PRIVACY STATEMENT

Last Updated: April 4, 2024

Bookly, values you as our customer and recognizes that privacy is important to you.

This Privacy Statement explains how Bookly (the “Site”, “we”, ‘us or “our”) collects, uses, and discloses personal information when you, visit use our platform and associated services, your

rights in determining what it does with the information that it collects or holds about you and tells you how to contact Bookly.

Please read this Privacy Statement carefully. By using and accessing any of the Services, you agree to the collection, use and disclosure of your information including, personal information.

What personal information do we collect and use, and how do we collect it?

We collect personal information when:

• You give us the personal information, we collect it
• We receive it from others when you create an account on one of our sites, sign up to

receive offers or information, or make a booking using our platform, you give us your personal information.

• Through automated technology such as cookies placed on your browser, with your consent where applicable, when you visit our sites or download and use our apps.
• Disclosed from affiliated companies, as well as business partners and other third-parties, which help us improve our platform and associated tools and services, update and

maintain accurate records, potentially detect and investigate fraud, and more effectively market our services.

Personal information collected includes, but is not limited to:

• Basic contact details (name, address, phone number, e-mail )
• Order information (billing address, shipping address, payment confirmation )
• Account information (username, password, security questions )
• Shopping information (items you view, items you add to your shopping cart, itesm you add to your wish list etc.)
• Customer support information (information you choose to include in communications with us.

Some feathers of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features.

A more complete list of the type of personal information collected is described below.

What are your rights and choices?

You can exercise your data protection rights in various ways. For example, you can opt out of marketing by clicking the “unsubscribe” link in the emails, in your account as applicable, or

contacting our customer service. This Privacy Statement has more information below about the options and data protection rights and choices available to you.

Lawful Bases for Processing:

 

In the tables below, you will find the lawful basis we rely on to collect and use your personal information.

In summary, we will collect personal information from you only when one of the following lawful bases applies:

• Consent: this means that we will process your personal information where you have

given your consent to do so (e.g., sending you marketing communications where consent is required).

• Legal obligation: this means that we will process your personal information where we have a legal obligation to collect personal information from you such as where it is

necessary to use your transaction history to complete our financial and tax obligations under the law.

• Performance of a contract: this means that we will process your personal information where the personal information is necessary to perform a contract with you (e.g., manage your booking, process payments, or create an account at your request). If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the

provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

• Legitimate interest: this means that we will process your personal information where the processing is in our legitimate interests and not overridden by your rights (as explained

below). Certain countries and regions allow us to process personal information on the basis of legitimate interests. If we collect and use your personal information in reliance

on our legitimate interests (or the legitimate interests of any third-party), this interest will typically be to operate or improve our platform and communicate with you as necessary to provide our services to you, for security verification purposes when you contact us, to respond to your queries, undertaking marketing, or for the purposes of potentially

detecting or preventing illegal activities. While the concept of legitimate interest only

exists in certain countries and regions, we balance our usage of your personal information against your rights globally.

Categories of Personal Information We Collect and Use

We collect personal information for the following purposes:

• Platform Usage and Booking Purposes – including to: Maintain your use of Bookly’s platform and services, and as otherwise described in this Privacy Enable and facilitate acceptance and processing of payments, coupons, and other transactions.

Administer loyalty and rewards programs. Collect and enable booking-related reviews. Help you to use our services faster and easier through features like the ability to sign-in using your account within the online services and sites of some of Bookly’s brands.

• Communications and Customer Service Purposes – including to: Respond to your questions, requests for information, and process information choices. Enable

communication between you and other suppliers. Contact you (such as by text message, email, phone calls, mail, push notifications, or messages on other communication

platforms) to provide information like confirmations and updates, emergency notifications, or for other purposes as described in this Privacy Statement.

• Marketing Purposes – including to: Contact you (such as by text message, email, phone calls, mail, push notifications, or messages on other communication platforms) for

marketing purposes. Analyze information such as browsing and/or purchase history and use the result to optimize advertising and marketing in accordance with your interests and preferences. Measure and analyze the effectiveness of our marketing and promotions.

Administer promotions like contests, sweepstakes, and similar giveaways. Deliver

targeted advertising and advertising based on your profile. Our Cookie Statement further explains how we use cookies and similar tracking technology.

·       Market Research, Analytics, and Training Purposes to improve our Services –

including to: Conduct surveys, market research, and data analytics. Maintain, improve, research, and measure the effectiveness of our sites and apps, activities, tools, and

services. Monitor or record calls, chats, and other communications with our customer service team and other representatives, as well as platform communications between or among partners and companions for quality control, training, dispute resolution, and as described in this Privacy Statement. Create aggregated or otherwise anonymized or

deidentified data, which we may use and disclose without restriction where permissible.

• Security and Compliance Purposes – including to: Promote security, verify identity of our customers, prevent and investigate fraud and unauthorized activities, defend against claims and other liabilities, and manage other Comply with applicable laws, protect our and our users’ rights and interest, defend ourselves, and respond to law enforcement, other legal authorities, and requests that are part of a legal process. Comply with

applicable security and anti-terrorism, anti-bribery, customs and immigration, and other such due diligence laws and requirements.

The following list of personal information is collected by us which includes, but is not limited to:

• Government issued identification data—including passports, driver’s license, government redress numbers, country of residence, tax identification number etc.
• Identification date—including name, username, e-mail address, telephone number for home, business and mobile and billing address (including street and postal code) etc.
• Payment data—including payment card number, expiration date, billing address, financial/bank account number, routing number etc.
• Travel related preferences—including favorite destination and accommodation types, special dietary and accessibility needs etc.
• Loyalty data—including loyalty program membership, loyalty points balance, points earnt and used, loyalty status, if any.
• Geolocation data—including inferred location from IP address, country selected to use our website, and exact real-time location etc.

• Images, videos, and recordings—including facial photographs, images you upload and videos etc.
• Communications with us—including e-mails, chat transcripts and recordings of calls with customer service representatives etc.
• Site interaction data—including searches you conduct, transactions, and other interactions with you on our platform online services and apps etc.
• Device data—including device type, unique device identification numbers, operating system, mobile carrier, and how your device has interacted with our online services,

including the pages accessed, links clicked, trips viewed, and features used, along with associated dates and times etc.

• Friends and companion information—including data you give us about other people, such as your companions or others for whom you are making a booking etc.
• Child data—including name and contact details of minor travelers provided by you as the parent/guardian of the minor as part of a trip reservation etc.
• Clickstream data—in certain instances, we may use clickstream data to render an illustration of your usage of our Clickstream data is the collection of a sequence of events that represent visitor actions on a website. We may reconstruct your site journey modeled on the timing and location of your actions.
• Birthdate and gender—including both your specific date of birth or an approximate age bracket you fall within, along with your gender.
• Sensitive data—data that could reveal sensitive information, including your racial or ethnic origin, religious or philosophical beliefs, sexual orientation or health or disability

information etc. We will only use your sensitive personal information for the purposes for which it was collected.

Sharing of Personal Information: We may share your personal information as described below and in this Privacy Statement, and as permitted by applicable law to the following third-party

entities which includes, but is not limited to:

• Third-party service providers: We may share personal information with third parties in connection with the delivery of services.
• Travel Suppliers: We may share personal information with travel-related suppliers such as hotels, airlines, car-rental companies, insurance, vacation-rental property owners and managers, and where available, activity providers, rail, or cruise lines who fulfill your booking. Please note that travel suppliers may contact you to obtain additional personal

information if and as required to facilitate your booking or to otherwise provide the travel or associated services.

• Business partners and offers: If we promote a program or offer a service or product in conjunction with a third-party business partner, then we may share your personal

information with that partner.

• Target Advertising Partners: We may share your personal information to third-party marketing partners for targeted advertising.
• Social Media and Online Platforms: We may share your personal information with media agencies, social media, search engines, and other online platforms to help us target our

online marketing. These social media and other online platforms may also use personal information they hold and combine or match it against personal information received

from us to create target audiences, which are audiences that we think would be interested

in our online advertising. This may involve social media and other online platforms

building a “lookalike” profit of the type of personal we are trying to target and providing specific adverts to those people when they browse the internet or use social media.

• Recipients in relation to our legal rights and obligations: We may share your personal

information and associated records to enforce our policies, as necessary or where we are permitted to do so by applicable law.

• Recipients in relations to corporate transactions: We may share your personal information in connection with a corporate transaction, such as a divestiture, merger, consolidation, assignments or asset sale, or bankruptcy.

Our Use of Artificial Intelligence: We use artificial intelligence and machine learning for various purposes to deliver our platform and associated services. We may use your personal information for the following purposes:

To enhance your user experience and keep our site safe. To determine the sort order, you see on our site. To provide destinations, property or activity recommendations. To provide flight price insights and alerts. To screen the content, you upload on our site (e.g., images of your properties) to ensure they meet our quality or formatting requirements, and to identify relevant amenities

included in your listing. To screen the reviews, you share with us to ensure they do not contain identifiable personal information or to assess customer satisfaction, to prevent and detect a

breach of our terms and conditions or other fraudulent activities to keep our site safe, to display your language and dialects within our virtual agents’ experience.

Automated decisions may be made by putting your personal information into a system and the decision is calculated using automatic processes.

We will rely on our legitimate interest to keep our site safe and to enhance your user experience. We will not engage in automated decision-making that involves a decision with legal or similarly significant effects solely based on automated processing of personal information, unless: you

explicitly consented to the processing, the processing is necessary for entering into a contract, or for its performance when otherwise authorized by applicable law.

You may have rights in relation to automated decision making, including the ability to request a manual decision-making process instead, or contest a decision based solely on automated

processing.

Cookies

Like many websites, we use Cookies on our Site. For specific information about the Cookies that we use related to powering our store with Shopify, see https://www.shopify.com/legal/cookies.

We use Cookies to power and improve our Site and our Services (including to remember your actions and preferences), to run analytics and better understand user interaction with the Services (in our legitimate interests to administer, improve and optimize the Services). We may also

permit third parties and services providers to use Cookies on our Site to better tailor the services, products and advertising on our Site and other websites.

Most browsers automatically accept Cookies by default, but you can choose to set your browser to remove or reject Cookies through your browser controls. Please keep in mind that removing or blocking

Cookies can negatively impact your user experience and may cause some of the Services, including certain features and general functionality, to work incorrectly or no longer be available.

Additionally, blocking Cookies may not completely prevent how we share information with third parties such as our advertising partners.

Your Rights and Choices

You have certain rights and choices with respect to your personal information, as described below:

If you have an account with us, you may change your communication preferences by either (1) logging in and updating the information in your account or (2) contacting us via the contact

information on our website. You can access, amend, inquire about deletion of, or update the accuracy of your personal information at any time by either logging into your account or by contacting us. If you no longer wish to receive marketing and promotional emails, you may unsubscribe by clicking the ‘unsubscribe’ link in the email. Please note that if you choose to

unsubscribe from or opt out of marketing emails, we may still send you important transactional and account-related messages from which you will not be able to unsubscribe. If we are

processing your personal information on the basis of consent, you may withdraw that consent at any time by contacting us. Withdrawing your consent will not affect the lawfulness of any

processing that occurred before you withdrew consent and it will not affect our processing of your personal information that is conducted in reliance on a legal basis other than consent

Certain countries and regions provide their residents with additional rights relating to personal information.

These additional rights vary by country and region and may include the ability to:

• Request a copy of your personal
• Request information about the purpose of the processing
• Delete your personal
• Object to our use or disclosure of your personal information. Restrict the processing of your personal information.
• Opt-out of the sale of your personal
• Port your personal
• Request information about the logic involved in our automated decision-making, the result of such decisions.
• Object to the use of fully automated decision making, including profiling, with significant legal effect, and request a manual decision-making process instead.
• Contest a decision based solely on automated

For questions about privacy, your rights, and choices, and in order for you, or (where applicable) your authorized agent to make a request to amend or update your personal information, or to

inquire about deletion of your information, please contact us.

In addition to the above rights, you may have the right to complain to a data protection authority about our collection and use of your personal information. However, we encourage you to

contact us first so we can do our best to resolve your concern. You may submit your request to us using the information in the Contact Information tab on our website

https://bookly.direct/policies/contact-information.

We respond to all requests we receive from individuals wanting to exercise their personal data

protection rights in accordance with applicable data protection laws. Should you have the right to appeal a decision to not act on a request under applicable law, instructions on how to make that appeal will be included in our response to you.

International Data Transfer

The personal information we process may be accessed from, processed or transferred to countries other than the country in which you reside. Those countries may have data protection laws that

are different from the laws of your country. Such cross-border transfer of your personal

information is necessary for us to service your transaction with us, and for the purposes outlined in this Privacy Statement.

The servers for our platform are located in the United States, and Bookly uses third-party service providers operate in many countries around the world. When we collect your personal

information, we may process it in any of those countries. Our employees may access your

personal information from various countries around the world. The transferees of your personal information may also be located in countries other than the country in which you reside.

We have taken appropriate steps and put safeguards in place to help ensure that any access,

processing and/or transfer of your personal information remains protected in accordance with this Privacy Statement and in compliance with applicable data protection law. Such measures

provide your personal information with a standard of protection that is at least comparable to that under the equivalent local law in your country, no matter where your data is accessed from,

processed and/or transferred to. We will comply with obligations regarding personal information cross-border transfer in accordance with application data protection laws, regulations, and

conditions set by the competent authorities. This may include fulfilling obligations such as security assessments and/or certifications and signing agreements with overseas recipients in accordance with the standard contract established by the competent authorities.

Security

We want you to feel confident about using our platform and all associated tools and services, and we are committed to taking appropriate steps to protect the information we collect. While no

company can guarantee absolute security, we do take reasonable steps to implement appropriate physical, technical, and organizational measures to protect the personal information that we

collect and process.

Our cybersecurity team develops and deploys technical security controls and measures to ensure responsible personal information collection, storage, and sharing that is proportionate to the

personal information’s level of confidentiality or sensitivity. We take efforts to continuously implement and update security measures to protect your personal information from unauthorized access, loss, destruction, or alteration. We hold our data-handling partners to equally high standards.

We have established an information security protection system based on industry best practices and have obtained PCI-DSS certification. We have also implemented appropriate security measures throughout the entire lifecycle of data collection, storage, processing, use,

transmission, and sharing, and have taken certain technical and management measures including but not limited to verification and access controls, VPN, SSL encrypted transmission, and multi factor authentication mechanisms, based on our information classification and processing

standards, to ensure the security of systems and services.

We have management and approval mechanisms for employees who may have access to your information and provide regular information security training for employees.

In the event of a personal data security incident that may affect your rights and interests, you will be notified in accordance with applicable data protection laws and regulations. We will also

report the relevant incident to the competent regulatory authorities, if required by applicable laws and regulations.

Minors

Our website and mobile application are not directed at minors (as defined in applicable data protection laws) and we cannot distinguish the age of persons who access and use these. If a

minor has provided us with personal information without parental or guardian consent, the parent or guardian should contact us (see “Contact Us” section below). If we become aware that

personal information has been collected from a minor without parental or guardian consent, we will terminate the minor’s account, where that minor has an account with us.

The limited circumstances we might need to collect the personal information of minors include: as part of a reservation, the purchase of other travel-related services, or in other exceptional

circumstances (such as features addressed to families). When processing personal information of minors, we strictly adhere to the principles of legality, necessity, clear purpose, openness,

transparency, and security, and we take strict measures to protect such data.

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children. If you are the parent or guardian of a child who has

provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.

As of the Latest Update date reference at the top of this Privacy Statement, we do not have actual knowledge that we “share” or “sell” (as those terms are defined in applicable law) personal

information of individuals under 16 years of age.

If you have any questions or concerns regarding our protection of minors’ personal information, or if you (in your capacity as the parent or guardian of the minor) wish to delete or correct the

personal information of minors, please contact us.

Record Retention

We will retain your personal information in accordance with all applicable laws, for as long as it may be relevant to fulfill the purposes set forth in this Privacy Statement, unless a longer

retention period is required or permitted by law. We will deidentify, aggregate, or otherwise anonymize your personal information if we intend to use it for analytical purposes or trend analysis over longer periods of time.

When we delete your personal information, we use industry standard methods to ensure that any recovery or retrieval of your information is impossible. We may keep residual copies of your

personal information in backup systems to protect our systems from malicious loss. This

personal information is inaccessible unless restored, and all unnecessary personal information will be deleted upon restoration.

Complaint

 

If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority.

Contact Us

If you have any questions or concerns about our use of your personal information, or wish to inquire about our personal information handling practices, and exercise your rights to access, correct or inquire about deletion of personal information, please contact us using the Contact Information tab on our website at https://bookly.direct/policies/contact-information.

Updates to Statement

 

We reserve the right to update this Privacy Statement from time to time at our sole discretion without any prior notice.