Traveller Privacy Notice

This Privacy Notice ("Notice") applies to personal information that Duffel Travel US Inc., or its affiliates (collectively, "Duffel," "we," "us," or "our") collects when you access and use the flight, hotel, and other travel booking services we make available ("Services") through Meta's AI travel assistant or any other Meta interface ("Meta Interface"). This Notice also covers rights and choices related to your personal information.

When you interact with the Meta Interface, Meta may collect, use, disclose, or otherwise process personal information about you in accordance with its own terms and privacy notice. We do not control, and are not responsible for, Meta's collection, use, or disclosure of personal information through the Meta Interface or other Meta products and services. This Notice applies only to personal information that we collect, use, disclose, or otherwise process in connection with the Services.

PERSONAL INFORMATION WE COLLECT

We collect personal information in different ways including:

• Directly from you. This includes when you make an account, sign up to get our emails, use our Services, or contact us.

• Automatically. This includes through cookies, server logs, and other tools on our platform or website.

• From other sources. These can include our affiliates, vendors, social media, publicly available sources, and other companies.

The following are a few examples of our collection and use of personal information:

Context	Examples of Personal Information	Primary Purpose
Booking Information	We may collect your (and anyone on whose behalf you book) name, frequent flyer or other loyalty details, passport number, redress control number, country of citizenship or residence, booking reference number, and itinerary when you book though our Services. We may also collect contact information for people you add to, or notify of, your reservations or itineraries through our Services.	We use your personal information to perform our contract with you and allow our travel partners to complete and administer bookings. We use your personal information where required to comply with legal obligations. We also have an interest in providing personal information to people you associate with your reservations or itineraries.
Travel Partners Information	We collect the name and contact information of our travel partners (e.g. hotels and airlines) and their employees with whom we may interact.	We have an interest in contacting our travel partners and communicating with them about business activities such as projects, services, and billing.
Demographics	We collect personal information, such as your age, gender, marital status, or your region.	We have an interest in understanding our users and potential customers better. Our hotel and airline partners may also require us to collect this information as part of the booking.
Location Information	We may collect information about your location, such as information from your IP address or geolocation information.	We have an interest in understanding where our users and customers are located and providing relevant products and services.
Email Interactions	If you receive email from us, we may use tools to capture when you open our message, click on links or banners in it, or make purchases after receiving an email.	We have an interest in understanding how you engage with our messages.
Feedback/Support	If you provide feedback or contact us for support, we collect your name and email, as well as other information that you send.	We have an interest in receiving and acting upon feedback.
Mailing List (Email or Mail)	When you sign up for our mailing lists, we collect your contact information.	We have an interest in sharing information about our products and services. Where required by law we will ask for your consent before communicating with you.
Surveys	We collect personal information you share through surveys. If a third-party offers a survey, the third party's privacy notice also applies to the collection, use, and disclosure of your personal information.	We have an interest in understanding your opinions.
Use of our Services	We may use technology (e.g. a cookie or a pixel) to learn how you engage with our websites. This may include which links you click or what you type into our online forms. We may also track your IP address and personal information about your device.	We have an interest in operating our Services. We may also use your personal information to gather analytics and learn your preferences. We may also use this personal information to help detect and prevent fraud. Where required by law, we base the use of these technologies upon consent.
Website Targeted Advertising	We may let third parties place tracking technology on our websites (e.g. a cookie or a pixel). The third party might also collect personal information over time and across other websites. Among other things, they may use this personal information to serve ads tailored to your interests, which may include ads about our products or services.	Where required by law, we base the use of third-party tracking technologies upon consent and users should see our cookie preference centre for more information.

Sensitive Information Disclosure. We collect the following categories of sensitive personal information (as defined under relevant laws): social security, driver's license, state or provincial identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; and personal information collected and analyzed concerning a consumer's health. We collect this personal information to process transactions, comply with laws, manage our business, or provide services. Note that we do not use such personal information for any purposes that are not identified within Cal. Civ. Code § 1798.121. We do not "sell" or "share" sensitive personal information for cross-context behavioral advertising, although we may transfer it to third parties when you instruct us to do so. When that occurs, third parties will use it for the purposes indicated in their privacy notices.

If you are in Canada, we collect, use, and disclose your personal information with your consent, except where applicable law permits or requires otherwise. Your consent may be express or implied, depending on the circumstances and the sensitivity of the personal information. Where required, including for certain sensitive information or certain tracking technologies, we will seek express consent.

HOW WE USE PERSONAL INFORMATION

We also use personal information to:

• Identify you when you use our services.

• Book reservations.

• Complete transactions.

• Improve or create services and products.

• Streamline checkouts.

• Conduct analytics.

• Connect with you (e.g., addressing your requests, inquiries, issues, or feedback).

• Market our products or services.

• Market the products or services of our business partners.

• Find and prevent malicious, deceptive, fraudulent, or illegal activity.

• Find and prevent security incidents.

• Enforce our policies and agreements.

• Debug, find, and fix errors that impair our website and services.

• Comply with legal or regulatory obligations.

• Establish or exercise our rights

• Defend against legal claims.

• Manage our relationships.

• For other reasons with your consent.

The sections above describe our main purposes in collecting your personal information, but often we have multiple purposes. For instance, if you make a reservation, we may collect your personal information to perform our contract with you. We also have a legitimate interest in maintaining that personal information so that we can easily address questions about a reservation. As a result, our collection and processing of your personal information is based in different contexts on your consent, our need to perform a contract, our legal obligations, and/or our legitimate interest in conducting our business.

To the extent we store and use deidentified personal information, we will not try to reidentify the information, except to test our deidentification methods. If we share deidentified personal information we will obligate the recipient not to try to reidentify the personal information.

HOW WE SHARE DATA

In addition to the specific situations discussed elsewhere in this Notice we may share personal information in the following situations:

• Travel Partners. We share personal information (including travel preferences, contact and payment details, booking IDs, relevant reviews, etc.) with travel-related partners such as hotels, airlines, car-rental companies, etc. If you reach out to us with an inquiry about your booking, we may contact the travel partner to assist us with your request. Depending on the payment method used for your booking, we may need to forward your payment details to the travel partners to secure your booking, facilitate check-in, and/or for payment processing. Please note that travel partners may contact you to obtain additional personal information if and as required to facilitate your booking or to provide the travel or associated services. They are independently responsible for their compliance with applicable personal information protection laws, and you should refer to the relevant travel partners' privacy notice for more information about how they process your personal information for more information.

• Affiliates and Acquisitions. We may share personal information with our affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If a company acquires or enters negotiations to acquire our company, our business, all of our assets, or part of our assets, we may share personal information with that company.

• Other Disclosures without Your Consent. We may share personal information to cooperate with law enforcement, participate in a legal process, or for legal compliance. We may share your personal information to establish or exercise our rights, to defend against legal claims, to investigate, prevent, or act on possible illegal activities, threats to safety of person or property, or a violation of our policies.

• Service Providers. We may share your personal information with service providers. Service providers may help us to run our website, conduct surveys, provide technical support, process payments, fulfill orders, and more. Some of these service providers may be located outside of your jurisdiction, including in Canada, and the United States. For more information about the way in which our service providers treat personal information, please contact us as set out in the "Contact Information" section below.

• Professional Services. We may share personal information with our professional service providers, such as auditors or lawyers.

• Other Disclosures with Your Consent. We may share your personal information with third parties when you consent or direct us to.

Some laws require us to disclose whether the following categories of personal information are collected and shared with third parties for a "business purpose." The table below indicates the categories of personal information we collect and transfer in a variety of contexts. We do not "sell" your personal information for money, nor do we "share" it for cross context behavioral advertising. We also do not process your personal information for targeted advertising, as that term is defined under applicable law.

Category of Personal Data	Disclosure Personal Data for a Business Purpose – Category of Recipients
Identifiers – this may include information such as name, alias, postal address, unique personal identifier, online identifier, email address, or account name.	Affiliates or subsidiaries. • Business partners. • Data analytics providers. • Internet service providers. • Joint marketing partners. • Operating systems and platforms. • Other Service Providers. • Payment processors and financial institutions. • Professional services organizations, this may include auditors and law firms. • Social networks.
Government Issued Identification – this may include things like social security number, driver's license number, or state issued identification number.	Affiliates or subsidiaries. • Business partners. • Other Service Providers. • Professional services organizations, this may include auditors and law firms.
Financial Information – this may include bank account number, credit card number, debit card number, and other financial information.	Affiliates or subsidiaries. • Business partners. • Other Service Providers. • Payment processors and financial institutions. • Professional services organizations, this may include auditors and law firms.
Health Related Information – this may include medical information, mental or physical condition or treatment, or health insurance information.	Affiliates or subsidiaries. • Business partners. • Other Service Providers.
Characteristics of protected classifications – this may include age, sex, race, ethnicity, physical, or mental handicap, etc.	Affiliates or subsidiaries. • Business partners. • Other Service Providers. • Professional services organizations, this may include auditors and law firms.
Commercial information – this may include information about products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Affiliates or subsidiaries. • Business partners. • Data analytics providers. • Joint marketing partners. • Other Service Providers. • Payment processors and financial institutions. • Professional services organizations, this may include auditors and law firms.
Internet or other electronic network activity information – this may include browsing history, search history, and information regarding an individual's interaction with an internet website, app, or ad.	Affiliates or subsidiaries. • Data analytics providers. • Internet service providers. • Joint marketing partners. • Operating systems and platforms. • Other Service Providers. • Professional services organizations, this may include auditors and law firms.
Geolocation personal information – this could include precise or non-precise geolocation information.	Affiliates or subsidiaries. • Business partners. • Other Service Providers. • Professional services organizations, this may include auditors and law firms.
Audio, electronic, visual, thermal, olfactory, or similar information	Affiliates or subsidiaries. • Business partners. • Other Service Providers. • Professional services organizations, this may include auditors and law firms.
Professional or employment-related information – this includes, for example, information submitted by job applicants.	Affiliates or subsidiaries. • Other Service Providers. • Professional services organizations, this may include auditors and law firms.
Non-public education information (as defined in the Family Educational Rights and Privacy Act) – this includes, for example, information submitted by job applicants.	Affiliates or subsidiaries. • Other Service Providers. • Professional services organizations, this may include auditors and law firms.
Inferences drawn from any of the information listed above	Affiliates or subsidiaries. • Business partners. • Data analytics providers. • Joint marketing partners. • Other Service Providers. • Professional services organizations, this may include auditors and law firms.
Additional categories of personal information described in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) – this may include signature, physical characteristics, or description, insurance policy number.	Affiliates or subsidiaries. • Business partners. • Other Service Providers. • Payment processors and financial institutions. • Professional services organizations, this may include auditors and law firms.

YOUR CHOICES

Some jurisdictions give you the right to make the following choices:

• Access. You may request access to your personal information or confirmation that we have personal information about you. In certain limited cases, you may ask to receive access to your personal information in a portable, machine-readable form.

• List of Third-Party Recipients. You may request a list of specific third parties to which we have disclosed personal information. Some areas also allow you to obtain a list of the categories of third parties to which we have disclosed personal information. You can find that information in the table above under the "How We Share Personal Information" section.

• Change. We allow you to change your account profile via the Services. If the Services do not permit you to update or correct certain information, you can ask us to do so by contacting us at the address below. We may keep historical personal information in our backup files as permitted by law.

• Deletion. You may ask us to delete your personal information. If required by law, we will grant such a request, but note that in many cases, we must keep your personal information to comply with legal obligations, resolve disputes, enforce agreements, or for other business purposes.

• Promotional Emails. You may provide us with your email address to allow us to send newsletters, surveys, offers, or other promotional content, as well as targeted offers from third parties. You can stop receiving such emails by following the unsubscribe instructions at the bottom of those emails. If you choose not to receive such emails, we may still send you service-related communications.

• Revocation Of Consent. Where we process your personal information based upon consent, you may revoke consent. Note, if you revoke consent for processing personal information, we may no longer be able to provide you some types of services.

• Information about Automated Decisions. Where we render a decision about you based exclusively on automated processing of your personal information, we will inform you about that decision and you may request further information about how the decision was made and submit comments to us about the decision.

• Lodge a complaint. You may have the right to lodge a complaint with a regulatory authority.   

• Opt-out of Website Targeted Advertising. We may conduct website-based targeted advertising with your consent. If you consent, you will be able to withdraw your consent or opt-out of online targeted advertising (e.g. cookies) via our cookie preference centre.

Not all the rights above are absolute, and they do not apply in all circumstances. We may limit or deny a request because the law permits or requires us to. We will not discriminate against individuals who exercise a privacy right.

Submitting Requests

You may exercise the above rights through by contacting us at the contact information provided in the "Contact Information" section. If you disagree with our denial of a request, you may appeal our decision by contacting us with the subject line "Appeal."

We will require you to prove your identity when making most types of requests. We may verify your identity by phone or email. Depending on your request, we will ask for information such as your name, the last reservation you placed with us, or the date of your last reservation from us. We may also ask you to send us a signed declaration confirming your identity.

In some circumstances, you may designate an authorized agent to exercise rights on your behalf. If you are an authorized agent, you must provide proof of your identity and the consumer on behalf of whom you are submitting the request, together proof that you are authorized to act on their behalf.

HOW WE PROTECT AND RETAIN PERSONAL INFORMATION

We use commercially reasonable efforts to protect the confidentiality and security of personal information we process, including by maintaining appropriate administrative, technical, and physical security safeguards. Such safeguards may include measures to protect against unauthorized access, alternation, disclosure, or destruction of personal information. However, despite these efforts, since no system or security measure is completely secure, we cannot guarantee the security of personal information during its transmission or its storage.

If you create an account via the Services, you are responsible for selecting a unique and complex password and keeping it confidential. You are responsible for any access to or use of your account by someone who has obtained your password, whether or not you approved of such access or use. You must notify us of unauthorized use of your password or account immediately.

We will retain each category of your personal information for as long as necessary to fulfill the purposes described in the "How We Use Personal Information" section above, unless otherwise required by applicable laws. Criteria we will use to determine how long we will retain your personal information include whether: we need your personal information to provide you with our Services; we continue to have a relationship with you; you have requested information or services from us; we have a legal right or obligation to continue to retain your personal information; we have an obligation to a third party that involves your personal information; our retention or recordkeeping policies and obligations dictate that we retain your personal information; or we have another business purpose for retaining your personal information.

TRANSMISSION OF PERSONAL INFORMATION TO OTHER COUNTRIES

We and our service providers may process your personal information from time to time across borders, including in Canada and in the United States. The privacy laws of those other countries might be different from the laws of the jurisdiction in which you reside and might permit the government, government agencies, courts, law enforcement agencies and security authorities in those countries to access your personal information without notice. Any such transfers will be undertaken in accordance with this Notice and in compliance with applicable laws. For more information about our personal information processing practices, please contact using the information provided below.

THIRD-PARTY APPLICATIONS/WEBSITES

We may provide links to websites and other third-party content or services that we do not own or operate, and we have no control over the privacy practices of those websites or services. For details about such third parties' privacy practices, see their privacy notices.

CHANGES TO THIS PRIVACY NOTICE

We may change our Notice and privacy practices. Changes to this Notice will be published via the Services and, if changes are material, we will notify you via email. Our Notice shows "effective" and "last updated" dates below. The effective date is the date the current version took effect. The last updated date is the date the current version was last substantively changed.

CONTACT INFORMATION

If you have questions, comments, or complaints on our privacy practices, or if you need to access this Notice in a different form due to a disability, please contact us. We will try to address your requests and provide you with additional privacy-related information.

• Data Protection Officer
• [email protected]
• +1 (888) 771-2254