Privacy Policy | Rakuten Travel Xchange

Welcome to the Privacy Policy for Rakuten Travel Xchange Pte. Ltd. (Singapore) and RAKUTEN TRAVEL XCHANGE PTE. LTD SINGAPORE SUCURSALA BUCURESTI (Romania) (collectively, "RTX"). RTX is a business-to-business ("B2B") accommodation wholesale and travel technology division that distributes global inventory of accommodations and directly negotiated rates of Rakuten Travel and Rakuten STAY, both of which are subsidiaries of Rakuten Group, Inc.

RTX is a part of the Rakuten Group. Rakuten Group, Inc., is based in Tokyo, Japan. More information about Rakuten is available at https://global.rakuten.com/corp/about/company

This Privacy Policy explains how we collect, use, share and protect your personal data. We also explain the options and rights you have and how to use them.

If your business uses RTX Services and has a contract with RTX, the terms in your contract shall apply in the event there are any differences between your contract and this Privacy Policy. If you want to exercise your privacy rights regarding a booking, please reach out directly to the service managing your reservation.

Personal Data we collect and how

We collect personal data in different ways when you contact us with your general and service-specific enquiries, or to register to use our Services, such as the Travel Agent Portal ("TAP"), or to engage us to develop a custom website (collectively, "our Services"). As we are a B2B platform, we only collect personal data through other businesses that use our Services and never directly from end customers. The following is a list of the categories of personal data we collect, and how we obtain it.

Information that you directly provide to us

You provide personal data to us when you contact us with your enquiries or register and / or use an account to provide our Service.

For the purposes of contacting us with general enquiries or service-specific enquiries, this contains:

Basic information:

personal details (name, date of birth);
contact details (phone number, email address, postal address and / or mobile number);

For the purposes of registering and / or using an account for TAP, this contains:

For registering an account for TAP:

Basic and company-related information for business's point of contact:
First name and last name of contact point;
contact details, including business contact details (phone number, email address, Company Certificate Number, company address and / or mobile number); and
account login details, (your username and password, account ID).
Service interest preferences: information about your interest in, or preference for, other services offered by RTX.

Information we collect via cookies and tracking technologies:

When you enter our Website, we only place strictly necessary cookies to verify if information being inputted into our forms is entered by humans or through automated means. These data types include:

Identifiers for devices you have used to access our services, including:
- IP address (from which your approximate location can be inferred);
- Unique devices identifiers or MAC identifiers
Internet activity information: information about your visits to our website and login sessions, and usage of our website).

How we use your data and the basis on which we use it

We require a valid reason to process your data.

The basis shall be the collection of personal data for the purpose of performing our contract with you for the use of our Services by you; where applicable, fulfilling our legitimate interests, only when we have a valid interest that shall not override yours (the collection of data in order to secure our Services); complying with our legal obligations; as well as, where applicable, processing personal data based on your consent (when you voluntarily provide us with your contact information to find out more about our Services).

If we ask for your consent to process your personal data, you may withdraw your consent at any time by contacting us here https://solutions.travel.rakuten.com/contact-us.

We do not make any automated decisions about you. We also do not create a profile about you.

You can find here the information regarding the purposes for which we process the types of personal data listed above, as well as our basis for such processing operations.

Purpose of Use	Types of Data	Basis for Processing
Provide you our Services, including making general enquiries and TAP enquiries	As defined under the "Personal Data we collect and how" section above	Performance of a contract: We process your data to provide, operate and deliver our Services as defined above
Authentication & Account management for TAP	As defined under the "Personal Data we collect and how" section above	Performance of a contract: We process your data to provide you with our Services: Allow you to register, log in or activate your account. Verify that you are truly you when you log into our service (authentication). We record your configuration and settings, to manage your accounts Creating and update your profile, with the information you provided to us.
Improve our Services for you	As defined under the "Personal Data we collect and how" section above, as well as: Device identifiers Location IP address Resource identifiers (URLs) Account usage information of our Services	Legitimate interest: We use data about your usage of our Service for: Service improvements; Internal analytics about how our service is used; Develop new services; Improving the technical functionality of our Services.
Communication, support & customer services	As defined under the "Personal Data we collect and how" section above	Performance of a contract: We use your data to reply to your requests and enquiries, and to notify you about changes and updates to our Services.
Safety, security, and fraud prevention	Any data as detailed under "Personal Data we collect and how" section above for the prevention, identification and investigation of scams, cyber-attacks, and other potentially illegal or fraudulent activities, or in relation to any other activities necessary to protect the legal rights of RTX and/or the rights of third parties	Legitimate interest: We use data to protect our service from fraud and other threats. We analyze log-in patterns to protect your account against being accessed by someone else.
Compliance with law requirements	Depending on the circumstances, any data as detailed under the "Personal Data we collect and how" section above	Legal obligation We may be required by law to disclose data to law enforcement bodies (such as a court or the police).

Your Choices

The rights and choices about your data are different depending on your location. This includes the right to request:

access to your data; either if you want to know what data we have about you;
get a copy of your data in a machine-readable format (right to data portability);
correct any information that is wrong;
delete your data;
restrict usage to the bare minimum (for example, if you ask us to delete, but we still need to keep your order history for legal reasons, like tax audits of our business);
object to specific uses (you can opt-out of marketing e-mails);
ask us where we got certain data about you, how we use it and with whom we share it;
withdraw your consent easily; if you do so, the lawfulness of processing based on your consent before its withdrawal will not be affected.

Data Sharing

We are a global business. That means your data will be shared with other Rakuten Group companies around the world. Also, we use service providers in different countries. Data are sent to them as well as indicated in the Data Sharing section above. We have taken steps to keep your data safe. We are always watching out to ensure they are trustworthy, and we have strict contracts in place.

Inside the Rakuten Group, we have BCRs (Binding Corporate Rules), a set of privacy internal rules that we apply across all the Rakuten Group companies. The BCRs are Rakuten global standard for the protection of privacy and processing of personal data. Rakuten's BCRs allow secure transfers of data within the Rakuten Group companies and have been approved by the relevant Data Protection Authorities in Luxembourg and the United Kingdom. You can find them here.

Security

We have strict security measures in place in accordance with high security standards to ensure that your account and your data are safe with us. Some of these are technical, like password rules and monitoring of log-in patterns. Others are organizational, like having proper processes and access rules in place. We do so to prevent unauthorized access or unauthorized disclosure of your information, to maintain the accuracy of such information and, when necessary, to ensure its proper destruction.

When collecting or transferring your personal information, we employ data encryption technology, and restrict access only to those persons who require it to fulfil their job responsibilities. We conduct periodic reviews of our practices to ensure that our safeguards are properly implemented and remain state of the art. We make sure to always keep up with the latest developments.

Retention

As long as you have your account for the use of our Services, we will keep your data. When you delete your account, we will retain data only if we are required to do so by law, or in case we still need it for our defense in court proceedings.

Contact Us

Rakuten Travel Xchange Pte. Ltd. is responsible for the personal data we collect and process. Our main offices are located in Singapore. For any questions or concerns, or if you want to make use of your rights, feel free to reach out to us anytime via https://solutions.travel.rakuten.com/contact-us

Please note that when contacting us, we may ask you for certain information to verify your identity and respond to your request appropriately.

Our data protection officer can be contacted this way. If you have any complaints, we hope we can work with you to achieve a good solution. If we are not able to, you can contact your local data protection authority. Additionally, you can contact the data protection authority of Luxembourg here.

Changes to this Policy

We may update this privacy policy from time to time. If there is going to be a substantial change, we will notify you in advance.