Last Updated: July 31, 2024
Expedia Cruises, part of the Expedia Group, (“we” or “us”) values you as our customer and recognizes that privacy is important to you. This Privacy Statement explains how we collect, use, and disclose personal information when you use our platform and associated services, your rights in determining what we do with the information that we collect or hold about you and tells you how to contact us.
This is a summary of our Privacy Statement. To review our Privacy Statement in full, please click here, or scroll down.
This Privacy Statement is designed to describe:
We collect personal information when:
When you create an account on one of our sites, sign up to receive offers or information, or make a booking using our platform, you give us your personal information. We also collect such information through automated technology such as cookies placed on your browser, with your consent where applicable, when you visit our sites or download and use our Apps. We also receive information from affiliated companies within Expedia Group, as well as business partners and other third-parties, which help us improve our platform and associated tools and services, update and maintain accurate records, potentially detect and investigate fraud, and more effectively market our services.
Your personal information may be shared for several purposes, including: to help you book your travel and/or vacation, assist with your travel and/or vacation stay, communicate with you (including when we send information on products and services or enable you to communicate with travel providers and/or property owners), and comply with the law. The full Privacy Statement below details how personal information is shared below.
You can exercise your data protection rights in various ways. For example, you can opt out of marketing by clicking the “unsubscribe” link in the emails, in your account as applicable, or contacting our customer service. Our Privacy Statement has more information about the options and data protection rights and choices available to you.
More information about our privacy practices is in our full Privacy Statement. You can also contact us as described below in the "Contact Us" section to ask questions about how we handle your personal information or make requests about your personal information.
*****************************
You will find in this section information about:
In the tables below, you will find the lawful basis we rely on to collect and use your personal information.
In summary, we will collect personal information from you only when one of the following lawful bases applies:
We collect personal information for the following purposes:
We collect the following categories of personal information for the following purposes:
Personal Information Category | Purposes for Collection | Sources of Personal Information | Lawful Basis |
---|---|---|---|
Government issued identification data – including passport, driver’s license, government redress numbers, country of residence, tax identification number (for property owners) |
|
|
|
Identification data – including name, username, email address, telephone number, as well as home, business, and billing addresses (including street and postal code) |
|
|
|
Payment data - including payment card number, expiration date, billing address, financial / bank account number |
|
|
|
Travel related preferences - including favorite destination and accommodation types, special dietary and accessibility needs, as available |
|
|
|
Loyalty data – including loyalty program membership, loyalty points balance, points earnt and used, loyalty status |
|
|
|
Geolocation data – including inferred location from IP address, country selected to use our website, and exact, real-time location (with your consent) |
|
|
|
Images, videos and recordings – including facial photographs, images you upload, and videos |
|
|
|
Communications with us – including emails, chat transcripts and recordings of calls with customer service representatives |
|
|
|
Site interaction data - including searches you conduct, transactions and other interactions with you on our platform, online services and apps |
|
|
|
Device data – including device type, unique device identification numbers , operating system, mobile carrier, and how your device has interacted with our online services, including the pages accessed, links clicked, trips viewed, and features used, along with associated dates and times |
|
|
|
Friends and co-traveler data - including data you give us about other people, such as your travel companions or others for whom you are making a booking |
|
|
|
Child data – including name and contact details of minor travelers provided by you as the parent/guardian of the minor as part of a trip reservation |
|
|
|
Clickstream data - In certain instances, we may use clickstream data to render an illustration of your usage of our site. Clickstream data is the collection of a sequence of events that represent visitor actions on a website. We may reconstruct your site journey modeled on the timing and location of your actions. |
|
|
|
Birthdate and gender - including both your specific date of birth or an approximate age bracket you fall within, along with your gender. |
|
|
|
Sensitive data – data that could reveal sensitive information, including your racial or ethnic origin, religious or philosophical beliefs, sexual orientation, or health or disability information. We will only use your sensitive personal information for the purposes for which it was collected. |
|
|
|
We share your personal information as described below and in this Privacy Statement, and as permitted by applicable law.
Recipient of Personal Information | Purpose Category |
---|---|
Expedia Group Companies. We share your personal information within the Expedia Group companies, listed at expediagroup.com. Expedia Group companies (either autonomously or as joint data controllers, where applicable) share access and use your personal information as described in this Privacy Statement. |
|
Third-party service providers. We share personal information with third-parties in connection with the delivery of services to you and the operation of our business. These third-party service providers are required to protect personal information we share with them and may not use any directly identifying personal information other than to provide services we contracted them for. They are not allowed to use the personal information we share for purposes of their own direct marketing (unless you have separately consented with the third-party under the terms provided by the third-party). |
|
Travel suppliers. We share personal information with travel-related suppliers such as hotels, airlines, car-rental companies, insurance, vacation-rental property owners and managers, and where available, activity providers, rail, or cruise lines who fulfill your booking. Please note that travel suppliers may contact you to obtain additional personal information if and as required to facilitate your booking or to otherwise provide the travel or associated services. |
|
Business partners and offers. If we promote a program or offer a service or product in conjunction with a third-party business partner, we will share your personal information with that partner to assist in marketing or to provide the associated product or service. In most of those cases, the program or offer will include the name of the third-party business partner, either alone or with ours, or you will be redirected to the website of that business with notice. |
|
Targeted Advertising partners. We may disclose your personal information to our third-party marketing partners for targeted advertising. This may be considered “sharing” data under California law. Subject to certain limitations, some US residents have the right to opt out of having their personal information shared for this purpose. For more information, see the Your Rights and Choices section below. You should note that by opting out of these types of disclosures, you may limit our ability to customize your experience with content that may be of interest to you or to provide you with a better travel experience. View our Cookie Statement for more information on our use of tracking technology for the purposes of targeted advertising. |
|
Social media and online platforms: we share personal information with media agencies, social media, search engines and other online platforms to help us target our online marketing. These social media and other online platforms may also use personal information they hold and combine or match it against personal information received from us to create target audiences, which are audiences that we think would be interested in our online advertising. This may involve social media and other online platforms building a ‘lookalike’ profile of the type of person we are trying to target and providing specific adverts to those people when they browse the internet or use social media. |
|
Other Third-Parties. When you access certain features like Facebook’s “Like” button or a single sign-on that allows you to login with your social media credentials to our online services, you will share information with the third-party, like a social media company, such as the fact that you have visited or interacted with us. In the European Economic Area (EEA), Switzerland, and United Kingdom (UK) we will not load social media sharing or sign-on buttons on our website unless and until you accept our use of cookies and similar technologies. For more information, see our Cookie Statement . The third-party provider may combine this information with other information they have about you. The personal information shared will be governed by the third-party provider’s privacy policy (including any personal information we may access via the third-party provider). The third-party providers should inform you about how you can modify your privacy settings on their site. |
|
Recipients in relation to our legal rights and obligations. We may disclose your personal information and associated records to enforce our policies; as necessary to satisfy our tax or other regulatory reporting requirements, including the remission of certain taxes in the course of processing payments; or where we are permitted (or believe in good faith that we are required) to do so by applicable law, such as in response to a subpoena or other legal request, in connection with actual or proposed litigation, or to protect and defend our property, people and other rights or interests. |
|
Recipients in relations to corporate transactions. We may share your personal information in connection with a corporate transaction, such as a divestiture, merger, consolidation, assignments or asset sale, or in the unlikely event of bankruptcy. In the case of any acquisition, we will inform the buyer it must use your personal information only for the purposes disclosed in this Privacy Statement. |
|
We jointly use, and our Expedia Group companies are joint controllers of your personal information in the following manner:
We use artificial intelligence and machine learning for various purposes to deliver our platform and associated services. We may use your personal information for the following purposes:
Automated decisions may be made by putting your personal information into a system and the decision is calculated using automatic processes.
We will rely on our legitimate interest to keep our site safe and to enhance your user experience. We will not engage in automated decision-making that involves a decision with legal or similarly significant effects solely based on automated processing of personal information, unless:
You may have rights in relation to automated decision making, including:
If you want to know more about your data protection rights, please see the Your Rights and Choices section below. https://expediagroup.com/travel-with-us/default.aspx
You have certain rights and choices with respect to your personal information, as described below:
Certain countries and regions provide their residents with additional rights relating to personal information. These additional rights vary by country and region and may include the ability to:
For more information on what data subject rights may be available to you, please click here.
For questions about privacy, your rights and choices, and in order for you, or (where applicable) your authorized agent to make a request to amend or update your information, or to inquire about deletion of your information, please contact us here..
In addition to the above rights, you may have the right to complain to a data protection authority about our collection and use of your personal information. However, we encourage you to contact us first so we can do our best to resolve your concern. You may submit your request to us using the information in the Contact Us section.
We respond to all requests we receive from individuals wanting to exercise their personal data protection rights in accordance with applicable data protection laws. Should you have the right to appeal a decision to not take action on a request under applicable law, instructions on how to make that appeal will be included in our response to you.
The personal information we process may be accessed from, processed or transferred to countries other than the country in which you reside. Those countries may have data protection laws that are different from the laws of your country. Such cross-border transfer of your personal information is necessary for us to service your transaction with us, and for the purposes outlined in this Privacy Statement.
The servers for our platform are located in the United States, and the Expedia Group companies and third-party service providers operate in many countries around the world. When we collect your personal information, we may process it in any of those countries. Our employees may access your personal information from various countries around the world. The transferees of your personal information may also be located in countries other than the country in which you reside.
We have taken appropriate steps and put safeguards in place to help ensure that any access, processing and/or transfer of your personal information remains protected in accordance with this Privacy Statement and in compliance with applicable data protection law. Such measures provide your personal information with a standard of protection that is at least comparable to that under the equivalent local law in your country, no matter where your data is accessed from, processed and/or transferred to. We will comply with obligations regarding personal information cross-border transfer in accordance with application data protection laws, regulations, and conditions set by the competent authorities. This may include fulfilling obligations such as security assessments and/or certifications and signing agreements with overseas recipients in accordance with the standard contract established by the competent authorities.
Such measures include the following:
All wholly owned U.S. affiliates of Expedia, Inc. (part of the Expedia Group of brands) have certified to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF and Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) (“the DPF Frameworks”) and that we adhere to the DPF Framework Principles of Notice, Choice, Accountability for Onward Transfers, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability for personal information from the EU, Switzerland, and the United Kingdom. The Federal Trade Commission has jurisdiction over such Expedia Group U.S. affiliates’ compliance with the DPF Frameworks. In addition, Expedia Group maintains intra-group Standard Contractual Clauses where applicable to cover the transfer of EU personal information to the U.S. Our certifications can be found here. For more information about the the DPF Frameworks principles, please visit: https://www.dataprivacyframework.gov.
In compliance with the DPF Frameworks, Expedia, Inc. U.S. affiliates (part of Expedia Group of brands) commit to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO), the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the DPF Frameworks. Under certain circumstances, you may have the possibility to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. Please visit this link for more information: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2..
Expedia, Inc. commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the DPF Frameworks should first contact us via our Contact Us below.
We want you to feel confident about using our platform and all associated tools and services, and we are committed to taking appropriate steps to protect the information we collect. While no company can guarantee absolute security, we do take reasonable steps to implement appropriate physical, technical, and organizational measures to protect the personal information that we collect and process.
Our cybersecurity team develops and deploys technical security controls and measures to ensure responsible personal information collection, storage, and sharing that is proportionate to the personal information’s level of confidentiality or sensitivity. We take efforts to continuously implement and update security measures to protect your personal information from unauthorized access, loss, destruction, or alteration. We hold our data-handling partners to equally high standards.
We have established an information security protection system based on industry best practices and have obtained PCI-DSS certification. We have also implemented appropriate security measures throughout the entire lifecycle of data collection, storage, processing, use, transmission, and sharing, and have taken certain technical and management measures including but not limited to verification and access controls, VPN, SSL encrypted transmission, and multi factor authentication mechanisms, based on our information classification and processing standards, to ensure the security of systems and services.
We have management and approval mechanisms for employees who may have access to your information and provide regular information security training for employees.
In the event of a personal data security incident that may affect your rights and interests, you will be notified in accordance with applicable data protection laws and regulations. We will also report the relevant incident to the competent regulatory authorities, if required by applicable laws and regulations.
Our website and mobile application are not directed at minors (as defined in applicable data protection laws) and we cannot distinguish the age of persons who access and use these. If a minor has provided us with personal information without parental or guardian consent, the parent or guardian should contact us (see "Contact us" section below). If we become aware that personal information has been collected from a minor without parental or guardian consent, we will terminate the minor’s account, where that minor has an account with us.
The limited circumstances we might need to collect the personal information of minors include: as part of a reservation, the purchase of other travel-related services, or in other exceptional circumstances (such as features addressed to families). When processing personal information of minors, we strictly adhere to the principles of legality, necessity, clear purpose, openness, transparency, and security, and we take strict measures to protect such data.
If you have any questions or concerns regarding our protection of minors’ personal information, or if you (in your capacity as the parent or guardian of the minor) wish to delete or correct the personal information of minors, please clic here.
We will retain your personal information in accordance with all applicable laws, for as long as it may be relevant to fulfill the purposes set forth in this Privacy Statement, unless a longer retention period is required or permitted by law. We will deidentify, aggregate, or otherwise anonymize your personal information if we intend to use it for analytical purposes or trend analysis over longer periods of time.
When we delete your personal information, we use industry standard methods to ensure that any recovery or retrieval of your information is impossible. We may keep residual copies of your personal information in backup systems to protect our systems from malicious loss. This personal information is inaccessible unless restored, and all unnecessary personal information will be deleted upon restoration.
The criteria we use to determine our retention periods include:
If you have any questions or concerns about our use of your personal information, or wish to inquire about our personal information handling practices, and exercise your rights to access, correct or inquire about deletion of personal information, please contact us via the Privacy Section on our Customer Services Portal here. For a list of the Expedia Group companies, click here.
Your principal data controller is the Expedia Group company responsible for the site or app with which you are interacting, and this data controller may be acting as a joint controller with other members of the Expedia Group of companies. For more information about the data controller(s) (and joint controllers, where applicable) and/or Representative for personal information we process, please click here .
We may update this Statement in response to changing laws or technical or business developments. If we propose to make any material changes, we will notify you by means of a notice on this page. You can see when this Privacy Statement was last updated by checking the “last updated” date displayed at the top of this Statement.
For information on prior updates please contact us.