Privacy
Privacy Statement summary
This is a summary of our Privacy Statement
What does this Privacy Statement cover?
This Privacy Statement is designed to describe:
- What type of personal information we collect and use, and how we collect it
- When and with whom we share your personal information
- What choices you can make about how we collect, use and share your personal information
What personal information do we collect and use, and how do we collect it?
We collect personal information when:
- You give us the information
- We collect it automatically
- We receive it from others
When you create an account on one of our sites, sign up to receive offers or information or make a booking using our platform, you give us your personal information. We also collect such information through automated technology such as cookies placed on your browser, with your consent where applicable, when you visit our sites or download and use our Apps. We also receive information from affiliated companies within Expedia Group, as well as business partners and other third parties, which help us to improve our platform and associated tools and services, update and maintain accurate records, potentially detect and investigate fraud and more effectively market our services.
How is your personal information shared?
Your personal information may be shared to help you to book your travel and/or holiday, assist with your travel and/or holiday stay, communicate with you (including when we send information on products and services or enable you to communicate with travel providers and/or property owners) and comply with the law. The full Privacy Statement details how personal information is shared.
What are your rights and choices?
You can exercise your data protection rights in various ways. For example, you can opt out of marketing by clicking the 'unsubscribe' link in the emails, in your account, where applicable, or by contacting our customer service. Our Privacy Statement has about the options and data protection rights available to you.
Categories of personal information that we collect
When you use our platform, apps or associated tools or services, we may collect the following kinds of personal information from you as needed:
- Name, email address, telephone number and home, business and billing addresses
- Government-issued identification required for booking, or identity verification such as passport, driving licence and government redress numbers, and for holiday property owners, their tax identification number
- Payment information such as payment card number, expiry date and billing address
- Travel-related preferences and requests such as favourite destination and accommodation types, and special dietary and accessibility needs, as available
- Loyalty scheme and membership information
- Birth date and gender
- Geolocation
- Images, videos and other recordings
- Social media account ID and other publicly available information
- Communications with us (such as recordings of calls with customer service representatives for quality assurance and training purposes)
- Searches that you conduct, transactions and other interactions with you on our online services and apps
- Other communications that occur through the platform among partners and holidaymakers, and in-group chat and collaboration tools for holidaymakers
- The searches and transactions that are conducted through the platform
- Data that you give us about other people, such as your travel companions or others for whom you are making a booking
- Information that we receive about you from other Expedia Group companies and third parties, such as our business and affiliate partners and authorised service providers, which may include updated contact information, demographic information, interests and purchase history, and which we may add to your account or profile and use for market research and analysis
When you install any of our apps or use our platform, we automatically collect the following types of information from your device
- IP address
- Device type
- Unique device identification numbers
- Internet browser type (such as Firefox, Safari, Chrome and Internet Explorer)
- Internet service provider
- Operating system
- Mobile network
- How your device has interacted with our online services, including the pages accessed, links clicked, trips viewed and features used, along with associated dates and times
- Details of any referring website or exit pages, as well as general geographic location (such as at the country or city level)
Mobile apps
When you download and use any of our mobile apps, we collect certain technical information from your device to enable the app to work properly and as otherwise described in this Privacy Statement. That technical information includes:
- Device and telephone connectivity information such as your carrier, network type, network operator, subscriber identity module ('SIM') operator and SIM country
- Operating system and version
- Device model
- Performance and data usage
- Usage data, such as dates and times that the app accesses our servers, the features and links clicked in the app, searches, transactions and the data and files downloaded to the app
- Device settings that are selected or enabled, such as Wi-Fi, Global Positioning System ('GPS') and Bluetooth (which may be used for location services, subject to your permission as explained below)
- Mobile device settings
- Other technical information such as app name, type and version, as needed, to provide you with services
Permissions for location-based services:
Depending on your device’s settings and permissions and your choice to participate in certain programs, we may collect the location of your device by using GPS signals, mobile phone towers, Wi-Fi signals, Bluetooth or other technologies. We will collect this information, if you opt in through the app or other program (either during your initial login or later) to enable certain location-based services that are available within the app (for example, locating the closest available accommodation to you). To disable location capabilities of the app, you can log off or change your mobile device’s settings.
Use of personal information
We use your personal information for various purposes described below, which depend on the site that you visit or the app that you use.
Your use of online sites, apps and services:
- Book the requested travel or enable booking of a holiday property
- Provide services related to the booking and/or account
- Create, maintain and update user accounts on our platform and authenticate you as a user
- Maintain your search and travel history, accommodation and travel preferences and similar information about your use of Expedia Group’s platform and services, and as otherwise described in this Privacy Statement
- Enable and facilitate acceptance and processing of payments, coupons and other transactions
- Administer loyalty and rewards schemes
- Collect and enable booking-related reviews
- Help you to use our services faster and more easily through features, such as the ability to sign in using your account within the online services and sites of some of the Expedia Group companies
Communications and marketing:
- Respond to your questions and requests for information, and process information choices
- Enable communication between you and the travel supplier, such as hotels and holiday rental property owners
- Contact you (such as by text message, email, phone calls, mail, push notifications or messages on other communication platforms) to provide information such as travel booking confirmations and updates, for marketing purposes or for other purposes as described in this Privacy Statement
- Market our products and services, optimise such marketing to be more relevant to you and measure and analyse the effectiveness of our marketing and promotions
- Administer promotions such as contests, sweepstakes and similar giveaways
Other business purposes and compliance
- Conduct surveys, market research and data analytics
- Maintain, improve, research and measure the effectiveness of our sites and apps, activities, tools and services
- Monitor or record calls, chats and other communications with our customer service team and other representatives, as well as platform communications between or among partners and holidaymakers for quality control, training, dispute resolution and as described in this Privacy Statement
- Create aggregated or otherwise anonymised or de-identified data, which we may use and disclose without restriction where permissible
- Promote security, verify identity of our customers, prevent and investigate fraud and unauthorised activities, defend against claims and other liabilities and manage other risks
- Comply with applicable laws, protect our and our users’ rights and interest, defend ourselves and respond to law enforcement, other legal authorities and requests that are part of a legal process
- Comply with applicable security and anti-terrorism, anti-bribery, customs and immigration and other such due diligence laws and requirements
- Operate our business using lawful business purposes and as permitted by law
Lawful bases for processing:
We will collect personal information from you only (i) where the personal information is necessary to perform a contract with you (e.g. manage your booking, process payments or create an account at your request), (ii) where the processing is in our legitimate interests and not overridden by your rights (as explained below) or (iii) where we have your consent to do so (e.g. sending you marketing communications where consent is required). In some cases, we will have a legal obligation to collect personal information from you, such as where it is necessary to use your transaction history to complete our financial and tax obligations under the law.
If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).
Certain countries and regions allow us to process personal information on the basis of legitimate interests. If we collect and use your personal information in reliance on our legitimate interests (or the legitimate interests of any third party), this interest will typically be to operate or improve our platform and communicate with you as necessary to provide our services to you, for security verification purposes when you contact us, to respond to your queries, undertaking marketing or for the purposes of potentially detecting or preventing illegal activities.
In some cases, we may use automated decision-making, for example, in relation to assessing fraudulent transactions or suspicious activity on our site. As part of this processing, automated decisions may be made by putting your personal information into a system and calculating the decision using automatic processes. If you pose a fraud risk, this may affect your ability to book on our site. You may have rights in relation to automated decision making, including the ability to request a manual decision-making process instead or to contest a decision based solely on automated processing. If you want to know more about your data protection rights, please section below.
Sharing of personal information
We share your personal information as described below and in this Privacy Statement, and as permitted by applicable law.
- Third-party service providers. We share personal information with third parties in connection with the delivery of services to you and the operation of our business (for example, to provide credit card processing, customer service, business analytics and fraud prevention and compliance services, and to serve you with advertising that is tailored to your interests). These third-party service providers are required to protect personal information that we share with them, and may not use any directly identifying personal information other than to provide services that we contracted them for. They are not allowed to use the personal information that we share for purposes of their own direct marketing (unless you have separately consented with the third party under the terms provided by the third party).
- Travel suppliers. We share personal information with travel-related suppliers such as hotels, airlines, car hire companies, insurance, holiday rental property owners and managers and, where available, activity providers, rail companies or cruise lines who fulfil your booking. Please note that travel suppliers may contact you to obtain additional information if and as required to facilitate your booking or to otherwise provide the travel or associated services.
- Business partners and offers. If we promote a programme or offer a service or product in conjunction with a third-party business partner, we will share your information with that partner to assist in marketing or to provide the associated product or service. In most of those cases, the programme or offer will include the name of the third-party business partner, either alone or with ours, or you will be redirected to the website of that business with notice. An example of such a business partner relationship would be a third-party loyalty scheme for which you could earn points by completing a booking on our platform.
- Legal rights and obligations. We may disclose your personal information to enforce our policies, or where we are permitted (or believe in good faith that we are required) to do so by applicable law, such as in response to a request by a law enforcement or governmental authority, in connection with actual or proposed litigation, or to protect and defend our property, people and other rights or interests. We may also share your personal information pursuant to a subpoena or other legal request, or as necessary to remit certain taxes in the course of processing payments as required by law or legal process.
- Corporate transactions. We may share your personal information in connection with a corporate transaction, such as a divestiture, merger, consolidation, assignments or asset sale, or in the unlikely event of bankruptcy. In the case of any acquisition, we will inform the buyer that it must use your personal information only for the purposes disclosed in this Privacy Statement.
Your rights and choices
You have certain rights and choices with respect to your personal information, as described below:
- You can access, amend, inquire about deletion, or update the accuracy of your information at any time by either logging into your account or contacting us
- If you no longer wish to receive marketing and promotional emails, you may unsubscribe by clicking the ‘unsubscribe’ link in the email. You can also log in to your account to change communication settings (not available for all Expedia Group companies) or contact us here. Please note that if you choose to unsubscribe from or opt out of marketing emails, we may still send you important transactional and account-related messages from which you will not be able to unsubscribe
- For our mobile apps, you can view and manage notifications and preferences in the settings menus of the app and of your operating system
- If we are processing your personal information on the basis of consent, you may withdraw that consent at any time by contacting us. Withdrawing your consent will not affect the lawfulness of any processing that occurred before you withdrew consent, and it will not affect our processing of your personal information that is conducted in reliance on a legal basis other than consent
Certain countries and regions provide their residents with additional rights relating to personal information. These additional rights vary by country and region, and may include the ability to:
- Request a copy of your personal information
- Request information about the purpose of the processing activities
- Delete your personal information
- Object to our use or disclosure of your personal information
- Restrict the processing of your personal information
- Opt out of the sale of your personal information
- Port your personal information
- Request information about the logic involved in our automated decision-making that is used in our fraud prevention practices, and the result of such decisions
For questions about privacy, your rights and choices, and in order to make a request to amend or update your information, or to inquire about deletion, please contact us
In addition to the above rights, you may have the right to complain to a data protection authority about our collection and use of your personal information. However, we encourage you to contact us first so that we can do our best to resolve your concern. You may submit your request to us using the information in the section. We respond to all requests that we receive from individuals wanting to exercise their personal data protection rights in accordance with applicable data protection laws.
International data transfer
The personal information that we process may be transmitted or transferred to countries other than the country in which you reside. Those countries may have data protection laws that are different from the laws of your country.
The servers for our platform are located in the United States, and the Expedia Group companies and third-party service providers operate in many countries around the world. When we collect your personal information, we may process it in any of those countries.
We have taken appropriate steps and put safeguards in place to help ensure that your personal information remains protected in accordance with this Privacy Statement. For example, any data transfers between our group companies are governed by our intragroup agreements which incorporate strict data transfer terms (including the European Commission's Standard Contractual Clauses, for transfers from the EEA) and require all group companies to protect the personal information that they process in accordance with applicable data protection law. In addition, certain Expedia Group US affiliates have certified with the EU-US and Swiss-US Privacy Shield, as explained below in the 'Privacy Shield' section.
We also require that third-party service providers to whom data transfers are made have appropriate safeguards in place to protect your personal information, in compliance with applicable data protection law. The particular measures used will depend on the service provider, and our agreements with them may include Standard Contractual Clauses approved by the European Commission, the service provider's certification under the EU-US and/or Swiss-US Privacy Shield or reliance on the service provider's binding corporate rules, as defined by the European Commission.
Updates to Privacy Statement
We may update this Privacy Statement in response to changing laws or technical or business developments. You can see when this Privacy Statement was last updated by checking the 'last updated' date displayed at the top of this Statement.