2.1. Personal data provided by you

• The personal data that you share with us when you register to our “Email Alerts” service or access to the service called "Contact Us".

The provision of the above personal data, where requested, is necessary for the adequate performance of the requested service and to allow us to comply with our legal obligations except when we rely on consent as legitimate basis for processing and or our legitimate interest. Without it, we may not be able to provide you with all the requested services.

It is important that all the personal data you give us is correct and accurate. This includes, by way of example only, ensuring that we have your correct contact (including email) details at all times.

2.2. Personal data collected automatically from our Website, from communication we send, and/or from third parties

• We collect information about your visits to and use of the Website, such as information about the device and browser you are using, your IP address or domain names of the computers connected to the Websites, uniform resource identifiers for requests made, the time of request, the method used to submit the request to the server, the size of the archive obtained as a response, the numerical code indicating the status of the response given by the server (correct, error, etc.) and other parameters relative to the operating system and the computer environment used, the date and time that you visited, the duration of your visit, the referral source and website navigation paths of your visit and your interactions on the Website.

The provision of the above personal data, where requested, is necessary for the adequate performance of the requested service and to allow us to comply with our legal obligations except when we rely on consent as legitimate basis for processing and or our legitimate interest. Without it, we may not be able to provide you with all the requested services.

It is important that all the personal data you give us is correct and accurate. This includes, by way of example only, ensuring that we have your correct contact (including email) details at all times.

2.2. Personal data collected automatically from our Website, from communication we send, and/or from third parties

• We collect information about your visits to and use of the Website, such as information about the device and browser you are using, your IP address or domain names of the computers connected to the Websites, uniform resource identifiers for requests made, the time of request, the method used to submit the request to the server, the size of the archive obtained as a response, the numerical code indicating the status of the response given by the server (correct, error, etc.) and other parameters relative to the operating system and the computer environment used, the date and time that you visited, the duration of your visit, the referral source and website navigation paths of your visit and your interactions on the Website.

4.1. Categories of recipients of your data

We share your personal data, for the purposes described in this Privacy Policy, to the following categories of recipients:

• Our authorised employees and/or collaborators that assist and advise us on administration, legal affairs, and information systems, as well as those in charge of maintaining our network and hardware/software equipment;

• Our third-party service providers (including other entities of the lmastminute.com group), which process your personal data on our behalf and under our instructions for the purposes described hereinabove acting as data processors, such as those providing us with IT and hosting services, analytics and administration services etc.

• Competent authorities when we are required to do so by the current law.

• Competent authorities and Law and enforcement third parties when this is necessary so that we can enforce our terms of use and protect and defend our rights or property or the rights or property of any third party.

• Third parties that receive the data (e.g. business consultants, professionals for delivering due diligence services or assess value and capabilities of the business) when it is necessary in connection with any sale of our business or its assets (in which case your details will be disclosed to our advisers and any prospective purchaser’s advisers and will be passed to the new owners.

The complete list of parties to which your personal data may be disclosed is available at our registered office and may be requested by writing to [email protected].

4.2. International transfer of your data

Users’ personal data is processed in at the Data Controller’s registered office (see point 1), on the lm group servers, and at the offices of other entities to which data may be provided in order to provide the services requested of the Data Controller.

We also transfer your personal data to:

• non-European Economic Area (EEA) countries offering an adequate level of data protection such as Switzerland in accordance with the “Adequacy decisions” of the EU Commission that recognises some countries as providing adequate protection;

Should you want to obtain further details about the safeguards put in place, you can contact us by writing to [email protected].

Document

Account information:

• User, password

• Email

• Name and surname

• Country

• Occupation

Retention period

• 10 years

Starting date

• From the date of the registration

Document

• Technical cookies

Retention period

• Max 3 years

Starting date

• From the date of browsing on our websites

Right of access - To receive confirmation of the existence of your personal data, access its content and obtain a copy.

Right of rectification - To update, rectify and/or correct your personal data.

Right to erasure/right to be forgotten and right to restriction - To request the erasure of your data or restriction of your data which has been processed in violation of the law, including whose storage is not necessary in relation to the purposes for which the data was collected or otherwise processed; where we have made your personal data public, you have also the right to request the erasure of your personal data and to take reasonable steps, including technical measures, to inform other data controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Right to data portability - To receive a copy of your personal data you provided to us for a contract or with your consent in a structured, commonly used and machine-readable format (e.g. data relating to your purchases) and to ask us to transfer that personal data to another data controller.

Right to withdraw your consent - Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

Right to object, at any time - You have the right to object at any time to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement , or where we are using your data for direct marketing.

Right not to be subject to a decision based solely on automated processing, including profiling - You can always request a manual decision- making process instead, express your opinion or contest decision based solely on automated processing, including profiling, if such a decision would produce legal effects or otherwise similarly significantly affect you. You can exercise the above rights at any time by:

• Contacting us via email at [email protected]

• As for direct marketing, please note that you can also object at any time by clicking the unsubscribe link which we provide in each communication sent to you

• As for online targeted ads and the withdrawal of your consent please refer to our Cookie section of this Privacy Policy.

In case you exercise any of the above rights provided by GDPR, please note that we will attend your request considering the personal information held by LASTMINUTE.COM NV.

Your rights in relation to your personal data might be limited in some situations. For example, if fulfilling your request would reveal personal data about another person or if we have a legal requirement or a compelling legitimate ground we may continue to process your personal data which you have asked us to delete.

You also may have the right to make a complaint if you feel your personal information has been mishandled. We encourage you to come to us in the first instance but, to the extent that this right applies to you, you are entitled to complain directly to the relevant Data Protection Supervisory Authority.

9.1 Types of cookies according to the managing entity

• First party cookies: these are sent to your Device from a computer or domain managed by us and from which the service you requested is provided.

9.2. Types of cookies according to the length of time you stay connected

Depending on the amount of time you remain active on your Device, these are the following types of cookies:

• Session cookies:these are designed to receive and store data while you access the Website. These cookies do not remain stored on your Device when you exit the session or browser.

• Persistent cookies: these types of cookies remain stored on your Device and can be accessed and processed after you exit the Website as well as when you navigate on it for a pre-determined period of time. The cookie remains on the hard drive until it reaches its expiration date. The maximum time we use persistent cookies on our Website is 2 years. At this point the browser would purge the cookie from the hard drive.

9.3. Types of cookies according to their purpose

• a) Technical cookies: these cookies are strictly necessary for the operation of our Website and are essential for browsing and allow the use of various features. Without them, you cannot use the search function, compare tool or book other available services on our Website.

• b) Analytical cookies for statistical purposes and measuring traffic: these cookies gather information about your use of our Website, the pages you visit and any errors that may occur during navigation. We also use these cookies to recognise the place of origin for visits to our Website. These cookies do not gather information that may personally identify you. All information is collected in an anonymous manner and is used to improve the functioning of our Website through statistical information. Therefore, these cookies do not contain personal data. In some cases, some of these cookies are managed on our behalf by third parties, but may not be used by them for purposes other than those mentioned above.

  You must keep in mind that if your Device does not have cookies enabled, your experience on the Website may be limited, thereby impeding the navigation and use of our services.

  There are a number of ways to manage cookies. By modifying your browser settings, you can opt to disable cookies or receive a notification before accepting them. You can also erase all cookies installed in your browser’s cookie folder. Keep in mind that each browser has a different procedure for managing and configuring cookies. Here’s how you manage cookies in the various major browsers:

  MICROSOFT WINDOWS EXPLORERGOOGLE CHROMEMOZILLA FIREFOXAPPLE SAFARI

  If you use another browser, please read its help menu for more information.

  If you would like information about managing cookies on your tablet or smartphone, please read the related documentation or help archives online.