Privacy Statement

SkyBook ("we," "our," or "us") values you as our customer and recognizes that privacy is important to all of us. This Privacy Statement explains how we collect, use, and disclose personal data when you use our platform and associated services, your rights in determining what we do with the data that we collect or hold about you, and tells you how to contact us.

This Privacy Statement is designed to describe how and what type of personal data we collect and use, when and with whom we share your personal data, what choices you can make about how we collect, use, and share your personal data, and how you can access and update your personal data.

This Privacy Statement applies to any data processing done by us in connection to the use of our services, both through our website and through our mobile applications for iOS and Android.

Contents

1. Categories of Personal Data We Collect and Use
2. Sources of Personal Data Collection
3. Purposes for Processing Your Personal Data
4. Legal Bases for Processing
5. Sharing of Personal Data
6. Our Use of Artificial Intelligence
7. Your Rights and Choices
8. Cookies and Similar Technologies
9. International Data Transfers
10. Data Security
11. Data Retention
12. Children and Minors
13. Specifics for Residents of Selected Regions
14. Changes to This Privacy Statement
15. Contact Us

1. Categories of Personal Data We Collect and Use

We collect and process various categories of personal data depending on how you interact with our platform and services. Below is a comprehensive overview of the types of personal data we may collect:

1.1 Government-Issued Identification Data

This includes passport information, national ID card details, driver's license information, government redress numbers, country of residence, and where applicable, tax identification numbers. This information is necessary for flight bookings as required by airlines and governmental authorities for border control, security screening, and regulatory compliance.

1.2 Identification and Contact Data

This encompasses your name, username, email address, telephone number, as well as home, business, and billing addresses including street address and postal code. We use this information to identify you, communicate with you about your bookings, and process transactions.

1.3 Payment and Financial Data

This includes payment card numbers, expiration dates, CVV codes, billing addresses, financial account numbers, and transaction history. We never store complete payment card details in non-encrypted form. Payment information is processed through secure, PCI-DSS compliant payment processors. If you choose to save payment methods for future use, this data is stored securely and encrypted.

1.4 Travel Preferences and Requirements

This includes your favorite destinations and accommodation types, seat preferences (window, aisle, extra legroom), meal preferences (vegetarian, kosher, halal, allergies), special assistance requirements, accessibility needs, frequent flyer program memberships, and any other travel-related preferences you share with us. This information helps us personalize your experience and ensure your travel needs are communicated to service providers.

1.5 Booking and Transaction Information

This comprises all details of your bookings including flight itineraries, travel dates, passenger details, fare classes, baggage selections, seat selections, ancillary services purchased, booking references, e-tickets, boarding passes, and any modifications or cancellations to your bookings. We also retain information about services purchased through our platform and the history of your transactions with us.

1.6 Account Information

When you create a SkyBook account, we collect and maintain your login credentials (email and password, which is always stored in encrypted form), profile information, saved travelers, search history, booking history, saved payment methods, notification preferences, communication preferences, and any other settings or preferences you configure within your account.

1.7 Device and Technical Data

This includes your device type (smartphone, tablet, computer), unique device identification numbers, operating system and version, web browser type and version, screen resolution, mobile carrier information, app version, and how your device has interacted with our online services, including the pages accessed, links clicked, flights viewed, searches performed, and features used, along with associated dates and times.

1.8 Network and Connection Data

This encompasses your IP address, internet service provider information, network connection type, referring URLs (how you arrived at our site), and other network identifiers. This data helps us ensure security, detect fraud, and optimize our services for your connection type.

1.9 Location Data

We collect general location information inferred from your IP address, including your city and country. With your explicit consent, we may also collect precise location data from your device's GPS or other geolocation technologies. Precise location is only collected when necessary for specific features, such as finding nearby airports or providing location-based travel recommendations. You can enable or disable location services at any time through your device settings.

1.10 Communications and Customer Service Data

This includes all communications exchanged between you and SkyBook through any channel, including emails, chat transcripts, phone call recordings (where permitted by law and disclosed to you), in-app messages, social media interactions, and any notes or records created by our customer service team regarding your inquiries, complaints, or requests. We retain this information to provide quality customer service, train our staff, resolve disputes, and improve our services.

1.11 Online Behavior and Interaction Data

This encompasses your behavior on our website and app, including what pages you visit, how long you spend on each page, what you click on, your search queries, filters applied, flights compared, bookings started but not completed, and your general navigation patterns. We also track your interactions with our emails and notifications, such as whether you open emails and click on links within them.

1.12 Clickstream Data

In certain instances, we collect clickstream data, which is the sequence of pages you visit and actions you take on our website. This allows us to understand user journeys, identify friction points, and improve our platform's usability. We may reconstruct your site journey based on the timing and location of your actions for analytical purposes.

1.13 Co-Traveler and Third-Party Data

When you make bookings for other travelers, we collect their personal data as necessary to complete the booking, including names, dates of birth, gender, passport details, contact information, and any special requirements. If you provide us with personal data about other individuals, you confirm that you have their consent to do so or are otherwise authorized to provide this information on their behalf.

1.14 Reviews, Feedback, and User-Generated Content

This includes ratings you provide about your travel experiences, written reviews, feedback submitted through surveys or feedback forms, and any other content you choose to share with us. We use this information to improve our services and may display reviews (without identifying personal details) to help other travelers.

1.15 Demographic Data

This may include your date of birth, age range, and gender. This information may be required by airlines for booking purposes or used to personalize your experience and ensure we provide relevant search results and offers.

1.16 Sensitive Personal Data

In limited circumstances, we may process sensitive personal data, such as health information when you request special assistance services (wheelchair assistance, medical equipment, oxygen requirements) or dietary requirements that may indicate religious beliefs. We only process such data when necessary to fulfill your specific requests, with your explicit consent where required by law, and in strict accordance with applicable data protection regulations. We will only use sensitive personal information for the purposes for which it was collected.

2. Sources of Personal Data Collection

2.1 Information You Provide Directly

You provide personal data to us when you create an account, search for and book flights, enter passenger details, make payments, contact our customer service, subscribe to newsletters or promotional communications, participate in surveys or promotions, submit reviews or feedback, or otherwise interact with our platform. This is the primary source of the personal data we hold about you.

2.2 Information Collected Automatically

We automatically collect certain information when you visit our website or use our mobile app through cookies, pixels, web beacons, SDKs, and similar tracking technologies. This includes device information, browser information, IP address, location data, and information about how you interact with our platform. Our servers also automatically record certain information each time you access our services.

2.3 Information from Third Parties

We receive personal data from various third-party sources, including:

• Airlines and Travel Partners: Information about your bookings, flight status, check-in status, and any changes to your itinerary
• Payment Processors: Transaction verification, fraud screening results, and payment status
• Identity Verification Services: Confirmation of identity details for security purposes
• Social Media Platforms: If you choose to sign in using social media credentials (such as Google or Apple), we receive basic profile information from these platforms
• Advertising Partners: Information about your interactions with our advertisements on other platforms
• Metasearch Engines: If you arrive at our platform through a price comparison or metasearch website, we may receive information about your search from that partner
• Business Partners: Information from our affiliate partners and business collaborators as necessary to provide joint services

2.4 Information from Public Sources

In limited circumstances, we may collect information from publicly available sources, such as public social media profiles, to verify information or prevent fraud.

3. Purposes for Processing Your Personal Data

We process your personal data for multiple purposes, all of which are essential to providing you with our services, maintaining our business operations, and meeting our legal obligations. Below is a detailed explanation of each purpose:

3.1 Platform Usage and Booking Purposes

We process your personal data to:

• Facilitate your flight searches and display relevant results based on your criteria
• Enable you to book flights and related travel services
• Verify your identity as required by airlines and regulations
• Process payments, refunds, and manage financial transactions
• Issue and deliver booking confirmations, e-tickets, and boarding passes
• Create, maintain, and update your user account
• Authenticate you when you log in to your account
• Maintain your search history, booking history, and travel preferences
• Enable features such as saved travelers, saved payment methods, and booking management
• Process special service requests such as meal preferences, wheelchair assistance, or medical requirements
• Manage loyalty programs and promotional credits
• Collect and display booking-related reviews
• Enable faster checkout by pre-filling information from your account or previous bookings

3.2 Communications and Customer Service Purposes

We process your personal data to:

• Send booking confirmations, itinerary updates, and travel reminders
• Notify you of flight changes, delays, cancellations, or gate changes
• Respond to your questions, requests, and complaints
• Provide customer support through various channels (email, chat, phone)
• Enable communication between you and airlines or other travel suppliers when necessary
• Send important service-related announcements
• Process and respond to data subject requests
• Contact you regarding your account security if we detect unusual activity
• Provide emergency notifications or critical travel alerts

3.3 Marketing and Promotional Purposes

With your consent where required, we process your personal data to:

• Send you promotional emails about travel deals, discounts, and special offers
• Personalize marketing communications based on your travel preferences and history
• Display targeted advertisements on our platform and third-party websites
• Analyze your browsing and purchase history to understand your preferences
• Measure and analyze the effectiveness of our marketing campaigns
• Administer contests, sweepstakes, and promotional programs
• Send push notifications about relevant offers (if you've enabled them)
• Create customer segments for more relevant marketing
• Deliver advertising based on your profile and interests through advertising networks

You can opt out of marketing communications at any time by clicking the unsubscribe link in any promotional email, adjusting your account preferences, or contacting us directly.

3.4 Research, Analytics, and Service Improvement Purposes

We process your personal data to:

• Conduct market research and analyze travel trends
• Understand how users interact with our platform to improve user experience
• Identify and fix technical issues, bugs, and errors
• Develop new features, products, and services
• Test new functionality before release
• Analyze customer feedback to improve our services
• Create aggregated, anonymized, or de-identified data for statistical analysis
• Monitor and record customer service interactions for quality assurance and training purposes
• Benchmark our performance against industry standards
• Optimize our website and app performance

3.5 Security and Fraud Prevention Purposes

We process your personal data to:

• Detect, prevent, and investigate fraudulent transactions and activities
• Protect against unauthorized access to accounts
• Verify your identity during transactions and account access
• Monitor for suspicious activity patterns
• Protect our platform, users, and partners from security threats
• Enforce our terms and conditions and other policies
• Conduct security assessments and vulnerability testing
• Maintain the integrity and availability of our services
• Investigate potential violations of our policies

3.6 Legal and Compliance Purposes

We process your personal data to:

• Comply with applicable laws, regulations, and legal processes
• Respond to lawful requests from government authorities, law enforcement, and courts
• Meet tax reporting and financial record-keeping requirements
• Comply with aviation security and border control requirements
• Fulfill anti-money laundering and sanctions screening obligations
• Establish, exercise, or defend legal claims
• Protect the rights, property, and safety of SkyBook, our users, and the public
• Maintain records as required by consumer protection laws

4. Legal Bases for Processing

We only process your personal data when we have a valid legal basis to do so. Depending on the purpose and type of data, we rely on one or more of the following legal bases:

4.1 Performance of a Contract

Processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract. This applies when we process your data to facilitate bookings, manage your account, process payments, provide customer support related to your bookings, and deliver the travel services you have purchased.

4.2 Consent

Where required by law, we obtain your consent before processing your personal data. This applies primarily to marketing communications, the use of non-essential cookies, collection of precise location data, and processing of sensitive personal data such as health information for special assistance requests. Where we rely on consent, you have the right to withdraw it at any time, though this will not affect the lawfulness of processing based on consent before its withdrawal.

4.3 Legal Obligation

Processing is necessary for compliance with legal obligations to which we are subject. This includes maintaining financial and tax records, complying with aviation security requirements, responding to valid legal requests from authorities, and meeting regulatory reporting obligations.

4.4 Legitimate Interests

Processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. Our legitimate interests include:

• Operating and improving our platform and services
• Ensuring the security of our platform and preventing fraud
• Understanding how our services are used to improve user experience
• Marketing our services to existing customers (where consent is not required)
• Responding to customer inquiries and complaints
• Protecting our legal rights and establishing, exercising, or defending legal claims
• Conducting business analytics and research
• Ensuring network and information security

When we rely on legitimate interests, we conduct a balancing test to ensure that our interests do not override your rights. We consider the nature of the personal data, the purposes of processing, the potential impact on you, and any safeguards we can put in place.

4.5 Vital Interests

In rare circumstances, processing may be necessary to protect your vital interests or those of another person, such as in emergency situations where your health or safety is at risk.

5. Sharing of Personal Data

We share your personal data with various third parties to provide our services, operate our business, and comply with legal requirements. Below is a detailed explanation of who we share data with and why:

5.1 Airlines and Travel Suppliers

To complete your booking, we must share your personal data with the airlines you are traveling with. This includes your name, date of birth, gender, passport details, contact information, and any special service requests. Airlines process this data as independent data controllers according to their own privacy policies, which are available on their websites. Airlines may use your data to:

• Issue tickets and boarding passes
• Manage your reservation and any changes
• Provide in-flight services and handle special requests
• Comply with government and border control requirements
• Contact you regarding operational matters
• Market their own services (subject to their own policies and your preferences)

Similarly, if you book ancillary services such as travel insurance, car rentals, or accommodations through our platform, we share necessary data with those providers.

5.2 Global Distribution Systems (GDS) and Ticketing Platforms

To search for flights and make bookings, we connect to various global distribution systems and airline ticketing platforms. These systems receive your search criteria and, when you make a booking, your passenger details. These platforms act as intermediaries between us and the airlines.

5.3 Payment Processors and Financial Institutions

We share your payment information with payment processors to complete transactions. These processors are PCI-DSS compliant and employ strong security measures to protect your financial data. We may also share information with banks and financial institutions as necessary to process refunds, handle chargebacks, or verify payment methods.

5.4 Service Providers and Data Processors

We engage various third-party service providers who process personal data on our behalf. These providers are bound by contractual obligations to protect your data and may only use it for the specific services they provide to us. Categories of service providers include:

• Cloud Hosting and Infrastructure: Providers who host our platform and store data
• Email Service Providers: Companies that help us send booking confirmations and other communications
• Customer Support Tools: Platforms that help us manage and respond to customer inquiries
• Analytics Providers: Services that help us understand how our platform is used
• Fraud Prevention Services: Companies that help us detect and prevent fraudulent transactions
• Identity Verification Services: Providers that help verify customer identities
• SMS and Push Notification Services: Platforms for sending mobile notifications
• Survey and Feedback Tools: Services for collecting customer feedback

5.5 Advertising and Marketing Partners

With your consent where required, we share data with advertising networks and marketing partners to deliver targeted advertisements. This may include sharing identifiers that allow these partners to recognize you across different platforms and show you relevant ads. You can opt out of personalized advertising through your account settings or by adjusting cookie preferences.

5.6 Social Media Platforms

If you choose to sign in using social media credentials, we exchange data with those platforms as necessary for authentication. We may also share data with social media platforms to enable targeted advertising and to measure ad effectiveness. When you interact with social media features on our platform (such as share buttons), those platforms may collect information about your interaction.

5.7 Metasearch Engines and Affiliate Partners

If you arrive at our platform through a metasearch engine or affiliate partner, we may share information about your booking with that partner, such as confirmation that a booking was completed. This is necessary for attribution and business operations.

5.8 Government Authorities and Law Enforcement

We disclose personal data to government authorities, law enforcement agencies, and regulatory bodies when required by law or when we believe in good faith that such disclosure is necessary to:

• Comply with legal obligations, including court orders and subpoenas
• Meet aviation security and border control requirements (such as Advance Passenger Information)
• Respond to valid legal requests from authorities
• Protect the rights, property, and safety of SkyBook, our users, or the public
• Detect, prevent, or investigate fraud, security breaches, or illegal activities

5.9 Professional Advisors

We may share personal data with our professional advisors, including lawyers, accountants, auditors, and insurers, as necessary for them to provide their services to us.

5.10 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. In such cases, we will notify you of any change in ownership or uses of your personal data, as well as any choices you may have regarding your data.

5.11 With Your Consent

We may share your personal data with other third parties when you have given us your explicit consent to do so.

6. Our Use of Artificial Intelligence

We use artificial intelligence (AI) and machine learning technologies to enhance our services and improve your experience. Below are the ways we utilize AI:

6.1 Search and Personalization

We use AI to personalize your search results and recommendations based on your preferences, past searches, and booking history. This helps us show you the most relevant flights and offers. AI also helps us predict your preferences and pre-fill search forms to save you time.

6.2 Pricing and Availability

We use machine learning algorithms to analyze pricing trends and help you find the best deals. Our price prediction features use historical data to indicate whether prices are likely to rise or fall.

6.3 Customer Support

We may use AI-powered tools to assist our customer support team, including chatbots that can answer common questions and systems that help agents access relevant information quickly. When you interact with an AI assistant, you will be informed. Any significant actions recommended by AI will require your confirmation before being executed.

6.4 Fraud Detection

We use AI and machine learning to detect potentially fraudulent transactions by analyzing patterns and behaviors that may indicate fraud. This helps protect both you and our platform from fraudulent activities.

6.5 Content Analysis

We may use AI to analyze reviews and feedback to understand customer sentiment and identify areas for improvement. AI may also be used to screen content for quality and compliance with our policies.

6.6 Automated Decision-Making

Some of our processes involve automated decision-making, such as fraud screening. We do not engage in fully automated decision-making that produces legal or similarly significant effects without human oversight, unless you have explicitly consented, it is necessary for contract performance, or it is authorized by applicable law. You have the right to request human review of automated decisions, express your point of view, and contest decisions. Contact us if you wish to exercise these rights.

7. Your Rights and Choices

You have certain rights regarding your personal data. The specific rights available to you may vary depending on your location and applicable laws. Below is a comprehensive overview of your rights:

7.1 Right of Access

You have the right to request access to the personal data we hold about you. This includes the right to obtain confirmation of whether we are processing your data, access to the data itself, and information about how we process it. You can access much of your data directly through your account. For a comprehensive data export, please contact us.

7.2 Right to Rectification

You have the right to request correction of inaccurate personal data and completion of incomplete data. You can update most of your information directly through your account settings. For changes that cannot be made through your account, please contact us.

7.3 Right to Erasure (Right to Be Forgotten)

You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary for the purposes for which it was collected, when you withdraw consent (where consent is the legal basis), or when the data has been unlawfully processed. Please note that we may need to retain certain data to comply with legal obligations, complete transactions, or establish and defend legal claims.

7.4 Right to Restrict Processing

You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data, when processing is unlawful but you do not want deletion, or when you have objected to processing pending verification of legitimate grounds.

7.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where technically feasible. This applies to data you have provided to us and that we process based on consent or contract performance.

7.6 Right to Object

You have the right to object to processing of your personal data in certain circumstances, including processing based on legitimate interests and processing for direct marketing purposes. If you object to direct marketing, we will stop processing your data for that purpose immediately.

7.7 Right to Withdraw Consent

Where we process your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data violates applicable law. We encourage you to contact us first so we can address your concerns directly.

7.9 Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to certain exceptions. You also have the right to request human intervention, express your point of view, and contest such decisions.

7.10 How to Exercise Your Rights

You can exercise many of your rights directly through your account settings. To make a formal data subject request, please contact us using the information provided at the end of this Privacy Statement. We will respond to your request within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before processing your request. If your request is complex or we receive a high volume of requests, we may extend the response period as permitted by law, and we will inform you of any extension.

7.11 Managing Communications Preferences

You can manage your communication preferences in the following ways:

• Marketing Emails: Click the "unsubscribe" link at the bottom of any marketing email
• Push Notifications: Adjust settings in your mobile device or app settings
• Account Settings: Update your preferences in your account profile
• Contact Us: Reach out to our support team to update preferences

Please note that even if you opt out of marketing communications, we will still send you transactional messages related to your bookings and account.

8. Cookies and Similar Technologies

We use cookies and similar tracking technologies to collect information, provide functionality, and understand how our platform is used. This section explains what these technologies are and how we use them.

8.1 What Are Cookies?

Cookies are small text files that are placed on your device (computer, tablet, or smartphone) when you visit a website. They are widely used to make websites work more efficiently, provide functionality, remember your preferences, and gather analytics data. Cookies can be "persistent" (remaining on your device for a set period) or "session" cookies (deleted when you close your browser).

8.2 Types of Cookies We Use

Strictly Necessary Cookies:

These cookies are essential for the operation of our website and cannot be switched off. They enable core functionality such as security, network management, and account access. Without these cookies, services you have asked for cannot be provided.

Performance and Analytics Cookies:

These cookies help us understand how visitors interact with our website by collecting information about pages visited, time spent on pages, errors encountered, and other usage data. This information is aggregated and anonymized and helps us improve our platform.

Functional Cookies:

These cookies enable enhanced functionality and personalization, such as remembering your language preferences, search history, currency selection, and other settings. They may be set by us or by third-party providers whose services we use.

Targeting and Advertising Cookies:

These cookies are used to deliver advertisements that are relevant to you based on your interests. They also help limit the number of times you see an ad and measure the effectiveness of advertising campaigns. These cookies may be set by us or by advertising partners and may track your activity across different websites.

8.3 Similar Technologies

In addition to cookies, we use other tracking technologies including:

• Pixels and Web Beacons: Small graphic images embedded in web pages or emails that track whether you have viewed content or opened an email
• Local Storage: Technology that allows websites to store data locally on your device
• SDKs (Software Development Kits): Code libraries in our mobile apps that collect data about app usage and device information
• Device Fingerprinting: Techniques that collect information about your device configuration to create a unique identifier

8.4 Managing Cookie Preferences

You can control cookies through various means:

• Cookie Consent Banner: When you first visit our website, you can select which types of cookies you consent to
• Browser Settings: Most browsers allow you to manage cookie settings, including blocking all cookies, accepting all cookies, or receiving a notification when a cookie is set
• Opt-Out Tools: You can opt out of targeted advertising through industry opt-out tools such as the Digital Advertising Alliance (DAA) or European Interactive Digital Advertising Alliance (EDAA)

Please note that if you disable certain cookies, some features of our website may not function properly.

8.5 Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals to websites. Due to the lack of a common industry standard for interpreting DNT signals, our website does not currently respond to DNT signals. However, you can manage your privacy preferences through the cookie settings and opt-out mechanisms described above.

9. International Data Transfers

Your personal data may be transferred to, stored in, and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from the laws of your country.

9.1 Where Your Data May Be Transferred

Our servers and service providers are located in various countries around the world. When you book a flight, your data is transmitted to airlines and other travel suppliers who may be located in different countries. Our employees and contractors may access your data from various locations globally.

9.2 Safeguards for International Transfers

When we transfer personal data internationally, we implement appropriate safeguards to ensure your data remains protected in accordance with this Privacy Statement and applicable law. These safeguards include:

• Adequacy Decisions: Transferring data to countries that have been determined to provide an adequate level of data protection
• Standard Contractual Clauses: Using contractual terms approved by relevant authorities that require recipients to protect your data
• Data Processing Agreements: Entering into agreements with service providers that require them to protect data and limit its use
• Binding Corporate Rules: Where applicable, relying on binding corporate rules approved by data protection authorities
• Certification Mechanisms: Relying on certifications or approved codes of conduct where available

9.3 Transfers to Travel Suppliers

When you book a flight with an airline in a country that may not have equivalent data protection laws, the transfer of your personal data is necessary to perform the contract you have requested (your booking). Each airline processes your data according to its own privacy policy. We recommend reviewing the privacy policies of airlines with whom you book.

9.4 Your Rights Regarding International Transfers

You may contact us to request information about the safeguards we have in place for specific transfers of your personal data. You may also have the right to request a copy of the safeguards we use.

10. Data Security

We take the security of your personal data seriously and have implemented comprehensive technical, administrative, and physical measures to protect your information from unauthorized access, alteration, disclosure, or destruction.

10.1 Technical Security Measures

• Encryption: We use industry-standard encryption (TLS/SSL) to protect data transmitted between your device and our servers. Sensitive data at rest is also encrypted.
• Secure Payment Processing: Payment transactions are processed through PCI-DSS compliant payment processors. We do not store complete credit card numbers on our servers.
• Access Controls: We implement strict access controls to limit who can access your personal data to only those employees and contractors who need it to perform their duties.
• Monitoring and Detection: We employ security monitoring tools to detect and respond to potential security threats and unauthorized access attempts.
• Regular Security Assessments: We conduct regular security assessments, vulnerability scans, and penetration testing to identify and address potential vulnerabilities.
• Secure Development Practices: We follow secure software development practices and conduct security reviews of our code.

10.2 Administrative Security Measures

• Employee Training: Our employees receive training on data protection and security best practices.
• Background Checks: We conduct appropriate background checks on employees who have access to personal data.
• Confidentiality Obligations: Employees and contractors are bound by confidentiality obligations.
• Incident Response Plan: We maintain an incident response plan to address potential data breaches promptly and effectively.
• Vendor Management: We assess the security practices of our third-party service providers and require them to maintain appropriate security measures.

10.3 Your Role in Security

While we implement robust security measures, you also play an important role in protecting your data:

• Use strong, unique passwords for your account
• Do not share your login credentials with others
• Log out of your account when using shared devices
• Keep your devices and software updated
• Be cautious of phishing attempts and suspicious emails
• Contact us immediately if you suspect unauthorized access to your account

10.4 Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities as required by applicable law. Our notification will include information about the nature of the breach, the data affected, the likely consequences, and the measures we are taking to address it.

10.5 Limitations of Security

Despite our best efforts, no method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security. Any transmission of data is at your own risk.

11. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the type of data and the purposes of processing.

11.1 Retention Periods

Account Information:

We retain your account data for the duration of your account. If you close your account or it becomes inactive, we retain certain data for up to 5 years after the last activity to allow you to reactivate your account, comply with legal obligations, and handle any potential disputes.

Booking and Transaction Data:

We retain booking records for a minimum of 7 years after the travel date to comply with tax and financial record-keeping requirements and to handle potential legal claims. Some jurisdictions require longer retention periods.

Customer Service Records:

Communications with our customer service team are retained for up to 5 years to help resolve ongoing issues, handle complaints, and defend against potential claims.

Marketing Data:

If you have subscribed to marketing communications, we retain your contact information and preferences until you unsubscribe. After unsubscription, we retain a record of your opt-out preference to ensure we honor it.

Analytics and Log Data:

We retain analytics data and server logs for up to 3 years for security, performance monitoring, and business analytics purposes. This data may be aggregated or anonymized for longer-term analysis.

Legal Claims and Disputes:

If we are involved in legal proceedings or anticipate potential claims, we may retain relevant data for the duration of the limitation period (typically 4-6 years, depending on jurisdiction) plus a reasonable period for potential appeals.

11.2 Criteria for Determining Retention Periods

We consider the following factors when determining how long to retain personal data:

• The duration of our relationship with you
• Legal obligations that require us to keep data for a certain period
• Statutes of limitation for potential legal claims
• Whether the data is needed for security or fraud prevention purposes
• Regulatory requirements applicable to our business
• Industry best practices

11.3 Deletion and Anonymization

When personal data is no longer needed for the purposes for which it was collected and there is no legal requirement to retain it, we will securely delete or anonymize the data. Anonymized data, which cannot be linked back to you, may be retained indefinitely for research and analytics purposes.

11.4 Backup and Residual Copies

We maintain backup systems to protect against data loss. When data is deleted from our active systems, residual copies may remain in backup systems for a limited period until they are overwritten through normal backup rotation processes. These backups are encrypted and access is strictly controlled.

12. Children and Minors

12.1 Age Requirements

Our platform is not directed at children under 16 years of age, and we do not knowingly collect personal data from children under 16 without parental consent. If you are under 16, please do not use our services or provide any personal data to us without the involvement of a parent or guardian.

12.2 Minor Travelers

When booking travel for minors (children under 18), the adult making the booking is responsible for providing the minor's personal data and must have the authority to do so. The adult must ensure that the booking complies with any applicable airline policies regarding travel by minors. We collect only the personal data necessary to complete the booking and facilitate travel.

12.3 Protection of Minors' Data

When processing personal data of minors, we take extra care to ensure appropriate protection. This includes limiting the use of such data to what is strictly necessary for the booking and travel services, not using minors' data for marketing purposes, and implementing additional security measures.

12.4 Discovery of Data from Children Under 16

If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that data promptly. If you believe we may have collected data from a child under 16, please contact us immediately using the contact information provided at the end of this Privacy Statement.

12.5 Parental Rights

Parents or guardians of minors may contact us to access, correct, or request deletion of personal data we hold about their children. We may require verification of the parental or guardian relationship before fulfilling such requests.

13. Regional Privacy Rights

Depending on your location, you may have additional rights regarding your personal data beyond those described in Section 7. These rights vary by jurisdiction and are provided under applicable privacy laws in your country, state, or region.

13.1 Additional Rights for Residents of Certain Jurisdictions

If you reside in certain countries or regions with comprehensive data protection laws, you may be entitled to exercise one or more of the following additional rights:

• Request a copy of your personal data in a portable format
• Request detailed information about our data processing activities and purposes
• Request deletion of your personal data, subject to legal and contractual obligations
• Object to our use or disclosure of your personal data for certain purposes
• Restrict or limit the processing of your personal data
• Opt out of the sale or sharing of your personal data for targeted advertising
• Transfer your personal data to another service provider where technically feasible
• Request information about the logic and outcomes of automated decision-making processes
• Object to fully automated decision-making that has legal or similarly significant effects
• Request manual review instead of automated processing for significant decisions
• Contest decisions made solely through automated processing
• Lodge a complaint with your local data protection authority or regulatory body
• Withdraw consent at any time where processing is based on consent

13.2 How to Exercise Your Regional Rights

To exercise any of these rights, please contact us using the information provided in Section 15. We will respond to your request in accordance with applicable law, typically within 30 days. We may need to verify your identity before processing your request to protect your privacy and security.

The availability of specific rights depends on your jurisdiction and the nature of our relationship with you. We will inform you if any requested right is not available to you based on applicable law. If we deny your request, we will explain the reason for the denial, and where applicable, inform you of your right to appeal the decision.

13.3 Non-Discrimination

We will not discriminate against you for exercising any privacy rights available to you under applicable law. This means we will not deny you services, charge different prices, provide a different level of service, or suggest that you may receive different pricing or service quality based solely on your exercise of privacy rights.

14. Changes to This Privacy Statement

We may update this Privacy Statement from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes, we will update the "Last Updated" date at the top of this Privacy Statement.

14.1 Notification of Changes

If we make material changes that significantly affect how we collect, use, or share your personal data, we will provide you with prominent notice before the changes take effect. This notice may be provided through:

• An email notification to the address associated with your account
• A prominent notice on our website or mobile app
• A pop-up notification when you log in to your account
• Other appropriate means depending on the significance of the changes

14.2 Your Acceptance of Changes

Your continued use of our services after the effective date of any changes constitutes your acceptance of the revised Privacy Statement. If you do not agree with the changes, you should discontinue use of our services and may request deletion of your account and personal data.

14.3 Previous Versions

You may request access to previous versions of this Privacy Statement by contacting us using the information provided below.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Statement or our privacy practices, please contact us. We are committed to addressing your inquiries and resolving any concerns you may have.

15.1 Privacy Inquiries

For questions about this Privacy Statement, how we handle your personal data, or to exercise your data protection rights, please contact us through our Support page.

15.2 Customer Support

For general customer support inquiries, including questions about your bookings, please visit our Support page.

15.3 Data Subject Requests

To submit a formal data subject request (such as a request to access, delete, or correct your personal data), please contact us through our Support page. Please include sufficient information to allow us to verify your identity and process your request. We will respond within the timeframe required by applicable law.

15.4 Complaints

If you are not satisfied with our response to your inquiry or believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection authority. However, we encourage you to contact us first so we can try to resolve your concern directly.

15.5 Response Time

We aim to respond to all privacy-related inquiries within 30 days. Complex requests may require additional time, in which case we will inform you of the extended timeline and the reasons for it.