www.expedia.com Open in urlscan Pro
104.126.112.248  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Shop travelShop travel
StaysStays
FlightsFlights
CarsCars
PackagesPackages
Things to doThings to do
CruisesCruises

--------------------------------------------------------------------------------

Deals
Groups & meetings
Expedia Magazine
English
List your propertySupportTrips
Tara

--------------------------------------------------------------------------------

Account
List of favorites
Feedback

--------------------------------------------------------------------------------

Sign out
PDF


PRIVACY STATEMENT

Last Updated: 11-21-2023
Expedia, Inc., part of the Expedia Group, (“we” or “us”) values you as our
customer and recognizes that privacy is important to you. This Privacy Statement
explains how we collect, use, and disclose personal information when you use our
platform and associated services, your rights in determining what we do with the
information that we collect or hold about you and tells you how to contact us.
Privacy Statement Summary
This is a summary of our Privacy Statement. To review our Privacy Statement in
full, please click here, or scroll down.
What does this Privacy Statement cover?
This Privacy Statement is designed to describe:

 * How and what type of personal information we collect and use
 * When and with whom we share your personal information
 * What choices you can make about how we collect, use, and share your personal
   information
 * How you can access and update your personal information.

What personal information do we collect and use, and how do we collect it?
We collect personal information when:

 * You give us the personal information
 * We collect it automatically
 * We receive it from others

When you create an account on one of our sites, sign up to receive offers or
information, or make a booking using our platform, you give us your personal
information. We also collect such personal information through automated
technology such as cookies placed on your browser, with your consent where
applicable, when you visit our sites or download and use our apps. We also
receive personal information from affiliated companies within Expedia Group, as
well as business partners and other third-parties, which help us improve our
platform and associated tools and services, update and maintain accurate
records, potentially detect and investigate fraud, and more effectively market
our services.
How is your personal information shared?
Your personal information may be shared for several purposes, including: to help
you book your travel and/or vacation, assist with your travel and/or vacation
stay, communicate with you (including when we send information on products and
services or enable you to communicate with travel providers and/or property
owners), and comply with the law. The full Privacy Statement below details how
personal information is shared below.
What are your rights and choices?
You can exercise your data protection rights in various ways. For example, you
can opt out of marketing by clicking the “unsubscribe” link in the emails, in
your account as applicable, or contacting our customer service. Our Privacy
Statement has more information about the options and data protection rights and
choices available to you.
How to contact us
More information about our privacy practices is in our full Privacy Statement.
You can also contact us as described below in the “Contact Us” section to ask
questions about how we handle your personal information or make requests about
your personal information.
*****************************


PRIVACY STATEMENT

Categories of Personal Data We Collect and Use
Sharing of Personal Information
Joint Use of Personal Information
Our Use of AI
Your Rights and Choices
International Data Transfer
Data Privacy Framework
APEC Cross Border Privacy Rules System Participation
Security
Minors
Record Retention
Contact Us
Updates to Statement
Cookie Statement


COLLECTION AND USE OF YOUR PERSONAL INFORMATION

You will find in this section information about:

 * the types of personal information that we collect and use,
 * how we collect and use it,
 * the purposes for which we collect and use it, and
 * the lawful basis we rely on to collect and use it.


LAWFUL BASES FOR PROCESSING:

In the tables below, you will find the lawful basis we rely on to collect and
use your personal information.
In summary, we will collect personal information from you only when one of the
following lawful bases applies:

 * Consent: this means that we will process your personal information where you
   have given your consent to do so (e.g., sending you marketing communications
   where consent is required).
 * Legal obligation: this means that we will process your personal information
   where we have a legal obligation to collect personal information from you
   such as where it is necessary to use your transaction history to complete our
   financial and tax obligations under the law.
 * Performance of a contract: this means that we will process your personal
   information where the personal information is necessary to perform a contract
   with you (e.g., manage your booking, process payments, or create an account
   at your request),
    * If we ask you to provide personal information to comply with a legal
      requirement or to perform a contract with you, we will make this clear at
      the relevant time and advise you whether the provision of your personal
      information is mandatory or not (as well as of the possible consequences
      if you do not provide your personal information).

 * Legitimate interest: this means that we will process your personal
   information where the processing is in our legitimate interests and not
   overridden by your rights (as explained below),
    * Certain countries and regions allow us to process personal information on
      the basis of legitimate interests. If we collect and use your personal
      information in reliance on our legitimate interests (or the legitimate
      interests of any third-party), this interest will typically be to operate
      or improve our platform and communicate with you as necessary to provide
      our services to you, for security verification purposes when you contact
      us, to respond to your queries, undertaking marketing, or for the purposes
      of potentially detecting or preventing illegal activities. While the
      concept of legitimate interest only exists in certain countries and
      regions, we balance our usage of your personal information against your
      rights globally.




CATEGORIES OF PERSONAL INFORMATION WE COLLECT AND USE

We collect personal information for the following purposes:

 * Platform Usage and Booking Purposes – including to:
    * Enable your booking, verify your identity, and for travel insurance
      purposes.
    * Book the requested travel or enable vacation property booking.
    * Provide services related to the booking and/or account.
    * Create, maintain, and update user accounts on our platform and
      authenticate you as a user.
    * Maintain your search and travel history, accommodation and travel
      preferences, and similar information about your use of Expedia Group’s
      platform and services, and as otherwise described in this Privacy
      Statement.
    * Enable and facilitate acceptance and processing of payments, coupons, and
      other transactions.
    * Administer loyalty and rewards programs.
    * Collect and enable booking-related reviews.
    * Help you to use our services faster and easier through features like the
      ability to sign-in using your account within the online services and sites
      of some of the Expedia Group brands.

 * Communications and Customer Service Purposes – including to:
    * Respond to your questions, requests for information, and process
      information choices.
    * Enable communication between you and the travel supplier like hotels and
      vacation property owners.
    * Contact you (such as by text message, email, phone calls, mail, push
      notifications, or messages on other communication platforms) to provide
      information like travel booking confirmations and updates, emergency
      notifications, or for other purposes as described in this Privacy
      Statement.

 * Marketing Purposes – including to:
    * Contact you (such as by text message, email, phone calls, mail, push
      notifications, or messages on other communication platforms) for marketing
      purposes.
    * Analyze information such as browsing and/or purchase history and use the
      result to optimize advertising and marketing in accordance with your
      interests and preferences.
    * Measure and analyze the effectiveness of our marketing and promotions.
    * Administer promotions like contests, sweepstakes, and similar giveaways.
    * Deliver targeted advertising and advertising based on your profile. Our
      Cookie Statement further explains how we use cookies and similar tracking
      technology.

 * Market Research, Analytics, and Training Purposes to improve our Services –
   including to:
    * Conduct surveys, market research, and data analytics.
    * Maintain, improve, research, and measure the effectiveness of our sites
      and apps, activities, tools, and services.
    * Monitor or record calls, chats, and other communications with our customer
      service team and other representatives, as well as platform communications
      between or among partners and travelers for quality control, training,
      dispute resolution, and as described in this Privacy Statement.
    * Create aggregated or otherwise anonymized or deidentified data, which we
      may use and disclose without restriction where permissible.

 * Security and Compliance Purposes – including to:
    * Promote security, verify identity of our customers, prevent and
      investigate fraud and unauthorized activities, defend against claims and
      other liabilities, and manage other risks.
    * Comply with applicable laws, protect our and our users’ rights and
      interest, defend ourselves, and respond to law enforcement, other legal
      authorities, and requests that are part of a legal process.
    * Comply with applicable security and anti-terrorism, anti-bribery, customs
      and immigration, and other such due diligence laws and requirements.

We collect the following categories of personal information for the following
purposes:
Personal Information Category
Purposes for collection
Sources of Personal Information
Lawful basis
Government issued identification data – including passport, driver’s license,
government redress numbers, country of residence, tax identification number (for
property owners)
 * Platform Usage and Booking Purposes
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies

 * Legal obligation
 * Performance of a contract with you

Identification data – including name, username, email address, telephone number,
as well as home, business, and billing addresses (including street and postal
code)
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legal obligation
 * Performance of a contract with you (and any co-traveler)
 * Legitimate interest (of you or a co-traveler)
 * Consent (including consent of a parent/guardian for the use of child data)

Payment data - including payment card number, expiration date, billing address,
financial / bank account number
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legal obligation
 * Performance of a contract with you (and any co-traveler)
 * Consent

Travel related preferences - including favorite destination and accommodation
types, special dietary and accessibility needs, as available
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services

 * Directly from you
 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legitimate interest (of you or a co-traveler)
 * Consent

Loyalty data – including loyalty program membership, loyalty points balance,
points earnt and used, loyalty status
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services

 * Directly from you
 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legitimate interest (of you or a co-traveler)
 * Performance of a contract with you
 * Consent

Geolocation data – including inferred location from IP address, country selected
to use our website, and exact, real-time location (with your consent)
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legal obligation
 * Performance of a contract with you (and any co-traveler)
 * Legitimate interest (of you or a co-traveler)
 * Consent

Images, videos and recordings – including facial photographs, images you upload,
and videos
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Performance of a contract with you
 * Consent

Communications with us – including emails, chat transcripts and recordings of
calls with customer service representatives
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legal obligation
 * Performance of a contract with you (and any co-traveler)
 * Legitimate interest (of you or a co-traveler)
 * Consent (including consent of a parent/guardian for the use of child data)

Site interaction data - including searches you conduct, transactions and other
interactions with you on our platform, online services and apps
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legal obligation
 * Legitimate interest
 * Consent

Device data – including device type, unique device identification numbers ,
operating system, mobile carrier, and how your device has interacted with our
online services, including the pages accessed, links clicked, trips viewed, and
features used, along with associated dates and times
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legal obligation
 * Legitimate interest
 * Consent

Friends and co-traveler data - including data you give us about other people,
such as your travel companions or others for whom you are making a booking
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Performance of a contract with you (and any co-traveler)
 * Legitimate interest (of you or a co-traveler)
 * Consent

Child data – including name and contact details of minor travelers provided by
you as the parent/guardian of the minor as part of a trip reservation
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Performance of a contract with you (and any co-traveler)
 * Consent (including consent of a parent/guardian for the use of child data)

Clickstream data - In certain instances, we may use clickstream data to render
an illustration of your usage of our site. Clickstream data is the collection of
a sequence of events that represent visitor actions on a website. We may
reconstruct your site journey modeled on the timing and location of your
actions.
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * From other Expedia Group companies
 * Automatically from your device
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legitimate interest
 * Consent

Birthdate and gender - including both your specific date of birth or an
approximate age bracket you fall within, along with your gender.
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies
 * From third parties, such as our business and affiliate partners and
   authorized service providers

 * Legal obligation
 * Performance of a contract with you (and any co-traveler)
 * Legitimate interest (of you or a co-traveler)
 * Consent

Sensitive data – data that could reveal sensitive information, including your
racial or ethnic origin, religious or philosophical beliefs, sexual orientation,
or health or disability information.
We will only use your sensitive personal information for the purposes for which
it was collected.
 * Platform Usage and Booking Purposes
 * Communication and Customer Service Purposes
 * Security and Compliance Purposes

 * Directly from you
 * From other Expedia Group companies

 * Legal obligations
 * Consent


SHARING OF PERSONAL INFORMATION

We share your personal information as described below and in this Privacy
Statement, and as permitted by applicable law.
Recipient of Personal Information
Purpose Category
Expedia Group Companies. We share your personal information within the Expedia
Group companies, listed at expediagroup.com. Expedia Group companies (either
autonomously or as joint data controllers, where applicable) share access and
use your personal information as described in this Privacy Statement.
 * Platform Usage and Booking Purposes
 * Communications and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance purposes

Third-party service providers. We share personal information with third-parties
in connection with the delivery of services to you and the operation of our
business.
These third-party service providers are required to protect personal information
we share with them and may not use any directly identifying personal information
other than to provide services we contracted them for. They are not allowed to
use the personal information we share for purposes of their own direct marketing
(unless you have separately consented with the third-party under the terms
provided by the third-party).
 * Platform Usage and Booking Purposes
 * Communications and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services
 * Security and Compliance purposes

Travel suppliers. We share personal information with travel-related suppliers
such as hotels, airlines, car-rental companies, insurance, vacation-rental
property owners and managers, and where available, activity providers, rail, or
cruise lines who fulfill your booking. Please note that travel suppliers may
contact you to obtain additional personal information if and as required to
facilitate your booking or to otherwise provide the travel or associated
services.
 * Platform Usage and Booking Purposes
 * Communications and Customer Service Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services

Business partners and offers. If we promote a program or offer a service or
product in conjunction with a third-party business partner, we will share your
personal information with that partner to assist in marketing or to provide the
associated product or service. In most of those cases, the program or offer will
include the name of the third-party business partner, either alone or with ours,
or you will be redirected to the website of that business with notice.
 * Platform Usage and Booking Purposes
 * Communications and Customer Service Purposes
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services

Targeted Advertising partners. We may disclose your personal information to our
third-party marketing partners for targeted advertising. This may be considered
“sharing” data under California law. Subject to certain limitations, some US
residents have the right to opt out of having their personal information shared
for this purpose. For more information, see the Your Rights and Choices section
below. You should note that by opting out of these types of disclosures, you may
limit our ability to customize your experience with content that may be of
interest to you or to provide you with a better travel experience.
View our Cookie Statement for more information on our use of tracking technology
for the purposes of targeted advertising.
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services

Social media and online platforms: we share personal information with media
agencies, social media, search engines and other online platforms to help us
target our online marketing. These social media and other online platforms may
also use personal information they hold and combine or match it against personal
information received from us to create target audiences, which are audiences
that we think would be interested in our online advertising. This may involve
social media and other online platforms building a ‘lookalike’ profile of the
type of person we are trying to target and providing specific adverts to those
people when they browse the internet or use social media.
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services

Other Third-Parties. When you access certain features like Facebook’s “Like”
button or a single sign-on that allows you to login with your social media
credentials to our online services, you will share information with the
third-party, like a social media company, such as the fact that you have visited
or interacted with us. In the European Economic Area (EEA), Switzerland, and
United Kingdom (UK) we will not load social media sharing or sign-on buttons on
our website unless and until you accept our use of cookies and similar
technologies. For more information, see our Cookie Statement. The third-party
provider may combine this information with other information they have about
you. The personal information shared will be governed by the third-party
provider’s privacy policy (including any personal information we may access via
the third-party provider). The third-party providers should inform you about how
you can modify your privacy settings on their site.
 * Marketing Purposes
 * Market Research, Analytics, and Training Purposes to improve our Services

Recipients in relation to our legal rights and obligations. We may disclose your
personal information and associated records to enforce our policies; as
necessary to satisfy our tax or other regulatory reporting requirements,
including the remission of certain taxes in the course of processing payments;
or where we are permitted (or believe in good faith that we are required) to do
so by applicable law, such as in response to a subpoena or other legal request,
in connection with actual or proposed litigation, or to protect and defend our
property, people and other rights or interests.
 * Security and Compliance purposes

Recipients in relations to corporate transactions. We may share your personal
information in connection with a corporate transaction, such as a divestiture,
merger, consolidation, assignments or asset sale, or in the unlikely event of
bankruptcy. In the case of any acquisition, we will inform the buyer it must use
your personal information only for the purposes disclosed in this Privacy
Statement.
 * Security and Compliance purposes


JOINT USE OF YOUR PERSONAL INFORMATION

We jointly use, and our Expedia Group companies are joint controllers of your
personal information in the following manner:

 * We process all the categories of personal information identified in the
   “Categories of Personal Information We Collect and Use” section jointly for
   the uses identified in the table above.
 * The Expedia Group companies listed at
   https://expediagroup.com/travel-with-us/default.aspx process this personal
   information jointly.
 * Expedia, Inc. is the party responsible for managing your personal
   information. More information about how to contact us regarding this joint
   use can be found in the “Contact Us” section.


OUR USE OF ARTIFICIAL INTELLIGENCE

We use artificial intelligence and machine learning for various purposes to
deliver our platform and associated services. We may use your personal
information for the following purposes:

 * To enhance your user experience and keep our site safe.
 * To determine the sort order you see on our site.
 * To provide destinations, property or activity recommendations.
 * To provide flight price insights and alerts.
 * To screen the content you upload on our site (e.g., images of your
   properties) to ensure they meet our quality or formatting requirements, and
   to identify relevant amenities included in your listing.
 * To screen the reviews you share with us to ensure they do not contain
   identifiable personal information or to assess customer satisfaction,
 * To prevent and detect a breach of our terms and conditions or other
   fraudulent activities to keep our site safe,
 * To display your language and dialects within our virtual agents’ experience.

Automated decisions may be made by putting your personal information into a
system and the decision is calculated using automatic processes.
We will rely on our legitimate interest to keep our site safe and to enhance
your user experience. We will not engage in automated decision-making that
involves a decision with legal or similarly significant effects solely based on
automated processing of personal information, unless:

 * you explicitly consented to the processing,
 * the processing is necessary for entering into a contract, or for its
   performance
 * when otherwise authorized by applicable law.

You may have rights in relation to automated decision making, including:

 * the ability to request a manual decision-making process instead, or
 * contest a decision based solely on automated processing.

If you want to know more about your data protection rights, please see the Your
Rights and Choices section below.
https://expediagroup.com/travel-with-us/default.aspx


YOUR RIGHTS AND CHOICES

You have certain rights and choices with respect to your personal information,
as described below:

 * If you have an account with us, you may change your communication preferences
   by either (1) logging in and updating the information in your account (not
   available for all Expedia Group companies) or (2) contacting us here.
 * You can control our use of certain cookies by following the guidance in
   our Cookie Statement.
 * You can access, amend, inquire about deletion of, or update the accuracy of
   your personal information at any time by either logging into your account or
   contacting us here
 * If you no longer wish to receive marketing and promotional emails, you may
   unsubscribe by clicking the ‘unsubscribe’ link in the email. You can also log
   into your account to change communication settings (not available for all
   Expedia Group companies) or contacting us here. Please note that if you
   choose to unsubscribe from or opt out of marketing emails, we may still send
   you important transactional and account-related messages from which you will
   not be able to unsubscribe
 * For our mobile apps, you can view and manage notifications and preferences in
   the settings menus of the app and of your operating system
 * If we are processing your personal information on the basis of consent, you
   may withdraw that consent at any time by contacting us. Withdrawing your
   consent will not affect the lawfulness of any processing that occurred before
   you withdrew consent and it will not affect our processing of your personal
   information that is conducted in reliance on a legal basis other than consent

Certain countries and regions provide their residents with additional rights
relating to personal information. These additional rights vary by country and
region and may include the ability to:

 * Request a copy of your personal information
 * Request information about the purpose of the processing activities
 * Delete your personal information
 * Object to our use or disclosure of your personal information
 * Restrict the processing of your personal information
 * Opt-out of the sale of your personal information
 * Port your personal information
 * Request information about the logic involved in our automated decision-making
   , the result of such decisions,
 * Object to the use of fully automated decision making, including profiling,
   with significant legal effect, and request a manual decision-making process
   instead,
 * Contest a decision based solely on automated processing.

For more information on what data subject rights may be available to you, please
click here.
For questions about privacy, your rights and choices, and in order for you, or
(where applicable) your authorized agent to make a request to amend or update
your personal information, or to inquire about deletion of your information,
please contact us here.
In addition to the above rights, you may have the right to complain to a data
protection authority about our collection and use of your personal information.
However, we encourage you to contact us first so we can do our best to resolve
your concern. You may submit your request to us using the information in
the Contact Us section.
We respond to all requests we receive from individuals wanting to exercise their
personal data protection rights in accordance with applicable data protection
laws. Should you have the right to appeal a decision to not take action on a
request under applicable law, instructions on how to make that appeal will be
included in our response to you.


INTERNATIONAL DATA TRANSFER

The personal information we process may be accessed from, processed or
transferred to countries other than the country in which you reside. Those
countries may have data protection laws that are different from the laws of your
country. Such cross-border transfer of your personal information is necessary
for us to service your transaction with us, and for the purposes outlined in
this Privacy Statement.
The servers for our platform are located in the United States, and the Expedia
Group companies and third-party service providers operate in many countries
around the world. When we collect your personal information, we may process it
in any of those countries. Our employees may access your personal information
from various countries around the world. The transferees of your personal
information may also be located in countries other than the country in which you
reside.
We have taken appropriate steps and put safeguards in place to help ensure that
any access, processing and/or transfer of your personal information remains
protected in accordance with this Privacy Statement and in compliance with
applicable data protection law. Such measures provide your personal information
with a standard of protection that is at least comparable to that under the
equivalent local law in your country, no matter where your data is accessed
from, processed and/or transferred to. We will comply with obligations regarding
personal information cross-border transfer in accordance with application data
protection laws, regulations, and conditions set by the competent authorities.
This may include fulfilling obligations such as security assessments and/or
certifications and signing agreements with overseas recipients in accordance
with the standard contract established by the competent authorities.

Some measures that we have in place include the following:

 * Adequacy decisions of the European Commission confirming an adequate level of
   data protection in respective non-EEA countries. Please see the latest list
   of such countries published by the European Commission here.
 * Transferee countries’ participation in the APEC-CBPR forum. Please see the
   latest list of participant countries here. Expedia Group holds the APEC-CBPR
   certification, and we have accordingly established measures across all
   Expedia Group companies to ensure that data is shared only in accordance with
   the CBPR requirements. Further detail on Expedia Group’s participation in
   such forum may be found in the “APEC Cross Border Privacy Rules System
   Participation” section below
 * Ensuring that the third-party partners, vendors and service providers to whom
   data transfers are made have appropriate mechanisms in place to protect your
   personal information. For instance, our agreements signed with our
   third-party partners, vendors and service providers incorporate strict data
   transfer terms (including, where applicable, the European Commission's
   Standard Contractual Clauses issued by the European Commission and/or United
   Kingdom, for transfers from the EEA/UK), and require all contracting parties
   to protect the personal information they process in accordance with
   applicable data protection law. Our agreements with our third-party partners,
   vendors and service providers may also include, where applicable, their
   certification under the EU-U.S. DPF and the UK extension to EU-U.S. DPF
   and/or Swiss-U.S. DPF certification (and any other country specific extension
   to the DPF adopted from time to time), or reliance on the service provider's
   Binding Corporate Rules, as defined by the European Commission. In regard to
   the onward principle of the DPF Frameworks, if Expedia, Inc. learns that a
   third party is using or disclosing your Personal Information in a manner that
   is contrary to this Policy, we will take reasonable steps to prevent or stop
   such use or disclosure. Expedia, Inc. may be liable for onward transfers of
   Personal Information to third parties in violation of this Policy and the DPF
   Frameworks (will change defined term if needed based on feedback above).
 * Intra-group agreements in place for our Group companies which incorporate
   strict data transfer terms (including, where applicable, Standard Contractual
   Clauses issued by the European Commission and/or United Kingdom, for
   transfers from the EEA/UK) and require all group companies to protect the
   personal information they process in accordance with applicable data
   protection law.

Carrying out periodic risk assessments and implement various technological and
organization measures to ensure compliance with relevant laws on data transfer.


DATA PRIVACY FRAMEWORK

All wholly owned U.S. affiliates of Expedia, Inc. (part of the Expedia Group of
brands) have certified to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the
UK Extension to the EU-U.S. DPF and Swiss-U.S. Data Privacy Framework
(Swiss-U.S. DPF) (“the DPF Frameworks”) and that we adhere to the DPF Framework
Principles of Notice, Choice, Accountability for Onward Transfers, Security,
Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and
Liability for personal information from the EU, Switzerland, and the United
Kingdom. The Federal Trade Commission has jurisdiction over such Expedia Group
U.S. affiliates’ compliance with the DPF Frameworks. In addition, Expedia Group
maintains intra-group Standard Contractual Clauses where applicable to cover the
transfer of EU personal information to the U.S. Our certifications can be
found here. For more information about the DPF Frameworks principles, please
visit:https://www.dataprivacyframework.gov.
In compliance with the DPF Frameworks, Expedia, Inc. U.S. affiliates (part of
the Expedia Group of brands) commit to cooperate and comply respectively with
the advice of the panel established by the EU data protection authorities
(DPAs), the UK Information Commissioner’s Office (ICO), the Gibraltar Regulatory
Authority (GRA) and the Swiss Federal Data Protection and Information
Commissioner (FDPIC) with regard to unresolved complaints concerning our
handling of personal data received in reliance on the DPF Frameworks. Under
certain circumstances, you may have the possibility to invoke binding
arbitration for complaints regarding DPF compliance not resolved by any of the
other DPF mechanisms. Please visit this link for more
information: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2.
Expedia, Inc. commits to resolve DPF Principles-related complaints about our
collection and use of your personal information. EU and UK individuals and Swiss
individuals with inquiries or complaints regarding our handling of personal data
received in reliance on the DPF Frameworks should first contact us via our
Contact Us below.


APEC CROSS BORDER PRIVACY RULES SYSTEM PARTICIPATION

The privacy practices of Expedia, Inc., described in this Privacy Statement,
comply with the APEC Cross Border Privacy Rules System. The APEC CBPR system
provides a framework for organizations to ensure protection of personal
information transferred among participating APEC economies. More information
about the APEC framework can be found here.


SECURITY

We want you to feel confident about using our platform and all associated tools
and services, and we are committed to taking appropriate steps to protect the
information we collect. While no company can guarantee absolute security, we do
take reasonable steps to implement appropriate physical, technical, and
organizational measures to protect the personal information that we collect and
process.
Our cybersecurity team develops and deploys technical security controls and
measures to ensure responsible personal information collection, storage, and
sharing that is proportionate to the personal information’s level of
confidentiality or sensitivity. We take efforts to continuously implement and
update security measures to protect your personal information from unauthorized
access, loss, destruction, or alteration. We hold our data-handling partners to
equally high standards.
We have established an information security protection system based on industry
best practices and have obtained PCI-DSS certification. We have also implemented
appropriate security measures throughout the entire lifecycle of data
collection, storage, processing, use, transmission, and sharing, and have taken
certain technical and management measures including but not limited to
verification and access controls, VPN, SSL encrypted transmission, and multi
factor authentication mechanisms, based on our information classification and
processing standards, to ensure the security of systems and services.
We have management and approval mechanisms for employees who may have access to
your information and provide regular information security training for
employees.
In the event of a personal data security incident that may affect your rights
and interests, you will be notified in accordance with applicable data
protection laws and regulations. We will also report the relevant incident to
the competent regulatory authorities, if required by applicable laws and
regulations.


MINORS

Our website and mobile application are not directed at minors (as defined in
applicable data protection laws) and we cannot distinguish the age of persons
who access and use these. If a minor has provided us with personal information
without parental or guardian consent, the parent or guardian should contact us
(see “Contact Us” section below). If we become aware that personal information
has been collected from a minor without parental or guardian consent, we will
terminate the minor’s account, where that minor has an account with us.
The limited circumstances we might need to collect the personal information of
minors include: as part of a reservation, the purchase of other travel-related
services, or in other exceptional circumstances (such as features addressed to
families). When processing personal information of minors, we strictly adhere to
the principles of legality, necessity, clear purpose, openness, transparency,
and security, and we take strict measures to protect such data.
If you have any questions or concerns regarding our protection of minors’
personal information, or if you (in your capacity as the parent or guardian of
the minor) wish to delete or correct the personal information of minors, please
click here.


RECORD RETENTION

We will retain your personal information in accordance with all applicable laws,
for as long as it may be relevant to fulfill the purposes set forth in this
Privacy Statement, unless a longer retention period is required or permitted by
law. We will deidentify, aggregate, or otherwise anonymize your personal
information if we intend to use it for analytical purposes or trend analysis
over longer periods of time.
When we delete your personal information, we use industry standard methods to
ensure that any recovery or retrieval of your information is impossible. We may
keep residual copies of your personal information in backup systems to protect
our systems from malicious loss. This personal information is inaccessible
unless restored, and all unnecessary personal information will be deleted upon
restoration.
The criteria we use to determine our retention periods include:

 * The duration of our relationship with you, including any open accounts you
   may have with Expedia Group companies, or recent bookings or other
   transactions you have made on our platform
 * Whether we have a legal obligation related to your personal information, such
   as laws requiring us to keep records of your transactions with us
 * Whether there are any current and relevant legal obligations affecting how
   long we will keep your personal information, including contractual
   obligations, litigation holds, statutes of limitations, and regulatory
   investigations
 * Whether your personal information is needed for secure backups of our systems


CONTACT US

If you have any questions or concerns about our use of your personal
information, or wish to inquire about our personal information handling
practices, and exercise your rights to access, correct or inquire about deletion
of personal information, please contact us via the Privacy Section here. For a
list of the Expedia Group companies, click here.
Your principal data controller is the Expedia Group company responsible for the
site or app with which you are interacting, and this data controller may be
acting as a joint controller with other members of the Expedia Group of
companies. For more information about the data controller(s) (and joint
controllers, where applicable) and/or Representative for personal information we
process, please click here.


UPDATES TO STATEMENT

We may update this Statement in response to changing laws or technical or
business developments. If we propose to make any material changes, we will
notify you by means of a notice on this page. You can see when this Privacy
Statement was last updated by checking the “last updated” date displayed at the
top of this Statement.
For information on prior updates please contact us.