List of controllers

Data categories

American requests

1. Disclosure under request access might be limited to the 12-month period preceding the receipt of verifiable request.
2. Upon deletion request there are some cases when we might reject your request.

Cases when we might deny the deletion of personal information

• To comply with law requirements;
• To perform a transaction initiated by you;
• To exercise or defend our legal claims;
• To comply with official request submitted by local, state or federal authorities;
• cooperation with law enforcement concerning activities that may violate the law;
• To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity;
• or prosecute those responsible for that activity;
• To prevent from adversely affecting the rights and freedoms of other customers, including passengers, payment card holders;
• To debug to identify and repair errors that impair existing intended functionality;
• solely for the internal analytical, risk management, quality assurance, training and statistical purposes, applying additional safeguards additional safeguards preventing any undue impact on customer’s person (functional separation);
• To ensure integrity of archiving and backup systems.

How we share your personal data

1. Associated companies: We may share your data with the associated companies of Website Operator and/or TPPs, as well as combine it with other information to organize internal workflow, enhance our efficiency, provide and improve our services, Website’s content and make our advertising more convenient and better matching your expectations. For example, if you want to check your booking information of a Travel Product, you might be redirected to our Associated company that accumulates and centrally displays such information and allows to manage it within account (specific terms and policies might be applied). If you participate in loyalty/ membership programs organised by our associated companies and covering all or current associated companies, we might share the information about products purchased by you, so you are able to use benefits within those programs (e.g. cashback calculation etc.).
2. Corporate affiliates and change of control: We may share your data in case of change of control/owners of Website Operator and/or TPPs.
3. Service providers: We may share your data with suppliers who perform services on our behalf (for example, data storage and security services, communication and request management tools, accounting programs, IT development and maintenance, marketing management, providing legal advice, analytical services etc.) and have agreed in writing to protect and not further disclose your information.
4. Payment service providers, travel vendors and related services: We may share your data (names, contacts, itineraries, financial data etc.) with the payment service providers, acquirer banks and the travel vendors you have booked with. This can include online travel agencies, Global Distribution Systems (e.g. Amadeus, Galileo, Sabre etc.), hotels, airlines, car rental companies, eSIM providers and travel insurance (including medical protection and similar products) providers. These third parties will process your data in accordance with their own privacy policies (our Privacy Notice does not apply). If you contact our customer support, the latter may need to share information about Client’s request with the relevant travel vendor to assist you.
5. Business partners: We may share your data with various business partners. Some of these business partners may use your data for fraud prevention. We may also share your information to ask our partner to create a survey, form, application, or questionnaire, for the purpose to know the degree of Your satisfaction with our services. Some of these business partners may use your data for online behavioral advertising purposes, or to offer you services or products that we believe you may be interested in. We may also share your information as otherwise described to you at the time of collection. We may also share anonymous aggregated usage information with partners.
6. Legal consultants: We may share your data with our legal consultants, based on our legitimate interest, if it is necessary to represent us in relations with external actors (e.g. plaintiffs, authorities, courts etc.) in order to exercise, establish and protect TPP and partners’ legal claims, etc. As an example - for German-speaking Clients we might be represented by Luther Rechtsanwaltsgesellschaft mbH, which is a separate controller and processes your data in accordance with their privacy policy.
7. Information shared in public: If you provide us a review of your trip, you authorize us to publish it on all our Website under the screen name you provided. You also authorize us to aggregate it with other reviews.
8. Authorities: We may disclose data if required by applicable legislation, for example to law enforcement or other authorities.

Data transfers to third countries and international organizations outside EU/UK/ UAE

Website Operator and TPPs from the EU/UK might transfer your data to third country providing safeguards, so the level of your data protection is not undermined. Such transfers might take place in cases, if:

• we have to perform an agreement concluded between you and Website operator/TPP;
• we have to carry out pre-contractual measures in order to prepare a contract;
• if you consented to the proposed transfer;
• transfer is based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the EU/UK;
• transfer is based on adequacy decision made by the European Commission (e.g. the EU-U.S. Data Privacy Framework)/UK Government (e.g. the UK-US Data Bridge Regulations) or standard data protection clauses adopted by the relevant authority, e.g. when we share the data with associated companies located outside EU or UK or when we use data storage facilities of our partners operating in the USA under relevant safeguards;
• other cases may be applicable (you shall be informed prior to any such transfer).

TPPs from the UAE might transfer your data to third country providing :

• the third country to which the Personal data is transferred has legislations addressing Personal data protection. This includes most significant provisions, measures, controls, stipulations and rules related to the protection of the privacy and confidentiality of Personal Data, and ability of data subject to exercise their legal rights. The third country shall also have a judicial or regulatory authority imposing appropriate measures against the Controller or the Processor.
• If the third country joins a bilateral or multilateral agreement related to the protection of Personal data concluded with countries to which the Personal Data is transferred.

Typical security measures

• Authorization and authentication mechanisms;
• Content encryption;
• Pseudonymization;
• Audit trials;
• Access restriction;
• Backup systems;
• Physical security:
  • Security staff;
  • Pass entry system;
  • Alarm system;
  • Video surveillance;
  • Limited access to server rooms;
  • Fire alarm;
  • Protection from power cuts;
• Internal control procedures;
• Timely communication on data protection breaches, maximally mitigating possible adverse effects;
• Firewalls;
• Strong Password Criteria;
• Penetration tests;
• Incorporated internal policies, procedures and documents;
• Staff training;
• Etc.

Additional rights if You purchased from Travel Provider established in EU/UK/UAE

The scope of your rights (as data subjects) is set under each current processing purpose and legal basis, more information:

Right to be informed (relevant solely to EU/UK)

If personal data is not collected directly from you, the right to be informed shall not apply when:

• obtaining or disclosure of your data is expressly laid down by applicable legislation, or
• the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
• we are prohibited to inform you on it, if and insofar as the data must remain confidential subject to an obligation of professional secrecy regulated by applicable legislation, including a statutory obligation of secrecy

In such cases we will provide appropriate safeguards.

Right of access (relevant solely to EU/UK)

You are entitled to access to the following information:

• the purposes of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipient to whom your personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
• where possible, the envisaged period for which your personal data will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request from us rectification or erasure of your data or restriction of processing of your data or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where your personal data are not collected from you, any available information as to their source;
• the existence of automated decision-making and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you;
• about appropriate safeguards we are providing regarding your data transfers to a third country or to an international organization in accordance with the requirements of applicable legislation.

Right to erasure (relevant solely to EU/UK)

Cases, when you have the right to obtain from controller the erasure of your data:

• your data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw consent on which the processing is based and we have no other legal ground for the processing;
• you object to the processing pursuant to law requirements and there are no overriding legitimate grounds for the processing, or you object against the processing for the marketing purposes;
• your personal data have been unlawfully processed;
• your personal data have to be erased for compliance with a legal obligation in applicable legislation to which the we are subject;

The erasure of your personal data is not applicable, and your request might be refused when under the EU/UK legislation to the extent that processing is necessary:

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by applicable legislation to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
• for reasons of public interest in the area of public health in accordance with applicable legislation
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with law requirements in so far as the right to inform data subjects is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• for the establishment, exercise or defense of legal claims.

Right to restriction of processing (relevant solely to EU/UK)

You are entitled to obtain from us restriction of processing where one of the following applies:

• you are contesting the accuracy of your data, for a period enabling us to verify the accuracy of your data;
• the processing is unlawful and you oppose the erasure of your data and request the restriction of their use instead;
• we no longer need your data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
• you have objected to processing pursuant to law requirements pending the verification whether our legitimate grounds override those of your interests.

Nonetheless the restriction of processing, we will still be entitled to:

• Store your data;
• Process your data in any manner, if:
  • You have consented to it;
  • We have to establish, exercise or defend our legal claims;
  • The rights of another person shall be protected;
  • There are reasons of important public interest.

Right to data portability (relevant solely to EU/UK)

You are entitled to transmit your data, which you have provided from one controller to another controller, where:

• the processing is based on consent or on a contract; and
• the processing is carried out by automated means.

Unfortunately, there might be cases when your data transmission to another controller is not technically feasible. In this regard we will try to do our best in providing maximum support, so another controller receives your data.

Automated individual decision-making, including profiling (relevant solely to EU/UK)

You are entitled not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision:

• is necessary for entering into, or performance of, a contract between you and TPP/Website operator; or
• is authorized by applicable legislation to which TPP/Website Operator is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• is based on your explicit consent.

Right to lodge a complaint (relevant solely to EU/UK)

If we are not able to resolve any dispute or claim arising from your data processing under this Policy in an amicable way, you are entitled to lodge a complaint with an appropriate supervisory authority (for EU or for UK).

Right to object (relevant solely to EU/UK)

In case controller processes your data:

• the performance of a task carried out in the public interest, or
• in the exercise of official authority vested in us, or
• for the purposes of the legitimate interests pursued by us or by a third party, you are entitled to object to such processing, specifying in your request the particular situation (reason for objection).

We will not process your data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

There are also other cases set by applicable legislation, when you are entitled to object, as well as the conditions under which the right to object might be exercised.

Information regarding possible restrictions of your rights

Please, be informed that each of your rights and some of the principal provisions set herein might be restricted due to legislative measures, mostly to the advantage of other natural and legal persons, as well as national interests and public security.

(1) The law to which controller is subject may restrict by way of a legislative measure the scope of the obligations and rights provided in this policy, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

• national security;
• defense;
• public security;
• the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
• other important objectives of general public interest of the EU/UK, in particular an important economic or financial interest of the EU/UK, including monetary, budgetary and taxation a matters, public health and social security;
• the protection of judicial independence and judicial proceedings;
• the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
• a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) To (e) and (g);
• the protection of the data subject or the rights and freedoms of others;
• the enforcement of civil law claims.

(2) In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

• the purposes of the processing or categories of processing;
• the categories of personal data;
• the scope of the restrictions introduced;
• the safeguards to prevent abuse or unlawful access or transfer;
• the specification of the controller or categories of controllers;
• the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
• the risks to the rights and freedoms of data subjects; and
• the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

Categories of cookies and tracking technologies used on our Website

Technical and strictly necessary Cookies and Tracking Technologies

In most cases our Website use cookies and terminal access technologies in order to ensure technical feasibility to connect our website with your device and provide services requested by you. This type of tracking is integrated by default into our website. In case, you try to block/ turn off any of such technologies you might not receive some essential part of services, requested by you. Some examples of such technologies are:

1. User input cookies (session-id).
2. Authentication cookies and persistent login tokens, used for authenticated services website.
3. Security cookies and verification scripts used to detect authentication abuses and prevent malicious attacks.
4. Multimedia content player session cookies, such as flash player or web media cookies.
5. Load balancing session cookies and traffic routing identifiers (faster processing of your requests).
6. Third party social plug-in content sharing cookies.

Functionality and Preferences Cookies

Such Cookies help us to optimize and make more user-friendly our website, enhance security level, facilitate faster and more convenient use of website, receive valuable statistics in anonymized way, including, but not limited to:

• To make aggregated or segmented statistics on new and returned visitors to the website.
• To help us recognize your browser, device characteristics (including canvas/WebGL rendering, audio signals, installed fonts, screen resolution, and system parameters), and its previously configured settings, for example language preferences, font size etc.
• To manage contractual relationships with partners, when you book on partner websites.
• To help improve our Website offering and for capacity planning purposes. We or our service providers may set analytics cookies or utilize cookieless analytics scripts, local storage, pixel tags, or unique first-party identifiers. These allow us to gather aggregated or segmented information about the types of visitors that access our website and the pages and advertisements that they view. In order to better understand your use of our website, we or our service providers may collect information on such use, including pages visited, links clicked etc. We do not use this information to personally identify you.

In case we are collecting Cookies for statistical purposes, we are committed to apply a “functional separation” principle, so the results of the processing shall be without any negative impact to Your privacy or there should not be any decisions made against You. Retention period of Functionality Cookies usually is very short. In case of longer periods, please be aware that we always assess the risk level of such processing, so it does not adversely affect Your privacy. Under the strict supervision we might allow service providers to collect Functionality Cookies on our website in order to provide us with aggregated statistics. In such cases we require service providers to aggregate or erase data obtained from Your device.

Advertising and Targeting Cookies

Third party vendors, including but not limited to Criteo (joint controller), Google and Facebook, use Advertising technologies to serve ads based on your prior visits to Website. Where permitted by law and based on your consent, previously unlinked or pseudonymous browsing histories and device identifiers may be combined and linked to your customer account profile upon login or completion of a purchase.

Advertising cookies enables to such vendors and its partners to serve ads to you based on your visit to Website.

OPT-OUT from cookies

You may opt in/ opt out of optional tracking technologies by visiting our Cookie preference tool. Please also note that opting out of a third party cookie does not mean that you will no longer receive or be subject to online advertising or marketing.