PRIVACY POLICY
PLEASE READ THIS PRIVACY POLICY CAREFULLY
1. OUR PRIVACY STATEMENT
The protection of your personal data is of great importance to Kuoni Travel Investments Ltd. (“Company”),
and its affiliates (together, the “JTB Europe Group”) as well as to JTB Corporation and its affiliates(together, the “JTB Group”). This privacy policy (the “Privacy Policy”) therefore intends to inform you about
how the Company, a Swiss company active in the provision of travel services, acting as data controller, andthe JTB Europe Group, collect and processes your personal data that you submit or disclose to us. We also act
as data processor when we process your personal data received or obtained through third-parties. We
process this personal data in accordance with the applicable EU and Member State regulations on dataprotection, in particular, the General Data Protection Regulation No 2016/679 (the “GDPR”).
We encourage you to read this Privacy Policy carefully. If you do not wish your personal data to be used by us
as set out in this Privacy Policy, please do not provide us with your personal data. Please note that in such acase, we may not be able to provide you with our services, you may not have access to and/or be able to usesome features of the Website, and your customer experience may be impacted.
If you have any queries or comments relating to this Privacy Policy, please contact dpo@jtb-europe.com
2. HOW DO WE USE YOUR PERSONAL DATA?
We will always process your personal data based on one of the legal basis provided for in the GDPR (Articles 6and 7). In addition, we will always process your sensitive personal data, for example, concerning your tradeunion membership, religious views, or health condition, in accordance with the special rules provided for inthe GDPR (Articles 9 and 10).

We may collect and process your personal data for the purposes set out below and disclose your personal
data to the JTB Europe Group affiliates and JTB Group affiliates for business purposes and also to companies
and our service providers who act as ‘data processor’ on our behalf. These purposes include:
a. Fulfilling the contract with you and legal obligations (Articles 6(1)(b) and (c) of the General Data
Protection Regulation (“GDPR”): In order for you to travel abroad, it may be mandatory as requiredby government authorities at the point of departure and/or destination to disclose and process yourpersonal data for immigration, border control and/or any other purposes. Also we need to provide
airlines/accommodation providers with your name, passport number, contact details, and otherrelated information in accordance with their terms and conditions. If you do not provide us with thispersonal data, we might not be able to offer our services to you.
b. Fulfilling your and our legitimate interests (Article 6(1)(f) of the GDPR): Where it is in both your andour benefit that we further process your personal data as part of our business administration,
maintaining service quality, customer care, business management, risk assessment/management,
security, and operation purposes.
c.

Consent: For marketing purposes and other similar data processes that may require yourauthorization for their processing (Article 6(1)(a) of the GDPR). We will usually inform you before
collecting your data if we intend to use your data for such purposes or if we intend to disclose yourpersonal data to any third party for such purposes. You can exercise your right to prevent suchprocessing by checking certain boxes on the forms we used to collect your data.

d. Explicit consent (Article 9(2)(a) of the GDPR): Information which is considered to be ‘sensitive
personal data’ under the GDPR. This personal data might include information necessary to arrange
bookings and travel plans, including your allergies, disabilities, and other relevant health information.
We collect it to provide you with our services, cater to your needs or act in your interest, and we are
only prepared to accept sensitive personal data on the condition that we have your positive consent.

2

We will process your data for these specified, explicit and legitimate purposes, and will not further process
the data in a way that is incompatible with these purposes. If we intend to process personal data originallycollected for one purpose in order to attain other objectives or purposes, we will ensure that you are
informed of this. We will keep your personal data for as long as it is necessary for us to comply with our legal
obligations, to ensure that we provide an adequate service, and to support our business activities (Article 5and 25(2) GDPR).
3. WHAT TYPES OF PERSONAL DATA DO WE USE?
For the purposes specified under this Privacy Policy, we will process the personal data specified above andother personal data as specified to you in our specific information notices.

We can obtain such personal data either directly from you when you decide to communicate such data to us(i.e., when you fill in forms or provide it to us by e-mail) or indirectly (when you provide us the information
via a third party, like a travel agent). We ensure that the personal data processed is adequate, relevant andlimited to what is necessary in relation to the purposes for which it is processed.
4. HOW DO WE SHARE YOUR PERSONAL DATA?
We may share your personal data with JTB Europe Group affiliates, JTB Group entities and with third parties
in accordance with the GDPR. Where we share your data with a data processor, we will put the appropriate
legal framework in place in order to cover such transfer and processing (Articles 26, 28 and 29). Furthermore,
where we share your data with any entity outside the EEA, we will put appropriate legal frameworks in place,notably controller-to-controller (2004/915/EC) and controller-to-processor (2010/87/EU) Standard Contract
Clauses approved by the European Commission, in order to cover such transfers (Articles 44 ff. GDPR).
Strategic Partners
Your personal data may be transferred to, stored, and further processed by strategic partners that work with
us to provide our products and services or help us market to customers. Your personal data will only be3

shared by us with these companies in order to provide or improve our products, services and advertising, asappropriate. If necessary, consent will be requested from you.
Service Providers
We share your personal data with companies which provide services on our behalf, such as hosting,
maintenance, support services, email services, marketing, auditing, fulfilling your orders, processing
payments, data analytics, providing customer service, and conducting customer research and satisfaction
surveys.
Corporate Affiliates and Corporate Business Transactions
We may share your personal data with all Company’s affiliates. In the event of a merger, reorganization,acquisition, joint venture, assignment, spin-off, transfer, or sale or disposition of all or any portion of ourbusiness, including in connection with any bankruptcy or similar proceedings, we may transfer any and all
personal data to the relevant third party.
Legal Compliance and Security
It may be necessary for us – by law, legal process, litigation, and/or requests from public and governmental
authorities within or outside your country of residence – to disclose your personal data. We may also disclose
your personal data if we determine that, due to purposes of national security, law enforcement, or otherissues of public importance, the disclosure is necessary or appropriate.
We may also disclose your personal data if we determine in good faith that disclosure is reasonably necessary
to protect our rights and pursue available remedies, enforce our terms and conditions, investigate fraud, orprotect our operations or users.
Data Transfers
Such disclosures may involve transferring your personal data out of the European Union, such as the UnitedStates, Japan, Singapore and India. Such transfer may take place for the purposes of providing you customer

4

services, executing your reservation with suppliers (e.g., airlines, hotels), and providing you with services atyour place of destination. For each of these transfers, we make sure that we provide an adequate level ofprotection to the data transferred, in particular by entering into standard contract clauses as defined by theEuropean Commission decisions 2001/497/EC, 2002/16/EC, 2004/915/EC and 2010/87/EU.
We will not use your personal data for online marketing purposes unless you are our customer, or you haveexpressly consented to such use of your personal data. You can change your marketing preferences at anytime by contacting us as detailed below.
5. OUR RECORDS OF DATA PROCESSES
We handle records of all processing of personal data in accordance with the obligations established by theGDPR (Article 30), both where we might act as a controller or as a processor. In these records, we reflect all
the information necessary in order to comply with the GDPR and cooperate with the supervisory authorities
as required (Article 31).
6. SECURITY MEASURESWe process your personal data in a manner that ensures their appropriate security, including protection
against unauthorised or unlawful processing, accidental loss, destruction or damage. We use appropriatetechnical or organisational measures to achieve this level of protection (Article 25(1) and 32 GDPR).
We will retain your personal data for as long as it is necessary to fulfil the purposes outlined in this Privacy
Statement, unless a longer retention period is required or permitted by law.
7. NOTIFICATION OF DATA BREACHES TO THE COMPETENT SUPERVISORY AUTHORITIESIn case of breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised
disclosure of, or access to, personal data transmitted, stored or otherwise processed, we have themechanisms and policies in place in order to identify it and assess it promptly. Depending on the outcome ofour assessment, we will make the requisite notifications to the supervisory authorities and communications
to the affected data subjects, which might include you (Articles 33 and 34 GDPR).

5

8. PROCESSING LIKELY TO RESULT IN HIGH RISK TO YOUR RIGHTS AND FREEDOMS
We have mechanisms and policies in place in order to identify data processing activities that may result inhigh risk to your rights and freedoms (Article 35 of the GDPR). If any such data processing activity isidentified, we will assess it internally and either stop it or ensure that the processing is compliant with theGDPR or that appropriate technical and organisational safeguards are in place in order to proceed with it.
In case of doubt, we will contact the competent Data Protection Supervisory Authority in order to obtain
their advice and recommendations (Article 36 GDPR).
9. YOUR RIGHTS
You have the following rights regarding personal data collected and processed by us.
–Information regarding your data processing: You have the right to obtain from us all the requisite
information regarding our data processing activities that concern you (Articles 13 and 14 GDPR).

–

Access to personal data: You have the right to obtain from us confirmation as to whether or not
personal data concerning you are being processed, and, where that is the case, access to thepersonal data and certain related information (Article 15 GDPR).

–

Rectification or erasure of personal data: You have the right to obtain from us the rectification of
inaccurate personal data concerning you without undue delay, and to complete any incomplete
personal data (Article 15 GDPR). You may also have the right to obtain from us the erasure of
personal data concerning you without undue delay, when certain legal conditions apply (Article 17GDPR).

–

Restriction on processing of personal data: You may have the right to obtain from us the restrictionof processing of personal data, when certain legal conditions are met (Article 18 GDPR).

–

Object to processing of personal data: You may have the right to object, on grounds relating to yourparticular situation, at any time to processing of personal data concerning you, when certain legal
conditions are met (Article 21 GDPR).

6–

Data portability of personal data: You may have the right to receive your personal data in astructured, commonly used and machine-readable format, and have the right to transmit those data
to another controller without our hindrance, when certain conditions are met (Article 20 GDPR).

–Not to be subject to automated decision-making: You may have the right not to be subject toautomated decision-making (including profiling) based on the processing of your personal data,
insofar as this produces legal or similar effects on you, when certain conditions are met (Article 22GDPR).

If you intend to exercise such rights, please refer to the contact section below.
If you are not satisfied with the way in which we have proceeded with any request, or if you have any
complaint regarding the way in which we process your personal data, you may lodge a complaint with a Data
Protection Supervisory Authority.
10. CHILDREN
Our products and services are primarily directed at adult customers. However, we may knowingly collect andprocess personal data on children under sixteen (16). On these occasions, we will take account of this event
when processing the personal data of children and implementing the legal basis for such processing. Forexample, where the processing of personal data of children is based on their consent, we will seek theconsent of parents, tutors, or other adults holding parental responsibility over children.
11. LINKS TO OTHER SITES
We may propose hypertext links from the Website to third-party websites or Internet sources. We do notcontrol and cannot be held liable for third parties’ privacy practices and content. Please read carefully theirprivacy policies to find out how they collect and process your personal data.

712. UPDATES TO PRIVACY POLICY
We may revise or update this Privacy Policy from time to time. Any changes to this Privacy Policy will become
effective upon issuing of the revised Privacy Policy. If we make changes which we believe are significant, wewill inform you through the Website to the extent possible and seek your consent where applicable.
CONTACTFor any questions or requests relating to this Privacy Policy, you can contact us by email dpo@jtbeurope.com.
The contact details of the Data Protection Officer are as follows:
Email: dpo@jtb-europe.com
Phone: +41 44 325 21 11
Physical Address:

Kuoni Travel Investments Ltd.
Attn. of Data Protection Officer
Elias Canetti-Street 28050 Zürich
Switzerland* *8