Privacy policy for Travel Product purchasing

Your privacy is of significance to companies, providing you services of purchasing travel products ("TRAVEL PROVIDER", "we", "us", "our"). We are committed to maximally avoid risky processing of your personal data, as well as to process only as much data as it would be absolutely necessary for achievement of our purposes or providing services upon your request, taking into consideration the proportionality principle.

Solely for this policy:

the term "personal data" or "personal information" means any information related to identifiable or identified natural person (data subject or consumer);
the term "TRAVEL PROVIDER" means the company, which offers, displays and sells travel products on OOJO.COM website;
The term "website" means OOJO.COM
terms "you" / "your" mean the end-client (consumer) purchasing travel products from the current TRAVEL PROVIDER.

This policy is divided into two parts:

General part, which describes common rules, equal and applicable to every TRAVEL PROVIDER
Part, applicable you if you purchased from the UK TRAVEL PROVIDER

GENERAL PART OF PRIVACY POLICY

This Privacy policy:

aims to give you information on how TRAVEL PROVIDER processes and protects your personal data,
is instrumental in TRAVEL PROVIDER personal data protection system and it is binding to every TRAVEL PROVIDER's employee and subcontractor.

TRAVEL PROVIDER invokes the Privacy policy concluding agreements and maintaining relationships with data protection authorities (when necessary under applicable legislation).

TRAVEL PROVIDER processes your personal data in material compliance with the following principal provisions:

TRAVEL PROVIDER respects and complies with the requirements of the applicable legislation (together hereinafter referred to as "LAWS)".
We are fair and maximally transparent with you regarding your data processing and protection.
All the information is being provided to you in concise, transparent, intelligible and easily accessible form, using plain and clear language.
We will not process your data without having a legal basis and specified, explicit and legitimate purposes.
By default, we are processing only personal data, which:
- Is necessary to achieve the current purpose;
- Is accurate and, where necessary, kept up to date.
Upon achievement of a purpose we are either deleting your personal data or anonymizing it, so it is impossible to identify you.
When data is being processed for internal analytical or statistical purposes, we are applying anonymization or additional safeguards preventing any undue impact on your person (functional separation).
We are performing and constantly improving organizational and technical measures ensuring your data protection against any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the data.
We are conducting staff training on a regular basis regarding data protection matters.
We are welcoming your active involvement on updating your data, as well as assisting in upgrading of this Privacy policy and our data protection system.
We are carrying out all the necessary measures, so the relevant safeguards are included into agreements with our partners, as well as responsibilities are clearly shared subject to the requirements of LAWS.
LAWS-compliant information and communication technologies (ICT) are being used in processing your data. We are ensuring ICT integrity, confidentiality, availability and resilience in line with relevant risk level.

WHAT DATA DOES TRAVEL PROVIDER COLLECT ABOUT YOU?

We are collecting different categories of data depending on the services we provide to you, requirements of the LAWS and our legitimate interests conducting our business.

DATA CATEGORIES

We have grouped your personal data together as follows:

Identifiers

or Identity Data such as a first/ middle/ last name, alias, postal address, unique personal identifier (cookie), date of birth, online identifier Internet Protocol address, passport / ID data (number, expiry, country of issuance, nationality) or other similar identifiers.
Contact Data

includes (billing address, delivery address, email address and telephone numbers).
Commercial information

including requested price quotes, products or services purchased or other purchasing or consuming histories or tendencies, as well as Financial Data (bank account and payment card details) and Transaction Data (details about payments to and from you and other details of products and services you have purchased from us).
Network Activity Information

including, but not limited to Technical Data (your login data, browser type and version, browsing history, search history, time zone setting, browser plug-in types and versions, operating system, and other technology on the devices you use to access the website), and information regarding your interaction with the website (Usage Data).
Geolocation data

in a general way (country, state or city).
Audio

(e.g. call records) and Electronic (e.g. email threads) information.
Inferences

(conclusions) drawn from any of the personal data collected by us, including, but not limited to Profile Data (your preferences, attitudes, intelligence, feedback and survey responses) and Marketing Data (your preferences in receiving marketing from us and our partners and your communication preferences).

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data, but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Network Activity Information to calculate the percentage of users accessing a specific product available on the website. However, if we combine or connect Aggregated Data with your personal data, so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
Customer support

If you choose to contact our customer support services we will collect any inquires, complaint or other information that you may submit to our support team. We do not collect any Special Categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

CHILDREN

TRAVEL PROVIDER does not knowingly collect personal data from minors, except if the minor is one of travelers. If we become aware that a minor is attempting to submit personal data, we will remove this information from our records. If you are the parent/legal guardian of a minor who has given us personal data, please contact us so we can delete it.

WHY DO WE NEED YOUR DATA?

TRAVEL PROVIDER collects only the minimal personal data that is necessary for achieving processing purposes (e.g. book seats in airplane, make a payment, detect fraud, handle your requests and claims etc.). Note that we may process your personal data for more than one purpose. For example, when you have purchased the travel products we will still keep processing minimal personal data to comply with tax legislation or to protect/ exercise our legal claims.

Main groups of processing purposes

TRAVEL PROVIDER distributes Travel Products where we have to process your personal data for the purposes set below.

The purpose of processing	The legal basis of processing	Data Storage Period (criteria)
To purchase travel products (airplane tickets, car rentals, hotel booking etc.) and assistance requested by you or otherwise perform contractual obligations, including credit card chargeback	contractual obligations	not more than the maximum survival period of legal claims set in the applicable LAWs. The period starts on the purchase date.
Ensure quality of professional staff for the services rendered	legitimate interest	no longer than it is necessary to resolve issues related to the customer experience, training of staff and/or preventing or remediating any negative consequences, and/or protecting/ exercising our legal claims
To comply with legal obligations (e.g. tax, accounting, AML requirements, fraud prevention, border control etc.).	legal obligations	According to the requirements of legislation, but not more than 10 years
to exercise and protect TRAVEL PROVIDER's and its partners' legal claims (legal purposes);	legitimate interests	Not more than the maximum survival period of legal claims set in the applicable LAWs. after the purchase date
to maintain backup and archive systems and restore data (if necessary);	legitimate interests	no longer than the backup or archived system is restored to an active system, shared with third parties or next processed for the (commercial) purposes other than technical maintenance and IT security
to use personal data in aggregated form for IT security, maintenance, statistical and analytical purposes, e.g. to secure or improve products/services.	legitimate interests	no longer than the statistical/ analytical report was created or IT security/maintenance measures are applied
to manage data subject requests	legitimate interests	not more than the maximum survival period of legal claims set in the applicable LAWs. The period starts on the request's submission date.

IF YOU FAIL TO PROVIDE PERSONAL DATA

Where TRAVEL PROVIDER collects personal data to comply with LAWS or under the terms of a contract where you are a party to such a contract, and you fail to provide your data when requested, we may not be able to perform the contract (for example, to sell to you travel products). In this case, we may have to cancel a transaction, but we will notify you if this is the case at the time.

Associated companies: We may share your data with the associated companies and affiliates of TRAVEL PROVIDER, as well as combine it with other information to organize internal workflow, enhance our efficiency, provide and improve our services.

Change of control: We may share your personal data in case of change of control/owners of TRAVEL PROVIDER.

Payment service providers and travel vendors: We may share your personal data with the payment service providers, acquirer banks and the travel vendors you have booked with. This can include online travel agencies, hotels, airlines, car rental companies, and travel insurance providers. These third parties will process your PERSONAL DATA as data controllers in accordance with their own privacy policies. If you contact our customer support, they may need to share information about your request with the relevant travel vendor in order to assist you.

Service providers: We may share your data with suppliers who perform services on our behalf and have agreed in writing to protect and not further disclose your information.

Authorities: We may disclose data if required by LAWS, for example to law enforcement or other authorities.

YOUR RIGHTS

Right to be informed how your data is being used

TRAVEL PROVIDER will inform you at least of the identity of TRAVEL PROVIDER, the purposes of data processing and sources where to find additional information. In the event we are collecting your data from other controllers (processors) you will also be informed in a timely manner. In case, the processing of your data is based on consent, you will definitely have the right to withdraw your consent at any time. Please, be informed that the withdrawal of consent is not affecting the lawfulness of processing based on consent before its withdrawal. There might also be other cases where your rights to be informed are limited.

Right of access to your data

You are entitled to receive a confirmation from TRAVEL PROVIDER as to whether or not your data is being processed by us, and if so, you have a right to access the relevant data.

Right to delete (erase) your data

You are entitled to obtain the erasure of your data from TRAVEL PROVIDER, unless there are legislative requirements or other legitimate reasons not to erase your data.

Right to rectify and add

You are entitled to obtain from TRAVEL PROVIDER without the rectification of inaccurate personal data. Considering purposes of processing you are also entitled to supplement incomplete personal data.

Right to object(opt-out)

In certain cases you can object to processing your data, which can be in the form of withdrawing your consent or challenging certain grounds for processing your data.

ADDITIONAL RIGHTS IF YOU PURCHASED FROM TRAVEL PROVIDER LOCATED IN UK

The scope of your rights (as data subjects) is set under each current processing purpose and legal basis which will be informed to you when TRAVEL PROVIDER collects / you are providing your data to us. In case we are a processor, the main contact for data subjects should remain data controller. In such cases we will definitely provide possible support in contacting the relevant controller.

Right to be informed

If personal data is not collected directly from you, the right to be informed shall not apply when:

obtaining or disclosure of your data is expressly laid down by LAWS, or
the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
we are prohibited to inform you on it, if and insofar as the data must remain confidential subject to an obligation of professional secrecy regulated by LAWS, including a statutory obligation of secrecy

In such cases we will provide appropriate safeguards.

Right of access

You are entitled to access to the following information:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipient to whom your personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
where possible, the envisaged period for which your personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from us rectification or erasure of your data or restriction of processing of your data or to object to such processing;
the right to lodge a complaint with a supervisory authority;
where your personal data are not collected from you, any available information as to their source;
the existence of automated decision-making and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you;
about appropriate safeguards we are providing regarding your data transfers to a third country or to an international organization in accordance with the requirements of LAWS.

Right to erasure

Cases, when you have the right to obtain from TRAVEL PROVIDER the erasure of your data:

your data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you withdraw consent on which the processing is based and we have no other legal ground for the processing;
you object to the processing pursuant to law requirements and there are no overriding legitimate grounds for the procesing, or you object against the processing for the marketing purposes;
your personal data have been unlawfully processed;
your personal data have to be erased for compliance with a legal obligation in LAWS to which the we are subject;

Unfortunately, since the exceptional character of exercitation of such rights the LAWS set restrictions when your request might be refused.

The erasure of your personal data is not applicable to the extent that processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing by LAWS to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
for reasons of public interest in the area of public health in accordance with laws
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with law requirements in so far as the right to inform data subjects is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the establishment, exercise or defense of legal claims.

Right to restriction of processing

In the following cases you are entitled to file a request to restrict your data processing

You are entitled to obtain from us restriction of processing where one of the following applies:

you are contesting the accuracy of your data, for a period enabling us to verify the accuracy of your data;
the processing is unlawful and you oppose the erasure of your data and request the restriction of their use instead;
we no longer need your data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
you have objected to processing pursuant to law requirements pending the verification whether our legitimate grounds override those of your interests.

Nonetheless the restriction of processing, we will still be entitled to:

Store your data;
Process your data in any manner, if:
- You have consented to it;
- We have to establish, exercise or defend our legal claims;
- The rights of another person shall be protected;
- There are reasons of important public interest.

Right to data portability

You are entitled to transmit your data, which you have provided to TRAVEL PROVIDER, to another controller, where:

the processing is based on consent or on a contract; and
the processing is carried out by automated means.

Unfortunately, there might be cases when your data transmission to another controller is not technically feasible. In this regard we will try to do our best in providing maximum support, so another controller receives your data.

Right to object (opt-out)

In case TRAVEL PROVIDER processes your data:

the performance of a task carried out in the public interest, or
in the exercise of official authority vested in us, or
for the purposes of the legitimate interests pursued by us or by a third party, you are entitled to object to such processing, specifying in your request the particular situation (reason for objection)

In such cases we will not process your data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. There are also other cases set by LAWS, when you are entitled to object, as well as the conditions under which the right to object might be exercised.

Your rights regarding automated individual decision-making, including profiling

You are entitled not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision:

is necessary for entering into or performance of, a contract between you and TRAVEL PROVIDER; or
is authorized by LAWS to which TRAVEL PROVIDER is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
is based on your explicit consent.

Right to lodge a complaint

If we are not able to resolve any dispute or claim arising from your data processing under this Policy in an amicable way, you are entitled to lodge a complaint with an appropriate supervisory authority

RESTRICTIONS OF YOUR RIGHTS AND PRINCIPAL PROVISIONS

Please, be informed that each of your rights and some of the principal provisions set herein might be restricted due to legislative measures, mostly to the advantage of other natural and legal persons, as well as national interests and public security.

The law to which TRAVEL PROVIDER is subject may restrict by way of a legislative measure the scope of the obligations and rights provided in this policy, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

a. national security;

b. defense;

c. public security;

d. the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

e. other important objectives of general public interest of the UK, in particular an important economic or financial interest of the UK, including monetary, budgetary and taxation a matters, public health and social security;

f. the protection of judicial independence and judicial proceedings;

g. the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

h. a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

i. the protection of the data subject or the rights and freedoms of others;

j. the enforcement of civil law claims.

In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

k. the purposes of the processing or categories of processing;

l. the categories of personal data;

m. the scope of the restrictions introduced;

n. the safeguards to prevent abuse or unlawful access or transfer;

o. the specification of the controller or categories of controllers;

p. the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

q. the risks to the rights and freedoms of data subjects; and

r. the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

SECURITY MEASURES

Considering the state of the art and costs of implementation, the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for your rights and freedoms posed by the processing, TRAVEL PROVIDER ensures and permanently improves security measures to protect your data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. To achieve the highest security level, we are performing organizational and technical measures.

TRAVEL PROVIDER TYPICAL SECURITY MEASURES

Authorisation and authentication mechanisms;
Content encryption;
Pseudonymization;
Audit trials;
Audit Access restriction;
Backup systems;
Physical security:
- Security staff;
- Pass entry system;
- Alarm system;
- Video surveillance;
- Limited access to server rooms;
- Fire alarm;
- Protection from power cuts;
Internal control procedures;
Timely communication on data protection breaches, maximally mitigating possible adverse effects;
Firewalls;
Strong Password Criteria;
Penetration tests;
Incorporated internal policies, procedures and documents;
Staff training;
Etc.

CONTACT TRAVEL PROVIDER

Each TRAVEL PROVIDER has its own line of contact, please find it in the appropriate country section.

COUNTRY	NAME OF THE TRAVEL PROVIDER	ADDRESS	CONTACT EMAIL
THE UK	TRAVELTECH ENTERPRISES LTD	87 - 89 Baker Street, London, England, W1U 6RJ	[email protected]
CANADA	AVIAJET INC.	102-31, rue Principale E, Sainte-Agathe-des-Monts, J8C 1J5, QC, Canada	[email protected]

HOW DOES TRAVEL PROVIDER TREAT YOUR REQUESTS?

Due to the remote nature of our services, it is important for us to keep communicating through the same email (Verified Email), which was used by you to request a price quote or using our services. The Verified Email is the key communication channel for us, so we can give quick answers and not divulge your data to any malicious person. You might also submit a request through the voice call, but still we must use the Verified Email to reply, due to law requirements and in order to protect our legal claims. Receiving your request on exercising your rights under this Privacy policy, we will process your request without undue delay, and in any event within one month of receipt of the request, except in cases where we are not able to identify you (we are either not processing your personal data or it was anonymized/ erased) or the requested fee was not paid.

A general period for answering is one month, we will answer not later than 45 days in cases where it is possible under applicable legislation. In case your requests are manifestly unfounded or excessive, TRAVEL PROVIDER might refuse to act on the request explaining reasons or you might be charged a reasonable fee considering the administrative costs of providing the information or communication, or taking the action requested. In case we have reasonable doubts concerning the identity of the natural person (also authorized representative) making the request, we may request the provision of additional information necessary to confirm the identity of such natural person.

You are entitled to receive one copy of your data free of charge. For any further copies we may charge a reasonable fee based on administrative costs. The right to obtain a copy shall not adversely affect the rights and freedoms of others.

AMENDMENTS AND EFFECTIVE DATE

We might make minor amendments to this Privacy policy which shall not negatively affect your person, except if LAWS set otherwise. In case of material changes we will definitely publish such amendments and amended policy on the internet and, as far as possible, notify you either by email or by pop-up windows when you are visiting our websites next time. Amendments shall enter into force on the Effective Date. Actual version of the Privacy policy is published on our websites.

UK

If you purchase travel product in GBP currency your TRAVEL PROVIDER is TRAVELTECH ENTERPRISES LTD TRAVEL PROVIDER respects and complies with the requirements of the UK GDPR, Data Protection Act 2018 and other national and international laws (together hereinafter referred to as "LAWS)". TRAVEL PROVIDER will not process your data without having a legal basis and specified, explicit and legitimate purposes.

LODGE A COMPLAINT

If we are not able to resolve any dispute or claim arising from your data processing under this Policy in an amicable way, you are entitled to lodge a complaint with UK supervisory authority.

DATA TRANSFERS TO THIRD COUNTRIES AND INTERNATIONAL ORGANIZATIONS

TRAVEL PROVIDER might transfer your data to third country providing safeguards and security measures, so the level of your data protection is not undermined.

Such transfers might take place in cases, if:

we have to perform an agreement concluded between you and TRAVEL PROVIDER;
we have to carry out pre-contractual measures in order to prepare a contract;
if you consented to the proposed transfer;
transfer is based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the UK;
transfer is based on adequacy decision made by the UK Government or standard data protection clauses adopted by the relevant authority, e.g. when we share the data with associated companies located in Moldova, India, EEA and the Philippines or when we use data storage facilities of our partners operating in the USA under relevant safeguards;
other cases may be applicable (you shall be informed prior to any such transfer).