ONE YEAR TRAVEL PROMOTION - PRIVACY POLICY

1. WHO IS THE CONTROLLER OF ENTRANTS' PERSONAL DATA?

BravoNext, S.A.t/a lastminute.com, a Swiss company belonging to the lm group, listed in the Ticino business register under no. CHE - 115.704.228 and with registered office at Vicolo de’ Calvi 2 - 6830 Chiasso, Switzerland, which is responsible for the processing of Users’ personal data under this Privacy Policy (hereinafter, referred to as the “Data Controller” and/or “lastminute.com”). Furthermore, lastminute.com informs Entrants that, for compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) purposes only (Art. 27 GDPR), it has designated as its EU representative Viaggiare SRL, an Italian company belonging to the lastminute.com group, listed in the Italian Chamber of Commerce - Milano under VAT identification no. IT04403760962 and with registered office at Via Ferrucci 10 20100 Milan, Italy.

lastminute.com, an entity located in Switzerland, is subject to Swiss law regarding personal data protection. For that reason, lastminute.com undertakes to comply with the obligations imposed by the GDPR and the Swiss Federal Act on Data Protection (FADP) too. 

In the same vein, lastminute.com informs Entrants that the Decision of the Commission of 26 July 2000 in accordance with Directive 95/46/CE of the European Parliament and the Council relating to the adequate level of protection for personal data in Switzerland declared that, in Switzerland, the laws guarantee an adequate level of protection in accordance with Directive 95/46/CE.

2. WHAT CATEGORIES OF ENTRANTS' DATA DOES LASTMINUTE.COM COLLECT AND USE? 

When Entrants join the Promotion, visit the lastminute.com social media channels (Instagram and TikTok) lastminute.com collects the categories of personal data as follows:

2.1 Personal data provided by Entrants:

The personal data that Entrants share with lastminute.com, including the information included in Entrants’ contents to enter the Promotion, comments, reviews or messages during the Promotion.

The provision of Entrants' personal data, where requested, is necessary for participation in the Promotion to comply with lastminute.com legal obligations except when lastminute.com relies on consent as legitimate basis for processing and or lastminute.com legitimate interest. Without it, lastminute.com may not be able to provide Entrants with all the expected outputs (Promotion participation).

It is important that all the personal data Entrants give lastminute.com is, personally owned, correct and accurate. This includes, by way of example only, ensuring that lastminute.com has got Entrants' correct contact details and Entrants’ owned content at all times.

3. WHY DOES LASTMINUTE.COM COLLECT ENTRANTS' DATA?

In general terms, lastminute.com uses Entrants’ personal data to allow Entrants to enter the Promotion. More specifically:

Why?

On which legal basis?

A. To create and maintain the contractual relationship established for the provision of the product and/or service requested (entering the Promotion) by Entrants in all its phases and by way of any possible integration and modification or to take steps at Entrants' request in relation to the contract prior to entering into the contractual relationship. 

To fulfil a contract, or take steps linked to a contract (i.e. to enter the Promotion)

 B. n.a.

 C. n.a.

 D. To carry out aggregative statistical analyses on anonymised groups or to analyse identifiable individuals' behaviour so that lastminute.com can see how lastminute.com website, products and services are being used and how lastminute.com business is performing.

To pursue lastminute.com legitimate interest (i.e. improving lastminute.com Website, its features and lastminute.com products and services)

E. n.a. 

F. To send Entrants personalised and profiled marketing communications

Without prejudice to the provisions of the preceding paragraph E and only with Entrants’ previous consent, to share with them via email, phone, mail, whatsapp, SMS and/or on our website or third party ones (e.g. using ads and/or Web Push Notifications) the best deals and offers on products and services lastminute.com thinks Entrants might find interesting because they are suited to Entrants’ interests. If Entrants have already given lastminute.com their consent to profiling activities through marketing cookies or other means, lastminute.com may send personalised communications. The personalised service or the offers can be related to the following sectors (please note that lastminute.com does not share Entrants' email address with third parties): tourism, leisure, entertainment, high technology, fashion, decoration, consumer goods, food and beverage, finance, banking, insurance, energy, environment, communication, mass media, real estate, pharmaceuticals, clothing and textiles, education and training, energy, publications and publishing, information and communications technology, retail, sport, telecommunications and general services.

For this purpose lastminute.com may:

-    analyse Entrants’ personal information to create a profile of your interests and preferences so that lastminute.com can tailor and target its communications in a way that is timely and relevant to Entrants.

-    combine the information Entrants give lastminute.com via cookies and other tracking technologies with information related to Entrants’ purchases.

-    analyse information about the way Entrants engage with communication material they receive from lastminute.com, such as data on when emails have been opened or to determine if Entrants have viewed or interacted with an ad, to record the number of times Entrants have viewed each ad, to prevent a single ad being shown to Entrants too frequently etc.

-    temporarily share an encrypted version of Entrants’ email address, with carefully selected partners who may combine this information with other forms of online identifiers or other personal data  in order to present Entrants with lastminute.com offers cross device or cross channel, for example on social networks (Facebook, Instagram, Twitter).

-    use automated decision making to segment and target product offers based on Entrants’ demands and needs. This allows lastminute.com to be more focused, efficient and cost effective with its resources and also reduces the risk of someone receiving information they may find inappropriate or irrelevant. Entrants can always request a manual decision-making process instead, express their opinion or contest decision based solely on automated processing, including profiling, if such a decision would produce legal effects or otherwise similarly significantly affect Entrants. For further details, Entrants may contact lastminute.com Data Protection Officers whose details are provided in this privacy policy.

This letter F legal basis is valid IF APPLICABLE AND WHERE EXPLICITLY REQUESTED THROUGH A NON PRE-FLAGGED CHECKBOX

Where Entrants give their consent (by ticking the appropriate check box or by inserting their email address into the proper field to receive personalised communications about us and our selected third parties)

G. n.a. 

H. n.a.

I. n.a.

J. n.a.

K. n.a.

Where lastminute.com relies on legitimate interest as a basis for processing Entrants' personal information, lastminute.com carries out an assessment to ensure that its interest in the use of Entrants' data is legitimate and that Entrants' fundamental rights of privacy are not outweighed by lastminute.com's legitimate interests (‘balancing test’). Entrants can find out more information about the balancing test by contacting lastminute.com's Data Protection Officer at dpo.en@lastminutegroup.com.

4. WHO SEES, RECEIVES AND USES ENTRANTS' DATA AND WHERE?

4.1 Categories of recipients of Entrants' data

lastminute.com shares Entrants' personal data, for the purposes described in this Privacy Policy, to the following categories of recipients:

• lastminute.com authorised employees and/or collaborators that assist and advise lastminute.com on Finance and Administration, Product, Legal&DPO, Customer Care, and Information Technology, as well as those in charge of maintaining lastminute.com network and hardware/software equipment; 

• lastminute.com third-party service providers (including other entities of the lastminute.com group), which process Entrants' personal data on lastminute.com behalf and under lastminute.com instructions for the purposes described hereinabove acting as data processors, such as those providing lastminute.com with IT and hosting services call centre and customer support, analytics and administration services etc.; 

• competent authorities when lastminute.com is required to do so by the current law; 

• competent authorities and law and enforcement third parties when this is necessary so that lastminute.com can enforce lastminute.com terms of use and protect and defend lastminute.com rights or property or the rights or property of any third party; 

• third parties that receive the data (e.g. business consultants, professionals for delivering due diligence services or assessing value and capabilities of the business) when it is necessary in connection with any sale of lastminute.com business or its assets (in which case Entrants' details will be disclosed to lastminute.com advisers and any prospective purchaser’s advisers and will be passed to the new owners). 

The complete list of parties to which Entrants' personal data may be disclosed is available at lastminute.com registered office and may be requested by emailing privacy.en@lastminutegroup.com.

4.2 International transfer of Entrants' data

Entrants’ personal data is processed at the Data Controller’s registered office, on the lastminute.com group  servers, and at the offices of other entities to which data may be provided in order to provide the services requested of the Data Controller.

Given the fact that lastminute.com are an international travel company, lastminute.com also transfer Entrants’ personal data to:

• non-European Economic Area (EEA) countries offering an adequate level of data protection such as Switzerland in accordance with the “Adequacy decisions” of the EU Commission that recognises some countries as providing adequate protection; 

• non-European Economic Area countries where data protection laws may be less protective than the legislation in the EEA. This happens when: 

• lastminute.com discloses Entrants' data to autonomous data controllers such as airlines, hotels, car hire companies, tour operators etc. that might process Entrants' data outside the EEA in order to provide Entrants with the requested services. 

• lastminute.com discloses Entrants' data to lastminute.com service providers who act as data processors on lastminute.com behalf that might be located in a country outside the EEA, including the US, Morocco, Albania, UK, India and Tunisia. When such a transfer happens, lastminute.com ensures that it takes place in accordance with this Privacy Policy and is regulated by standard contractual clauses approved by the European Commission as ensuring adequate protection for data subjects. lastminute.com providers, acting as a data processor, may be engaged in, among other things, the fulfilment of Entrants’ service request, the processing of Entrants' payment details, the provision of advertising and marketing services on lastminute.com behalf and the provision of support services through electronic communications or call centre. 

Should Entrants want to obtain further details about the safeguards put in place, Entrants can contact lastminute.com by writing to privacy.en@lastminutegroup.com.

5. HOW LONG DOES LASTMINUTE.COM RETAIN ENTRANTS’ DATA?

lastminute.com retains Entrants’ personal data for as long as is required to achieve the purposes and fulfil the activities as set out in this Privacy Policy, otherwise communicated to Entrants or for as long as is permitted by applicable law. Further information about the retention period is available here: 

5.1.1 Document Promotion Participation records (name, address, contact information, birth date if requested)

5.1.2 Retention period 1 year 

5.1.3 Starting date from the date of participation in the Promotion

5.2.1 Document Data used for marketing activities to Entrants/users subject to the consent or under soft-opt in

5.2.2 Retention period 5 years 

5.2.3 Starting date from the consent or the renewal of the consent via interaction with marketing communications

5.3.1 Document Technical cookies

5.3.2 Retention period Max 3 years 

5.3.3 Starting date from the date of browsing our websites

5.4.1 Document Non-technical cookies

5.4.2 Retention period Max 1 year 

5.4.3 Starting date from the date of consent

6. WHAT ARE ENTRANT’S DATA PROTECTION RIGHTS AND HOW CAN ENTRANTS EXERCISE THEM?

Entrants can exercise the rights provided by the Regulation EU 2016/679 (Articles 15-22), including the right to:

6.1.1 Right of access

6.1.2 To receive confirmation of the existence of Entrants’ personal data, access its content and obtain a copy.

6.2.1 Right of rectification

6.2.2 To update, rectify and/or correct Entrants’ personal data.

6.3.1 Right to erasure/right to be forgotten and right to restriction

6.3.2 To request the erasure of Entrants' data or restriction of Entrants' data which has been processed in violation of the law, including whose storage is not necessary in relation to the purposes for which the data was collected or otherwise processed; where lastminute.com has made Entrants' personal data public, Entrants have also the right to request the erasure of Entrants' personal data and to take reasonable steps, including technical measures, to inform other data controllers which are processing the personal data that Entrants have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

6.4.1 Right to data portability

6.4.2 To receive a copy of Entrants' personal data Entrants provided tolastminute.com for a contract or with Entrants' consent in a structured, commonly used and machine-readable format (e.g. data relating to Entrants' participation) and to ask lastminute.com to transfer that personal data to another data controller.

6.5.1 Right to withdraw Entrants' consent

6.5.2 Wherever lastminute.com relies on Entrants' consent Entrants will always be able to withdraw that consent, although lastminute.com may have other legal grounds for processing Entrants' data for other purposes.

6.6.1 Right to object, at any time

6.6.2 Entrants have the right to object at any time to the processing of Entrants' personal data in some circumstances (in particular, where lastminute.com doesn’t have to process the data to meet a contractual or other legal requirement or where lastminute.com is using Entrants' data for direct marketing 

6.7.1 Right not to be subject to a decision based solely on automated processing, including profiling

6.7.2 Entrants can always request a manual decision- making process instead, express Entrants' opinion or contest decision based solely on automated

processing, including profiling, if such a decision would produce legal effects or otherwise similarly significantly affect you.

 Entrants can exercise the above rights at any time by:

• Contacting lastminute.com via email at privacy.en@lastminutegroup.com. 

• As for direct marketing, please note that Entrants can also object at any time by clicking the unsubscribe link which lastminute.com provides in each communication sent to you. 

• As for online targeted ads and the withdrawal of Entrants' consent, please refer to lastminute.com Cookie section of this Privacy Policy. 

In case Entrants exercise any of the above rights provided by GDPR, please note that lastminute.com will attend Entrants' request considering the personal information held by all the companies within the lm group where BravoNext, S.A. holds, directly or indirectly, 100% of the shares.

Entrants' rights in relation to Entrants' personal data might be limited in some situations. For example, if fulfilling Entrants' request would reveal personal data about another person or if lastminute.com has a legal requirement or a compelling legitimate ground lastminute.com may continue to process Entrants' personal data which Entrants have asked lastminute.com to delete.

Entrants also may have the right to make a complaint if Entrants feel Entrants' personal information has been mishandled. lastminute.com encourages Entrants to come to lastminute.com in the first instance but, to the extent that this right applies to you, Entrants are entitled to complain directly to the relevant Data Protection Supervisory Authority.

7. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)

lastminute.com Data Protection Officer (or "DPO") is available at:

dpo.en@lastminutegroup.com

Vicolo de’ Calvi 2 - 6830 

Chiasso SWITZERLAND