We strive to limit our data collection about you. We collect information about you only if we need the information for the purposes of providing the Services or enhancing our provision of the Services. We collect any information you or your organization provide us. The information provided and collected by us includes Personal Information, such as your name, postal address, email address, telephone number, payment details, social media handles and account IDs, personal identification, dietary preferences, hotel room preferences, and traveler profile details. You might provide this information to us directly, or by participating in contests or responding to surveys, subscribing to our email newsletter or other promotional materials, or by contacting customer support. Please note that if you make reservations for someone else or for someone who would be your travel companion, you would have to obtain prior explicit consent from these individuals. By submitting the Personal Information of these individuals to us or to our service providers, you acknowledge and agree that you have the needed consent and authority to do so. In addition to collecting information from you or your organization, we may obtain information of a personal or non-personal nature about you from entities who are our affiliates, business partners and/or associates and other sources. Social media accounts (e.g., Facebook and Google) used to sign up with our Services, or used in ways that associate them with us, also provide information which may be of personal nature. We may access your personal information from social media outlets in compliance with their information sharing policies. Information obtained from social media integration may include your name, pictures and photos, your gender, friends and their contact details, your personal preferences and all other information that you and your social media friends have authorized your social media provider to provide. In addition to these, we may also be provided with your updated location data from your social media provider. We may also collect some information automatically whenever you choose to visit our website. Examples of such data are your IP address, your browser software, referring website, your browsing history on our site, transactions initiated and abandoned, and transaction initiated and completed. In addition, we collect your Device Identifier for your Device. A Device Identifier is a number that is automatically assigned to your Device used to access the Services, and our computers identify your Device by its Device Identifier.

Our Services are primarily provided through the Mobile Application. We may collect and use technical data and related information, including but not limited to, technical information about your device, system and application software, and peripherals, that is gathered periodically to facilitate the provision of software updates, product support and other services to you (if any) related to such Mobile Applications. When you use our Mobile Applications, the Mobile Application may automatically collect and store some or all of the following information from your mobile device (“Mobile Device Information”), in addition to the Device Information, including without limitation:

• The manufacturer and model of your mobile device
• Your mobile operating system
• The type of mobile internet browsers you are using
• Your geolocation
• Your preferred language and country site (if applicable)

Information about how you interact with the Mobile Application and any of our web sites to which the Mobile Application links, such as how many times you use a specific part of the Mobile Application over a given time period, the amount of time you spend using the Mobile Application, how often you use the Mobile Application, actions you take in the Mobile Application and how you engage with the Mobile Application Information to allow us to personalize the services and content available through the Mobile Application Data from SMS/ text messages upon receiving Device permissions for the purposes of (i) issuing and receiving one-time passwords and other device verification, and (ii) automatically filling verification details during financial transactions, either through us or a third-party service provider, in accordance with applicable law. We do not share or transfer SMS/ text message data to any third party other than as provided under this Privacy Policy.

To the extent permissible under the applicable laws (the “Data Protection Laws”), we use your information to:

• Provide any information or Services that you have requested or ordered;
• Compare information for accuracy and to verify it with your third parties;
• Provide, maintain, protect and improve our Services;
• Manage, monitor, and administer your use of the Services and provide an enhanced, personal, user experience;
• Manage our relationship with you (for example, customer services and technical support activities);
• Processing payments;
• Undertake internal testing of our Services or systems to test and improve their security and performance (in these circumstances, we would de-identify any information used for such testing purposes);
• Provide you with any information that we are required to send you to comply with our regulatory or legal obligations;
• Detect, prevent, investigate or remediate, crime, illegal or prohibited activities or to otherwise protect our legal rights (including liaison with regulators and law enforcement agencies for these purposes);
• Contact you to see if you would like to take part in our customer research (for example, feedback on your use of our applications, products and services);
• Monitor, carry out statistical analysis and benchmarking (provided that in such circumstances it is on an aggregated basis which will not be linked back to you or any living individual);
• Deliver advertising, marketing (including in-product messaging) or information which may be useful to you; and
• Deliver joint content and services with third parties with whom you have a separate relationship (for example, social media providers).

In addition to the commercial uses listed above, we may be required to provide any and all of your Personal Information to governmental authorities as necessary to comply with the law. To the extent required by Data Protection Laws, or where we have a legitimate and lawful purpose for doing so, we retain information about you after your withdrawal from the Services, the closure of your account, if your application for an account is declined or if you decide not to proceed with the application.

a. Personal Information

You may provide us with instructions on what to do with your Personal Information. Users have choices and control over their Personal Information. Where we need to collect Personal Information and you fail to provide that data when requested, we may have to close your account and/or block your access to the Services. Since your choices and instructions may result in loss of access to the Services and services, please review your options carefully.

b. Your rights if you are located in California

Under California law, California residents are entitled to, once a year, free of charge, request a notice describing what categories of personal information we shared with third parties (if any) for their direct marketing purposes during the preceding calendar year. The notice will identify the categories of personal information shared with third parties, as well as the name and address of the third parties that receive such personal information. If you are a California resident and want to obtain a copy of this notice, please submit a written request to sales@trackex.com with "California Privacy Rights" in the subject line.

c. Your rights in respect to your Personal Information if you are located in the EU or Switzerland

If you are located in the EU or Switzerland, you have the following rights in respect to the Personal Information that we hold:

• Right of access – the right to obtain access to your personal data;
• Right to rectification – the right to obtain rectification of your Personal Information without undue delay where the data is inaccurate or incomplete;
• Right to erasure – the right to obtain the erasure of your Personal Information without undue delay in certain circumstances, such as where the data is no longer necessary in relation to the purposes for which it was collected or processed;
• Right to restriction – the right to restrict data processing undertaken by us on your Personal Information in certain circumstances, such as where the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of that personal data;
• Right to portability – the right to portability allows you to move, copy or transfer Personal Information easily from one organization to another; and,
• Right to object – you have a right to object to data processing based on legitimate interests and direct marketing.
• Right to withdraw consent – you have a right to withdraw your consent to our processing your data. If you exercise this right, we may not be able to provide services to you.

If you wish to exercise one of these rights, please contact us at sales@trackex.com and we will respond within 30 days of the request. If you request access to your personal data, we will provide all information to you by email in addition to context regarding data use. If you request erasure of your personal data, we will respond with a confirmation of erasure by email within 30 days of the request. If your request is deemed unfounded and/or excessive, under the GDPR we retain the right to refuse to respond to the request or to charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. If we refuse to respond, or charge a reasonable fee, we will provide our reasons for doing so. If you are not satisfied with the reasons, you may complain to the relevant data protection authority.

d. Other Choices

In addition, the browser you use may provide the ability to control cookies or other types of local data storage. We does not control these choices, or default settings, which are offered by makers of your browser.

The Information we collect is securely stored within our databases, and we use standard, industry-wide, commercially reasonable security practices such as encryption, firewalls and SSL (Secure Socket Layers) for protecting your information. However, as effective as encryption technology is, no security system is impenetrable. We cannot guarantee the security of our databases, nor can we guarantee that information you supply won't be intercepted while being transmitted to us over the Internet or wireless communication, and any information you transmit to the Company you do at your own risk. We recommend that you not disclose your password to anyone.

From time to time, we may update this Privacy Policy to reflect changes to our information practices. Any changes will be effective immediately upon the posting of the revised Privacy Policy. If we make any material changes, we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on the Services prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.

If you have any queries about how we treat your information, the contents of this notice, your rights under local law, how to update your records or how to obtain a copy of the information that we hold about you, please email us at sales@trackex.com, subject line: “Data protection officer” in the subject header.