1. Who is the controller of your personal data?

As indicated in the General conditions of use of the Website, the services offered through this Website are provided by BravoNext S.A., which is the owner of this Website, by other companies belonging to lm group, and/or by their partners who provide the related services. When this Privacy Policy mentions "Company", "we", "us", "our" or "Data Controller", it refers in particular to:

• for the offers’ comparison and booking services with regard to the products "Flights", "Flight + Hotel", “City Breaks” and “Holidays”, available on this Website:

the controller for the processing of Users’ and/or Customers’ personal data is Red Universal de Marketing y Bookings Online, S.A.U., a Spanish company belonging to the lm group, listed in the Madrid business register under no. CIF A-82602871 and with registered office at Paseo de la Florida 2 Oficina exterior 2 - 28008 Madrid – Spain.

We, being an entity located in Spain, are subject to Spanish law regarding the protection of personal data. For that reason, we undertake to comply with the obligations imposed by the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Spanish regulations, including the Organic Law 3/2018, of December 5, on Data Protection and Guarantee of Digital Rights.

You can read the applicable Privacy Policies at the following links:

“Flights”: https://www.lastminute.ie/en/info/privacy.html?purpose=contract-management&touchPoint=checkout-flight

“Flight + Hotel”: https://www.lastminute.ie/en/info/privacy.html?purpose=contract-management&touchPoint=checkout-dp

“City Breaks”: https://www.lastminute.ie/en/info/privacy.html?purpose=contract-management&touchPoint=checkout-dp

“Holidays”: https://www.lastminute.ie/en/info/privacy.html?purpose=contract-management&touchPoint=checkout-dp 

• for the offers’ comparison and booking services with regard to the product "Hotels" as well as for the service "My lastminute.com", available on this Website:

the controller for the processing of Users’ and/or Customers’ personal data is BravoNext, S.A., a Swiss company belonging to the lm group, listed in the Ticino business register under no. CHE - 115.704.228 and with registered office at Vicolo de’ Calvi 2 - 6830 Chiasso, Switzerland. Furthermore, we inform you that, for compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) purposes only (Art. 27 GDPR),  Bravonext has designated as its EU representative Viaggiare SRL., an Italian company belonging to the lm group, listed in the Italian Chamber of Commerce - Milan under VAT identification no. IT04403760962 and with registered office at Via del Don, 3, 20123 Milan, Italy.We, being an entity located in Switzerland, are subject to Swiss law regarding the protection of personal data. For that reason, we undertake to comply with the obligations imposed by the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Swiss Federal Act on Data Protection of 19 June 1992 (FADP). In the same vein, we inform our Users and/or Customers that the Decision of the Commission of 26 July 2000 in accordance with Directive 95/46/CE of the European Parliament and the Council relating to the adequate level of protection for personal data in Switzerland declared that, in Switzerland, the laws guarantee an adequate level of protection in accordance with Directive 95/46/CE.In accordance with Swiss Federal Act on Data Protection of 19 June 1992 and with Article 45 of the Swiss Federal Act on the Supervision of Insurance Companies of 17 December 2004 (FASIC) we inform our Users and/or Customers that their personal data is processed and kept by the Company in the manner and for the means as follows, in accordance with the LPD and LSA.

You can read the applicable Privacy Policies at the following links:

“Hotels”: https://www.lastminute.ie/en/info/privacy.html?purpose=contract-management&touchPoint=checkout-hotel

“My lastminute.com” service: https://www.lastminute.ie/en/info/terms-conditions-my-bookings/ 

• With regard to the offers’ comparison and booking services related to the “Flights - Multi-city” and “Cars” products, which are available on this Website, we inform you that these services are provided by third parties and that your personal data will be processed by them in their capacity as data controllers in accordance with their respective privacy policies, which are available in the booking process of each product/service offered.  

2. What categories of your data do we collect and use?

When you visit the Website and use our Comparison Service (you as a "User") or then purchase or register to our services (you as a "Customer")  we collect the categories of personal data as follows:

2.1. Personal data provided by you

• The personal data that you share with us including when you register for an account, subscribe to marketing communications and which you provide to us when using our services, downloading our app, including the information entered into our booking platform and included in your comments, reviews or messages sent via telephone to our Customer Care Team,  or through the Live Chat or through social media channels. 

•  More specifically:  

• When you book with us, you may provide us with information such as: 

• Passenger information, passport details, contact details, payment details (i.e. credit data, billing address, account information), date of birth etc. 

• Information about your purchases, including what you booked, when and where you booked it and how you paid for it.

• Special categories of personal data, for example, relevant medical data and any special dietary or disability requests, so information concerning your health or revealing religious, philosophical or sexual orientation that you might voluntary provide us in the course of making a booking by selecting the box "special transportation need" and filling in the empty field or by other means, such as via telephone to our Customer Care Team or through the Live Chat or at any moment when making a booking.  We will use the special categories of personal data only as strictly necessary to fulfil your request. Where we need to process this data, we will only do it if we have your explicit consent, in accordance with Art.6.1.a) and Art. 9.2 GDPR or if permitted by regulations. 

• When you contact us or we contact you through the Live Chat, the Customer Care Team via email, post and/or phone or through social media  we may collect: personal data you provide when you connect with us, including your name, username, phone number, email. 

• When you take part in surveys or questionnaires about our services you may provide us with your contact details, your feedback and contributions to customer surveys and questionnaires. 

• When you subscribe to the personalised marketing services under p.3 - F of this privacy policy you may provide us with: Your personal details, information about your purchases, including what you booked, information about when you click on our adverts, the way you access the website, including IP address, online identifiers and browsers details. You may also provide us with information about your bookings, your browsing behaviour or your personal interests. Please note that some of this information might be collected automatically in accordance with p. 2.2. 

• When you register for an account into the Personal Area, or you use your Account you may provide us with: your personal details such as your name, surname, email, address, phone number, profile picture and your login information as your email and the password you choose. Please, check p. 2.3. of this privacy policy in case you register or access the Personal Area services using your social network credentials. Please, note that when you sign into your registered personal account, you will remain logged-in to the Personal Area page for a period of sixty days or until you choose to log out of your account. The company providing this service on all the websites within the lm group is BravoNext, S.A. a Swiss company belonging to lm group, listed in the Commercial Register of Canton Ticino under Identification number CHE-115.704.228 and with registered office at Vicolo de’ Calvi 2 - 6830 Chiasso, Switzerland. Before completing the registration process, you must confirm that you have read and accept the specific Privacy Policy and Terms and Conditions of BravoNext, S.A. for this service. 

• When you download and use our app: We do not collect directly personal details from you. However, please, note that some information will be share with Facebookp. 11.2 of this Privacy Policy). By installing our App you declare that you have read and accept the Privacy Policy and Terms and Conditions of our App.
  

• When you consent to take part in promotions, competitions, contests you may provide us with: your personal details, including your address, email or phone number or eventually any other data that may be necessary to take part on the specific case. We will inform you about the privacy policy of the specific promotions, competitions or contests as soon as the promotions start.

•  When you consent to be subscribed to our marketing communications via WhatsApp, you may provide us with: your name and phone number. Before subscribing to marketing communications via Whatsapp you have to read and accept the specific privacy policy for the WhatsApp communications. 

• Personal data you provide about other individuals: If you plan to submit someone else's personal data to us, for instance when booking on their behalf, you should only provide us with that third party's details with their consent and after they have been given access to this Privacy Policy. When submitting data about other individuals you declare you have their consent 

• Personal data about children: Please note that we may collect and use the information of children only as provided by their parent or guardian or with their consent. If we become aware that we have processed information of a child without the valid consent of a parent or guardian, we reserve the right to delete it. 

The provision of the above personal data, where requested, is necessary for the adequate performance of the contract between you and us and to allow us to comply with our legal obligations except when we rely on consent as legitimate basis for processing and or our legitimate interest. Without it, we may not be able to provide you with all the requested services.

It is important that all the personal data you give us is correct and accurate. This includes, by way of example only, ensuring that we have your correct contact (including email) details at all times. 

2.2. Personal data collected automatically from our Website, on the phone, from communication we send, and/or  from third parties

• We collect information about your visits to and use of the Website, such as information about the device and browser you are using, your IP address or domain names of the computers connected to the Websites, uniform resource identifiers for requests made, the time of request, the method used to submit the request to the server, the size of the archive obtained as a response, the numerical code indicating the status of the response given by the server (correct, error, etc.) and other parameters relative to the operating system and the computer environment used, the date and time that you visited, the duration of your visit, the referral source and website navigation paths of your visit and your interactions on the Website including the Services and offers you are interested in. Please note that we may associate this information with your account.  

See the cookies section of this Privacy Policy (9. Information about cookies) for further information on the purposes for which we collect and use this information. Please note that, your personal information may also be linked to Cookies to i.e. enable the storage of your travel searches on your Personal Account when you are registered to the service and/or collect information on how you use our product and services.

• We may record or monitor calls to and from our Customer Care Team for contractual reasons, quality control purposes, analytics, for staff training and/or to protect us in the event of a legal dispute. Any personal data obtained from you during the call will be treated in accordance with this Privacy Policy.

• We may use this style to also understand how you engage with communication material that we send to you, such as emails, including the action you take such as any links in them that you click on, your duration and frequency of your engagement with the email.  

• To the extent permitted by the applicable law wherein we receive additional information about you, such as fraud detection information and warnings from third party service providers and/or partners for our fraud prevention activities. 

2.3. Other sources of personal data: Facebook log-in, Google Sign-in and Apple Sign-in when registering and/or using your account into the Personal Area 

You may create and use the Personal Area through our login system or you might choose to link, connect or login to the Personal Area with a third party service (e.g., Facebook, Google and Apple), the third party service may send us information such as your registration and profile information (i.e. user name, user ID associated with your social media account, picture, email), and any other information you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network and those third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and services before linking or connecting them to our Website. 

Please also note that by using the service provided by the third party, the information may be  transferred or transmitted or stored and processed by such third party in the United States or other countries outside the EU, in accordance with the privacy policies linked below. As a consequence, certain extra-EU national programmes may enable public authorities to have access to your personal data for security purposes. 

In particular:  

Facebook log-in 

• When you choose to register and/or log-in using Facebook to connect to our platforms of services on our Website, either when you register or after you have registered, you agree to share your name, email, profile picture, user ID associated with your social media account with us. We will also record the fact that you have registered through Facebook. 

Information about your activity on our Website may be sent to Facebook, when you have an account with them and choose to use the social media login feature to register with us. 

The social media platform may receive information, such as your IP and the browser URL.

For more information on the collection and use of data by Facebook, about your rights in this regard and ways to protect your privacy, see the privacy policy of Facebook https://www.facebook.com/policy.php 

Google Sign-in 

• When you log-in using Google to connect to our platforms or services you agree to share your email and your picture profile with us. We will also record the fact that you have registered through Google. 

Google’s platform may receive information, such as your IP and browser URL. 

Please review Google’s privacy policy to find out more about your rights in this regard and ways to protect your privacy: https://policies.google.com/privacy  

Apple Sign-in

• When you log-in using Apple Sign-in to connect to our platforms or services you agree to share your name,surname and email address and Apple ID associated with us. We will also record the fact that you have registered through Apple.

Apple's platform may receive information, such as your IP and browser URL. 

Please review Apple’s privacy policy to find out more about your rights in this regard and ways to protect your privacy:  https://support.apple.com/en-us/HT208650

4. Who sees, receives and uses your data and where?

4.1. Categories of recipients of your data

We share your personal data, for the purposes described in this Privacy Policy, to the following categories of recipients:

• Our authorised employees and/or collaborators that assist and advise us on administration, products, legal affairs, Customer Care Team, and information systems, as well as those in charge of maintaining our network and hardware/software equipment;

• Airlines, hotels, car hire companies, insurance companies, tour operators as well as those other parties to which it is necessary to disclose your personal data in order to provide you with the requested services that will be operating as autonomous data controllers. Please note that airline companies are required, in accordance with new regulations introduced in the US and other countries, to allow customs and border authorities to have access to flight passenger data. For that reason, in certain situations, we may communicate data collected on passengers included in the reservation to the competent authorities of the countries included in the Customer’s travel itinerary if required by the local law.

• Our third-party service providers (including other entities of the lmastminute.com group), which process your personal data on our behalf and under our instructions for the purposes described hereinabove acting as data processors, such as those providing us with IT and hosting services call centre and customer support, analytics and administration services etc.

• Payment providers and financial institutions (e.g. for chargeback, fraud detection and prevention purposes) acting as autonomous data controllers.

• Our business partners who are social media platforms when it is explicitly requested by you (e.g. when you share information generated from our website onto those platforms), when using social media authentication methods or downloading our App whereby you agree either with our privacy policy or with the platforms that we may share information about your online activity with these partners even when you are not logged in to the social media platform). or when these business partners that provide us with functionality capabilities request information about the specifications of the device that the App has been installed on, which they have obtained the right to do.  The information you share will be governed by the social media's privacy policy. Please check clause 2.3 of this Privacy Policy for more information.

• Competent authorities when we are required to do so by the current law.

• Competent authorities and Law and enforcement third parties when this is necessary so that we can enforce our terms of use and protect and defend our rights or property or the rights or property of any third party.

• Third parties that receive the data (e.g. business consultants, professionals for delivering due diligence services or assess value and capabilities of the business) when it is necessary in connection with any sale of our business or its assets (in which case your details will be disclosed to our advisers and any prospective purchaser’s advisers and will be passed to the new owners. 

The complete list of parties to which your personal data may be disclosed is available at our registered office and may be requested by writing to privacy.en@lastminutegroup.com.

4.2. International transfer of your data

Users’ and/or Customers’ personal data is processed at the Data Controller’s registered office (see point 1), on the lm group servers, and at the offices of other entities to which data may be provided in order to provide the services requested of the Data Controller.

Given the fact that we are an international travel company, we also transfer your personal data to:

• non-European Economic Area (EEA) countries offering an adequate level of data protection such as Switzerland in accordance with the “Adequacy decisions” of the EU Commission that recognises some countries as providing adequate protection;

• non-European Economic Area countries where data protection laws may be less protective than the legislation in the EEA. This happens when:

• we disclose your data to autonomous data controllers such as airlines, hotels, car hire companies, tour operators etc. that might process your data outside the EEA in order to provide you with the requested services.

• we disclose your data to our service providers who act as data processors on our behalf that might be located in a country outside the EEA, including Morocco, Albania, UK, India and Tunisia. When such a transfer happens, we ensure that it takes place in accordance with this Privacy Policy and is regulated by standard contractual clauses approved by the European Commission as ensuring adequate protection for data subjects. Our providers, acting as data processor, may be engaged in, among other things, the fulfilment of your service request, the processing of your payment details, the provision of advertising and marketing services on our behalf and the provision of support services through electronic communications or call centres.

Should you want to obtain further details about the safeguards put in place, you can contact us by writing to privacy.en@lastminutegroup.com.

6. What are your data protection rights and how can you exercise them?

You can exercise the rights provided by the Regulation EU 2016/679 (Articles 15-22), including 

Name of the right

Right of access

Content

To receive confirmation of the existence of your personal data, access its content and obtain a copy.

Name of the right

Right of rectification

Content

To update, rectify and/or correct your personal data.

Name of the right

Right to erasure/right to be forgotten and right to restriction

Content

To request the erasure of your data or restriction of your data which has been processed in violation of the law, including whose storage is not necessary in relation to the purposes for which the data was collected or otherwise processed; where we have made your personal data public, you have also the right to request the erasure of your personal data and to take reasonable steps, including technical measures, to inform other data controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Name of the right

Right to data portability

Content

To receive a copy of your personal data you provided to us for a contract or with your consent in a structured, commonly used and machine-readable format (e.g. data relating to your purchases) and to ask us to transfer that personal data to another data controller.

Name of the right

Right to withdraw your consent

Content

Wherever we rely on your consent (see p. 3 - F and J), you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

Name of the right

Right to object, at any time

Content

You have the right to object at any time to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement (see p. 3-B, C D, H, I), or where we are using your data for direct marketing (p. 3-E).

Name of the right

Right not to be subject to a decision based solely on automated processing, including profiling

Content

You can always request a manual decision- making process instead, express your opinion or contest decision based solely on automated processing, including profiling, if such a decision would produce legal effects or otherwise similarly significantly affect you. 

You can exercise the above rights at any time by:

• Contacting us via email at privacy.en@lastminutegroup.com.

• As for direct marketing, please note that you can also object at any time by clicking the unsubscribe link which we provide in each communication sent to you

• As for online targeted ads and the withdrawal of your consent please refer to our Cookie section of this Privacy Policy.   

In case you exercise any of the above rights provided by GDPR, please note that we will attend your request considering the personal information held by all the companies within the lm group where BravoNext, S.A. holds, directly or indirectly, 100% of the shares.  

Your rights in relation to your personal data might be limited in some situations. For example, if fulfilling your request would reveal personal data about another person or if we have a legal requirement or a compelling legitimate ground we may continue to process your personal data which you have asked us to delete.

You also may have the right to make a complaint if you feel your personal information has been mishandled. We encourage you to come to us in the first instance but, to the extent that this right applies to you, you are entitled to complain directly to the relevant Data Protection Supervisory Authority.

7. Contact details of the data controller

The contact details of the Data Controller of the data processing described hereinabove are:

• for the offers’ comparison and booking services with regard to the products "Flights", "Hotels", "Flight + Hotel", “City Breaks” and “Holidays”, available on this Website:

Red Universal de Marketing y Bookings Online, S.A.U., a Spanish company belonging to the lm group, listed in the Madrid business register under no. CIF A-82602871 and with registered office at Paseo de la Florida 2 Oficina exterior 2 - 28008 Madrid – Spain.

• for the offers’ comparison and booking services with regard to the products "Hotels" as well as for the service "My lastminute.com", available on this Website:

BravoNext, S.A., a Swiss company belonging to the lm group, listed in the Ticino business register under no. CHE - 115.704.228 and with registered office at Vicolo de’ Calvi 2 - 6830 Chiasso, Switzerland.

8. Contact details of our data protection officer (DPO)

Our Data Protection Officer (or "DPO") is available at:

dpo.en@lastminutegroup.com

Vicolo de’ Calvi 2 - 6830 Chiasso, Switzerland

9. Information about Cookies

For any information about Cookies please read the following Cookie Policy.

10. Privacy notice for Facebook 

10.1. Facebook Custom Audiences - Facebook pixel

We use the remarketing function “Custom Audiences” of Facebook Inc. (1601 Willow Road, Menlo Park, California 94025) or, if you are based in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This function allows us to show our Users and/or Customers of our website interest-based ads when they visit Facebook (“Facebook ads”), and to analyze such Facebook ads for statistical and market research purposes, which helps us optimize future advertising. This allows us to serve more relevant advertising. 

For this purpose we use the so-called Facebook pixel for our website. 

When a User or a Customer visits our website and takes an action (for example, buying something), the Facebook pixel is triggered and reports this action. This way, we will know when a customer took an action after seeing our Facebook ad. We will also be able to reach this customer again by using a Custom Audience. Therefore, this pixel allows user behavior to be tracked after they have been redirected to our Website by clicking on a Facebook ad. This way, we will know when a customer took an action after seeing our Facebook ad. We will also be able to reach this customer again by using a Custom Audience.

Therefore, this enables us to measure the effectiveness of Facebook ads for statistical and market research purposes. The data collected in this way is anonymous to us, i.e. we do not see the personal data of individual users. However, this data is stored and processed by Facebook, which is why we are informing you, based on our knowledge of the situation. Facebook may link this information to your Facebook account and also use it for its own promotional purposes, in accordance with Facebook’s Data Usage Policy  https://www.facebook.com/about/privacy. Such data may allow Facebook and its partners to show ads on or off Facebook. A cookie may also be stored on your computer for these purposes.

10.2. Facebook SDK

Within our App, we use the Software Development Kit (SDK) from Facebook. The Facebook SDK is issued and administered by Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA, or, if you are based in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. By means of this integration, we can link various Facebook services with our App (i.e. Facebook Analytics, Facebook Ads, Facebook Login via the SDK, Facebook Account Ki, Facebook Share, Facebook Graph API and Facebook App Events). 

In particular, we have linked the following SDK Facebook services with our App:

Facebook Login: to provide you with the possibility to register or log in with your Facebook account 

Facebook App Events: To understand people's actions in our app and measure the effectiveness of your Mobile App Ads. We use this service  to evaluate the reach of our advertising campaigns and use of Facebook SDK. Facebook merely provides us with an aggregated analysis of user behavior within our app. 

In addition, as our App is linked to SDK Facebook services, we have to follow Facebook policies, which include that we are obliged to share with Facebook, when you download the App, even when you are not logged in to the social media platform, the following data: 

• Anonymous online identifier; 

• Information confirming that you have download our App;

• Type of device you have used to download our App;

• Your device model name;

• Your geographical zone; 

• Your time zone;

• Your connection provider;

• The size and density of your screen device;

• CPU cores of your device;

• The external storage size in GB of your device;

• The free space on external storage in GB of your device;

• Device timezone

By downloading our App you declare that you agree with the communication of the data to Facebook as described above. 

Further information about Facebook SDK within iOS can be found here:https://developers.facebook.com/docs/ios. For Android, please refer to: https://developers.facebook.com/docs/android.

You can check and modify the status of your connection to Facebook and the respective access privileges of our Apps at any time under your Facebook profile settings (https://www.facebook.com/settings?tab=applications). If you want to cancel the connection between Facebook and our App, please log in to Facebook and make the necessary changes in your profile settings.

11. Update and old versions of this privacy policy

We reserve the right to modify this Privacy Policy at any time in accordance with this provision. If we make changes to this Privacy Policy, we will post the revised Privacy Policy on our Website and update the “Last Updated” date at the top of this Privacy Policy.

Old versions of this Privacy Policy are available here.