PRIVACY NOTICE PURSUANT TO SEC. 13 OF EU REGULATION NO. 679/2016 (“GDPR”)
BookMyExperiences (hereinafter, “BME” or the “Data controller” ”we”), a service provided by KMTH Trading LLC, takes the protection of your personal data as the Data Controller very seriously. We treat your personal data confidentially and in accordance with the provisions of data protection law. This privacy statement informs you about how to what extent and for what purposes we process the personal data of customers using the BookMyExperiences website or the subdomains of the same and mobile App.
Version No.: 1.0
I. SUBJECT OF DATA PROTECTION
Subject of data protection is personal data. Data is personal if it can be assigned to an identified or identifiable natural person. This includes information such as names, addresses, email addresses, and telephone numbers. The data is provided directly by the Data subject when accessing the website or the mobile app or in the particular case where the Data subject accesses the Website or the App through a third-party company such as Facebook, they can access credentials.
II. COLLECTION, PROCESSING AND USE OF PERSONAL DATA ON REQUEST
The use of our website and App is generally possible without providing personal data. You are neither obliged to visit this website nor to provide any personal data. If you do not provide us with personal data, you might not be able to use individual functionalities of this website. Otherwise there will be no consequences for you. The collection of users’ personal data on our site is always on a voluntary basis, except in the cases described in the following. We would like to point out that data transmission over the Internet (e.g. communication by email) can have security gaps. Complete protection of data against access by third parties is not possible.
We collect, process and use your personal data, which you have provided us with when booking or registering an account for our member area, to the extent necessary in each case for the following purposes:
1. Registration and execution of the contract via Website or App
- Data that you provide when setting up an account, such as your name, email address, telephone number, mobile phone number, address and data which will be provided depending on the service you use
- We collect, process and use transaction data regarding your activities on the websites (e.g. purchases, content that you generate or that relates to your account)
- Billing and other data you provide for the purchase
- Data collected in the context of reviews, chats and correspondence on the website or by email, fax and post
- Other personal data that we may ask you to provide for special purposes
- If you voluntarily provide us with additional personal data during registration, this data will also be used for the implementation of the usage relationship.
2. Contact establishment
If you provide us with personal data for the purpose of contacting us, this data will be used by us as this is necessary for the purpose of the respective communication.
BookMyExperiences may process and use your personal data in the following conditions:
- marketing purposes, e.g. to send emails with general information or of an advertising nature (newsletter), specific and promotional communications about discounts, offers, events or services similar or different to those previously purchased by you only with your explicit consent.
- profiling activities: that is evaluating your tastes, preferences and consumption habits by inviting you to participate in market surveys, only with your explicit consent.
- communication of your personal data to BookMyExperiences third-party partners for the purpose of delivery of commercial and promotional communications by the aforementioned companies, only with your explicit consent.
You can revoke the declarations of consent granted to us in this regard at any time with effect for the future. If you wish to opt-out of receiving these emails from us, please follow the instructions contained in an applicable email you receive from us, which will allow you to opt-out of receiving these types of email communications from us. In addition, you can object to this use - insofar as we use your personal data within the legally permissible framework for e.g. postal marketing measures. In both cases, an email to the following address is sufficient: firstname.lastname@example.org.
The legal basis for data processing is the execution of a contract and the provision of the requested service in the legitimate interest of BookMyExperiences only after your explicit consent.
4. The information you provide to Payment Processors
All payments made are processed by a PCI/DSS-compliant (these are payment card industry security standards) payment processing service engaged by us. All information collected by these third-party providers for purposes of processing your payments is not available to us unless you have otherwise provided this information to us in connection with your use of the Websites or our products and services.
5. Aggregate Information
We may share your information on an anonymous, aggregate basis with affiliated or unaffiliated third parties like the search engine service that provides information on tickets and offers, museums, cultural institutions, theaters and tour operators (hereinafter, jointly called, the “Suppliers”) for:
- sale of tickets, or vouchers to redeem tickets, issued by Suppliers or other third parties in order to access the related premises and exhibitions and/or to use leisure/travel services offered by Suppliers (hereinafter, the “Supplier Services”)
- sale of tickets for leisure/travel services offered directly by BookMyExperiences (including travel packages) and additional services with respect to Supplier Services
- publication of and access to reviews written by you in relation to services, attractions and trips offered on the Website
- service communications with Suppliers in relation to the Supplier Services
- statistical purposes on anonymized data
While this information will not identify you personally, in some instances these third parties may be able to combine this aggregate information with other data they have about you, or that they receive from third parties, in a manner that allows them to identify you personally (mosaic theory).
III. DATA PROCESSING TO ENABLE THE USE OF THE WEBSITE
When you visit our website, we collect the necessary data to enable you to use it (usage data). This includes your IP address and data about the start, end and subject of your use of the website as well as any identification data (e.g. your login data when you log into a secure area). This data is used to provide and design the service according to users’ preference. This data is always deleted as soon as it is no longer required and if there are no storage obligations. For information on the processing of pseudonymous usage profiles, see item VII.
BookMyExperiences hereby informs you that your data can be processed by computer, telematic, paper and manual instruments, in compliance with the confidentiality and safety rules provided by the law. In case of expressed consent to the profiling activity, an automated activity will allocate you into a category of subjects with homogeneous characteristics on the basis of the services previously used, any market surveys that may have been completed and the relevant demographic class. The provision of the Data is optional.
The Data shall not be disseminated without your explicit consent.
- Within the BookMyExperiences organization, the Data may be processed by the relevant offices entrusted with the execution of certain processing activities (i.e. Administration, Commercial, Marketing, IT). We may share the minimum personal data necessary with other companies in the TUI Group, for example, to provide the products and services you requested; to manage and improve our products, services and day-to-day operations; to help to personalize your experience; where appropriate, to make contact and interact with you; and, if allowed and appropriate, for marketing or market research purposes.
- We may share personal data with an organization we sell or transfer (or enter into negotiations to sell or transfer) any of our businesses or any of our rights or obligations under any agreement we may have with you. If the transfer or sale goes ahead, the organization receiving your personal data can use your data in line with this Privacy Notice.
- In case of purchase of Supplier Services, BookMyExperiences may communicate to the Supplier the Data strictly necessary to ensure the provision of Supplier Services in Italy and abroad (such as, the name of user, email address and other booking information required by Supplier).
IV. DATA PROCESSING FOR MOBILE APPLICATIONS AND DEVICES
When you download data, use our mobile applications or access one of our websites optimized for mobile devices, we may collect information about you and your mobile device as described above in this statement. This can include location data, for example, if you release it for our mobile application. We use this information to provide you with location-based services such as search results and other personalized content, if approved by you and your device. You can control or deactivate location services from the settings menu on most mobile devices. If you have questions about deactivating location services on your device, we recommend that you contact your mobile service provider or the manufacturer of your device.
If we collect other personal data that is transferred as a result of your use of our mobile applications or your access to our website with a mobile device, we will obtain your express consent in advance.
V. DATA COLLECTED FROM OTHER SOURCES
We may obtain additional information about you from third parties to supplement our account information to the extent permitted by law. This includes demographic and navigation data, credit check data and other information from credit agencies, to the extent permitted by law.
VI. DATA STORAGE
The data is stored on servers located within the European Union.
- Any Data collected from you shall be retained for the entire duration of your registration to BookMyExperiences Website or App, or until your request for deletion of the same. The data shall be retained for the period of time that is necessary for the provision of the purchased or requested services, and subsequently for no longer than the statutory limitation period.
- Any Data collected for the purposes of processing a service shall be retained unless you explicitly withdraw your consent regarding the publication of reviews or requests and the deletion of your Data.
- Any Data collected for the purposes of processing a service shall be retained until you withdraw consent to the marketing and profiling activities from BookMyExperiences or its partners, or present an explicit request for deletion of the Data; except for cases where the Data controller needs to retain such Data to defend its rights in relation to any disputes that are on-going at the time of the request, or upon formal request from public authorities.