City Travel OÜ Privacy Notice
1. Introduction
1.1. Given the nature of its business, City Travel is regarded as a travel undertaking which, in its day-to-day business, uses personal data in providing, arranging, organising and intermediating various travel and tourism services. In our activities we are guided by the European General Data Protection Regulation (GDPR), the Personal Data Protection Act of the Republic of Estonia (IKS), our own data protection strategy and other applicable data protection rules. This privacy notice (hereinafter the Privacy Notice) is addressed to the data subject referred to in the GDPR and the IKS, i.e. the natural persons whose personal data are processed in order to provide the service.
1.2. We assume that you (the Data Subject) are aware of and care about the processing of your personal data. We therefore confirm that City Travel takes compliance with the rules laid down for processing your data with the utmost seriousness. The Privacy Notice describes the principles and practices used by City Travel that concern the entire chain of personal data processing, from collection and use through to erasure, with a focus on the protection of personal data. Protecting personal data is an ongoing responsibility, which is why we review the rules of the Privacy Notice from time to time, check their compliance with the applicable requirements and update the content where necessary.
2. Data Protection Officer (DPO)
2.1. To comply with data protection requirements, our company City Travel, registry code 12584093, with its registered office at Nafta 1, 10152 Tallinn, Harju County, has appointed a data protection officer:
DPO's place of work: Nafta 1, 10152 Tallinn, Harju County
E-mail address: info@citytravel.ee
3. Collection of data
3.1. City Travel collects personal data mainly from its customers. As a rule, these are the data needed to provide the travel and tourism services chosen by the customer; they may always be specified further within a particular travel service and may vary depending both on the means of travel (e.g. bus, train, aircraft, ship) and on the destination (domestic travel, travel within the EU and to countries treated as equivalent to them, travel to countries outside the EU). Travel normally requires the first name and surname, a travel document/identity card bearing a photograph for verifying identity, the personal identification code (in the absence of a personal identification code, the date of birth, sex and age), as well as contact details such as e-mail address, telephone number and residential address. When travelling to countries outside the EU, the list of data may be extended by the laws and requirements of the destination country concerned (e.g. nationality, passport details, visa, vaccination, etc.). We use your personal data to perform the contract concluded between us and to provide you with travel and tourism services. We do not sell or share personal data with third parties, except those with whom they must be shared by law or in order to perform the service contract concluded between us.
3.1.1. Processing of personal data in the course of providing and intermediating accommodation services
If you purchase an accommodation service, your data (name, personal identification code and/or sex, date of birth, contact details) are needed to comply with the requirements laid down for accommodation establishments and to provide the service. The list of personal data may vary owing to the requirements laid down in different countries. For this purpose it is necessary to know the data of the persons who will use the accommodation service and the period for which accommodation is needed. As a general rule, accommodation establishments are obliged to keep a register of the persons accommodated, in which the data required by law are entered and which is disclosed to law enforcement authorities on request.
Depending on the content of the service, we may also need special categories of personal data relating to particular features of the accommodation service. For example, in the case of certain mobility impairments this may mean the availability of mobility aids (wheelchair, lift, etc.) or, as regards catering, data on a special diet in the case of intolerance to certain substances (where a catering service has been ordered in addition to accommodation).
If you purchase accommodation and rehabilitation services, we also need special categories of personal data from you concerning the rehabilitation in question. In this way both the place and the time of the rehabilitation become known to us, as well as its content to the extent necessary for providing the rehabilitation service concerned. In any case, these are special categories of personal data which you yourself provide to us in order to receive the service.
When selling accommodation and related services, if the best price has been offered by wholesalers (including aggregators and consolidators), we transfer your data to the wholesaler of the services (including aggregators and consolidators), who in turn transfers the data to the specific provider of the accommodation service or related services.
We require both accommodation service providers and wholesalers (including aggregators and consolidators) to process personal data in compliance with the GDPR. Each party involved in providing the accommodation service may use personal data only for the performance of the contract. In the case of the provision of an accommodation service, City Travel is not responsible for the processing of data that have been given to the accommodation establishment on site.
3.1.2. Processing of personal data in the course of providing and intermediating passenger transport services
To provide a passenger transport service, we need the following personal data from you: name, personal identification code, travel document details, e-mail address, telephone number and data related to the service. In the course of providing a passenger transport service, information on special categories of personal data may also become known (e.g. the need for a wheelchair in the case of a mobility impairment; in the case of children, information on the travel of children and their escorts). Under legislation, the service provider is obliged to transfer personal data to law enforcement authorities.
If you have purchased from us a service of intermediating a passenger transport service, we as a rule transfer the data collected to the passenger transport service provider or to an intermediary of passenger transport service providers, who in turn then transfers those data to the specific service provider.
In the case of the provision of a passenger transport service, City Travel is not responsible for the processing of data that have been given directly to the carrier.
We require service providers to process personal data in compliance with the GDPR. Each passenger transport service provider and each party involved in providing the passenger transport service may use personal data only for the performance of the contract.
3.1.3. Processing of personal data in the course of intermediating package travel
If you purchase a package travel, your data (name, personal identification code and/or sex, date of birth, contact details) are needed to comply with the requirements laid down by the organiser and to provide the service. The list of personal data may vary owing to the requirements laid down in different countries. For this purpose it is necessary to know the data of the persons who will use the travel service and the period of the trip.
Depending on the content of the service, we may also need special categories of personal data concerning particular features of the passenger transport service or accommodation service. For example, in the case of certain mobility impairments this may mean the availability of mobility aids (wheelchair, lift, etc.) or, as regards catering, special diet data in the case of intolerance to certain substances (where a catering service has been ordered in addition to accommodation).
When selling package travel and related services, we transfer your data to the organiser, who in turn transfers the data to the specific provider of the passenger transport service and accommodation service or related services.
In the case of the provision of a travel organisation service, City Travel is not responsible for the processing of data that have been given directly to the organiser.
We require organisers to process personal data in compliance with the GDPR. Each party involved in providing the travel service may use personal data only for the performance of the contract.
3.1.4. Processing of personal data in the course of providing and intermediating visa application services
To provide a visa application service, we need personal data from you such as name, personal identification code, details of a valid travel document, destination country, desired period of validity of the visa, purpose of the visit to the destination country and other data required by the countries to be visited.
We require service providers to process personal data in compliance with the GDPR. Each party involved in providing the service may use personal data only for the performance of the contract.
3.1.5. Processing of personal data in the course of intermediating travel-related insurance services
To provide the intermediation of travel-related insurance services, we need personal data from you such as name, personal identification code, place of residence, e-mail address and telephone number. In the course of performing the relevant contract, data may become known to us concerning, among other things, the illness of you or a member of your family (insured event, travel disruption insurance), an accident and medical expenses, as well as personal data that have become known owing to other unforeseen insured events.
We transfer the personal data provided to the insurer, from whom we require the processing of personal data in compliance with the GDPR.
3.1.6. Providing or intermediating vehicle rental services
To provide or intermediate a vehicle rental service, we need personal data from you such as name, personal identification code, place of residence, contact details, details of the document certifying the right to drive a vehicle of the relevant category to the extent necessary, credit card details, etc. In the course of performing the contract, data may become known to us concerning, among other things, your preferences in choosing different cars, the persons travelling in the car, and the times and routes of journeys. We emphasise that items you leave in the car may also contain data about you, and City Travel is not responsible for the use of such data.
In the case of providing or intermediating a vehicle rental service, we transfer the personal data provided to the specific vehicle rental service provider, from whom we require the processing of personal data in compliance with the GDPR. In the case of the provision of a vehicle rental service, City Travel is not responsible for the handling of data that you give on site to the company providing the vehicle rental service.
If you have purchased from us a service of intermediating a vehicle rental service, we as a rule transfer the data necessary for booking the service to the intermediary of the vehicle rental service, who in turn then transfers the data collected to the specific service provider.
3.1.7. Sending the best travel offers and reminder letters
We send you the best travel offers and reminder e-mails (e.g. upselling, congratulations, invitations to events and similar offers) only with your consent and only to an e-mail address you have confirmed in advance. You may withdraw your consent at any time, either by selecting unsubscribe at the bottom of the e-mail or by notifying us at the e-mail address info@citytravel.ee
We also send you informative and notification e-mails if you have made a purchase from us for the first time, have acquired our customer card, or your employer has confirmed you as an authorised person of the company. These e-mails are confirmatory in nature, so that you are aware that you have joined us. Among informative e-mails, we also send you notifications about the expiry of bonus points and of the customer card.
In connection with the provision of services, we have the right to send you a feedback e-mail if you have made a purchase from us or requested an offer for a service. We send feedback e-mails solely to identify shortcomings in our service and to offer the best service. If a natural disaster or an emergency situation occurs, we may also contact you to make sure that everything is fine and whether we can be of assistance to you.
3.2. Our websites www.citytravel.ee, communication environments and various social media channels (Facebook, Instagram), like many other similar environments, collect certain information automatically and store it in log files. This information may include the IP address, the region or general location where your computer or device is connected to the internet, the type of browser used, the operating system and other usage-related information, including the history of pages visited. City Travel uses this information to make City Travel's online environments better, simpler and more user-friendly. We may also use your IP address to diagnose problems with City Travel's server, to administer the website, to analyse trends and to track the activity of site visitors on the site. Also in order to collect broader demographic information so as to better identify the preferences of visitors to our web environments. The online environments also use a system of cookies.
3.3. If you have given consent to receive newsletters and advertising, or if you take part in prize draws or other campaigns organised or intermediated by us, we ask for your name and contact details. We use this information to send you information about the services and goods offered by our company or about anything else that may be of interest to you. Our newsletter may from time to time contain links to other online environments. City Travel is not responsible for the content or privacy policy of those environments. If you no longer wish to receive the newsletter and direct mailings, you can stop receiving such e-mails by clicking the link (opt-out or unsubscribe) at the bottom of each newsletter and/or advertisement or by notifying us at info@citytravel.ee.
3.4. If you wish to place an order through our online environment, we need your contact details: name, personal identification code, date of birth, travel document details, e-mail address, telephone number and, in some cases, also your residential address. This information is needed only in order to contact you regarding information relating to your order and to the performance of the contract concluded or to be concluded with you. We share your personal data with companies involved in the direct provision of the service to you. In other cases we do not share your personal data with anyone. While the order is being prepared, we also ask you for information relating to payment for the order, such as a credit card number or bank payment details. In doing so we use a secure online connection so that your personal data are protected.
4. When and how City Travel stores data
4.1. The data collected about you that have been obtained through your purchases are kept at City Travel for the period during which the statutory data retention obligation and the limitation period for filing claims apply, after which the personal data are erased. The data are kept in one or more databases administered by a third party located in the EU or in a country that has acceded to the Agreement on the European Economic Area. Such third parties do not have access to the data and do not use your personal data for any purpose other than storage and backup.
5. When and how City Travel uses your personal data
5.1. Your personal data are mainly used, by agreement with you, to provide you with services.
5.2. Personal data are also used to update our online environment in line with your preferences, interests and needs, to get to know your wishes and preferences better, and to improve aspects of the services provided in City Travel's online environments.
5.3. If you have given consent to receive newsletters, special advertisements, direct mailings, etc. from us, we send you the requested information. You have the option of opting out of such e-mails (see clause 3.3).
5.4. Your personal data are shared with service providers whose service is indispensable for the performance of the contracts concluded and the provision of the services.
5.5. We may also share your personal data if such a need arises from the investigation of crimes, compliance with court claims, or meeting your vital needs; or in connection with a sale, purchase, merger, reorganisation, financing, liquidation, dissolution or similar operation relating to the company. In such cases we confirm that we will take all necessary measures to ensure that your personal data are adequately protected.
5.6. When information necessary for participation in prize draws and other similar undertakings is collected, the contact details obtained are used so that we can contact you if you win. If the prize has been put up by another contractual partner, your contact details are transferred to that partner so that it can contact the winner. As a rule, a precondition for participating in such prize games is giving consent to the use of your contact details for other purposes as well, which is why we ask you to read the terms and conditions of the prize game carefully before taking part.
6. Transfer of personal data outside the EU or areas treated as equivalent to it
6.1. City Travel is located in the Republic of Estonia, which is one of the Member States of the EU. The personal data we collect are processed mainly in the Republic of Estonia as well as at the registered addresses of third parties. Where, in the course of providing the service, it is necessary for the performance of the contract to transfer data outside the EU or to territories treated as equivalent to it, under Article 45 of the GDPR there is a need to guarantee an equivalent level of protection of personal data outside the EU at least at the same level as within the EU. We inform you that our company has no legal means of giving such a guarantee other than contractual ones, i.e. with those undertakings with which it is possible to conclude contracts and negotiate contract terms we can obtain confirmations as to the adequacy of the relevant protection and oblige them to guarantee the relevant protection themselves, but we are in no way able to guarantee the adequacy of such a measure and its compliance with the requirements of the GDPR.
6.2. If, however, it is not possible to reach an agreement with the relevant service provider on a level of personal data protection compliant with the requirements of the General Regulation, we warn you that data protection in the destination country concerned is not at the same good level as that established by the General Regulation, and at the same time we explain that we have no means whatsoever of guaranteeing a high level of personal data protection with regard to such a destination country. If, despite this warning, you nevertheless wish to obtain a service in such a destination, by purchasing the trip you confirm that we may send your personal data to such a destination country.
6.3. We never send a service provider located outside the EU more personal data than is minimally required to confirm the service in question, nor more than you yourself would be obliged to provide to it if you ordered the same service directly from the service provider, i.e. without using our service.
7. Rights of the data subject
7.1. The Privacy Notice is intended to provide you with information about what information City Travel collects about you and how it is used. If you have any questions about personal data, please contact us at the e-mail address info@citytravel.ee.
7.2. If you wish to find out whether City Travel processes your personal data or wish to access your personal data, please contact us at the e-mail address info@citytravel.ee.
8. Security of your data
8.1. To protect the personal data and personally identifiable information that you enter in our online environment, we use physical, technical and administrative safeguards. Accordingly, we regularly update and test the protection technologies we use. Our internet networks are protected by firewalls and intrusion detection software. Access to your personal data is restricted to those employees who need such information to provide you with the agreed service or on another legal basis.
8.2. We use adequate measures to protect your personal data, and our activities are subject to the applicable legislation on information security; however, we consider it necessary to point out that no website or database is completely secure, i.e. so-called hack-proof. Protect yourself and help us prevent computer crime by keeping and protecting your passwords (secret words) very carefully. Our online environment does not use spyware (Spyware). If you suspect that your account has been broken into, please contact us without delay.
8.3. City Travel trains its employees to achieve greater awareness among employees of the importance of and need for personal data protection. Our commitment is also reflected in the company's internal regulations that directly concern employees and into which data protection provisions have been incorporated.
9. Amendment and supplementation of the Privacy Notice
Like any organisation, City Travel will certainly change over time and space, which is why it is only right to assume that a need may thus also arise in the future to amend and supplement the Privacy Notice. For the above reason, we inform you that we have the right to amend and supplement the content of the Privacy Notice at any time without notifying you. We publish the amendments on City Travel's Privacy Notice web page. Although we may notify you, e.g. by e-mail, of more significant changes to the terms of the Privacy Notice, it is safest if you yourself visit the Privacy Notice web page frequently enough to familiarise yourself with its updated and applicable terms (www.citytravel.ee).
10. Employee privacy notice
The employee privacy notice has been drawn up as a separate document and is available only to City Travel's employees.
11. Questions, complaints
11.1. If your personal data have changed, please contact us. If you have further questions about your personal data, be sure to contact us. We will reply within the time limit provided by law. At the same time, please be prepared that, as part of protecting personal data, we may ask you for more detailed information to verify your identity before answering your questions. In order for the contracts on which the processing of personal data is based to ensure the rights of Data Subjects to a sufficient extent, we reserve the right to require that a document certifying the right of representation of a Data Subject, which is submitted in the course of or after the performance of the legal relationship between the parties (including in connection with data processing) and which has been drawn up outside our travel agency, be notarially certified or certified in an equivalent manner. We must be sure that the Data Subject consents to the transfer of the information and that the information goes only to the right person or organisation. In most cases we will correct or erase any inaccuracy you have discovered. In some cases we may also refuse your request in full or in part if the law permits or requires us to do so.
11.2. For questions and complaints, please contact the data protection officer at the e-mail address info@citytravel.ee. We will reply to your enquiry as soon as possible, but no later than within 30 days.