Privacy Policy

Effective Date of Current Policy: April 25, 2024

1. PURPOSE

This Privacy Policy describes our data practices with regard to your Personal Information, including the kinds of information we collect, how we collect, use, disclose, and retain that information, and how you can exercise choice regarding that information. “Personal Information” means any information relating, or reasonably capable of being linked, to you.

This Privacy Policy covers the data practices of JRSK, Inc. and its affiliates Away Travel Limited, Away Travel Australia Pty Ltd., Away Travel ULC, and Away BV (collectively, “Away,” “we” “our,” or “us”). It applies to Personal Information we collect through our websites, emails, and other online services we control (collectively, the “Services”), our stores (“Stores”), and other locations we control subject to this Privacy Policy. It does not apply to information collected by third parties or information collected in the context of your employment with us.

Your use of the Services is also governed by our Terms and Conditions.

Some regions provide additional rights by law, as described below:

• California
• Colorado, Connecticut, Utah, and Virginia
• Nevada
• European Economic Area, Switzerland, and United Kingdom

For our contact details, see the Contact Us section below.

2. TYPES OF PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT

We collect information about you in a variety of contexts, as described below.

2.1 PERSONAL INFORMATION YOU PROVIDE THROUGH THE SERVICES

When you use the Services, you may be asked to provide Personal Information to us, such as when you register an account, make a purchase, sign-up for our newsletters, participate in a promotion, respond to our surveys, contact support, or apply for a job. The categories of Personal Information we collect include:

• Contact identifiers, including your name, email address, mailing address, and phone number.
• Characteristics or demographics, including your country.
• Commercial or transactions information, including records of products or services you purchased, obtained, or considered.
• Account credentials, including your username, password, password hints, and other information for authentication or account access.
• Payment information, including your payment instrument number (such as a credit or debit card number), expiration date, and security code as necessary to process your payments. This information is processed by our payment processors.
• User-generated content, including content within any messages you send to us (such as feedback, questions, or survey responses) or publicly post on the Services (such as in product reviews or blog comments).
• Contact identifiers relating to other consumers, including contact identifiers you provide about your friends when you use our refer-a-friend service. Do not provide us with any information relating to other consumers unless you have their express consent.
• Professional, employment, or education-related information, including your employment and work history, transcripts, writing samples, references, and other information necessary to consider you for a job.

Please do not provide any information that we do not request.

2.2 PERSONAL INFORMATION FROM YOUR BROWSER OR DEVICE WHEN YOU USE THE SERVICES

When you use the Services, we and third parties we work with automatically collect Personal Information from your browser or device. The categories of Personal Information we automatically collect include:

• Device identifiers, including your device’s IP address and Ad Id.
• Device information, including your device’s operating software and browser (e.g., type, version, and configuration), internet service provider, and regional and language settings.
• Internet activity, including information about your browsing history and interactions, such as the features you use, pages you visit, content you view, purchases you make or consider, time of day you browse, and referring and exiting pages.
• Non-precise location data, such as location derived from an IP address or data that indicates a city or postal code level.

This information is automatically collected through cookies and other tracking technologies incorporated into our Services, as described in the Cookies and Tracking Technologies section below.

2.3 PERSONAL INFORMATION WHEN VISIT OUR STORES

When you visit our Stores, we collect Personal Information, including your contact identifiers, and payment information when you make a purchase. We also deploy security cameras to capture video for security purposes. In some stores, we deploy video cameras with software that allows us to count the number of customers who enter our stores and track their physical movement within our stores. The software does not engage in any facial scanning, make determinations regarding user age, ethnicity, or gender, or otherwise use information with the intent to identify a specific individual.

2.4 PERSONAL INFORMATION FROM OUR BUSINESS RELATIONSHIPS

Through our business relationships with you, we collect information about you such as your contact identifiers. This information is not subject to this Privacy Policy except as required by applicable law.

2.5 PERSONAL INFORMATION FROM OTHER SOURCES

We obtain Personal Information about you from other sources. The categories of other sources from which we collect Personal Information include:

• Business partners that offer co-branded services, sell or distribute our products, or engage in joint marketing or promotional activities.
• Third party vendors and related parties we work with in connection with receiving analytics, advertising, security, and fraud prevention services.
• Social media platforms with which you interact. For example, when you “like,” “follow”, or otherwise engage with our content on social media (such as through our brand page or direct message), we may collect information such as your contact identifiers and any comments you provide. If you publicly reference us on social media (such as by using a hashtag associated with us in a tweet or post), we may use your reference on or in connection with our Services.
• Data providers, such as licensors of private and public databases.
• Public sources, including where information is in the public domain.

2.6 PERSONAL INFORMATION WE INFER

We infer new Personal Information from other information we collect, including to generate information about your likely preferences or other characteristics.

2.7 SENSITIVE PERSONAL INFORMATION

To the extent any of the categories of Personal Information we collect are sensitive categories of Personal Information under applicable law, we process such information only for the limited purposes permitted by applicable law. We do not sell or use sensitive categories of Personal Information for purposes of targeted advertising or to make inferences.

3. HOW WE USE YOUR PERSONAL INFORMATION

We collect and use Personal Information in accordance with the practices described in this Privacy Policy. Our purposes for collecting and using Personal Information include:

• Providing services. We use Personal Information to provide services, including to operate the Services.
• Administrative Purposes. We use Personal Information for administrative purposes, including to establish and maintain your account, ensure quality control, process transactions, and address legal requirements.
• Personalizing your experience. We use Personal Information to personalize your experience and show you content we believe you will find interesting.
• Communications. We use Personal Information to communicate with you about updates, security alerts, changes to policies, and other transactional messages. We also use Personal Information to personalize and deliver marketing communications to you. Communications may be by email, direct mail (“mailers”), and, where you opt-in, text.
• Research and Development.  We may perform research, including via surveys. We may engage service providers to conduct such surveys on our behalf. All survey responses are voluntary, and the Personal Information collected will be used for research and reporting purposes, to help us learn more about individual needs and the quality of the products and services we provide, and to determine the effectiveness of our Services, and the various types of our communications, advertising campaigns, and/or promotional activities.
• Analytics. We use Personal Information to understand trends, usage, and activities, for example through tracking technologies that we incorporate into the Services (such as Google Analytics), and to improve our services and make business and marketing decisions.
• Advertising. We work with agencies, ad networks, technology providers, and other third parties to place ads about our products and services on other websites and services. For example, we place ads through Google and Facebook that you may view on their platforms as well as on other websites and services. As part of this process, we incorporate tracking technologies into our own Service as well as into our ads displayed on other websites and services. Some of these tracking technologies may track your activities over time and across non-affiliated services and obtain or infer information about you for purposes of showing you relevant advertising based on your preferences and interests (“targeted advertising”). We also use audience matching services (which is a type of targeted advertising) to reach people (or people similar to people) who have visited our Service or are identified in one or more of our databases (“matched ads”). This is done by us providing a list of hashed email addresses or other identifiers to a third party or incorporating a pixel from a third party into our own Service, and the third party matching common factors between our data and their data. For instance, we incorporate the Facebook pixel on our Service and may disclose your hashed email address to Facebook as part of our use of Facebook Custom Audiences. Similarly we use audience matching services in connection with our mailers.
• Security and enforcement. We use Personal Information to prevent, detect, investigate, and address fraud, breach of policies or terms, or threats or harm.
• Promotions. When you voluntarily enter a promotion, we use Personal Information as set out in the official rules that govern the promotion as well as for administrative purposes and as required by law. By entering a promotion, you agree to the official rules that govern that promotion, and that, except where prohibited by applicable law, we, the sponsor, and related entities may use your name, voice and/or likeness in advertising or marketing materials.
• Recruitment. We use Personal Information to make decisions about recruiting and in anticipation of a contract of employment.
• At your direction or with your consent. We use Personal Information for additional purposes where you direct us to use it in a certain way or with notice to you and your consent.

Sometimes we aggregate or de-identify information so it is no longer considered Personal Information. We may use non-Personal Information for any purpose to the extent permitted by applicable law. For details on your choices around use of your information, see the Your Privacy Choices section below.

4. HOW WE DISCLOSE YOUR PERSONAL INFORMATION

We disclose the Personal Information we collect as described in this Privacy Policy. The categories of persons to whom we disclose Personal Information include:

• Service providers. Many of the third parties we work with are service providers that collect and process Personal Information on our behalf. Service providers perform services for us such as payment processing, data analytics, marketing and advertising, website hosting, and technical support. To the extent required by law, we contractually prohibit our service providers from processing Personal Information they collect on our behalf for purposes other than performing services for us, although we may permit them to use non-Personal Information for any purpose to the extent permitted by applicable law.
• Third party vendors and related parties. Some of the third parties we work with to perform services act as our service providers in some contexts, but in other contexts independently control the purposes and means of processing your Personal Information. For example, we disclose Personal Information to ad networks, technology providers, and other third parties that help provide targeted advertising, but may also use Personal Information for their own purposes. For these third parties, we encourage you to familiarize yourself with and consult their policies and terms of use.
• Business partners. We disclose Personal Information to our business partners in connection with offering co-branded services, selling or distributing our products, or engaging in joint marketing or promotional activities.
• Affiliates. We disclose Personal Information to our affiliates and related entities, including where they act as our service providers subject to this Privacy Policy or use the information in accordance with their own privacy policies.
• The public. The content you post publicly will be available to others. For example, other users of the Service may be able to see your name if you submit a review. We are not responsible for the actions of other users who view and use your posted content. Once you have posted information, you may not be able to edit or delete such information, subject to any rights you have under applicable law.
• Recipients for security and enforcement. We will disclose your Personal Information if we believe doing so is required or appropriate to: (i) comply with law enforcement or national security requirements and legal process, such as a court order or subpoena; (ii) respond to requests; (iii) protect your, our, or others’ rights, property, or safety; (iv) enforce our policies or contracts; (v) collect amounts owed to us; or (vi) prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity. For example, IP addresses may be disclosed to law enforcement bodies in order that they may identify users in connection with their investigation of the unauthorized activities.
• Recipients in a merger, sale, or other asset transfers. If we are involved in a proposed or actual merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, then your Personal Information may be sold or transferred as part of such contemplated transaction as permitted by applicable law.
• Recipients at your direction or with your consent. We disclose Personal Information where you direct us to or with notice to you and your consent.

Sometimes we aggregate or de-identify information so it is no longer considered Personal Information. We may disclose non-Personal Information for any purpose to the extent permitted by applicable law. For details on your choices around disclosure of your information, see the Your Privacy Choices section below.

5. THIRD PARTIES
Our Services may contain links to other websites and services controlled by third parties. In addition, we may integrate technologies, including those disclosed in the Cookies and Tracking Technologies section below, controlled by third parties. We do not endorse or make any representations about third party data practices. Except where third parties act as our service providers, they, and not us, control the purposes and means of processing any Personal Information they collect from you, and you should contact them directly to address any concerns you have about their processing. We encourage our users to read the privacy policies of each third party that they interact with.

6. COOKIES AND TRACKING TECHNOLOGIES

We and the third parties we work with use cookies and other tracking technologies in connection with the Services, as described below:

• Cookies. Cookies are small text files placed on your browser when you visit a website, open or click on an email, or interact with an advertisement. Our Services use session cookies (which expire when you close your browser) and persistent cookies (which expire at a set expiration date or when you manually delete them). We incorporate both first party cookies (which are cookies served directly by us) and third party cookies (which are cookies served by third parties we work with).
• Pixel. A pixel (also known as a web beacon) is a piece of code embedded within a service. There are various types of pixels, including image pixels (which are one-pixel transparent images) and JavaScript pixels (which contain JavaScript code). Pixels are often associated with cookies and are used for similar purposes. When you access a service that contains a pixel, the pixel may permit us or a third party to drop or read cookies on your browser, or collect other information about your browser or device.

We use such tracking technologies for the following purposes:

• Strictly Necessary. These tracking technologies are necessary for the operation of our Services, such as making our websites work, identifying irregular website behavior, preventing fraudulent activity and assisting with security, saving searches, and filling out forms.
• Performance-Related. These tracking technologies allow us to assess the performance of our Services, including as part of our analytic practices to help us understand how our visitors use our websites, determine whether you have viewed an item or link, or improve our Services;
• Functionality-Related. These tracking technologies allow us to offer you enhanced functionality when accessing or using our Services, such as identifying you when you sign-in to our Services, keeping track of your specified preferences, interests, or past items viewed, or helping us enhance the presentation of content on our Services.
• Targeting-Related. These tracking technologies may be set by us or our advertising partners and allow us to engage in advertising to you. They may be used by those third parties to build a profile of your interests and show you relevant adverts on other sites. 

For details on your choices around cookies and other tracking technologies, see the Your Privacy Choices section below.

7. YOUR PRIVACY CHOICES

7.1 REGION-SPECIFIC RIGHTS

Some regions provide additional rights by law, as described in our region-specific terms. This subsection details how you may exercise some of those rights to the extent they apply to you.

7.1.1 ACCESS, CORRECTION, AND DELETION

Depending on where you reside, you may have the right to (1) request to know more about and access your Personal Information, including in a portable format, (2) request deletion of your Personal Information, and (3) request correction of inaccurate Personal Information.
To exercise these rights, please submit a request through our webform in the Privacy Center. Residents of the US may alternatively call our toll free number at 844-202-2011. Residents of the European Economic Area, Switzerland, or the United Kingdom may alternatively:

Email us: privacy@awaytravel.com

Send us a letter: Away Travel Limited
11th Floor Whitefriars Lewis Mead
Bristol, England,
United Kingdom, BS1 2NT
Attention: Privacy Counsel

We will process your request in accordance with our obligations under applicable law.

7.1.2 OPTING OUT OF SALES, SHARES, AND TARGETED ADVERTISING

Depending on where you reside, you may have the right to opt out of sales or shares (as those terms are defined by applicable law), or the processing of your Personal Information for targeted advertising purposes. You can do so by following the prompts here or by visiting our website while using a legally-recognized opt out preference signal such as the Global Privacy Control. Please note that when you submit an opt-out through either method we do not know who you are within our systems, and your opt-out will apply only to information collected from tracking technologies on the specific browser from which you opt-out. If you delete or reset your cookies, or use a different browser or device, you will need to reconfigure your settings. For your opt-out to apply to information we have about you in our systems, you will need to provide your email address when you submit a request through our form.

7.2 COMMUNICATIONS

You can opt-out of receiving certain communications from us, as described below. Your opt-out is limited to the email address, phone number, or mailing address used and will not affect subsequent subscriptions.

• Emails. Through your account settings, by following the unsubscribe instructions near the bottom of such emails, or by emailing us as set out in the Contact Us section below with the word UNSUBSCRIBE in the subject field of the email. Please note that you cannot opt out of transactional messages.
• Texts and calls. For texts, by texting “STOP” in response to any text message you receive from us or contacting us as set out in the Contact Us section below and specifying you want to opt-out of text messages. For calls, by requesting opt-out during any call you receive from us or contacting us as set out in the Contact Us section below and specifying you want to opt-out of calls.
• Mailers. You may opt-out of receiving mailers from us by submitting a request to privacy@awaytravel.com.
  

7.4 BROWSER CONTROLS

• Cookies and pixels. You may be able to manage cookies through your browser settings. When you manage cookies, pixels associated with such cookies may also be impacted. Please note that cookie management only applies to our website. If you use multiple browsers, you will need to instruct each browser separately. If you delete or reset your cookies, you will need to reconfigure your settings. Your ability to limit cookies is subject to your browser settings and limitations.
• Preference signals. Your browser or extension may allow you to automatically transmit Do Not Track and other preference signals. Except as required by law, we do not respond to preference signals.
• Third party opt-out tools. Some third parties we work with offer their own opt-out tools related to information collected through cookies and pixels. To opt out of your information being used by Google Analytics, please visit https://tools.google.com/dlpage/gaoptout. We are not responsible for the effectiveness of any third party opt-out tools.
• Industry opt-out tools for targeted advertising. Some of the third parties we work with participate in programs that allow you to opt-out of receiving targeted advertising from participants. To opt-out of receiving targeted advertising from participants of the Digital Advertising Alliance (“DAA”) on your browser, visit https://www.aboutads.info/choices. To opt-out of receiving targeted advertising from participants of the Network Advertising Initiative (“NAI”) on your browser, visit https://www.networkadvertising.org/choices/. If you choose to opt-out of targeted advertising through these links, you should no longer see targeted advertising from the selected participants on the browser from which you opted-out, but the opt-out does not mean that the participants will not process your information for targeted advertising purposes or that you will not receive any advertising. We are not responsible for the effectiveness of any third party opt-out tools.

8. SECURITY

We take reasonable steps to help ensure that your Personal Information is treated securely and in accordance with this Privacy Policy. Unfortunately, the Internet cannot be guaranteed to be 100% secure, and we cannot ensure or warrant the security of any Personal Information you provide to us.

9. RETENTION

We retain the Personal Information we receive as described in this Privacy Policy for as long as reasonably necessary to fulfill the purpose(s) for which it was collected, provide our products and services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

10. DATA TRANSFERS

We are based in the United States. Any Personal Information we collected may be transferred or stored in the United States or in other regions around the world.

11. CHILDREN’S PRIVACY

We do not knowingly collect Personal Information from children under the age of 16, and no part of the Services is directed to children under the age of 16. If you believe that your child has provided us with Personal Information, please contact us at privacy@awaytravel.com. We will promptly take steps to delete such information and terminate the child’s account.

12. CHANGES TO THIS PRIVACY POLICY

We may revise this Privacy Policy in our sole discretion, so review it periodically. We will post any changes to this Privacy Policy on this web page, and the revised version will be effective immediately when it is posted. If the changes to this Privacy Policy are material, we may provide additional notice to you, such as by email or prominent notice of the Service.

13. CONTACT US

If you have any questions about or trouble accessing this Privacy Policy, please contact us:

By email: privacy@awaytravel.com

By mail:

Residents of the US:
JRSK, Inc. dba Away
503 Broadway, 3rd Floor
New York, NY 10012
Attention: General Counsel

Residents of the European Economic Area, Switzerland, or the United Kingdom:
Away Travel Limited
11th Floor Whitefriars Lewis Mead
Bristol, England,
United Kingdom, BS1 2NT
Attention: Privacy Counsel

To exercise choice, use the methods described in the Your Privacy Choices section above or your region-specific terms below.

14. CALIFORNIA

If you are a California resident, please review these additional privacy disclosures, which provide a summary of your rights under California law. Terms have the meaning ascribed to them in the California Consumer Protection Act as amended by the California Privacy Rights Act (“CPRA”), unless otherwise stated.

14.1 NOTICE AT COLLECTION

At or before the time of collection of your personal information, you have a right to receive notice of our data practices. Our data practices are as follows:

• For the categories of personal information we have collected in the past 12 months, see the Types of Personal Information We Collect and How We Collect It section above.
• For the categories of sources from which personal information is collected, see the Types of Personal Information We Collect and How We Collect It section above.
• For the specific business and commercial purposes for collecting and using personal information, see the How We Use Your Personal Information section above.
• For the categories of third parties to whom information is disclosed, see the How We Disclose Your Personal Information section above.
• For the criteria used to determine the period of time information will be retained, see the Retention section above.

We do not sell your personal information as that term is traditionally understood. However, some of our disclosures of personal information may be considered a “sale” or “share” as those terms are defined under the CPRA. A “sale” is broadly defined under the CPRA to include a disclosure for something of value, and a “share” is broadly defined under the CPRA to include a disclosure for cross-context behavioral advertising. We collect, sell, or share the following categories of personal information for commercial purposes: contact identifiers, characteristics or demographics, commercial or transactions information, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties to whom we sell or share your personal information include, where applicable, vendors and other parties involved in cross-context behavioral advertising. We do not knowingly sell or share personal information about consumers under the age of 16. For details on your rights regarding sales and shares, please see the Right to Opt-Out of Sales and Shares section below.

Some of the personal information we collect may be considered sensitive personal information under the CPRA. We collect, use, and disclose such sensitive personal information only for the permissible business purposes for sensitive personal information under the CPRA. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you.

14.2 RIGHT TO KNOW, CORRECT, AND DELETE

You have the following rights under the CPRA:

• The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which personal information is collected, the business or commercial purposes for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
• The right to correct inaccurate personal information that we maintain about you.
• The right to delete personal information we have collected from you.

To exercise any of these rights, please follow the instructions for data subject requests in the Your Privacy Choices section above. Please note these rights are subject to exceptions. If you have an account with us, we may require you to use the account to submit the request. We will confirm receipt of your request within 10 business days and respond to your request within 45 days. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your request.

14.3 RIGHT TO OPT-OUT OF SALES AND SHARES

To the extent we sell or share your personal information as those terms are defined under the CPRA, you have the right to opt-out of the sale or sharing of your personal information. To exercise this right, please follow the instructions for opting out of sales, shares, and targeted advertising in the Your Privacy Choices section above.

14.4 AUTHORIZED AGENT

You can designate an authorized agent to submit requests on your behalf. Requests must be submitted through the designated methods listed above. Except for opt-out requests, we will require written proof of the agent’s permission to do so and may verify your identity directly.

14.5. RIGHT TO NON-DISCRIMINATION

You have the right not to receive discriminatory treatment by us for the exercise of any of your rights.

14.6 SHINE THE LIGHT

If you are a California resident, you also have the ability to ask us, once per year and free of charge, for a notice identifying the categories of personal information, as defined by California Civil Code Section 1798.83, we disclose with third parties for their direct marketing purposes and the contact information for such third parties. If you would like a copy of this notice, please email us at privacy@awaytravel.com.

15. COLORADO, CONNECTICUT, UTAH, AND VIRGINIA

These additional rights and disclosures apply only to residents of Colorado, Connecticut, Utah, and Virginia. Terms have the meaning ascribed to them in the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), and the Virginia Consumer Data Protection Act (“VCDPA”), as applicable.

15.1 DATA SUBJECT REQUESTS

You may have the following rights under applicable law:

• To confirm whether or not we are processing your personal data
• To access your personal data
• To correct inaccuracies in your personal data
• To delete your personal data
• To obtain a copy of your personal data that you previously provided to us in a portable and readily usable format

To exercise any of these rights, please follow the instructions for data subject requests in the Your Privacy Choices section above. Please note these rights are subject to exceptions. We will respond to your request within 45 days. If you have an account with us, we may require you to use the account to submit the request. We may require specific information from you to help us confirm your identity and process your request. If we are unable to verify your identity, we may deny your request. We do not process personal data for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers.

15.2 RIGHT TO OPT-OUT OF SALES AND TARGETED ADVERTISING

You also may have the right to opt-out of the processing of personal data for purposes of targeted advertising or the sale of personal data. To exercise this right, please follow the instructions for opting out of sales, shares, and targeted advertising in the Your Privacy Choices section above.

15.3 AUTHORIZED AGENT

You can designate an authorized agent to submit requests on your behalf. Requests must be submitted through the designated methods listed above. Except for opt-out requests, we will require written proof of the agent’s permission to do so and may verify your identity directly.

15.4 APPEALS

If we refuse to take action on a request, you may appeal our decision within a reasonable period time by contacting us at privacy@awaytravel.com and specifying you wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint as follows:

• For Colorado residents, to the Colorado AG at https://coag.gov/file-complaint/
• For Connecticut residents, to the Connecticut AG at https://www.dir.ct.gov/ag/complaint/
• For Virginia residents, to the AG at https://www.oag.state.va.us/consumercomplaintform

16. NEVADA

If you are a Nevada consumer, you have the right to direct us not to sell certain information that we have collected or will collect about you. To exercise this right, please follow the instructions for opting out of sales, shares, and targeted advertising in the Your Privacy Choices section above.

17. EUROPEAN ECONOMIC AREA, UNITED KINGDOM AND SWITZERLAND

If you are located in the European Economic Area, the United Kingdom or Switzerland (collectively, “__Europe__”), please review these additional privacy disclosures which provide information about your rights under the EU General Data Protection Regulation (“__GDPR__”). Terms have the meaning ascribed to them in the GDPR.

17.1 DATA PRIVACY FRAMEWORK

We have certified to the U.S. Department of Commerce that we follow the EU-U.S. Data Privacy Framework Principles concerning the processing of personal data received from the European Economic Area in reliance on the EU-U.S. Data Privacy Framework and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. Data Privacy Framework.

The following are our other entities that have also certified to the Data Privacy Framework Principles regarding the collection, use, and retention of personal data from the European Economic Area and the United Kingdom transferred to the United States pursuant to the Data Privacy Framework:

8400 Melrose LLC; Away 364 Lafayette LLC; 371 Hayes LLC; Away Retail LLC; 82 Mercer LLC; Presenting NYC LLC; NYC East Holdings LLC.

If you have any inquiries or complaints about our processing of your personal data under the Data Privacy Framework, please first contact us, as set out in the Contact Us section above. When we share personal data from the EEA or UK with third-party service providers that processes the data solely on our behalf, then we will be liable for that third party's processing of such data in violation of the Data Privacy Framework Principles, unless we can prove that we are not responsible for the event giving rise to the damage.

We have further committed to cooperate and comply, respectively, with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of personal data received in reliance on the Data Privacy Framework.

If your complaint cannot be resolved through the above channels, you may pursue binding arbitration through the Data Privacy Framework Panel. Please see Annex 1 of the Data Privacy Framework here for more information.

If there is any conflict between the terms in this Privacy Policy and the Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern. To learn more about the Data Privacy Framework Principles, and to view our certification, please visit https://www.dataprivacyframework.gov/. We are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

17.2 ROLES

Away Travel Limited is the data controller with respect to any data transferred from Europe to the United States. Our address is set out in the Contact Us section above.

17.3 LAWFUL BASIS FOR PROCESSING

When we process your personal data as described above, we do so in reliance on the following lawful bases:

• To perform our responsibilities under our contract with you (e.g., Processing payments for and providing the products and services you requested).
• When we have a legitimate interest in processing your Personal Information to operate our business or protect our interests (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you).
• To comply with our legal obligations (e.g., to maintain a record of your consents and track those who have opted out of marketing communications).
• When we have your consent to do so (e.g., when you opt in to receive marketing communications from us). When consent is the legal basis for our processing your personal data, you may withdraw such consent at any time.

17.4 DATA SUBJECT RIGHTS

You have the right to access, rectify, or erase any personal data we have collected about you. You also have the right to data portability and the right to restrict or object to our processing of personal data we have collected about you. In addition, you have the right to ask us not to process your personal data (or provide it to third parties to process) for marketing purposes or purposes materially different than for which it was originally collected or subsequently authorized by you. You may withdraw your consent at any time for any data processing we do based on consent you have provided to us.

To exercise any of these rights, please follow the instructions for data subject requests in the Your Privacy Choices section above. We will respond to your request within 30 days. Although Away makes good faith efforts to respect requests, there may be circumstances in which Away is unable to address requests, including: where the information contains legal privilege, would compromise others’ privacy or other legitimate rights, where the burden or expense of providing access would be disproportionate to the risks to privacy in the case in question or where it is commercially proprietary. If Away determines that a request should be restricted in any particular instance, we will provide you with an explanation of why that determination has been made and a contact point for any further inquiries. To protect your privacy, Away will take commercially reasonable steps to verify your identity before granting access or making any changes to your personal data.