Privacy Policy
This document also provides Users with information on how to exercise their rights (including the right to object to some of the data management we carry out). More information about your rights and how you can exercise them is set out in the sections below.
Where any term used in this privacy policy is not specifically defined (such as "Service" or "Website"), the definition is understood as being the same as that used in the Company's Terms and Conditions of service.
What categories of data do we collect and use?
When you visit the website and use the comparison service (as a "User"), we collect the following categories of personal data:
Personal data provided by Users
Personal data that you share with us, including information contained in comments, telephone messages to our Support Service (where available) or via social media channels.
More specifically:
When contact is made between us and the User via the Support Service (where available) or email, we may collect: personal data provided by the User when he/she connects with us, including name and username, telephone number and email address.
When you download and use the app: we do not collect personal data from you directly. Note, however, that some information will be shared via Facebook (section 11.2 of this privacy policy). By installing the app you declare that you have read and accepted the privacy policy and the terms and conditions for the app.
The above personal data, where requested, is required for the proper execution of the contract between us and the User and to enable us to fulfil our legal obligations, except where we require the consent of the data subject as the lawful basis for processing and for our legitimate interest. Without it, we may not be able to provide all the services you request.
It is important that all the personal data you provide is correct and accurate. This includes, for example, ensuring that the contact details we hold (including email address) are correct at all times.
Personal data collected automatically from our website, over the telephone and/or from third parties
We collect information about your visits to the website and your use of the website, such as the device and browser you are using, the IP address or domain names of any computers connected to the website, the uniform resource identifier of any request made, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the computer environment used, the date and time of the visit, the duration of the visit, the referral site and the navigation path to the website leading to the visit and interactions on the website itself, including the services and offers you are interested in. Note that we may link this information to your User account.
For more information on the purposes for which we collect and use this information, see the section on Cookies in this privacy policy (9. Information about Cookies). Note that your personal details may also be linked to Cookies, e.g. to enable the storage of travel searches made on your personal account when you are logged onto the service and/or to collect information on how you use our products and services.
We may monitor calls to our Support Service (where available), for the purposes of quality control, analysis, staff training and/or to protect ourselves in the event of a legal dispute. Any personal data obtained from the User during the call will be processed in accordance with this privacy policy.
We may receive additional information about Users, such as information on fraud detection and warnings from third-party service providers and/or partners, to the extent permitted by applicable law, in relation to our fraud prevention activities.
Why do we collect personal data?
Generally, we use your personal data to provide the services you request, provide customer service, notify you about important changes to our website and suggest content and advertising that we think may be of interest to you. More specifically:
Why?
A. To create and maintain the contractual relationship established for provision of the requested service in all its phases and via any possible integration and modification, and to take action with regard to pre-contractual issues at the request of the User (e.g. to respond to User enquiries and concerns). Information relating to service provision and/or to providing Users with clarification or assistance may be sent by email, telephone or similar technologies.
On what lawful basis?
To fulfil a contract or implement measures related to a contract (i.e. to provide services requested and/or provide Users with clarification or assistance)
Why?
B. N/A
Why?
C. To comply with legal, regulatory and compliance requirements and to respond to requests from government authorities and law enforcement agencies conducting investigations.
On what lawful basis?
To comply with the law (i.e. to share personal data with regulatory authorities)
Why?
D. To carry out aggregate statistical analyses on anonymous groups to see how our website and services are used and to check on the performance of our business.
On what lawful basis?
To pursue our legitimate interests (i.e. to improve our website and its functionality and our services)
Why?
E. N/A
Why?
F. N/A
Why?
G. N/A
Why?
H. To keep our website and our systems secure and to prevent and detect security incidents and other offences.
On what lawful basis?
To pursue our legitimate interest (i.e. to ensure the security of our website)
Why?
I. To check compliance with our terms and conditions and to ascertain, exercise or defend a legal right.
Why?
J. To tailor and personalise advertising and online marketing communications based on information collected through Cookies and related to how Users make use of the website, of the services and of other websites (for more information see the section on Cookies in this privacy policy).
On what lawful basis?
Where a User gives his/her consent (i.e. through the Cookie banner or browser settings)
Why?
K. Where permitted by applicable law, we may monitor calls to and from our Support Services for the purposes of quality control, analysis and staff training.
On what lawful basis?
To pursue our legitimate interest (i.e. to improve our Support Service)
Where personal data processing is based on legitimate interest, we carry out an assessment to ensure that our interest in the use of the data is legitimate and that the User's fundamental right to privacy is not compromised by our legitimate interest ("comparative assessment"). For more information on comparative assessment please email our data protection officer.
Who sees, receives and uses the data and where does this take place?
Categories of data recipients
We share your personal data, for the purposes set out in this privacy policy, with the following categories of recipient:
our authorised employees and/or associates who provide assistance and consultancy services in the areas of administration, products, legal advice, the Support Service (where available) and IT systems, and those responsible for maintaining our network and hardware and software equipment; airlines, hotels, car hire companies, insurance companies, tour operators and any other party to whom personal data must be communicated in order to provide a service requested by the User and/or Customer, and who thereby operate as independent data controllers. Note that in accordance with new regulations introduced in the United States and other countries, airlines are required to allow customs and border authorities access to flight passenger data. For this reason, in some situations we may communicate information that we have collected on the passengers included in a reservation to the competent authorities in the countries on the Customer's travel itinerary, if required by local law;
our third-party service providers (including other lastminute.com group entities) who process your personal data on our behalf and under our instructions for the above purposes and thereby acting as data controllers, for example those who provide us with IT and hosting services, call centres and assistance, analytical and administration services, etc.;
social media platforms with which we have a commercial agreement, if expressly requested by the User (e.g. when sharing information generated by our site on such platforms), when downloading our app and consenting, via our privacy policy or via the social media platform, to our sharing information about your online activity with such partners, even when you have not accessed the social media platform, or when such commercial partners, who provide us with functional capabilities, request details about the device on which the app is installed, which they are entitled to do. The information shared will be governed by the privacy policy of the social media platform. The competent authorities, if required by the applicable legislation;
the competent authorities and third-party law enforcement agencies, where it is necessary to enforce our terms and conditions of use and protect and defend our rights or our property or the rights and property of third parties;
third parties who receive the data (e.g. business consultants, tax professionals who provide "due diligence" services or who assess the value and capabilities of the business), where necessary, in connection with the sale of our business or its assets (in which case the data will be communicated to our consultants and the consultants of any potential buyer and transferred to the new owners).
For how long do we store your data?
We store your personal data for as long as it is required to achieve the purposes and to carry out the activities described in this privacy policy, or as otherwise communicated to Users, or for as long as we are permitted by the applicable legislation. More information on the retention period is available here:
Document
Email from the Support Service, including User requests and complaints
Retention period
10 years
Start date
The date the email was sent
Document
Reports and complaints
Retention period
10 years
DATA COLLECTED VIA TAGS
Document
Technical cookies
Retention period
Max. 3 years
Start date
The date our website was accessed
Retention period
Max. 3 years
What are your data protection rights and how can you exercise them?
You can exercise your rights guaranteed under EU Regulation 2016/679 (articles 15-22), including rights to:
Name of right
Right of access
Content
To receive confirmation of the existence of personal data, access the content of the data and obtain a copy.
Name of right
Right to rectification
Content
To update, rectify and/or correct personal data.
Name of right
Right to erasure/right to have data forgotten and right to restrict
Content
To request the erasure of data or the limitation of data that has been processed in violation of the law, including data that does not require to be stored for the purposes for which the data was collected or processed; where we have made personal data public, the User also has the right to request the erasure of the personal data and for reasonable measures to be taken, including technical measures, to inform other data controllers who are processing the personal data of the request to delete any link, copy or reproduction of such personal data.
Name of right
Right to data portability
Content
To receive in a structured, commonly used and machine-readable format a copy of the personal data provided to the Company for the purposes of a contract or with the consent of the User, and to request such personal data to be transferred to another data controller.
Rights relating to personal data can be limited in some situations. For example, if complying with your request would reveal personal data relating to another subject, or if there are binding legal requirements or compelling legitimate grounds, we may continue to process the personal data you have asked us to delete.
You also have the right to complain if you think your personal information has been mismanaged. Users are requested to contact us in the first instance, but it is your right, if this right applies in your case, to lodge a complaint directly with the supervisory authority responsible for data protection.
Update and previous versions of this privacy policy
We reserve the right to change this privacy policy at any time in accordance with this section. If we make changes to this privacy policy, we will post the revised privacy policy on our website and update the "last updated" date at the top of this privacy policy.
