Privacy policy

1. Applicable Laws & Scope

This Privacy Policy applies to the Orbitza website and newsletter (the "Service"), operated by Orbitza ("we," "us," or "our"). We process personal information in accordance with applicable data protection laws, including, where they apply to you: the General Data Protection Regulation of the European Union ("GDPR"); the Brazilian General Data Protection Law ("LGPD", Lei Geral de Proteção de Dados); the California Consumer Privacy Act and the California Privacy Rights Act ("CCPA/CPRA"); and the laws of the State of New York and the United States.

Where these laws differ, we aim to provide the highest level of protection available. If a specific provision in this policy is inconsistent with a law that applies to you, the law prevails to the extent of the inconsistency.

2. Information We Collect

We collect only the information necessary to operate the Service, divided into the following categories:

• Personal Information You Provide: When you subscribe to our newsletter, we collect your email address. When you use the contact form, we collect your name, email address, and the content of your message. You may choose not to provide this information, but some features may then be unavailable.
• Usage Information: We may automatically collect technical information about your visit, including your IP address, browser type and version, device type, operating system, pages visited, referring pages, and the date and time of each visit. This information is collected in aggregated or anonymized form where possible.
• Cookies and Similar Technologies: We may use cookies and local storage to keep the Service functioning and to understand how visitors use the site. See Section 6 below for details.
• Correspondence: If you write to us by email, we retain the content of the correspondence and your contact details for as long as needed to resolve the matter.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the Service, including delivering the newsletter you have requested.
• To respond to your inquiries, messages, and requests, and to communicate with you about your subscription.
• To understand how the Service is used and to improve its content, design, and performance.
• To ensure the security and integrity of the Service, and to prevent fraud or abuse.
• To comply with our legal obligations and to protect our rights and the rights of others.

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects. We never sell your personal information.

4. Legal Bases for Processing (GDPR & LGPD)

Where the GDPR or the LGPD applies to you, we process personal information on the following legal bases:

• Consent: When you subscribe to the newsletter or submit a contact form, we rely on your freely given, specific, and informed consent. You may withdraw your consent at any time with effect for the future.
• Performance of a Contract: When processing is necessary to provide the Service you have requested.
• Legitimate Interests: To operate, secure, and improve the Service, to respond to your communications, and to prevent fraud — balanced against your rights and interests.
• Legal Obligation: When processing is required to comply with applicable law, regulation, or legal process.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:

• Service Providers: With trusted third parties who help us operate the Service (for example, website hosting and email delivery services). These providers access information only to perform tasks on our behalf and are contractually required to protect it.
• Analytics Partners: If we use analytics tools (such as Google Analytics or similar), they may process aggregated usage data. You can learn more about Google's data practices at the links in Section 7.
• Legal Requirements: When required by law, regulation, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction, subject to appropriate confidentiality protections.
• With Your Consent: In any other case, we will ask for your consent before sharing your information.

6. Cookies & Tracking Technologies

We use cookies and similar technologies to keep the Service functional and to understand how it is used. Specifically:

• Essential Cookies: Required for the Service to function correctly (for example, remembering interface preferences during your session).
• Performance & Analytics Cookies: Help us understand aggregate usage so we can improve the Service. These may be set by us or by third-party analytics providers.
• Advertising & Personalization Cookies: We do not currently serve personalized advertising or set advertising cookies. If this changes, we will update this policy and provide opt-out options as described in Section 7.

You can control or delete cookies through your browser settings at any time. Blocking essential cookies may affect how the Service works for you. For more information on managing cookies, visit your browser's help pages.

7. Advertising, Personalization & Your Opt-Out Choices

We do not currently display third-party personalized advertising. If, in the future, we or our partners display personalized ads or use advertising cookies, you have the right to opt out of personalized advertising at any time.

If advertising is provided through Google's platforms, you can turn off personalization of Google ads and learn about how Google uses data from partner sites using the links below:

• Turn off personalized Google ads ↗
• How Google uses data when you use our partners' sites or apps ↗

You may also opt out of personalized advertising through industry tools such as the Digital Advertising Alliance's opt-out page (www.aboutads.info) and the Network Advertising Initiative (www.networkadvertising.org). Where applicable, California residents may exercise additional rights described in Section 10.

8. Data Retention

We retain personal information only for as long as necessary for the purposes described in this policy, or as required by law. Specifically:

• Newsletter subscription data is retained until you unsubscribe or request deletion.
• Contact form messages and related details are retained for up to twelve (12) months after the matter is resolved, unless a longer period is required by law.
• Usage information collected by analytics tools is retained according to the retention settings of the relevant provider, and is aggregated or anonymized wherever possible.

When information is no longer needed, we delete or anonymize it securely.

9. Data Security

We take reasonable and appropriate technical and organizational measures to protect your personal information from unauthorized access, use, alteration, or disclosure. These include secure connections (HTTPS), access controls, and periodic reviews of our practices.

However, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect your data, we cannot guarantee its absolute security. You are responsible for protecting your own credentials and devices.

10. Your Rights & Choices

Depending on your location and the law that applies to you, you may have the following rights regarding your personal information:

• Right of Access: To request a copy of the personal information we hold about you.
• Right to Rectification: To correct inaccurate or incomplete information.
• Right to Erasure ("Right to Be Forgotten"): To request deletion of your personal information.
• Right to Restriction of Processing: To ask us to limit how we process your data in certain circumstances.
• Right to Data Portability: To receive your data in a structured, commonly used, machine-readable format (GDPR/LGPD).
• Right to Object: To object to processing based on legitimate interests, including direct marketing.
• Right to Withdraw Consent: To withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
• CCPA/CPRA Rights (California residents): The right to know what personal information we collect, the right to delete, the right to correct, the right to opt out of the "sale" or "sharing" of personal information (we do not sell your data), and the right to non-discrimination for exercising these rights. To request an opt-out of any sharing for cross-context behavioral advertising, please contact us.
• Right to Lodge a Complaint: To lodge a complaint with your local data protection authority (for example, a European supervisory authority under the GDPR, the Brazilian National Data Protection Authority — ANPD — under the LGPD, or the California Privacy Protection Agency under the CCPA/CPRA).

To exercise any of these rights, contact us at the address in Section 15. We will respond within the timeframes required by applicable law (typically within thirty (30) days). We may ask you to verify your identity before acting on your request. You may unsubscribe from the newsletter at any time using the link in any email we send.

11. Children's Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent, in accordance with the Children's Online Privacy Protection Act ("COPPA") and applicable international standards. If you believe a child has provided us with personal information, please contact us, and we will delete the information promptly.

12. International Data Transfers

Your personal information may be processed in the United States and in other countries where our service providers are located. When we transfer personal data from the European Economic Area, the United Kingdom, or Brazil to countries that have not been recognized as providing an adequate level of protection, we rely on appropriate safeguards such as Standard Contractual Clauses ("SCCs") or equivalent mechanisms approved by applicable authorities, in addition to any other measures required by law.

13. Third-Party Links

The Service may contain links to third-party websites or services that are not owned or controlled by us. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party website you visit before providing them with your information.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will update the "Last Updated" date at the top of this page and post a notice on the Service. If the changes are material, we will make reasonable efforts to notify you, including by email where we have your address and the law requires or permits such notice.

Your continued use of the Service after the revised policy takes effect constitutes acceptance of the revised policy. If you do not agree with the revised policy, you should stop using the Service and may request deletion of your information.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or need to make a data protection request, please contact us at:

[email protected]
Orbitza, New York, United States