Effective: February 15, 2023
Viator, Inc. owns and operates a service that enables users to research, find, and book travel experiences worldwide. In this Statement, these are collectively referred to as our “Services”.
The information that you and others entrust us with enhances our ability to provide more relevant, personalized, and helpful Services. We know that sharing your personal information with us is based on trust. We take your trust in us seriously and are committed to providing you with helpful information, products, and Services, curated based on the information you have shared with us. Equally, and perhaps more importantly, we are committed to respecting your privacy when you visit our website or use our Services, and being transparent about how we use the information you have entrusted to us. Please review this privacy and cookies statement (“Statement”) carefully to learn about our privacy practices.
This Statement describes how we obtain, use, and process your information – hopefully, in an easily understandable and transparent manner. It informs you of the rights you have, how you can exercise them, and how you can contact us. Please review this Statement carefully to learn about our practices with respect to information and privacy. By visiting our website and mobile application, whether on a computer, phone, tablet, or similar device (each of these is referred to as a “Device”), you acknowledge and confirm that you have read this Statement.
We offer our Services to users in a number of countries and territories where the laws and customs differ. This Statement provides a general overview of our privacy practices. In addition, sections 12 and 13 of this Statement provide specific information relevant to users residing in certain regions or countries.
When you access or use our Services, we collect and process information from and about you to provide the Services in a more personalized and relevant way. Some information we collect passively; for example, with our servers or with cookies or other similar tracking technologies. Some information we collect from different sources, including from you, affiliated entities, business partners, and other independent third-party sources. When you use our Services by “clicking-through” from a third-party website or when you visit third-party websites via our Services, those third-party websites may share information with us about your use of their service. Any information we receive from third-party websites may be combined with the information provided by you. Information collected may include the following:
We may also collect, in instances where you have provided it, information about other travelers, including their email address and other travel-related information. If you are sharing information with us about other individuals, you must obtain their consent and ensure that they have understood and accepted how we will use their personal information (as described in this Statement).
In addition to the categories noted above, we may also collect certain location information if you have instructed your Device to send such information via the privacy settings on that Device, or, for example, if you have uploaded photos tagged with location information.
To the extent possible, we want to provide you with relevant content and a tailored experience when you use our Services, and we use information about you to do that, including in the following ways:
Registration and other contracts
Improve our Services
Individualization and customization
Please note, if we use automated decision-making to process your personal information, we will implement appropriate measures required to safeguard your rights and freedoms including your right to obtain human intervention.
In order to provide some of our Services, we may need to share information with certain other third parties, including our group of companies, in the following circumstances:
Certain Device operating system versions permit you to opt out of certain types of information sharing, including to certain advertising networks. You can change the privacy settings of your Device at any time in order to turn off the functionality that collects and shares location information. Please check your Device settings if you want to limit such tracking. However, turning off location-sharing may affect certain features that we offer. If you have any questions about the privacy settings of your Device, we suggest you contact the manufacturer of your Device or your mobile service provider for help.
We also may share your information if we believe, in our sole discretion, that such disclosure is necessary:
You have options with respect to the processing and use of your information by us. You can access, update, and even deactivate your account by visiting the “Profile” section on our website or app. In addition, you can do the following:
Our Services are not intended for children, which we consider to be: (i) individuals that are 13 years of age or under, or the age of privacy consent in your jurisdiction; or (ii) when processing data on the basis of a contract, the age of legal capacity to enter into the agreement.
We will only collect or process information belonging to children under very limited circumstances. We might need to collect personal information belonging to children as part of our Service if, for example, the personal information is required as part of an experience-related reservation. We will only collect personal information belonging to children if it is provided by and with consent of a parent or guardian. If we become aware that we have processed the personal information of a child without the valid consent of a parent or guardian, we will delete the personal information.
We offer our Services to users located in many different jurisdictions. If we transfer your information to other countries, we will use and protect that information as described in this Statement and in accordance with applicable law.
We have implemented appropriate administrative, technical, and physical security procedures to help protect your information. We only authorize specific personnel to access personal information and they may do so only for permitted business functions. We use encryption when transmitting your information between your system and ours, and between our system and those of the parties with whom we share information. We also employ firewalls and intrusion detection systems to help prevent unauthorized access to your information. However, we cannot guarantee the security of information from unauthorized entry or use, hardware or software failure, or other circumstances outside of our control.
We will retain copies of your information for as long as you maintain your account or as necessary in connection with the purposes set out in this Statement, unless applicable law requires a longer retention period. In addition, we may retain your information for the duration of any period necessary to establish, exercise or defend any legal rights.
To give you control, we provide you with a Cookie Consent Tool which allows you to adjust and customize your cookie settings. You can access the Cookie Consent Tool by clicking the “Cookie Consent” link at the bottom of every page and modify your preferences in our cookie banner. In addition, you can manage cookies through the settings of your internet browser. You have the right to withdraw your consent to cookies at any time by clicking on the “Cookie Consent” link and modifying and saving your preferences. In the settings of your Internet browser, you can choose which cookies to accept and reject.
If you decline certain cookies, your access to some functionality and areas of our Services might be degraded or restricted.
Our use of any information we collect through cookies is subject to this Statement, which is linked on every page of our website.
We may update this Statement in the future. If we believe any changes are material, we will let you know by doing one or more of the following: sending you a communication about the changes, placing a notice on the website and/or posting an updated Statement on the website. We will note at the top of this Statement when it was most recently updated. We encourage you to check back from time to time to review the most current version and to periodically review this Statement for the latest information on our privacy practices.
This GDPR Statement applies to persons in the European Economic Area (“EEA”), including those based in the United Kingdom. This GDPR Statement supplements our Statement; however, where the Statement conflicts with the GDPR Statement, the GDPR Statement will prevail as to persons located in the EEA.
Controller of Personal Information and Local Representative
Viator, Inc. is the data controller of the personal information we collect. If you are an experiences supplier, resident in the UK, and receive payment services from Owl Payments Limited pursuant to the Payments Terms of Service between you and Owl Payments Limited, then the controller of your personal information in relation to payment services is Owl Payments Limited.
In accordance with applicable data privacy law, Viator, Inc. has appointed a representative within the European Union and United Kingdom.
The contact details of our European Union representative are:
Tripadvisor Ireland Limited
70 Sir John Rogerson's Quay
The contact details of our United Kingdom representative are:
7 Soho Square
Attn: Privacy Officer
Viator Limited’s role in this respect is limited solely to being a contact point for questions on data protection from European residents and data protection supervisory authorities. For the avoidance of doubt, Viator Limited cannot field other communications or legal process on behalf of Viator, Inc.
Your rights under GDPR
You have certain rights regarding your personal information. Your rights with respect to your own personal information include the following:
The right to request access to your personal information. This enables you to receive a copy of the personal information we hold about you.
The right to request correction of your personal information if it is inaccurate. You may also supplement any incomplete personal information we have, taking into account the purposes of the processing.
The right to request deletion of your personal information if:
The right to object to the processing of your personal information. We will comply with your request, unless we have a compelling overriding legitimate interest for processing or we need to continue processing your personal information to establish, exercise, or defend a legal claim.
The right to restrict the processing of personal information, if:
The right to data portability. You may request that we send this personal information to a third-party, where feasible. You only have this right if it relates to personal information you have provided to us where the processing is based on consent or necessity for the performance of a contract between you and us, and the processing is conducted by automated means.
You also have the right to lodge a complaint before your national data protection authority.
You will not usually have to pay a fee to access your personal information (or to exercise any of the other rights described in this Statement). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). To the extent you use a third party to submit a data request on your behalf, we may need to take reasonable steps to verify the authenticity of the request. These are security measures to ensure that personal information is not disclosed to any person who has no right to receive it. In an effort to speed up our response, we may also contact you to ask you for further information in relation to your request. You can exercise several of your rights through the personal information section of your account. To exercise your other rights you can file a request by clicking here.
Information Uses and Legal Basis
We will only use your personal information under the circumstances permitted by the law or you.
Pursuant to GDPR, we will use your personal information in one or more of the following circumstances:
Registration and other contracts:
Improve our Services and customization:
Your personal information may be stored or transferred to countries outside the EEA and the UK for the purposes described in this Statement. When we store or transfer your personal information outside the EEA and the UK, we take the following precautions to ensure that your personal information is properly protected.
Whenever we store or transfer your personal information outside the EEA and the UK, we will do so in accordance with applicable law, and we will ensure a similar degree of protection is afforded to it by implementing appropriate safeguards. Transfers of personal information are made:
By using our Services, you understand that your personal information may be transferred to our facilities and those third parties with whom we share it, as described in this Statement.
In addition to the further details as described in the Statement, we make the following disclosures:
California Privacy Statement
This California Privacy Statement is provided pursuant to California laws. It applies to California residents and supplements our overall Statement with additional disclosures and rights.
Your California rights
California residents may also take advantage of the following rights:
Access. You may request, that we disclose to you the categories and specific pieces of personal information that we have collected about you, the categories of sources from which we collected your personal information, our business or commercial purpose for collecting your personal information, the categories of personal information that we have disclosed for a business purpose, any categories of personal information about you that we have sold, the categories of third parties with whom we have disclosed your personal information, and the business or commercial purpose for collecting, selling, or sharing your personal information, if applicable.
Deletion. You may request that we delete your personal information that we maintain about you, subject to certain exceptions. As described in more detail in our Statement, there are some reasons for which we will not be able to fully address your deletion request, such as if we need to complete a transaction for you, to detect and protect against fraudulent and illegal activity, to exercise our rights, or to comply with a legal obligation. You can also access, update, and remove your information by visiting the ‘Profile’ page on our website.
Correction. You can request that we correct inaccurate personal information that we maintain about you.
Do Not Sell or Share My Personal Information. You may request to opt out of our sale or sharing of your personal information to third parties. For purposes of this California Privacy Statement, “sell” means the sale of your personal information to a third party for monetary or other valuable consideration, subject to certain exceptions set forth in applicable California law. For purposes of this California Privacy Statement, “share” means disclosure of personal information to third parties for cross-context behavioral advertising purposes, subject to certain exceptions in applicable law. To effect the opt out, please click on the “Do Not Sell or Share My Personal Information” button on the bottom of the homepage or submit a request in writing to the contact information below. As described above, we, and certain other companies, place tracking technologies, such as cookies, on our websites which allow us, and those companies, to receive information about your activity on our websites that is associated with your browser or Device. We and these companies may use that data to customize content for you and to serve you more relevant ads on our website or others. Note that if you would like to opt out of tracking for behavioral advertising purposes, you will need to set your preferences by clicking the “Cookie Consent” link at the bottom of the webpage or you may broadcast an opt-out preference signal recognized by Viator, such as the Global Privacy Control opt-out preference signal (on the browsers or browser extensions that support such a signal). We do not knowingly sell or share the personal information of minors under 16 years of age.
To take advantage of any of these rights, please contact us via our dedicated privacy portal by clicking here or writing to us at Viator, Inc., 400 First Avenue, Needham, Massachusetts, 02494, USA. California residents may designate an authorized agent to make a request on their behalf. When submitting the request, please ensure the authorized agent is identified as an authorized agent. We may need to verify your identity or elements of the request to enable us to process your request. We will take reasonable steps to verify your identity; these verification steps will vary depending on the sensitivity of the personal information and whether you have an account with us. We may deny certain requests, or fulfil a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate customer requests. We value your privacy and will not discriminate against California residents in response to your exercise of privacy rights.
Multi-State Privacy Statement for Virginia, Connecticut, Colorado
This Multi-State Privacy Statement is provided pursuant to applicable state laws and applies to Virginia, Connecticut, and Colorado residents, and supplements our overall Statement with additional disclosures and rights.
If you are a resident of Virginia, Connecticut, or Colorado you may take advantage of the following rights in accordance with applicable law:
To take advantage of any of these rights, please contact us via our dedicated privacy portal by clicking here or in writing at Viator, Inc., 400 First Avenue, Needham, Massachusetts, 02494, USA. Note that Connecticut and Colorado residents may designate an authorized agent to request on their behalf that we stop selling or processing their personal information for targeted advertising purposes. We will take reasonable steps to authenticate your identity prior to responding to your requests. The authentication process will vary depending on the sensitivity of the personal information and whether you have an account with us. We will use commercially reasonable efforts to authenticate the identity of authorized agents and their authority to submit requests on your behalf.
We may deny certain requests, or fulfil a request only in part, based on our legal rights and obligations. You have the right to submit an appeal if you are not satisfied with the outcome of your request by submitting a request by clicking here.
Previous version: https://www.viator.com/blog/Viator-Privacy-Policy-2022/l98069