We take your privacy seriously

Last updated March 2019

We recognise the importance of protecting your privacy and your rights with regards to data protection. The Internet is a very powerful medium when it comes to transmitting personal information; for that reason, we and all other companies belonging to LM group undertake the serious task of respecting the current laws regarding the protection of personal data and the security of the same, with the aim of guaranteeing secure, controlled and confidential navigation for its users and customers when visiting and/or using the Website and/or use our Service (you as a "User").

This Privacy Policy describes how we collect, use, process, and disclose your personal data in conjunction with your access to and use of our Website and services and, specifically:

It also informs you how you can exercise Your Rights (including the right to object to some of the data handling we carry out). More information about your rights and how you can exercise them is set out in the section below.

If you see an undefined term in this Privacy Policy (such as “Service” or “Website”), it has the same definition as in our Company contractual service conditions.

1. Who is the controller of your personal data?

When this policy mentions “Company”, “we,” “us,” “our” or “Data Controller”, it refers to: LM Forward Limited headquartered in The Johnson Building 77 - Hatton Garden, EC1N 8JS London (United Kingdom) Company No: 11855830, which is responsible for the processing of Users’ and/or Customers’ personal data under this Privacy Policy (hereinafter, referred to as the “Company”, “we”, “us”, “our”, “Data Controller”).

2. What categories of your data do we collect and use?

When you visit the Website and use our Service (you as a "User") we collect the categories of personal data as follows:

2.1. Personal data provided by you

  • The personal data that you share with us when you register for an account, subscribe to newsletters and which you provide to us when using our services, including the information entered into our booking platform and included in your comments, reviews or messages sent via telephone to our Customer Care Team or through the Live Chat.

The provision of the above personal data, where requested, is necessary for the adequate performance of the contract between you and us and to allow us to comply with our legal obligations. Without it, we may not be able to provide you with all the requested services.

It is important that all the personal data you give us when you register as a User or otherwise when you use the Website is correct and accurate. This includes, by way of example only, ensuring that we have your correct contact (including email) details at all times.

If you plan to submit someone else's personal data to us, for instance when booking on their behalf, you should only provide us with that third party's details with their consent and after they have been given access to this Privacy Policy.

Please note that we may collect and use information of children only as provided by their parent or guardian or with their consent. If we become aware that we have processed information of a child without the valid consent of a parent or guardian, we reserve the right to delete it.

2.2 Personal data collected automatically from our Website and from third parties

  • Information about your visits to and use of the Website, such as information about the device and browser you are using, your IP address or domain names of the computers connected to the Websites, uniform resource identifiers for requests made, the time of request, the method used to submit the request to the server, the size of the archive obtained as a response, the numerical code indicating the status of the response given by the server (correct, error, etc.) and other parameters relative to the operating system and the computer environment used, the date and time that you visited, the duration of your visit, the referral source and website navigation paths of your visit and your interactions on the Website including the Services and offers you are interested in. Please note that we may associate this information with your account.

Please see the cookies section of this Privacy Policy (9. Information about cookies) for further information on the purposes for which we collect and use this information.

  • If you link, connect or login to your account with a third party service (e.g., Facebook, Google), the third party service may send us information such as your registration and profile information (i.e. user name, user ID associated with your social media account, picture, email), and any other information you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network. You should always review and, if necessary, adjust your privacy settings on third-party websites and services before linking or connecting them to our Website.
  • To the extent permitted by the applicable law wherein we receive additional information about you, such as fraud detection information and warnings from third party service providers and/or partners for our fraud prevention activities.

3. Why do we collect your data?

In general terms, we use your personal data to provide you with the services you request, send you marketing and promotional communications, notify you about important changes to our Website and to deliver our content and ads which we think may be of interest to you. More specifically:

Why? On which legal basis?
A. To create and maintain the contractual relationship established for the provision of the Service requested by you in all its phases and by way of any possible integration and modification (e.g. responding to your questions and concerns; administering your account). To fulfil a contract, or take steps linked to a contract
B. To meet the legal, regulatory and compliance requirements and to respond to requests by government or law enforcement authorities conducting an investigation. To comply with the law
C. To carry out anonymous, aggregative statistical analyses so that we can see how our Website, products and services are being used and how our business is performing.

To pursue our legitimate interest

(i.e. improving our Website, its features and our products and services)
D. To send you (in cases permitted by law excepting where you did not object) advertising material via email or, where permitted by the law, other equivalent electronic communication regarding products and services similar to those already purchased by you and offered on our Website. On some occasions, we may send you a personalised and tailored version of the aforementioned advertisement materials.

Soft Opt-in/To pursue our legitimate interest

(i.e. marketing)
E. Without prejudice to the provisions of the preceding paragraph E, and only with your consent, to send you via email, phone, mail, SMS or MMS the best deals and offers on products and services we think you might find interesting which are marketed by us or our partners or business partners operating in the following sectors: tourism, leisure, entertainment, high technology, fashion, decoration, consumer goods, food and beverage, finance, banking, insurance, energy, environment, communication, mass media, real estate, pharmaceuticals, clothing and textiles, education and training, energy, publications and publishing, information and communications technology, retail, sport, telecommunications and general services. We may analyse your personal information to create a profile of your interests and preferences so that we can tailor and target our communications in a way that is timely and relevant to you. We may make use of additional information about you when it is available from external sources to help us do this effectively. We may also use automated decision making to segment and target product offers based on your demands and needs. This allows us to be more focused, efficient and cost effective with our resources and also reduces the risk of someone receiving information they may find inappropriate or irrelevant. You can always request a manual decision- making process instead, express your opinion or contest decision based solely on automated processing, including profiling, if such a decision would produce legal effects or otherwise similarly significantly affect you. For further details, you may contact our Data Protection Officers whose details are provided in this privacy policy.

Where you give your consent

(by ticking the appropriate check box)
F. Passing your data to LM Forward Ltd to collect and obtain the information about your bookings from the Data Controller with which you have contracted, in turn authorising this company to share this information to LM Forward Ltd; this will facilitate the search and location of bookings you have made with any company of LM group on any of the Websites of the LM group through the APP or the personal area.

Where you give your consent

(when you register or log into the APP or personal area)
G. To keep our Website and systems secure and to prevent and detect fraud, security incidents and other crime.

To pursue our legitimate interest

(i.e. ensuring the security of our Website)
H. To verify compliance with our terms and conditions and for the establishment, exercise or defence of legal claims.

To pursue our legitimate interest

(i.e. compliance with our terms and conditions, protection of our rights in the event of any dispute or claim)
I. To tailor and personalise online marketing notifications and advertising for you based on the information on your use of our Website, products and services and other sites collected through cookies (please see the Cookies section of this Privacy Policy for further information)

Where you give your consent

(i.e. through the cookie banner or by your browser's settings)

4. Who sees, receives and uses your data and where?

4.1. Categories of recipients of your data

We share your personal data, for the purposes described in this privacy policy, to the following categories of recipients:

  • Our authorised employees and/or collaborators that assist and advise us on Administration, Products, Legal Affairs, Customer Care Team, and Information Systems, as well as those in charge of maintaining our network and hardware/software equipment;
  • Our third-party service providers (including other entities of the LM group), which process your personal data on our behalf and under our instructions for the purposes described hereinabove acting as data processors, such as those providing us with IT and hosting services call centre and customer support, analytics and administration services etc.
  • Our business partners who are social media platforms when it is explicitly requested by you (e.g. when using social media authentication methods).
  • Competent authorities when we are required to do so by the current law.
  • Competent authorities and Law and enforcement third parties when this is necessary so that we can enforce our terms of use and protect and defend our rights or property or the rights or property of any third party.
  • Third parties that receive the data (e.g. business consultants, professionals for delivering due diligence services or assess value and capabilities of the business) when it is necessary in connection with any sale of our business or its assets (in which case your details will be disclosed to our advisers and any prospective purchaser’s advisers and will be passed to the new owners.

The complete list of parties to which your personal data may be disclosed is available at our registered office and may be requested by writing to privacy.en@lastminutegroup.com.

4.2. International transfer of your data

Users’ personal data is processed in at the Data Controller’s registered office (see point 1) , on LM group servers, and at the offices of other entities to which data may be provided in order to provide the services requested of the Data Controller.

Given the fact that we are an international company, we also transfer your personal data to:

  • Non-European Economic Area (EEA) countries offering an adequate level of data protection such as Switzerland in accordance with the “Adequacy decisions” of the EU Commission that recognises some countries as providing adequate protection;
  • Non-European Economic Area countries where data protection laws may be less protective than the legislation in the EEA. This happens when:
    • We disclose your data to autonomous data controllers that might process your data outside the EEA in order to provide you with the requested services.
    • We disclose your data to our service providers who act as data processors on our behalf that might be located in a country outside the EEA, including Morocco, India and Tunisia. When such a transfer happens, we ensure that it takes place in accordance with this Privacy Policy and is regulated by standard contractual clauses approved by the European Commission as ensuring adequate protection for data subjects. Our providers, acting as a data processor, may be engaged in, among other things, the fulfilment of your service request, the processing of your payment details, the provision of advertising and marketing services on our behalf and the provision of support services through electronic communications or call centre.

Should you want to obtain further details about the safeguards put in place, you can contact us by writing to privacy.en@lastminutegroup.com.

5. How long do we retain your data?

We retain your personal data for as long as is required to achieve the purposes and fulfil the activities as set out in this Privacy Policy, otherwise communicated to you or for as long as is permitted by applicable law. Further information about the retention period is available here:

Document Retention period Starting date
CUSTOMER RECORDS
Account information (see My Area):
- User, password
- Social login
- Purchase data
10 years From the date of the last interaction
Customer care emails (confirmation, schedule change/cancellation, quotation, penalties quotation, payment reminder, refund choice, voucher/payment, massive communications), including customer requests/claims via email 10 years From date on which email is sent
Customer care phone records for contractual reasons 3 years From the date of the recording
Recorded calls for quality purposes 1 month From the date of the call
Chat (Customer/User) 3 years From the date of the request
Reports or claims
Contractual documentation (log of the acceptance) 10 years From the date of the purchase
Credit card data Not retained
Finance/transactional information 10 years From completion of financial transaction
Transactional fraud check data 5 years From rejection of transaction for fraud
Surveys 1 month From the date of the survey
DATA USED FOR MARKETING PURPOSES (CRM)
Data used for marketing activities to Users subject to the consent or under soft-opt in 5 years From the consent or the renewal of the consent via interaction with marketing communications
DATA COLLECTED VIA TAG
Technical cookies Max 3 years From the date of browsing on our websites
Non-technical Cookies Max 1 year From the date of consent

6. What are your data protection rights and how can you exercise them?

You can exercise the rights provided by the Regulation EU 2016/679 (Articles 15-22), including the right to:

Name of the right Content
Right of access To receive confirmation of the existence of your personal data, access its content and obtain a copy.
Right of rectification To update, rectify and/or correct your personal data.
Right to erasure/right to be forgotten and right to restriction To request the erasure of your data or restriction of your data which has been processed in violation of the law, including whose storage is not necessary in relation to the purposes for which the data was collected or otherwise processed; where we have made your personal data public, you have also the right to request the erasure of your personal data and to take reasonable steps, including technical measures, to inform other data controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
Right to data portability To receive confirmation of the existence of your personal data, access its content and obtain a copy.
Right to data portability To receive a copy of your personal data you provided to us for a contract or with your consent in a structured, commonly used and machine-readable format (e.g. data relating to your purchases) and to ask us to transfer that personal data to another data controller.
Right to withdraw your consent Wherever we rely on your consent (see p. 3 - F, G and J), you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.
Right to object, at any time You have the right to object at any time to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement (see p. 3-D, H, I), or where we are using your data for direct marketing (p. 3-E).

You can exercise the above rights at any time by:

  • Contacting us via email at privacy.en@lastminutegroup.com.
  • As for direct marketing, please note that you can also object at any time by clicking the unsubscribe link which we provide in each communication sent to you
  • As for online targeted ads and the withdrawal of your consent please refer to our Cookie section of this Privacy Policy.

Your rights in relation to your personal data might be limited in some situations. For example, if fulfilling your request would reveal personal data about another person or if we have a legal requirement or a compelling legitimate ground we may continue to process your personal data which you have asked us to delete.

You also may have the right to make a complaint if you feel your personal information has been mishandled. We encourage you to come to us in the first instance but, to the extent that this right applies to you, you are entitled to complain directly to the relevant Data Protection Supervisory Authority.

7. Contact details of the data controller

The contact details of the Data Controller of the data processing described hereinabove are:

LM Forward Limited headquartered in The Johnson Building 77 - Hatton Garden, EC1N 8JS London (United Kingdom) Company No: 11855830, which is responsible for the processing of Users’ and/or Customers’ personal data under this Privacy Policy.

8. Contact details of our data protection officer (DPO)

Our Data Protection Officer (or "DPO") is available at:

  • dpo.en@lastminutegroup.com
  • The Johnson Building 77 - Hatton Garden, EC1N 8JS London (United Kingdom) Company

9. Information about cookies

Please refer to the dedicated Cookies Police available here.

10. Update and old versions of this privacy policy

We reserve the right to modify this Privacy Policy at any time in accordance with this provision. If we make changes to this Privacy Policy, we will post the revised Privacy Policy on our Website and update the “Last Updated” date at the top of this Privacy Policy.

Old versions of this Privacy Policy are available here.

Part of Forward
The media company of lastminute.com
This website is property of LM Forward Limited headquartered in The Johnson Building 77 - Hatton Garden, EC1N 8JS London (United Kingdom)
Company No: 11855830, a company belonging to lastminute.com group. © Playbook 2019 - All rights reserved