Privacy Policy

Last Updated: January 7, 2025

1. Introduction and Scope

Holisto Ltd. (DBA {brand}) (including its affiliated companies and subsidiaries shall be collectively referred to herein as “Holisto”, “we”, “our,” or “us”), is the owner and operator of an online global accommodations and related services booking platform, offered through its websites and mobile apps (respectively, “Website” and “App” and collectively the “Platform(s)”).

Holisto is committed to maintaining the privacy of its users accessing the Platform, booking or purchasing any offers made available therethrough (respectively “user”, “you” or “your” and a “Booking”). This privacy policy (“Privacy Policy”) describes how Holisto collects and use Personal Data (as defined below) and its privacy practices in connection with users accessing and browsing our Platforms or using any of our services made available through the Platform, including Booking (collectively with the Platform and any additional services, features, content or any other offerings by Holisto as part of the Platform shall be referred to as the “Services”). This Privacy Policy will further provide you information regarding your rights related to your Personal Data, your rights, and the choices you can make.

You are not obliged by law to provide us with any of your Personal Data. However, if you refrain from doing so, we may not be able to provide any or all of our Services (please see Section 4 below, “The Data We Collect & Purpose of Collection and Use”).

This Privacy Policy constitutes an integral part of our Terms of Service available at: https://www.{hostName}/terms-and-conditions (“Terms”). Capitalized terms used herein, however not defined, shall have the meaning assigned to them in our Terms.

Additional Information for Specific Jurisdictions

This Privacy Policy further includes specific information required under applicable data protection laws for residents of certain jurisdictions, among others:

If you are located in the EEA or UK – this Privacy Policy further details our lawful basis for processing Personal Data, information regarding cross-border data transfer and your rights, as well as additional information we are required to disclose to you under the EU/UK General Data Protection Regulations (“GDPR”).
If you are a California resident, please review Section 14 below, “CCPA Privacy Notice.” This notice serves as a Notice at Collection as required under the California Privacy Rights Act (“CCPA”) and further details the categories of information collected and additional information regarding our privacy practices, including your rights.
If you are a resident of certain states in the US – including Colorado, Connecticut, Virginia, and Utah, please review Section 13 below, “Additional Information for US Residents” – for additional information about privacy rights for residents of these U.S. jurisdictions.

Third-Party Links and Supplier’s Services

Please note that this Privacy Policy details only our privacy practices as the data controller of Personal Data.

Our Services may also include offers by third parties, which users may obtain directly from them. If you are directed to third-party websites and digital assets or purchase goods or services directly from such third parties on webpages hosted under our domain, any data collected is subject to the applicable third-party privacy practices and policies, which we do not control or monitor. Such data collection is not subject to this Privacy Policy.

In addition, once you book a travel service offered by our third-party suppliers through our Platform, for example, if you book accommodation (respectively “Supplier” and “Travel Service Offer”), we will share certain Personal Data with our Suppliers to confirm and fulfill your Booking or other purchase. Once your Personal Data is shared, the Supplier determines and is responsible for the processing of your Personal Data shared with it, and its own privacy policies and privacy practices will govern the processing of your Personal Data by the Supplier.

2. Contact Information, Data Controller and Data Protection Representatives’ Information

You will find here information regarding our position as the data controller of your personal data, our contact information, and our data protection representatives’ contact information

Holisto Ltd., incorporated under the laws of the state of Israel, is the data controller (as such term is defined under applicable data protection laws or an equivalent term) of the Personal Data collected through the Services. This means we control the processing of Personal Data described in this Privacy Policy.

For any questions, inquiries or concerns related to this Privacy Policy or related to the processing of your Personal Data, you may contact us at:

Holisto Ltd (CN 515341535)
Sderot Nim 2, Rishon Le-Zion, Israel, 7546302
By Email: contactus@{hostName}
Attn: Privacy Team.

Data Protection Officer:

We have further appointed a data protection officer that can be contacted directly for any specific inquiries related to your Personal Data and requests to exercise your rights. Our data protection office can be contacted at:

Data Protection Representative for Data Subjects in The EU and UK:

EU DPR:

HLST Ireland Ltd.
At 'RSJ LLP' office. The Exchange, George's Dock, I.F.S.C, Dublin 1, Ireland D01 P2V6
By Email: eu-dpr@holisto.com
Attn: Holisto DPR

UK DPR:

Holisto UK Ltd Ltd.
At 'Anstey Bond LLP' office, 1 Charterhouse Mews, London, England, EC1M 6BB
By Email: uk-dpr@holisto.com
Attn: Holisto DPR

3. Updates and Amendments

You will find here information regarding amendments or updates we may apply to this Privacy Policy and how we publish it.

We reserve the right to amend this Privacy Policy from time to time, at our sole discretion, including, for example, if we have a new offering under our Services or otherwise change our Personal Data processing practices and operations. The most recent version of the Privacy Policy will always be posted on the Platform. The updated date of the Privacy Policy will be reflected in the “Last Updated” heading. We will provide notice to you if these changes are material and where required by applicable law. Any amendments to the Privacy Policy will become effective within display of the modified Privacy Policy, unless we are otherwise obligated to provide prior notice or obtain consent under applicable data protection laws. We ask you review this Privacy Policy periodically to ensure that you are aware of our most updated privacy practices.

4. The Data We Collect & Purpose of Collection and Use

You will find here information regarding the types of personal data we collect, the purposes for which we process your Personal Data as well as our lawful basis for processing.

Depending on your interaction with our Services, certain information will be processed, which may include:

“Non-Personal Data” – meaning, information which does not identify a specific natural person and cannot reasonably be used for such identification. We collect Non-Personal Data such as technical information regarding your device or browser, type of operating system, scope, frequency, time and date you have accessed the Platform, interactions with the content displayed through Platform, language preference, and other technical information regarding the device used – all is considered as Non-Personal Data when collected on an aggregate basis, or otherwise not combined with any identifiers. We may further process and anonymize Personal Data in a manner that shall create a new set of data that will be Non-Personal Data. Non-Personal Data may be used by us without limitation and for any purpose. Some of this information may be considered “de-identified” under U.S. privacy laws and when we rely on data that has been “de-identified”, we will take reasonable measures to ensure that the de-identified information cannot be associated with an individual, household, or device and maintain and use the information in de-identified form and not attempt to re-identify it.

“Personal Data” – meaning information that identifies an individual or may with reasonable effort identify an individual. This may include online identifiers such as IP address, name, emails, etc., and other information that is identified with you. If we combine Personal Data with Non-Personal Data, we will treat the combined data as Personal Data.

Below we detail the Personal Data we collect, how and for which purposes we process and use your Personal Data and our lawful basis for processing (subject to the GDPR, if applicable).

Online Identifiers & Usage Data

Personal Data Sets

When users access or interact with our Platform and Services, we collect certain online identifiers associated or transmitted from the user’s browser and device, such as Internet Protocol (IP) address, Cookie identifiers, user agent, mobile device identifiers (such as device ID, IDFA if permission was granted) and similar unique online identifiers generated, tags, etc. (“Online Identifiers”).

In addition, when you access our Platform or use our Services, whether as a registered user or not, information regarding your use and interactions with the Platform and Services may be automatically collected. This information may include session durations, the links you accessed, or content viewed on the Platform, your interactions within the Platform including user-interface click and video screen recordings (provided that all other Personal Data is masked), the URL or advertising campaign from which you have reached our Platform, the time and date of interactions, language and currency preferences and settings, etc. (“Usage Data”). In the event the Usage Data is associated with an Online Identifier it will be considered and treated by us as Personal Data.

Purpose and Operations

Online Identifiers and Usage Data are processed by us through use of our, or our third-party service providers’ and marketing partners’, cookies and tracking technologies (see Section 6 below “Cookies and Tracking Technologies”). We process Online Identifiers and Usage Data for a few purposes, as follows:

Platform’s functionality, operation, security and fraud prevention purposes, debugging purposes and to resolve errors or technical issues;
Analytics, to further enhance and improve our Services, the content or offers we display, etc.;
To market, promote and advertise our Services, including on third party’s websites or platforms (whether personalized or not, further depending on your settings and preferences).

For example, we process Online Identifiers and Usage Data to analyze and better understand how users use our Platform, as well as to measure effectiveness of our content and advertising campaigns.

Note that, we do not attempt to analyze or determine your identity based on such information.

Lawful Basis (where the GDPR applies)

Processing these data sets for security and operational purposes, is based on our legitimate interests.
Processing these data sets for analytic and advertising purposes, is based on your consent - where required under applicable laws. You may withdraw consent, opt-out or otherwise change your preferences regarding our use of cookies at any time by using the cookie settings tool available on our Platform.

Location Data

Personal Data Sets

We process your approximate location (country, ZIP) - extracted from IP. With your approval (granted through your device permissions) we will process your GPS location to show you Travel Service Offers (e.g., hotels) around your location (collectively “Location Data”).

Purpose and Operations

Location Data is processed for security and functionality purposes, as well as to provide the Service you have requested to customize and improve our Services, as well as for analytics and marketing purposes.

Lawful Basis (where the GDPR applies)

Processing approximate location data set for these purposes is based on our legitimate interest.
Processing GPS location is based on your consent (granted through your device permissions). You may withdraw consent at any time changing the permissions granted to our App through your device settings.

Registration and Account

Personal Data Sets

If you want to use certain features of our Services (for example fast check-out process), you may register and create an account on our Platform. When you create an Account, you will be required to provide us your full name and email address. You may also register by using a Single Sign-On (SSO) to your social media account, such as Facebook, Google, Apple, etc. If you choose to register with an SSO, you give us your permission to retrieve the relevant information about you, depending on your social media’s privacy settings. The information we collect in this manner may include your full name, email address and other profile information such as profile picture, date of birth, gender or other public information – to the extent they are included in your social media account. In addition, you may choose our secured login options via SMS code and in such event, we will further process your phone number. (collectively the above “Account Data”).

Purpose and Operations

Account Data is processed to create and designate your account, to secure your account including authentication and validation purposes, account management and administration, support, and to enable your use of certain features of the Services. In addition, we may use this information to send you marketing communications, materials, and other information regarding our Platform and Services.

Lawful Basis (where the GDPR applies)

Processing these data sets to designate your account and enable the Services, is based on contract necessity.
Processing these data sets for security and authentication purposes, as well as for direct marketing purposes, is based on our legitimate interest. You can opt-out at any time from direct marketing using the “unsubscribe” option within the body of the message. However, please note that even in case you have opted-out from our marketing communication, we may still use your contact details to send you service-related emails.

Travel Search Information

Personal Data Sets

When you use our Services and search for accommodation or other services offered through the Platform, we will process and store the search information you have chosen including you will be asked to provide us with the following information: dates of travel, travel destination, number of guests, hotel class, budget, etc.

Purpose and Operations

Travel Search Information is processed to provide our Services, including to match and list the Travel Service Offers applicable to your search. We may further process the Travel Search Information to customize our Services, for analytics and Services improvement, as well as for marketing purposes.

Lawful Basis (where the GDPR applies)

Processing these data sets to provide our Services is based on contract necessity.
Processing of these data sets for Service customization and improvement is based on our legitimate interests.
Processing these data sets for analytic and marketing purposes, is based on your consent - where required under applicable laws. You may withdraw consent, opt-out or otherwise change your preferences regarding our use of cookies at any time by using the cookie settings tool available on our Platform.

Booking

Personal Data Sets

When you book a Travel Service Offer through our Services, you will provide us with the need information to facilitate your Booking, including your full name, email, phone number, country of residence, Zip code, and additional information you choose to provide such as special request to be shared with the Supplier or hotel, etc. We will further process and store your booking details, including travel dates, number of guests, and the specific accommodation or service booked (collectively the above “Booking Information”).

In addition, as part of the checkout process you will be required to provide your payment information which may include your credit card details, card-holder name, etc. (“Payment Information”). Note that, we do not store your full payment information, which is stored only by the applicable payment processor. We may store basic information to enable us to identify the transaction such as billing address and last 4 digits of your payment means.

Purpose and Operations

Booking Information and Payment Information are processed to provide our Services, including to process payments and to be shared with our Suppliers to fulfill your Booking, for Service operation and administration, processing and for record keeping purposes. We will further use Booking Information to contact you and send you service-related notices and updates, such as Booking conformation, etc. In addition, we may use your Booking Information to customize our Services, for analytics and Services improvement.

Lawful Basis (where the GDPR applies)

Processing Booking Information and Payment Information to provide our Services is based on contract necessity.
Processing of Booking Information for Service customization and improvement is based on our legitimate interests.

Support and Contact Communications

Personal Data Sets

If you voluntarily contact us following your interest in our Services, for support or other inquiries, through the Platform or by other means of communications, including email, calls, chats (including chatbots), etc., we will process certain information you provide such as your full name, phone number, email address, and any additional information you decide to share with us related to your inquiry or support request and our contact communications and, where applicable, call recordings when you communicate with our call centers.

Purpose and Operations

Support and Contact Communication Data are processed to provide our Services, respond to your inquiry and provide you the requested support and information. We will further process and retain this data to improve our Services, to have records of the support that was provided, for any future needs.

Lawful Basis (where the GDPR applies)

Processing these data sets to respond to your inquiries and provide customer support is based on contract necessity.
Processing these data sets to retain records and improve our Services is based on our legitimate interest.
When you contact our call centers, in the event calls or chats are recorded, you will receive prior notice and, in the event required under applicable laws, your consent will be obtained.

Feedback, Reviews and Survey

Personal Data Sets

If you voluntarily choose to participate in our survey or provide feedback or reviews regarding our Service or Travel Service Offers, we will process your name, email address and the information you provide as part of such participation.

Purpose and Operations

The information you provide when you voluntarily participate in our survey or provide feedback or reviews regarding our Service or Travel Service Offers, will be processed to improve our Services and, where applicable, post your review on our Platform.

Lawful Basis (where the GDPR applies)

Processing these data sets for these purposes is based on your consent (provided when you voluntarily choose to participate). You may withdraw your consent at any time.

Interactions with Suppliers

Personal Data Sets

When you click a link of Travel Service Offer made available through our Platform and you are directed to such Supplier’s website the applicable Supplier may share with us information related to any booking or reservation of its Travel Service Offer (associated with an online identifier or other identifier).

Purpose and Operations

We process this information to track traffic flows and conversion and manage our business transactions with the Suppliers.

Lawful Basis (where the GDPR applies)

Processing these data sets for these purposes is based on our legitimate interest.

Newsletter, Marketing Communications, Promotional Offers, Push Notifications & Engagement with Such Content

Personal Data Sets

In the event you sign up to receive our newsletter or other marketing materials, as well as promotional offers (discounts, coupons, etc.) you will be requested to provide your contact details, such as email address. If you provide permission to receive push notifications through our Platform, we will process Online Identifiers, Usage Data and location data. We will further process your engagement and interactions with the marketing content and communications detailed above, for example if and when you have accessed the content.

Purpose and Operations

We process the information you provide when you sign up to marketing communications or promotional offers in order to send you the content or other promotional offers you have signed up to receive. If you allow push notifications, we process the information in order to send you the push notifications, including to customize and personalize the content based on your location and preferences. We process the data related to your engagement and interactions with marketing communications for analytics and services improvement purpose.

Lawful Basis (where the GDPR applies)

Processing these data sets to send you marketing communication, promotional offers or push notifications is based on your consent. You may withdraw consent to receive marketing materials at any time through the “unsubscribe” link within the email or by contacting us directly. You may withdraw consent to receive push notifications at any time through your device or browsers settings.
Processing data sets related to your engagement with such content and communications is based on our legitimate interest.

Processing Operations & Processing for Compliance with Our Legal Obligations, Prevent Fraud or Infringement of Our Right and Defend our Rights

Please note that, the actual processing operation per each purpose of use and lawful basis detailed in the table above, may differ. Such processing operation usually includes a set of operations, made by automated means, such as collection, storage, use, disclosure by transmission, erasure, or destruction. Transfer of Personal Data to third party countries as further detailed under Section (8) below “International Data Transfer” is based on the same lawful basis as stipulated in the table above.

In addition, we may use all Personal Data listed above to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity thefts and any other misuse of the Services and to enforce our Terms, as well as to protect the security or integrity of our databases and the Services, take precautions against legal liability, and comply with our legal obligations. Such processing is based on out legitimate interests.

5. How We Collect Information

You will find here information regarding the source of the Personal Data we process, as detailed in the table under the Data We Collect & Purpose of Collection and Use paragraph above.

Depending on your interactions with our Service, the Personal Data we process is collected by us from the following sources:

Automatically – we may use cookies, SDKs and similar tracking technologies (as elaborated under Section (6) below “Cookies & Tracking Technologies”) to gather some information when you access the Platform or otherwise interact with our Services, marketing communications, etc.
Provided by you voluntarily – we will collect information if and when you choose to provide us with information, such as when you contact us, create an Account or when you make a Booking.
Provided by our Suppliers – our Suppliers which you have made a Booking of, or otherwise purchased, their Travel Service Offers through our Services or otherwise directed to such Suppliers through our Platform, may share with us certain information regarding your Booking and other reservations you have made with them in the event directed from our Platform.

6. COOKIES & TRACKING TECHNOLOGIES

You will find here information regarding our use of cookies and similar tracking technologies, the purposes for which we use these technologies and how you can change your preferences, including opt-out.

We use “cookies” and similar tracking technologies such as software developer kits for mobile apps, pixels and tags. A cookie is a small text file that a website places and stores on your device while you are viewing a website or an app. These tracking technologies are used for various purposes, for example, allowing you to navigate between pages efficiently; enabling automatic activation of certain features; remembering your preferences; security; analytics and marketing purposes.

The information generally collected and stored by cookies includes Online Identifiers, Usage Data (as defined under Section (4) “The Data We Collect & Purpose of Collection and Use”) preferences and technical information related to your device or browser.

Such cookies and tracking technologies can be either placed by us on our Platform (known as “first party cookies”), or by third parties such as our marketing partners, social media, analytic providers, etc. (known as “third party cookies”). In addition, the duration of such cookies and tracking technologies – meaning the period until such are deleted – can be either when you close your browser (known as “session cookies”) or longer periods according to their purpose and settings (known as “persistent cookies”), provided that you can delete or block cookies through your browser or device settings.

Cookies and tracking technologies can be classified to certain categories, according to their purpose and use, and in general:

Strictly Necessary Cookies - these cookies are necessary for the Platform to function and cannot be switched off. You can set your browser to block or alert you about these cookies, but some parts of the Platform will not work.
Performance/Analytic Cookies - these cookies allow us to count visits, traffic sources and actions on our Platforms so we can measure and improve the performance of our Services. They help us to know, for example, which pages are the most and least popular and see how visitors move around the Platform (mainly on an aggregated basis).
Functional Cookies - these cookies enable us to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages (for example, online forms, etc.). If you do not allow these cookies then some or all of these services may not function properly.
Advertising/Targeting Cookies - these cookies may be set through our Platform by our advertising partners. Where we use third-party advertising cookies, such third-party may independently collect, through the use of such tracking technologies, Personal Data and may combine such information with other information they have independently collected relating to your online activities across their network of websites, for the purpose of enhanced targeting functionality and delivering personalized ads, as well as providing aggregated analytics related to the performance of our advertising campaign you interacted with. These third parties collect and use this information under their own privacy policies.

If you do not allow these cookies, you will still be presented with ads however you experience less targeted advertising.

You may access the cookies declaration (available through the cookies preference management tool and widget on our website) which details the cookies we use on our Platform, as well as provide information on how to change your setting and preference at any time.

Managing Cookies and Opting Out

Other than cookies classified as essential or strictly necessary for functionality purposes, you can always configure your cookies preferences and opt-out from use of certain or all cookies at any time, using the cookies preference management tool and widget on our Platform. In some cases, certain services, features and functionality may not be available to you or work properly if you disable cookies.

In addition, most browsers will allow you to erase cookies from your computer’s hard drive, block acceptance of cookies, or receive a warning before a cookie is stored. You may set your browser to block all cookies, including cookies associated with our Platform, or to indicate when a cookie is being used by us, by adjusting the privacy and security settings of your web browser. You may further use your device setting to change your preferences as for tracking technologies and data collection through the Platform. Please refer to the support page of your browser or device to learn more about how you can adjust your privacy and security settings. Please note that once you choose to opt out or disable cookies, some features of the Services may not operate properly, and your online experience may be limited.

7. DATA SHARING – CATEGORIES OF RECIPIENTS WE SHARE PERSONAL DATA WITH

You will find here information regarding the third parties we may share Personal Data with, the purpose for which we share your Personal Data, and the categories of Personal Data that will be shared. As detailed herein, this mainly includes our services providers and business partners, such as our Suppliers.

We share your Personal Data with third parties, including with trusted partners or service providers that help us provide and improve our Services, and for other purposes, including marketing and compliance with our legal obligations. The categories of such third-party recipients, type of Personal Data we share, and purpose of sharing are as follows:

Trusted Agents and Service Providers - we share Personal Data with our trusted agents (such as legal counsel) and service providers (including, but not limited to, cloud providers, analytic tools, providers of management or security tools, etc.) so that they can perform the requested services on our behalf. These providers are prohibited from using your Personal Data for any purposes other than providing us with requested services. The type of Personal Data that will be shared can be any data processed by us, as needed and applicable to the services provides, provided that when we share Personal Data with services providers, we ensure they only have access to such information that is strictly needed to obtain the services.
Suppliers - as explained above, the offers listed on our Platforms or linked from our Platform are on behalf of Suppliers we engage with – meaning our partners operating the applicable Travel Service Offers - accommodations and other services – directly, or third parties on behalf of such operators. Once you book Travel Service Offer through our Platform, we will share Booking Information (as defined under Section (4) “Data We Collect & Purpose of Collection and Use”) with our Suppliers to confirm and fulfil your Booking or other purchase. Once your Personal Data is shared, the Supplier determines and is responsible for the processing of your Personal Data shared with it, and its own privacy policies and privacy practices will govern the processing of your Personal Data by the Supplier.
Marketing Partners – we may share Personal Data with marketing partners to market and promote our services, including for targeted ads. These may include social media partners or other marketing services operators, including by way of placing their cookies or other tracking technologies on our Platforms. The Personal Data shared may include Online Identifiers, Usage Data, Location Data and Travel Information (all as defined under Section (4) “Data We Collect & Purpose of Collection and Use”). These marketing partners may combine your Personal Data with other data they collect independently from you through other websites you visit online.
Corporate Transactions - we may share Personal Data, internally within our group, or in the event of a corporate transaction (e.g., sale of a substantial part of our business, merger, consolidation, or asset sale). The types of Personal Data that will be shared can be any data processed by us, as needed, however our affiliated companies or acquiring company will assume the rights and obligations as described in this Privacy Policy.
Legal and Law Enforcement - we may disclose certain Personal Data to law enforcement, governmental agencies, or authorized third parties, in response to a verified request relating to terror acts, criminal investigations or alleged illegal activity or any other activity that may expose us, you, or any other user to legal liability. The types of Personal Data that will be shared are subject to law enforcement authority request, and solely to the extent necessary to comply with such purpose.

8. INTERNATIONAL DATA TRANSFERS

You will find here information regarding the territories in which we may process your Personal Data.

Due to our global operations, your Personal Data will be shared with our service providers, business partners, within our company and company group and Suppliers around the world. Accordingly, your Personal Data may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country. However, in all cases, we will take appropriate measures to ensure that transfer of such Personal Data will provide sufficient safeguards, including contractual commitments on behalf of our partners and service providers. We further explain below why we transfer personal data, the measures we take to ensure your personal data will be secure upon transfer, and your rights in this regard.

When Personal Data collected within the EEA is transferred outside the EEA, we will take appropriate measures to ensure that your Personal Data receives an adequate level of data protection upon its transfer outside of the EEA, and you may exercise your rights, where applicable, to receive information on such transfer mechanism, as further detailed under Section (11) “Your Rights & Choices Related to Your Personal Data”.

9. DATA RETENTION

You will find here information regarding our Personal Data retention policies and practices, and the criteria according to which we determine for how long we retain Personal Data.

As explained under this Privacy Policy, we process Personal Data for various purposes. As a general principal, we only retain Personal Data as long as we determine is required to fulfill the purpose for which the Personal Data was collected, or, in some instance, where we have other necessities to retain Personal Data, for example, where needed to comply with our legal obligations.

The criteria used by us to determine the retention of Personal Data is as follows:

Purpose of Collection - we retain Personal Data as long as it is necessary and relevant for us to achieve the purposes for which it was collected.
Compliance With Our Legal Obligations - we retain Personal Data where we are required to do so in accordance with legal, regulatory, tax or accounting requirements.
Dispute, Claims and Legal Proceedings - we retain Personal Data where needed for us to have an accurate record of your dealings with us in the event of any complaints or challenges, and if we reasonably believe there is a prospect of litigation relating to your information or dealings.

We may at our sole discretion, delete Personal Data from our systems, without notice to you, once we deem it is no longer necessary for such purposes. We may also anonymize Personal Data if we intend to use it for analytical statistical purposes over longer periods.

10. SECURITY

You will find here information regarding our efforts and the measures we take to secure the Personal Data we process and store.

We implement appropriate physical, technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure or destruction. These measures include, among others, encryption, security tools such as firewalls, as well as placing access controls to ensure only permitted individuals of our staff members may access your Personal Data on a need-to-know basis.

You should be aware that no security measures are completely fail-proof, and it is impossible to prevent any and all threats to the security of data and systems. Therefore, we cannot guarantee that our Platforms and databases will be immune to any malfunctions, unauthorized interceptions or access, malware attacks or other kinds of abuse and misuse. As the security of information depends in part on the security of the computer, device or network you use to communicate with us and the security you use to protect your user's name and passwords, please make sure to respond appropriately to protect this information.

11. YOUR RIGHTS & CHOICES RELATED TO YOUR PERSONAL DATA

You will find here information regarding your choices and rights related to your Personal Data that we process and store, as well as certain limitations and the ways you may exercise your rights, either by contacting us and requesting exercise of your rights or, for certain rights, the way you may independently exercise such.

Under applicable data protection and privacy laws, individuals have certain rights and controls regarding their Personal Data we process and store. The rights you may exercise depends on the purpose of collection, your relationship with us, and your jurisdiction and the privacy laws that apply to the processing of your Personal Data.

The principal rights that may apply to your Personal Data (subject to your jurisdiction and additional conditions) may include:

Note that, not all those rights apply in every jurisdiction.

For California Residents, please further review Section (14) below, “CCPA Privacy Notice,” and for US residents, please further see Section (13) below, “Additional Information for US Residents,” to learn more about your rights under applicable US laws.

To exercise your rights, please contact us at: contactus@{hostName}. When you contact us you need to detail the rights you wish to exercise, and provide us with sufficient information to identify you and locate your Personal Data which is the subject of your request. We will respond and fulfill your request within the timeframe required under applicable laws.

Certain rights can be easily executed independently by you without the need to contact us, and for example:

If you use our App, you can exercise your right to request account and data deletion through the App menu;
You can opt out from receiving our marketing emails by clicking the “unsubscribe” link;
You can use the cookies preference management tool on our Platforms to change your preferences and opt out of cookies.

12. ELIGIBILITY AND CHILDREN PRIVACY

Minors may not use our Services.

Our Service are not intended for minors (as defined and according to the age limit in your jurisdiction). We do not, knowingly or intentionally, collect Personal Data about children. Please contact us at: contactus@{hostName} if you have reason to believe that a child has shared Personal Data with us.

13. ADDITIONAL NOTICE FOR US RESIDENTS

Residents of certain U.S. states (depending on the applicable state law, acting in an individual or household context and not in a commercial or employment context or as a representative of business), including Colorado, Connecticut, Virginia, and Utah, may have additional rights under applicable privacy laws and be entitled to additional disclosures. You will find here information required under such state laws, including the categories of Personal Data we collect, categories of third parties with whom Personal Data is shared, rights related to Personal Data, etc. The information herein supplements the information provided under this Privacy Policy, which further applies.

“Personal Data” under applicable US privacy laws, generally means any information that is linked or reasonably linkable to an identified or identifiable individual (and usually does not include publicly available information that is lawfully made available from government records, or that a consumer has otherwise made available to the public; de-identified or aggregated consumer information; or information excluded from the states laws scope, such as: HIPAA, GBPA, non-profit entities, etc.). “Sensitive Data” means data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship, or immigration status; genetic or biometric data used for the purpose of uniquely identifying an individual; Personal Data knowingly collected from a child; precise geolocation data.

We are required under certain US laws to provide you with a clear and accessible privacy notice that includes the categories of Personal Data processed, purpose of processing, instructions for exercising consumer rights and appealing decisions, categories of Personal Data shared with third parties, categories of third parties with whom data is shared, and any sale of data or targeted advertising. All such information is detailed above under this Privacy Policy as further highlighted below:

Categories of Personal Data & Categories of third parties with whom Personal Data is shared

Under Section (4) “Data We Collect & Purpose of Collection and Use” of this Privacy Policy, we describe our collection and processing of Personal Data practices, including the categories of Personal Data that we are collecting and processing, and the purposes for which Personal Data is processed, stored or used by us.

Additionally, under Section (7) “Data Sharing – Categories of Recipients We Share Personal Data With” of this Privacy Policy, we detail and disclose the categories of third parties we share Personal Data with for business purposes.

We will not collect additional categories of Personal Data or use the Personal Data we collected for a materially different, unrelated, or incompatible purpose without obtaining your consent.

“Sale” of Personal Data

Under US privacy laws, the term “sale” is referring to disclosing or making available Personal Data to a third-party in exchange for monetary or other valuable consideration, including for targeted advertising purposes. We do not “sell” Personal Data as most people would commonly understand that term, i.e. we do not disclose your Personal Data in direct exchange for money or some other form of payment. However, subject to the definition of the term “sale” under such US privacy laws, our practice of sharing the categories of Personal Data detailed below (as defined in the table Section (4) “Data We Collect & Purpose of Collection and Use” of this Privacy Policy) when we use cookies or other third-party advertising services is considered as “selling” Personal Data: Identifiers (Online Identifiers such as IP and Cookie ID); Internet and electronic network activity information (Usage Data - such as your engagement with our Platforms); Geolocation data (such as country level derived from IP).

Consumer Rights

Residents of certain U.S. states, including Colorado, Connecticut, Virginia, and Utah, may have additional rights under applicable privacy laws, subject to certain limitations, which may include:

Access Right – the right to confirm whether we are processing your Personal Data and to obtain a copy of the Personal Data in a portable and, to the extent technically feasible, readily usable format.
Deletion Right – the right to request us to delete your Personal Data you provided to us or obtained by us.
Right to Correct – the right to correct inaccuracies in your Personal Data, taking into account the nature and purposes of the processing of the Personal Data.
Right to Opt-Out – the right to opt out of certain types of processing, including: (i) to opt out of the “sale” of Personal Data; (ii) to opt out of targeted advertising by us; and (iii) to opt out of any processing of Personal Data for purposes of making decisions that produce legal or similarly significant effects.

Section (11) “Your Rights & Choices Related to Your Personal Data” of this Privacy Policy provides additional information regarding your principal rights.

Exercising Privacy Rights

You may submit a request to exercise most of your privacy rights under U.S. state privacy laws by contacting us at: contactus@{hostName}.

When you submit a request, we will take steps to verify your identity and your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for denial and how to remedy any deficiencies, where applicable.

To exercise your right to opt-out of the “sale”, you may use the cookies preference management tool on our Platforms to change your preferences and opt-out of cookies.

Authorized agents may initiate a request on behalf of another individual by contacting us at: contactus@{hostName}. Authorized agents will be required to provide proof of their authorization, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

If we decline to take action on your request, we shall inform you without undue delay, within the timeframe set out under the applicable law. Our notice will include a justification for declining to take action and instructions on how you may appeal our decision. Within the timeframe set out under applicable law as of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the applicable authority or Attorney General of your jurisdiction (including – Colorado Attorney General at https://coag.gov/file-complaint/; Connecticut Attorney General at: https://www.dir.ct.gov/ag/complaint/ or (860) 808-5318; Virginia Attorney General at https://www.oag.state.va.us/consumercomplaintform).

14. CCPA PRIVACY NOTICE

( I )Introduction and Scope

This CCPA Notice is an integral part of our Privacy Policy, subject to the provisions of the CCPA.

This CCPA Notice applies to users which are California residents accessing and browsing our Platform or using any of our Services. This CCPA Notice will provide you information regarding, among others, the categories of Personal Information we collect, with whom we share it for a business purpose, your rights related to your Personal Information under the CCPA and the choices you can make. Any terms defined in the CCPA have the same meaning when used in this CCPA Notice. If you wish to learn more about your California privacy rights, you may visit https://oag.ca.gov/privacy/consumer-privacy-resources.

( II )Categories of Personal Information Collected

When you access our Platforms and use our Services, we collect certain data regarding such interactions and use. This data includes “Personal Information” which is defined under the CCPA as any information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household or device as detailed in the table below. Personal Information may further include “Sensitive Personal Information”, as defined under the CCPA and as detailed in the table below.

Personal Information does not include publicly available information that is lawfully made available from government records, that a consumer has otherwise made available to the public; de-identified or aggregated consumer information; information excluded from the CCPA’s scope, such as health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPPA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA) and the Driver’s Privacy Protection Act of 1994.

Below we detail the categories of Personal Information that we collect (and have collected within the last 12 months) as a “business”. For additional details, please see Section (4) “Data We Collect & Purpose of Collection and Use” of the Privacy Policy.

Category A: Identifiers

Examples of Personal Information: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.

Collected: Yes. For example: If you create an Account with us or make a Booking, we collect your name, email address, account name, or other similar identifiers. We further collect online identifiers, IP addresses, and unique identifiers related to users accessing and browsing our Platforms.

Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))

Examples of Personal Information: A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.

Collected: Yes. For example, if you create an Account with us or make a Booking, we collect your name, billing address and telephone number. We further collect certain payment information to process Booking or other purchase transactions; however we do not store your full payment information, which is stored only by the applicable payment processor. We may store basic information to enable us to identify the transaction such as billing address and last 4 digits of your payment means.

Category C: Protected classification characteristics under California or federal law

Examples of Personal Information: Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Collected: No.

Category D: Commercial information

Examples of Personal Information: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Collected: Yes. For example, records of Booking you have made, as well as Travel Information related to accommodations you have searched through our Platform.

Category E: Biometric information

Examples of Personal Information: Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

Collected: No.

Category F: Internet or other similar network activity

Examples of Personal Information: Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.

Collected: Yes. For example, Travel Information related to accommodations you have searched through our Platform, your interaction with our Platform or marketing campaigns.

Category G: Geolocation data

Examples of Personal Information: Physical location or movements.

Collected: Yes. For example, approximate location derived from IP address; GPS location if you provide your approval through the App’s permission.

Category H: Sensory data

Examples of Personal Information: Audio, electronic, visual, thermal, olfactory, or similar information.

Collected: No.

Category I: Professional or employment-related information

Examples of Personal Information: Current or past job history or performance evaluations.

Collected: No.

Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))

Examples of Personal Information: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

Collected: No.

Category K: Inferences drawn from other personal information

Examples of Personal Information: Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Collected: No.

Category L: Sensitive personal information

Examples of Personal Information: Government-issued identifying numbers, financial account details, genetic data, precise geolocation, race or ethnicity, religious or philosophical beliefs, union membership, mail, email, text messages, biometric data, health data, and sexual orientation or sex life.

Collected: No.

( III )Categories of Sources of Personal Information

Depending on your interactions with our Service, the Personal Information is collected by us from the following categories of sources:

Directly and indirectly from activity on our Services - for example, we may use cookies, SDKs and similar tracking technologies (as elaborated under Section (6) “Cookies & Tracking Technologies” of the Privacy Policy) to gather some information when you access the Platform or otherwise interact with our Services, marketing communications, etc.
Directly from you - we will collect Personal Information if and when you choose to provide us with information, such as when you contact us, create an Account or when you make a Booking.
Provided by our Suppliers – our Suppliers which you have made a Booking of, or purchased, their Travel Service Offers through our Services or otherwise directed to such Suppliers through our Platform, may share with us certain information regarding your Booking and other reservations you have made with them in the event directed from our Platform.

( IV )How We Use Personal Information

We may use the Personal Information collected as identified above, for the following purposes: (a) to fulfill or meet the reason you provided the Personal Information; (b) monitor and improve our Services; (c) provide supporting services for our Platform and Services; (d) market and promote our Services; (e) analyze your use of our Services; (f) respond to law enforcement; or (g) otherwise, as detailed under the Privacy Policy (please see Section (4) “Data We Collect & Purpose of Collection and Use”).

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing a notice, as required under the CCPA.

( V )Disclosures of Personal Information for A Business Purpose

We may disclose Personal Information to a contractor or service provider for a business purpose. When we disclose Personal Information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract or as otherwise permitted under the CCPA (including restrict these third parties from selling or sharing your Personal Information).

Please see below the categories of Personal Information we disclose (and have disclosed within the last 12 months) for a business purpose (as defined under the CCPA), the categories of Personal Information shared (corresponding with the table above) and the categories of recipients.

Security

Business purpose: we share Personal Information with third party providers helping to ensure security and integrity of our properties to the extent the use of your Personal Information is reasonably necessary and proportionate for these purposes.

Categories of Personal Information shared: Category A; Category B; Category F.

Category of recipient: operational partner, security and fraud prevention providers, operating systems.

Debugging And Fixing Errors

Business purpose: we share Personal Information with third party providers of tools or services used for debugging to identify and repair errors that impair existing intended functionality.

Categories of Personal Information shared: Category A; Category B; Category F.

Category of recipient: analytic providers, operational partner, security and fraud prevention providers, operating systems.

Performing Services on Our Behalf

Business purpose: we share Personal Information with third parties performing services on our behalf or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on our behalf, or otherwise enabling certain features of the Services.

Categories of Personal Information shared: Category A; Category B; Category D; Category F; Category G.

Category of recipient: payment processors, affiliated companies, operating systems, customer support, cloud computing and storage vendors, maps feature providers, etc.

Internal Research

Business purpose: we share Personal Information with third parties for the purpose of undertaking internal research for technological development and demonstration.

Categories of Personal Information shared: Category A; Category D; Category F; Category G.

Category of recipient: affiliated companies, developers, operating systems, cloud and hosting providers, SaaS platforms for task management and development, customer support and optimization and analytics tools.

Verification, Quality Maintenance and Improvement

Business purpose: we share Personal Information with third parties for the purpose of undertaking activities to verify or maintain the quality or safety of a service or device that is owned, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned or controlled by us.

Categories of Personal Information shared: Category A; Category B; Category D; Category F; Category G.

Category of recipient: affiliated companies, developers, operating systems, cloud and hosting providers, SaaS platforms for task management and development, customer support and optimization tools.

Booking Fulfillment

Business purpose: we share Personal Information to enable and fulfill your Bookings.

Categories of Personal Information shared: Category A; Category B; Category D; Category F; Category G.

Category of recipient: Suppliers, affiliated companies, payment processors.

For additional details, please see Section (7) “Data Sharing – Categories of Recipients We Share Personal Data With” of the Privacy Policy.

( VI ) Sale or Share of Personal Information

We do not “sell” any information as most people would commonly understand that term – meaning we do not, and will not, disclose your Personal Information in direct exchange for money or other payments.

Under the CCPA the term “sharing” is defined as “communicating orally, in writing, or by electronic or other means, a consumer’s Personal Information” to “a third party for cross-context behavioral advertising, whether or not for money or other valuable consideration”. Due to such definition, our practice of sharing Personal Information (e.g., online identifiers, interactions with our website and location data) with our third-party marketing and analytic partners to advertise our Services, is considered as “sharing” under the CCPA. The Personal Information is “shared” through our use of such third parties’ cookies, pixels or other tracking technology on our Platforms, to enable marketing campaigns, including targeted ads, and to measure these marketing efforts, identify individuals that are interested in our Services, etc.

The categories of Personal Information disclosed to such third parties under this practice considered “sell” or “share” includes Category A; Category D; Category F and Category G.

( VII )Children

Our Services are not intended for minors (as defined under applicable laws). Accordingly, we do not, knowingly or intentionally, collect Personal Information about children.

( VIII ) Data Retention

Subject to applicable laws, we retain Personal Information for as long as needed to fulfill the purpose for which it was collected, as detailed under this CCPA Notice and the Privacy Policy, where we are permitted or required under applicable laws to retain Personal Information, or, until you exercise your applicable rights (for example, the right to request deletion of Persona Information). We may further extend the retention periods determined according to the criteria described above, as applicable to each category and purpose, as explained under Section (9) “Data Retention” of the Privacy Policy.

( IX ) Your Rights Under the CCPA & How You May Exercise Your Rights

Under the CCPA, California residents may exercise certain rights related to their Personal Information collected and stored by a business.

Below you will find explanation regarding your rights:

The right to know – you have the right to know the categories of Personal Information we collected about you, including the sources from which it is collected, the business or commercial purpose for collecting, selling, or sharing your Personal Information, the categories of third parties with whom we share Personal Information, and the specific pieces of Personal Information we have collected about you.
Deletion rights – you have the right to request us to delete Personal Information that we collected from you, subject to certain exceptions.
Correct inaccurate Personal Information - you have the right to request us to correct inaccurate Personal Information that we maintain about you.
Opt-out of “sharing” or “selling” Personal Information - you have the right to opt-out of the “sharing” of your Personal Information for cross-context behavioral advertising or “selling” Personal Information. As explained above, our practice of advertising our Services through placement of third parties marketing and analytic partners’ cookies and similar tracking technologies, is considered as “sharing” or “selling” Personal Information under the CCPA. You may easily opt-out by using the cookies preference management tool on our Platforms to change your preferences and opt-out of cookies.
Opt-Out of automated decision making –in certain circumstances, you have the right to opt-out of the use of automated decision making in relation to your Personal Information. Note that, we do not use your Personal Information for automated decision making.
Data portability - you have the right to request to be provided with a copy of your Personal Information we retain, including specific pieces of Personal Information, and where applicable, to obtain a copy of the Personal Information you provided to us in a portable format.
Non-discrimination – you have the right not to receive discriminatory treatment by a business for the exercise of your privacy rights conferred by the CCPA. This includes denying a consumer goods or services, charging different prices or rates for goods or services, providing a different level or quality of goods or services, etc. Note however that a business is entitled to charge different prices or rates, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to the business by your Personal Information.

To learn more about your California privacy rights, please visit https://oag.ca.gov/privacy/privacy-laws.

How can you exercise the rights?

To exercise your rights, please contact us at: contactus@{hostName}. Please detail the right/s you wish to exercise, and further provide us with sufficient information to identify you and locate your Personal Information. We will reply and fulfill your request within the timeframe set forth under applicable laws.

Notwithstanding the above, you can easily exercise certain rights independently, as detailed under Section (11) “Your Rights and Choices Related to Your Personal Data” of the Privacy Policy.

Authorized Agents

“Authorized agents” on behalf of consumers may submit opt-out requests on a consumer’s behalf. We will accept requests from qualified third parties on behalf of other consumers, subject to the following verification procedures:

When a consumer uses an authorized agent to submit a request to know or a request to delete, a business may require that the consumer do the following: (a) provide the authorized agent signed permission to do so or power of attorney; (b) verify their own identity directly with the business; (c) directly confirm with the business that they provided the authorized agent permission to submit the request.
A business may deny a request from an authorized agent that does not submit proof that they have been authorized by the consumer to act on their behalf.

Direct Marketing Requests:

California Civil Code Section 1798.83 permits you, if you are a California resident, to request certain information regarding the disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send us an email with your request and applicable details to: contactus@{hostName}

Do Not Track Settings:

Cal. Bus. and Prof. Code Section 22575 also requires us to notify you how we deal with the “Do Not Track” settings in your browser. As of the effective date listed above, there is no commonly accepted response for Do Not Track signals initiated by browsers. Therefore, we do not respond to the Do Not Track settings. Do Not Track is a privacy preference you can set in your web browser to indicate that you do not want certain information about your web page visits tracked and collected across websites. For more details, including how to turn on Do Not Track, visit www.donottrack.us.

( X ) Notice Of Financial Incentive

We do not offer financial incentives to consumers for providing their Personal Information.