PRIVACY POLICY
Last updated November 2020
This privacy policy (“Privacy Policy”) has been drafted and published in accordance with the Information Technology Act, 2000, the Information Technology (Amendment) Act, 2008, and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.
We recognise the importance of protecting your privacy and your rights with regards to data protection. The Internet is a very powerful medium when it comes to transmitting personal information; for that reason, we and all other companies belonging to the lastminute.com group (“lm group”) undertake the serious task of respecting the current laws regarding the protection of personal data and the security of the same, with the aim of guaranteeing secure, controlled and confidential navigation for its users and customers who visit and/or use the website and/or use our Comparison Service (you as a "User") or then purchase or register on our services, download our app and/or give us their consent for a specific purpose (you as a "Customer").
This policy constitutes a legal agreement between you, as the user of the Platform, and the Data Controller (as defined below) , as the owner of the platform, in respect of the subject matter hereof. The User must be a natural person who is at least 18 years of age. If the User is less than 18 years of age, the User should read through this Privacy Policy with the User’s parent or legal guardian, and in such a case this Privacy Policy shall be deemed to be a contract between the Company and the User’s legal guardian or parent and to the extent permissible under applicable laws, enforceable against the User.
This Privacy Policy describes how we collect, use, process, and disclose your personal data in conjunction with your access to and use of our Website and services and, specifically:
1. Who is the controller of your data? 2. What categories of your data do we collect and use? 3. Why and how do we collect your data? 4. Who sees, receives and uses your data and where? 5. How long do we retain your data? 6. What are your data protection rights and how can you exercise them? 7. Contact details of the data controller 8. Contact details of our data protection officer
9. Identity and contact details of Grievance Officer 10. Information about cookies 11. Privacy notice for Facebook 12. Update and old versions of this Privacy Policy 13. Data Security 14. Miscellaneous 15. Force Majeure 16. Governing Laws and Jurisdiction
It also informs you of how you can exercise your rights (including the right to object to some of the data handling we carry out). More information about your rights and how you can exercise them is set out in the section below.
If you see an undefined term in this Privacy Policy (such as “Service” or “Website”), it has the same definition as in our Company contractual service conditions.
1. Who is the controller of your personal data?
When this Privacy Policy mentions “Company”, “we,” “us,” “our” or “Data Controller”, it refers to: Bravoventure India Private Ltd, an Indian company belonging to the lm group, with registered office at 3 rd Floor, Wing B, Etamin Block, Exora Business Park Kadubeesanahalli Village, Varthur Hobli, Outer Ring Road Bengaluru - 560103 India, which is responsible for the processing of Users’ and/or Customers’ personal data under this Privacy Policy (hereinafter, referred to as the “Company”, “we”, “us”, “our”, “Data Controller”).
We, being an entity located in India, are subject to Indian law regarding the protection of personal data.
2. What categories of your data do we collect and use?
When you visit the Website and use our Comparison Service (you as a "User") or then purchase or register to our services (you as a "Customer") we collect the categories of personal data as follows:
2.1. Personal data provided by you
The personal data that you share with us including when you register for an account, subscribe to marketing communications and which you provide to us when using our services, downloading our app, including the information entered into our booking platform and included in your comments, reviews or messages sent via telephone to our Customer Care Team, or through the Live Chat or through social media channels.
More specifically:
When you book with us, you may provide us with information such as:
Passenger information, contact details,Information about your purchases, including what you booked, when and where you booked it and how you paid for it, date of birth etc., other data capable of identifying you
Sensitive personal data such as passport details, login credentials including password, financial data such as credit data, billing address, account information, other details such as relevant medical data and any special dietary or disability requests, some information concerning your health or revealing religious, philosophical or sexual orientation that you might voluntarily provide us in the course of making a booking by selecting the box "special transportation need" and filling in the empty field or by other means, such as via telephone to our Customer Care Team or through the Live Chat or at any moment when making a booking. We will use the sensitive personal data only as strictly necessary to fulfil your request. Where we need to process this data, we will only do it if we have your explicit consent.
When you contact us or we contact you through the Live Chat, the Customer Care Team via email, post and/or phone or through social media we may collect: personal data you provide when you connect with us, including your name, username, phone number, email.
When you take part in surveys or questionnaires about our services you may provide us with your contact details, your feedback and contributions to customer surveys and questionnaires.
When you subscribe to the personalised marketing services under p.3 - F of this Privacy Policy you may provide us with: Your personal details, information about your purchases, including what you booked, information about when you click on our adverts, the way you access the website, including IP address, online identifiers and browsers details. You may also provide us with information about your bookings, your browsing behaviour or your personal interests. Please note that some of this information might be collected automatically in accordance with p. 2.2.
When you use your account you may provide us with: your personal details such as your name, surname, email, address, phone number, profile picture and your login information as your email and the password you choose. Please note that as a registered user with an account, you are responsible for keeping your password, including one-time passwords sent to you, confidential. By submitting your information on our website, you agree to the handling of your information by us in a manner as stated under this Privacy Policy.
When you download and use our app: By installing our App you declare that you have read and accept the Privacy Policy and Terms and Conditions of our App.
When you consent to take part in promotions, competitions, contests you may provide us with: your personal details, including your address, email or phone number or eventually any other data that may be necessary to take part on the specific case. We will inform you about the privacy policy of the specific promotions, competitions or contests as soon as the promotions start.
When you consent to be subscribed to our marketing communications via WhatsApp, you may provide us with: your name and phone number. Before subscribing to marketing communications via WhatsApp you have to read and accept the specific privacy policy for the WhatsApp communications.
Personal data you provide about other individuals: If you plan to submit someone else's personal data to us, for instance when booking on their behalf, you should only provide us with that third party's details with their consent and after they have been given access to this Privacy Policy. When submitting data about other individuals you declare you have their consent
Personal data about children: Please note that we may collect and use the information of children only as provided by their parent or guardian or with their consent. If we become aware that we have processed information of a child without the valid consent of a parent or guardian, we reserve the right to delete it.
The provision of the above personal data, where requested, is necessary for the adequate performance of the contract between you and us and to allow us to comply with our legal obligations except when we rely on consent as legitimate basis for processing and or our legitimate interest. Without it, we may not be able to provide you with all the requested services.
It is important that all the personal data you give us is correct and accurate. This includes, by way of example only, ensuring that we have your correct contact (including email) details at all times.
2.2. Personal data collected automatically from our Website, on the phone, from communication we send, and/or from third parties
We collect information about your visits to and use of the Website, such as information about the device and browser you are using, your IP address or domain names of the computers connected to the Websites, uniform resource identifiers for requests made, the time of request, the method used to submit a request to the server, the size of the archive obtained as a response, the numerical code indicating the status of the response given by the server (correct, error, etc.) and other parameters relative to the operating system and the computer environment used, the date and time that you visited, the duration of your visit, the referral source and website navigation paths of your visit and your interactions on the Website including the Services and offers you are interested in. Please note that we may associate this information with your account.
See the cookies section of this Privacy Policy (9. Information about cookies) for further information on the purposes for which we collect and use this information. Please note that your personal information may also be linked to Cookies i.e. to enable the storage of your travel searches on your Personal Account when you are registered to the service and/or collect information on how you use our products and services.
We may record or monitor calls to and from our Customer Care Team for contractual reasons, quality control purposes, analytics, for staff training and/or to protect us in the event of a legal dispute. Any personal data obtained from you during the call will be treated in accordance with this Privacy Policy.
We may use this style to also understand how you engage with communication material that we send to you, such as emails, including the action you take such as any links in them that you click on, your duration and frequency of your engagement with the email.
To the extent permitted by the applicable law wherein we receive additional information about you, such as fraud detection information and warnings from third party service providers and/or partners for our fraud prevention activities.
3. Why do we collect your data?
In general terms, we use your personal data to provide you with the services you request, process payment, provide customer services, send you marketing and promotional communications, notify you about important changes to our Website and to deliver our content and ads which we think may be of interest to you. More specifically:
Why?
3A. To create and maintain the contractual relation established for the provision of the product and/or service requested by you in all its phases and by way of any possible integration and modification or to take steps at your request in relation to the contract prior to entering into contract (e.g. facilitating your bookings and taking payments; responding to your questions and concerns; administering your account). Information concerning our provision of the Service and/or to provide you with any clarification or assistance may be sent to you via email, phone, SMS, recorded calls or other similar technologies.
Please note that if your call to us is not connected, or if it is disconnected mid-call, you authorise us to use your phone number to call you back, in order to respond to your request.
On which legal basis?
To fulfil a contract, or take steps linked to a contract
(i.e. To provide the products and/or services you request and/or to provide you with any clarification or assistance to you)
Why?
3B. If permitted by the applicable law, to request your participation in our surveys conducted via email phone, SMS, recorded calls, instant messaging services or other similar technologies from time to time, so that you can tell us about your experience as a recipient of the Service. We will use your feedback to develop and improve our services. Following our analyses of your feedback, we may consider it necessary to contact you to provide you with a response to your survey submission. You can inform us at any time if you no longer want to receive our surveys by writing to privacy.in@lastminutegroup.com . Please note that your participation in the survey is voluntary and there are no consequences should you prefer not to participate.
On which legal basis?
To pursue our legitimate interest (i.e. To manage and improve our products, services and day to day operations)
Why?
3C. To meet the legal, regulatory and compliance requirements and to respond to requests by government or law enforcement authorities conducting an investigation.
On which legal basis?
To comply with the law (i.e. to share personal data with regulatory authorities)
Why?
3D. To carry out aggregative statistical analyses on anonymised groups or to analyse identifiable individuals’ behaviour so that we can see how our Website, products and services are being used and how our business is performing.
On which legal basis?
To pursue our legitimate interest (i.e. improving our Website, its features and our products and services)
Why?
3E. To send you (in cases permitted by law excepting where you did not object) advertising material via email or, where permitted by the law, other equivalent electronic communication regarding products and services similar to those already purchased by you and offered on our Website. On some occasions, we may send you a personalised and tailored version of the aforementioned advertisement materials.
On which legal basis?
Soft Opt-in/To pursue our legitimate interest (i.e. marketing)
Why?
3F. To send you personalised and profiled marketing communications
Without prejudice to the provisions of the preceding paragraph E, and only with your previous consent, to share with you via email, phone, mail, SMS, and on our website or third party ones (e.g. using ads and/or Web Push Notifications) the best deals and offers on products and services we think you might find interesting because they are suited to your interests. The individualised service or the offers can be marketed by us or our partners or business partners operating in the following sectors: tourism, leisure, entertainment, high technology, fashion, decoration, consumer goods, food and beverage, finance, banking, insurance, energy, environment, communication, mass media, real estate, pharmaceuticals, clothing and textiles, education and training, energy, publications and publishing, information and communications technology, retail, sport, telecommunications and general services.
For this purpose we may:
- analyse your personal information to create a profile of your interests and preferences so that we can tailor and target our communications in a way that is timely and relevant to you.
- combine the information you give us via cookies with information related to your purchases and information we receive from third parties that collect your data through various means agreed by you. You can find information about third parties on this link[1]
- analyse information about the way you engage with communication material you receive from us, such as data on when emails have been opened or to determine if you have viewed or interacted with an ad, to record the number of times you have viewed each ad, to prevent a single ad being shown to you too frequently etc.
- temporarily share an encrypted version of your email address, with carefully selected partners who may combine this information with other forms of online identifiers or other personal data in order to present you with our offers cross device or cross channel, for example on social networks (Facebook, Pinterest, Instagram, twitter).
- use automated decision making to segment and target product offers based on your demands and needs. This allows us to be more focused, efficient and cost effective with our resources and also reduces the risk of someone receiving information they may find inappropriate or irrelevant. You can always request a manual decision- making process instead, express your opinion or contest decision based solely on automated processing, including profiling, if such a decision would produce legal effects or otherwise similarly significantly affect you. For further details, you may contact our Data Protection Officers whose details are provided in this privacy policy.
On which legal basis?
Where you give your consent (by ticking the appropriate check box)
Why?
3G n.a
Why?
3H. To keep our Website and systems secure and to prevent and detect security incidents and other crimes.
On which legal basis? To pursue our legitimate interest (i.e. ensuring the security of our Website)
Why?
3I. To verify compliance with our terms and conditions and for the establishment, exercise or defence of legal claims.
On which legal basis?
To pursue our legitimate interest (i.e. compliance with our terms and conditions, protection of our rights in the event of any dispute or claim)
Why?
3J. To tailor and personalise online marketing notifications and advertising for you based on the information on your use of our Website, products and services and other sites collected through cookies (please see the Cookies section of this Privacy Policy for further information)
On which legal basis?
Where you give your consent (i.e. through the cookie banner or by your browser's settings)
Why?
3K. If permitted by the applicable law, to record or monitor calls to and from our Customer Care Team for contractual reasons, quality control purposes, analytics, for staff training and/or to protect us in the event of a legal dispute.
On which legal basis?
To pursue our legitimate interest (i.e. improving our Website, its features and our products and services)
4. Who sees, receives and uses your data and where?
4.1. Categories of recipients of your data
We share your personal data, for the purposes described in this Privacy Policy, to the following categories of recipients:
Our authorised employees and/or collaborators that assist and advise us on administration, products, legal affairs, Customer Care Team, and information systems, as well as those in charge of maintaining our network and hardware/software equipment;
Airlines, hotels, car hire companies, insurance companies, tour operators as well as those other parties to which it is necessary to disclose your personal data in order to provide you with the requested services that will be operating as autonomous data controllers. Please note that airline companies are required, in accordance with new regulations introduced in the US and other countries, to allow customs and border authorities to have access to flight passenger data. For that reason, in certain situations, we may communicate data collected on passengers included in the reservation to the competent authorities of the countries included in the Customer’s travel itinerary if required by the local law.
Our third-party service providers (including other entities of the lastminute.com group), which process your personal data on our behalf and under our instructions for the purposes described hereinabove acting as data processors, such as those providing us with IT and hosting services call centre and customer support, analytics and administration services etc.
Payment providers and financial institutions (e.g. for chargeback, fraud detection and prevention purposes) acting as autonomous data controllers.
Our business partners who are social media platforms when it is explicitly requested by you (e.g. when you share information generated from our website onto those platforms), when using social media authentication methods or downloading our App whereby you agree either with our privacy policy or with the platforms that we may share information about your online activity with these partners even when you are not logged in to the social media platform). or when these business partners that provide us with functionality capabilities request information about the specifications of the device that the App has been installed on, which they have obtained the right to do. The information you share will be governed by the social media's privacy policy. Please check clause 2.3 of this Privacy Policy for more information.
Competent authorities when we are required to do so by the current law.
Competent authorities and Law and enforcement third parties when this is necessary so that we can enforce our terms of use and protect and defend our rights or property or the rights or property of any third party.
Third parties that receive the data (e.g. business consultants, professionals for delivering due diligence services or assess value and capabilities of the business) when it is necessary in connection with any potential sale of our business or its assets, in which case, we may disclose your personal data to the prospective seller or buyer of such business or assets.
The complete list of parties to which your personal data may be disclosed is available at our registered office and may be requested by writing to privacy.in@lastminutegroup.com
4.2. International transfer of your data
Users’ and/or Customers’ personal data is processed in the Data Controller’s registered office (see point 1), on the lm group servers, and at the offices of other entities to which data may be provided in order to provide the services requested of the Data Controller.
Given the fact that we are an international travel company, we also transfer your personal data to:
we disclose your data to autonomous data controllers such as airlines, hotels, car hire companies, tour operators etc. that might process your data outside India in order to provide you with the requested services.
we disclose your data to our service providers who act as data processors on our behalf that might be located in a country outside India, including Morocco, Albania, UK, European Economic Area, Switzerland and Tunisia. Our providers, acting as data processor, may be engaged in, among other things, the fulfilment of your service request, the processing of your payment details, the provision of advertising and marketing services on our behalf and the provision of support services through electronic communications or call centre.
Should you want to obtain further details about the safeguards put in place, you can contact us by writing to privacy.in@lastminutegroup.com.
5. How long do we retain your data?
We retain your personal data for as long as is required to achieve the purposes and fulfil the activities as set out in this Privacy Policy, otherwise communicated to you or for as long as is permitted or required by applicable law.
6. What are your data protection rights and how can you exercise them?
You can exercise the rights provided by the Information Technology Act, 2000 read with the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, including the right to access, update and object and the other rights as granted by the applicable legislation.
You can exercise these rights and the other rights as granted under the applicable privacy and data protection legislation at any time by:
Contacting us via email at privacy.in@lastminutegroup.com.
As for direct marketing, please note that you can also object at any time by clicking the unsubscribe link which we provide in each communication sent to you
As for online targeted ads and the withdrawal of your consent please refer to our Cookie section of this Privacy Policy.
In case you exercise any of the above rights, please note that we will attend your request considering the personal information held by all the companies within the lm group where Bravoventure India Private Ltd holds, directly or indirectly, 100% of the shares.
Your rights in relation to your personal data might be limited in some situations. For example, if fulfilling your request would reveal personal data about another person or if we have a legal requirement or a compelling legitimate ground we may continue to process your personal data which you have asked us to delete.
You also may have the right to make a complaint if you feel your personal information has been mishandled. We encourage you to come to us in the first instance but, to the extent that this right applies to you, you are entitled to complain directly to the relevant Data Protection Supervisory Authority.
7. Contact details of the data controller
The contact details of the Data Controller of the data processing described hereinabove are:
Bravoventure India Private Ltd, a Indian company belonging to the lm group,with registered office at 3 rd Floor, Wing B, Etamin Block, Exora Business Park Kadubeesanahalli Village, Varthur Hobli, Outer Ring Road Bengaluru - 560103 India.
8. Contact details of our privacy Team
privacy.in@lastminutegroup.com
9. Identity and contact details of Grievance Officer
The Grievance Officer is Ms. Sowmya Rajesh, domiciled at the registered office of the lastminute.com group’s Company and available at the address privacy.people@lastminute.com or via the other communication channels at your disposal (e.g. chat etc.).
10. Information about Cookies
For any information about Cookies please visit the following webpage https://in.lastminute.com/info/cookies-policy.html.
11. Privacy notice for Facebook
11.1. Facebook Custom Audiences - Facebook pixel We use the remarketing function “Custom Audiences” of Facebook Inc. (1601 Willow Road, Menlo Park, California 94025). This function allows us to show our Users and/or Customers of our website interest-based ads when they visit Facebook (“Facebook ads”), and to analyze such Facebook ads for statistical and market research purposes, which helps us optimize future advertising. This allows us to serve more relevant advertising.
For this purpose we use the so-called Facebook pixel for our website.
When a User or a Customer visits our website and takes an action (for example, buying something), the Facebook pixel is triggered and reports this action. This way, we will know when a customer took an action after seeing our Facebook ad. We will also be able to reach this customer again by using a Custom Audience. Therefore, this pixel allows user behavior to be tracked after they have been redirected to our Website by clicking on a Facebook ad. This way, we will know when a customer took an action after seeing our Facebook ad. We will also be able to reach this customer again by using a Custom Audience.
Therefore, this enables us to measure the effectiveness of Facebook ads for statistical and market research purposes. The data collected in this way is anonymous to us, i.e. we do not see the personal data of individual users. However, this data is stored and processed by Facebook, which is why we are informing you, based on our knowledge of the situation. Facebook may link this information to your Facebook account and also use it for its own promotional purposes, in accordance with Facebook’s Data Usage Policy https://www.facebook.com/about/privacy. Such data may allow Facebook and its partners to show ads on or off Facebook. A cookie may also be stored on your computer for these purposes.
11.2. Facebook SDK
Within our App, we use the Software Development Kit (SDK) from Facebook. The Facebook SDK is issued and administered by Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA,. By means of this integration, we can link various Facebook services with our App (i.e. Facebook Analytics, Facebook Ads, Facebook Login via the SDK, Facebook Account Ki, Facebook Share, Facebook Graph API and Facebook App Events).
In particular, we have linked the following SDK Facebook services with our App:
Facebook Login: to provide you with the possibility to register or log in with your Facebook account
Facebook App Events: To understand people's actions in our app and measure the effectiveness of your Mobile App Ads. We use this service to evaluate the reach of our advertising campaigns and use of Facebook SDK. Facebook merely provides us with an aggregated analysis of user behavior within our app.
In addition, as our App is linked to SDK Facebook services, we have to follow Facebook policies, which include that we are obliged to share with Facebook, when you download the App, even when you are not logged in to the social media platform, the following data:
Anonymous online identifier;
Information confirming that you have downloaded our App;
Type of device you have used to downloaded our App;
Your device model name;
Your geographical zone;
Your time zone;
Your connection provider;
The size and density of your screen device;
CPU cores of your device;
The external storage size in GB of your device;
The free space on external storage in GB of your device;
Device timezone
By downloading our App you declare that you agree with the communication of the data to Facebook as described above.
Further information about Facebook SDK within iOS can be found here:https://developers.facebook.com/docs/ios. For Android, please refer to: https://developers.facebook.com/docs/android.
You can check and modify the status of your connection to Facebook and the respective access privileges of our Apps at any time under your Facebook profile settings (https://www.facebook.com/settings?tab=applications). If you want to cancel the connection between Facebook and our App, please log in to Facebook and make the necessary changes in your profile settings.
12. Update and old versions of this privacy policy
We reserve the right to modify this Privacy Policy at any time in accordance with this provision. If we make changes to this Privacy Policy, we will post the revised Privacy Policy on our Website and update the “Last Updated” date at the top of this Privacy Policy. You must periodically review the Privacy Policy for the latest information on our privacy practices. In the event you continue to use the website and our services after any update in the Privacy Policy, your use of the website and access to our services shall be subject to such update privacy policy.
Old versions of this Privacy Policy are available here.
13. Data security
While aiming to guarantee a secure, confidential, safe handling of your personal data, we use certain physical, managerial, technical or operational safeguards as per industry standards and established best practices to protect the information we collect. We use reasonable security practices and procedures and use secure servers as mandated under applicable laws for protection of your information. We review our information collection, storage and processing practices, including physical security measures to guard against unauthorized access to systems. However, as effective as these measures are, no security system is impenetrable. We cannot guarantee the security of our database, nor can we guarantee that the information you supply will not be intercepted while being transmitted to us over the internet. You accept the inherent security implications of data transmission over the internet and the world wide web cannot always be guaranteed as complete secure. Therefore, your use of the website will be at your own risk. If you have any concerns please feel free to contact the Data Protection Officer at the details given above.
14. Miscellaneous
The invalidity or unenforceability of any part of this Privacy Policy shall not prejudice or affect the validity or enforceability of the remainder of this Privacy Policy. This Privacy Policy does not apply to any information other than the information collected by us through the Platform. This Privacy Policy shall be inapplicable to any unsolicited information you provide us through the Platform or through any other means. All unsolicited information shall be deemed to be non-confidential and we shall be free to use and/ or disclose such unsolicited information without any limitations. The rights and remedies available under this Privacy Policy may be exercised as often as necessary and are cumulative and not exclusive of rights or remedies provided by law. It may be waived only in writing. Delay in exercising or non-exercise of any such right or remedy does not constitute a waiver of that right or remedy, or any other right or remedy.
15. Force Majeure
Notwithstanding anything contained in this Privacy Policy or elsewhere, the Company shall not be held responsible for any loss, damage or misuse of your personal data, if such loss, damage or misuse is attributable to a Force Majeure Event (as defined below) or any act or omission attributable to you or any person claiming on your behalf. A "Force Majeure Event" shall mean any event that is beyond our reasonable control and shall include, without limitation, sabotage, fire, flood, explosion, acts of god, civil commotion, strikes or industrial action of any kind, riots, insurrection, war, acts of government, computer hacking, unauthorised access to computer, computer system or computer network, computer crashes, breach of security and encryption (provided beyond our reasonable control), power or electricity failure or unavailability of adequate power or electricity.
16. Governing Laws and Jurisdiction
This Privacy Policy, our services and the use of it is governed by the laws of India and the courts in Bangalore shall have exclusive jurisdiction over any disputes connected to our website or the services.
Select your country:
Connect with us:
Mobile app:
Support and useful information
