Privacy Notice - Traveloka PH

1. Personal Data We Collect

Personal Data means any information about you or from which you are identifiable. This includes a piece of information or in combination with other information about you— such as your name, address, date of birth, occupation, phone number, e-mail address, image, bank account and credit card details, gender, or government-issued identifier, and financial related information ("Personal Data"). We collect and process Personal Data, as the data controller or processor (as applicable), in the ways listed below:

1.1 Data Collected Whenever You Use the Site/Apps

If you are a User
We collect Personal Data which identifies or can be used to identify, contact, or locate you. Without collecting such Personal Data, we would not be able to provide you with all services you requested on the Site or Apps. The Personal Data we directly collect from you, includes, but is not limited to, your:
- (i) Full name
- (ii) Email address
- (iii) Phone number
- (iv) Date of birth
- (v) Gender
- (vi) Identification or passport number
- (vii) Your booking ID (BID)
- (viii) Details of your bookings (such as hotel name, hotel location, and length of stay)
- (ix) Your travel preferences
- (x) Details of your airline frequent flyer membership
- (xi) Your reviews
In some cases, we will request a user to provide us with a government-issued document(s) as part of our know-your-customer process if required under the applicable laws or Our Terms & Conditions to identify you and to process your request and/or additional services such as certain financial services, refund process, insurance claim, and booking cancellation.
If you are a vendor or supplier

In order for the Site and its features to work, we collect Personal Data that identifies or can be used to identify, contact, or locate a person or any property or business related to the services provided by the vendor on the Site. We also collect other Personal Data that is needed to implement any payment obligation between you and us including any related tax obligation.
If you utilize any payment and/or transactional services on the Site or Apps

We will collect certain Personal Data related to the payment and/or transactional services you used. Those data include (but are not limited to) payment card number or account identifier, payment card or account holder, sender and receiver details, and history of transactions.
If you apply for a job

We will collect your resume, work history, and education qualifications as part of our talent application, onboarding, and consideration/acceptance processes.

1.2 Data Collected from Your Device

Whenever you use the Site, we will collect Personal Data in the form of technical data regarding your device and device usage such as information about web pages viewed, session duration, the internet device identity (ID), and may include:

Geographic location: we may collect information about your actual location, to provide you with the offers in the relevant location as provided in the Site. We may also derive your approximate location from your IP address, GPS, and other information provided by your mobile device.
Log Information: when you are using the Site, we will collect information that we refer to as "log information". The log information may be collected even though you do not create an account on the Site. This log information may include (but is not limited to) IP address, browser type, operating system, country, pages visited, your mobile carrier, device information, as well as other Internet usage-related information. We use the log information to provide you with a better experience using the Site.
Cookies and similar technologies: A cookie is a small piece of data that is stored in your computer or mobile device to help us track your internet usage. We use cookies in certain email notifications we send after a purchase/reservation of goods/services on the Site has been made. Please deactivate the cookies option if you wish us to stop the cookies feature and kindly note that if you deactivate cookies, you may not be able to access all or part of the Site or to use all or part of the functionality through the Site.
Device and Installed Application Information: the data and information from your phone and/or from the installed apps on your device may be collected to provide a segmented risk profile and generate aggregated statistical information only when necessary and including when required for Traveloka’s financial services-related checking. To protect your identity, we remove all personal identifiers (if any) and pseudonymize such information. Any metadata processed in this way cannot be used to reproduce the original data collected.

1.3 Data We Collect from Third Parties

We generally collect personal data directly from data subjects, except in certain cases where we collect Personal Data from third parties (“Third Party”) such as:

Companies and/or organizations that act as vendors and other parties who perform any process on our behalf, provide services on the Site, provide services to us, or whom we collaborate with under any contractual or other commitment;
Your advisers (including but not limited to accountants, auditors, lawyers, financial advisers, or other professional advisers) that were authorized by you;
Any person notified by You as your authorized representative; or
Any person, authorities, regulators, or third parties to whom we are permitted or required to disclose under the laws.
Any Personal Data obtained from your employer, as part of your registration for services on the Site through our business or corporate services, has been provided with proper consent from the employees.
Personal Data is collected regarding certain financial information and history when you register, access, add, and/or link (as relevant) for a payment card, loan product, insurance, or other financial services product or account through the Site. This Personal Data includes but is not limited to payment card or account transaction history, payment card or account details, and mapping and/or payment card or account status from the relevant payment or financial services provider or any other third parties.

In such cases, the collection will be conducted upon your acknowledgment/direction to the relevant third party, or subject to obtaining explicit consent from You prior to such collection.

1.4 Third-Party Personal Data You Provide to Us

You may provide us with Personal Data relating to other third-party individuals (including when you add any third-party individual data as flight passengers or hotel visitors). In that case, you undertake and warrant to us that you have already obtained properly documented approval from the relevant third-party individual and hereby consent on behalf of such individuals to the collection, use, disclosure, and processing of his/her Personal Data by us. If we are unable to collect your Personal Data, we may not be able to provide our services to you.

2. How We Collect, Process, Use, or Disclose Your Personal Data

2.1 Use of Personal Data

We may process and use Your Personal Data based on your request or Terms of Use that you have accepted and agreed to be bound for, including but not limited to, the following purpose (“Purposes”):

Identifying you as a user or vendor, which includes registering, maintaining, and managing your account on our Site;
Offering you travel and lifestyle packages, as well as financial services and payment options suitable for your preferences;
Verifying your account, transaction, and/or registration as we may, in our sole discretion necessary before providing services on the Site;
Managing, operating, and administering the Site;
Contacting you regarding your use of, and access to the Site and managing the queries and requests submitted by you through the Site;
Customizing your experience when using the Site;
Measuring and improving your customer experience and satisfaction, including managing your rewards points, providing you with direct or personalized marketing activities, and providing or offering services from us or our vendor and business partners;
Monitoring and analyzing your activities, demographic data, behavior, search queries, response time for the various services provided on the Site, and any Personal Data you provided to the Site in order to support and improve the performance, user experience, growth, and functions of the Site. We will anonymize your Personal Data (or use another method as required by the applicable laws) before we process it for these purposes;
Detecting and preventing money laundering, terrorism financing, fraud, abusive behavior, and harmful or illegal activity, including complying with the applicable laws, responding to legal requests, and protecting our rights;
Publishing your reviews about our services as well as the listed products on the Site;
Enforcing the provisions of the Traveloka Terms of Use;
Resolving disputes, collecting outstanding payments, and troubleshooting; and/or
For any other purposes that we notify you of when we collect the Personal Data.

2.2 How we use your Personal Data for marketing activities:

Digital marketing, which includes, but is not limited to, social media, display advertising, Search Engine Optimization (SEO), Search Engine Marketing (SEM), and push notifications (e.g., using open graph techniques, etc.);
Conventional marketing purposes, which include, however, are not limited to, sending you emails or communications about new products, special offers, Traveloka products that might be relevant to you, newsletters, updates, promotional materials, special privileges, festive greetings, surveys, and/or other information which we think you may find interesting;
Registering your use of, access to, and creation of an account/accounts on the site/application of our subsidiaries and/or affiliated companies; and
Migration of your reviews on our Site to the site/application of our subsidiaries and/or affiliated companies (“Migration Process”).
We may communicate such marketing to you by various means, where applicable (including by SMS, WhatsApp, push notification, or email).

Please note that you may opt out of receiving marketing materials from us including the Migration Process by following the unsubscribe instructions set out in our marketing materials or by contacting us on the contact details set out below and we will respect your wishes. However, please note that the opt-out will take effect within 7 (seven) Business Days after you successfully unsubscribe from the service.

2.3 Basis of Processing

Additionally, we may collect, process, use, or disclose your Personal Data, to the extent necessary, for an applicable legal basis in accordance with this Privacy Notice as follows:

Consent:
We typically collect, use, disclose, or otherwise process your Personal Data in accordance with this Privacy Notice with your consent when you access our Site and/or make bookings with us.
Contract:
Your Personal Data may be processed to fulfill contractual obligations when you engage in transactions or bookings with us, as governed by our Terms and Conditions and this Privacy Notice when using our services available on the Site/Apps.
Legal Obligations:
In some circumstances, we may process your Personal Data to comply with legal obligations and requirements imposed by applicable laws, governmental authorities, or regulatory agencies.
Vital Interest:
We may process your Personal Data when it is necessary to protect your vital interests or those of others.
Legitimate Interest:
Personal Data may be processed based on our legitimate interests, such as improving our services, managing security, and preventing fraud, while considering your rights and interests, as described in this Privacy Notice.

3. Sharing of Your Personal Data

We may share your Personal Data with other companies, organizations, and individuals including our subsidiaries and affiliates, who have agreed to treat your Personal Data in a manner no less secure than the standard outlined in this Privacy Notice (each a "Third-Party") in connection with providing our services to you and to our other customers and for any of the following purposes as well as for such other purposes if permitted and/or required by applicable law:

If you are a user, to help facilitate bookings or other interactions between users and/or vendors;
If you are a user, for the purpose of enabling us and/or vendors to perform or deliver a service/feature on the Site;
If you are a vendor, for the purpose of enabling a user to request, receive, and complete any booking or reservation from users to you;
To Third-Party in relation to any verification, authentication, risk assessment, fraud prevention, product development and maintenance as we or other Third-Party may consider necessary before providing and/or offering you with relevant services/products including any activities related to anti-money laundering and counter terrorism financing prevention, and conducting thorough assessments of customer and business information;
In relation to the transaction process in the form of merger, consolidation, change of control or ownership, restructuring, and/or sale of company assets of Traveloka's business, then your Personal Data may be disclosed and transferred as part of the transaction (even if the transaction is eventually not proceeded with).
In relation to our services, we share Personal Data with providers and vendors of website hosting, data analysis, marketing, promotions, processing credit card transactions, assessment of creditworthiness, and other relevant services;
If you are a user, to facilitate in our effort to conduct the collection of any outstanding or due payment obligations you may have to us;
If you are a user, to help facilitate the refund process or insurance claim with our vendors or service providers; and/or
If you are a user, to help facilitate the verification process with any third-party providing services on our Site.

We will notify you if we need to and seek your consent if we need to additionally collect, use, or process your Personal Data for other purposes other than expressly stated in this Privacy Notice.

4. Cross Border Data Transfer

Services provided through the Site can be used around the world. To make that possible, you acknowledge and consent that your Personal Data may be transferred to or accessed by entities around the world. Your Personal Data may be transferred from the country (“Original Country”) in which you are present while using our Services to another country (“Recipient Country”).

When we transfer your Personal Data from your Original Country to the Recipient Country, we will diligently adhere to all legal and regulatory obligations concerning your data to help ensure your data is protected. This includes establishing a legitimate reason for such transfer and implementing appropriate measures to maintain an equivalent level of protection for your Personal Data. Additionally, we will ensure that the recipient in the Recipient Country is bound to safeguard your Personal Data in a manner consistent with the standards set forth by applicable laws. In any case, we will take appropriate steps to ensure that your Personal Data remains subject to a standard of protection comparable to the requirements under the laws of your country.

5. Rights with Respect to Your Personal Data

As per the provisions of relevant laws and regulations, you have the following rights in relation to your Personal Data:

You may request information about the processing of your Personal Data and obtain a copy of it.
You may create a user account based on the information you provide. By providing that information, registering, and creating your account, you also warrant that the information you provide is true and accurate, current, and complete.
In certain cases, you have the right to request the correction and/or deletion of your Personal Data.
In specific circumstances, you can request the restriction of or object to the processing of your Personal Data.
You can withdraw your consent to the processing of your Personal Data, provided that our processing relies on your consent.
You may request to receive or transfer your Personal Data to another organization in a machine-readable format, where your data is processed based on your consent or as part of a contractual performance.
If your data privacy rights are violated or you have suffered harm due to unlawful processing of your Personal Data, you have the right to lodge a complaint with the relevant data privacy authority.

When you are given the option to share your Personal Data with us, it is always your choice. If you have previously granted consent for processing and decide to revoke it, we will respect your decision in compliance with our legal obligations.

Nevertheless, abstaining from sharing your Personal Data with us or withdrawing your consent, or disagreement with our Privacy Notice, may impact our ability to perform the necessary actions for the purposes outlined in or restrict your use of the Apps or Site.

Please note that all requests will undergo thorough screening and verification. To confirm your identity and authority to make a request, we may ask you to provide supporting information or documentation. Once verified, we will process your request within the timeframes prescribed by relevant laws.

6. Amendment & Update to this Notice

From time to time, Traveloka may revise this Privacy Notice to reflect changes in the laws and regulations, our use practices, the features of our Site and/or advances in technology. If we make revisions that change the way we collect or use your Personal Data:

We will notify you of any such amendments by means of a general notice published on the Site, or otherwise to your e-mail address set out in your account,
Those changes will be posted in this Privacy Notice, and the effective date will be noted at the beginning of this Privacy Notice, and
Your continued use of the Site, communications with us, or access to and use of the services following any amendments to this Privacy Notice will constitute your acceptance of this Privacy Notice and all its amendments.

Your continued use of Traveloka services, Apps and/or Site following the effective date of the modifications, updates, or amendments to this Privacy Notice, whether or not reviewed by you, shall constitute your agreement to be bound by such amendments.

7. Removal of Your Personal Data

To the extent permitted by applicable law, you may have the right to request us to remove your Personal Data that we hold from our systems. You may submit a deletion request to us at our contact details listed below.

We, without undue delay or within a time period as stipulated under the applicable law, shall use reasonable effort to erase your Personal Data or will use reasonable efforts to remove the means or personal identifiers by which the Personal Data can be associated with you as an individual, if:

The purpose for which Personal Data was collected is no longer being served by the retention of that Personal Data;
We are not otherwise permitted or required by applicable law to retain the Personal Data; and/or
In case it is mandated by applicable law, based on your request to delete your Personal Data.

Please note that by requesting us to remove your Personal Data, we may not be able to continue providing you with some of our services and you agree that we will not be liable to you for any losses or damages arising out of or in relation to such termination of services.

8. Retention of Your Personal Data

Unless we remove your Personal Data from our systems following the receipt of a request from you, your Personal Data will be retained by us for as long as your account is in existence, and as needed to provide you with our services, and/or for our legitimate business interests, or for as long as such retention is obligated or authorized by applicable law.

We will delete your Personal Data after 5 (five) years or a longer period as required by applicable laws and regulations from the date you terminated/de-registered your account with us.

9. Protection of Your Personal Data

We will protect your Personal Data by maintaining reasonable security arrangements, including physical, technical, and organizational measures, to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks. It is important to remember that even though we have several safeguards in place to protect your information, nothing within the internet is 100% secured and we cannot guarantee the safety of your Personal Data.

If we are subject to a data breach that relates to your Personal Data, to the extent required by applicable law, we will notify you through our channels, whether directly or indirectly, to give you sufficient information regarding such data breach and will work to protect against the misuse of your Personal Data.

10. Links to Other Websites

The Site may contain links to other websites. You should note that we do not have any control over such other websites. Please note that we are not responsible for the privacy Notice or practices of such other websites and advise you to read the privacy Notice of each website you visit that collects any of your Personal Data.

11. Complaints

If you have a complaint regarding the treatment of your Personal Data by us, please contact us at our Contact Details listed below. We will treat your complaint in a confidential manner. We will contact you within a reasonable time after receipt of your complaint to discuss it and to outline options regarding how your complaint may be resolved.

If you have a complaint regarding the treatment of your Personal Data that is not resolved by us, you may be able to make a complaint to the relevant regulatory authority. Any Personal Data that we collect while processing or resolving your complaint will be used solely for that purpose.

12. Contact Details

If you have any questions or complaints regarding this Privacy Notice or if you would like to access and/or correct your Personal Data, please contact the relevant Data Protection Officer (DPO) for your country:

Traveloka Group DPO and Legal Compliance team
Email: privacy@traveloka.com

Address: PT Traveloka Indonesia
Traveloka Campus (d/h Green Office Park 1) North Tower, Jl Grand Boulevard, BSD Green Office Park, Kel. Sampora, Kec. Cisauk, Kab.Tangerang, Prov. Banten, 15345
Traveloka Singapore
Address: Robinson 77, 77 Robinson Rd, Level 9 & 11 Singapore 068896
Traveloka Vietnam
Email: dpo.vn@traveloka.com

Address: 2nd Floor, An Phu Plaza, 117-119 Ly Chinh Thang Street, Vo Thi Sau Ward, District 3, Ho Chi Minh, Vietnam
Traveloka Philippines
Email: dpo.ph@traveloka.com

Address: Level 10-1 Fort Legend Tower, 31st Street & 3rd Avenue, Bonifacio Global City, Taguig, 1634, Metro Manila
Traveloka Thailand
Address: 3 Rajanakarn Building 28th floor, South Sathorn Rd, Sathorn, Bangkok 10120
Traveloka Malaysia
Address: Tower 2 Level 14 Menara Kembar Bank Rakyat, 33 Jalan Rakyat, Brickfields, KL

13. Language & Interpretation

This Privacy Notice is subject to translation into multiple languages. In case of any discrepancies between the English version of this Privacy Notice and its translations in other languages, the English version will take precedence.

Any capitalized terms not defined within this document will carry the same definitions as outlined in Traveloka's Terms and Conditions, as well as in this Privacy Notice.

14. Country Specific Requirements

14.1 Singapore

Registration Identity Card ("NRIC") or other national identification numbers for Site or Apps related purposes, to the extent permissible by law. However, please note that We may collect, use, and disclose your NRIC number or Foreign Identification Number (FIN) in accordance with applicable law to fulfill our obligations and to prevent, detect, and investigate fraudulent activity within the Site or Apps.

14.2 Vietnam

Please be informed that among the Personal Data we may collect as the foregoing, there might be some sensitive personal data according to the regulations in Decree 13/2023/ND-CP on Personal Data Protection. In such cases, we strongly advise you to carefully check your about-to-share data before continuing your transaction with us.

Unless the laws state otherwise, if there is a third-party individual who is a full-7-year-old or older child, you undertake and warrant to us that you have already obtained properly documented consent of the child and his/her parent or legal guardian to the processing of his/her Personal Data by us. The Personal Data we collect shall include date of birth for age verification and others depending on the queries or services you wish to acquire. We commit that the processing of children’s personal data is always done in accordance with the principle of protecting the rights and in the best interests of children.

15. Privacy Notices in Other Countries

Please check this Privacy Notice tailored or translated to your country/language:

Singapore

Thailand

Vietnam

Malaysia

Indonesia

Philippines

If there is any inconsistency between the English version of this Privacy Notice and other language versions, the English version shall prevail.