emerging audiences. The inability to quickly process customer refunds from the initial COVID-19 cancellations is also likely to have eroded existing customers' trust. Organic channels have declined in terms of reach and engagement since early 2020. The owned social media channels lost a huge audience and are seeing a slow rate of growth in terms of fans/followers.

A successful cyberattack resulting in significant downtime or loss of data could cause reputational damage. If a cyberattack was realised there is a risk that the fallout both internally and externally could damage the reputation of the company causing customers to move to a competitor platform.

Poor customer experiences can also impact brand damage. There are cases where a customer has a poor experience at the hostel, either through employee interactions or booking issues. It can be difficult for the customer to separate the experience in the hostel from the platform they booked with. With the expansion of our offerings, the scope for reputational impact from customer experiences increases, coupled with the ongoing trend of seeking redress in a public rather than a private forum.

If Hostelworld is identified as an organisation that makes false claims about its Diversity and Inclusion or Sustainability activities, the reputational damage could be devastating. Greenwashing claims are a risk to any organisation that is reporting on its climate change and sustainability objectives and goals.

Hostelworld may also face scrutiny in their response, as well as their speed of response, to developments in the greater geopolitical climate. Failure to respond in line with mainstream public opinion or a delayed response impacts companies brand and perceived integrity.

The paid marketing teams have continued to invest in promoting our app, specifically the new social

features and encouraging targeted audiences to download the app. The brand marketing teams have

worked to keep all owned channels functioning and active, ensuring that wherever possible we retain audiences. There has been a small investment in social media content creators who produce peer-to- peer video content. We are seeing a return on investment with increased engagement and a growing follower account across both TikTok and Instagram.

An ongoing CRM strategy alerts the existing customer base to the social features at touchpoints throughout the customer journey.

As an organisation we have communicated to customers via CRM and social media our stance on emotive issues such as the war in Ukraine, providing ways in which our customers can support hostels in impacted areas.

We have external PR advisors supporting us to manage any corporate PR incidents. The crisis communications plan is being updated to reflect the use of external advisors.

Hostelworld invest heavily in security controls to protect the platform and the network from malicious cyber activity. Regular reviews ensure that all controls are current and effective. The crisis communications plan has been updated to reflect the potential for a cyber security attack. We will use our external PR agency to minimise impact.

We have put in place an ESG Steerco to oversee our sustainability agenda, and where needed we utilise third parties to mitigate against the risk of bad press including engaging with a reputable third-party South Pole on our climate neutral journey and using our public relation partner to review any sustainability material on our site, in press releases or in our annual report.

Our customer service team strive to ensure that customers have a positive experience at all stages of interacting with us. The Group has a crisis management policy in place which includes appropriate escalation which is regularly reviewed for relevance and requires input from senior management.

Increased

15

Taxation

The Group can be subject to digital services tax (DST). Some countries have taken steps to introduce DST to address the issue of multinational businesses carrying on business in their jurisdiction without a physical presence and are therefore generally not subject to income tax in those jurisdictions.

The Group can also be subject to new vat rules being implemented and new reporting requirements. Hostelworld currently operates a B2B (Hostelworld to Hostel) VAT model and are VAT registered in Ireland. Non-EU countries are introducing local rules in relation to electronically supplied services (ESS) whereby if a business does not have a VAT/GST number a B2C (Hostelworld to Traveller) relationship is assumed and VAT/GST should be charged on supply. The EU are introduced DAC 7 which increases the reporting requirement of digital platforms.

There is an increase to the income and corporation tax risk profile of the Group due to the increasing global workforce footprint of the Group, the relocation of some executive leadership outside of Ireland, and the introduction of a 30-day work from abroad policy. A tax authority may consider a permanent establishment to exist in a country by virtue of some activity being carried on there. A tax authority may deem an employer to have a payroll withholding tax and social security obligation if an individual finds themselves personally tax resident in a country.

The Hostelworld Group structure is driven by our Intellectual Property (IP). Ireland acts as the Group entrepreneur and directs the activities of the overseas service providers. Key functions, assets or risks undertaken/managed outside Ireland may cause tax leakage.

If those tax authorities take a different view than the Group as to the basis on which the Group is subject to tax, it could result in the Group having to account for tax that it currently does not collect or pay, which could have a material adverse effect on the Group's financial condition and results of operation if it could not reclaim taxes already accounted for in the jurisdictions the Group considers relevant.

Changes to tax legislation or the interpretation of tax legislation, changes to tax laws based on recommendations made by the OECD in relation to its Action Plan on Base Erosion and Profits Shifting 2.0 (BEPS) or made by national governments can result in additional material tax positions being suffered by the Group.

Our tax risk is managed by the employment of suitably qualified personnel and close engagement with big four tax advisors. In collaboration with our tax advisors, a large professional services firm, we

assess possible tax impacts in the jurisdictions in which we operate to ensure our tax obligations are aligned to the operational nature of our business. We receive briefings to Board by our tax advisors, where required, on tax risks and any changes in tax legislation which impacts on current tax structure of the Group.

A biannual review is performed with our tax advisors on DST and ESS, and their impact on our Group as trade and turnover (on which the tax is levied) continues to pick up.

We are reviewing our internal processes and information gathered from the properties on our website to ensure compliance with local ESS regimes and the requirements of DAC 7 reporting.

We closely monitor our global footprint and put the appropriate tax structures in place when applicable. We also monitor business travel and have in place a strict work from abroad policy.

We approve where the key functions are located within the Group and align transfer pricing policies to reflect this.

Unchanged