Introduction

Switchfly, Inc. and its affiliates and subsidiaries (collectively, “we”, “us”, or “our”) care about privacy issues and want you to be familiar with how we collect, disclose, use and otherwise process (“Process” or “Processing”) Personal Information (as defined below) about you (“you” or “your”). This privacy notice (“Privacy Notice”) describes our practices in connection with Personal Information we Process through our websites (“Websites”), your purchase or use of our products or services, or other interactions with us, such as when you fill out a form, contact us, or submit documents to us, and certain rights you may have relating to such Processing. This Privacy Notice also applies to Personal Information Processed by us about your relatives or other individuals related to you that is used for emergency contact purposes.

For purposes of this Privacy Notice, “Personal Information” has the meaning given to such term (or to terms of similar intent, such as “personal data”) under applicable law, as and to the extent applicable to your rights and our obligations with respect to such information.

Your submission of such Personal Information to us or use of our Websites is deemed your consent to our Processing of your Personal Information as contemplated in this Privacy Notice.

We may provide you with products or services that have additional privacy terms, policies or notices that apply in connection with your use of such products or services. In the event of any conflict between this Privacy Notice and any such additional terms, policies or notices, such additional terms, policies or notices will govern in relation to your use of such products or services.

Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements, such that our practices may be more limited in such jurisdictions.

Personal Information We Collect  

The types of Personal Information Processed by or on behalf of us about you vary based on our interaction with you (for example, whether you are a Website visitor or a customer).

The Personal Information we obtain from you is generally necessary or useful for us to provide our products and services or information you have requested and provided directly by you in response to our request for the information. We may also collect Personal Information from certain third parties, such as our travel partners, data management companies, social media accounts or other persons who provide your Personal Information to us on your behalf.

User-provided Information: The user-provided Personal Information Processed by or on behalf of us about you in connection with the products and services we provide may include, but is not limited to, the following:

  • Personal identifiers such as your name, alias, title, military or other service rank, physical address, ZIP code, phone number, e-mail address, unique personal identifier, online identifier, account name, driver’s license or state identification number, passport number, loyalty rewards number and other similar identifiers;
  • Certain characteristics of protected classifications such as race, color, sex, age, religion, national origin, disability, citizenship status and genetic information;
  • Information about the products or services you purchased or received, how you used them, and the details of your customer service requests;
  • Your travel preferences, such as seat selection and meal requests;
  • Payment information, such as credit card number, debit card number, other financial or payment information; and
  • Medical information or health insurance information.

Automatically-collected Information: Your Personal Information may be automatically collected as you browse our Websites. The Personal Information our Websites’ servers automatically collect about you may include, but is not limited to, the following:

  • Domain name of the service providing you with Internet access;
  • Internet Protocol (IP) address used to connect your device to the Internet and other online identifiers or web beacons;
  • Browser type and version, relevant plug-ins, operating system and platform;
  • Time zone settings; and
  • Details of your online browsing activities, including, but not limited to, the full Uniform Resource Locators (URL), clickstream to, through and from the Website (including, but not limited to, date and time), the average time spent on our Websites, pages viewed, information searched for, access times, and other relevant statistics, download errors, information regarding interactions with our Websites (such as scrolling, clicks, and mouse-overs), application, or advertisement, physical and network access logs, records of products or services purchased, obtained, considered or searched for, or other purchasing or consuming histories or propensities.

See the section “Cookies” below for a discussion of our use of cookies on our Websites.

Geolocation Data: We may collect general or precise geographic location information about a particular individual or device.

Profiles and Inferences: Inferences drawn from any of the Personal Information identified above may be used to create a profile about your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Of the above categories of Personal Information that we may collect about you, the following may be considered “sensitive” categories under certain applicable laws: race, color, sex, age, religion, national origin, disability, citizenship status, genetic information, medical information, health insurance information, driver’s license number, passport number, and financial account, debit card or credit card number, and geolocation information. This Privacy Notice, and the practices described herein, applies equally to our Processing of such “sensitive” Personal Information.

Our Websites are not intended for children and we do not knowingly collect Personal Information directly from children (including any minors under the age of sixteen (16)). However, we may Process certain Personal Information relating to children that is provided by, and with the permission of, a parent or guardian of such children in accordance with applicable law.

Use Of Your Personal Information

We may use your Personal Information for the following purposes:

  • Providing the products, services or information you have requested;
  • Personalizing your experience on our Websites or the products or services we provide to you;
  • Providing customer support, including communicating with you and administering your travel reservations and your loyalty/rewards accounts;
  • Determining your eligibility for certain products or services;
  • Processing payments, fulfilling orders and requests and facilitating delivery if you purchase a product or service;
  • Facilitating marketing and advertising of products and services, and related features that may be of interest to you;
  • Creating efficiencies in managing reservations and recurring commercial interactions with you or otherwise managing an ongoing business relationship with you and our business partners;
  • Measuring the effectiveness of digital marketing and campaigns;
  • Inferring what products or services may interest you, your predicted attachment to your purchased products or services, and your likelihood of purchasing other products or services;
  • Fulfilling our contractual obligations to you or to third parties to whom you have provided your Personal Information;
  • Providing a list of your emergency contacts;
  • Operating our Websites and our other IT systems, and safeguarding their security;
  • Monitoring and securing our resources, network, premises and assets, including monitoring usage to ensure the security and functioning of our Websites and auditing, compliance and internal operations;
  • Improving our Websites, including your browsing experience;
  • Verifying your identity, such as when you request access to your Personal Information;
  • Complying with federal, state or local laws, rules, regulations, national security or law enforcement requirements, and other applicable legal and regulatory requirements, including at the request of government regulators or other law enforcement officials or public authorities and the courts (including the issuance of a valid subpoena, court order or summons).
  • Protecting or defending our rights or property and against fraud, lawsuits, claims or other liabilities;
  • Enforcing our terms of use and legal notices, as required or permitted by law;
  • For purposes of pre-closing integration planning, due diligence or implementation of commercial transactions such as proposed or actual mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization or other similar business transactions, including financings or restructurings;
  • For our internal business administration and record keeping purposes; and
  • For other legitimate business purposes.

We indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so, at the time of the collection of your Personal Information. If you do not provide the Personal Information necessary to provide you with our products and services, you will not be able to benefit from them.

We may Process your Personal Information, including “sensitive” categories of Personal Information, for purposes of automated decision-making, including profiling, to provide you with customized travel options.

We do not Process your “sensitive” Personal Information other than as described herein.

When We Share Personal Information

We do not sell, rent or trade your Personal Information to or with third parties or share your Personal Information with third parties for purposes of cross-context behavioral advertising. We will not share your Personal Information except as set forth in this Privacy Notice. In connection with the purposes listed below, we may share your Personal Information among our affiliates and subsidiaries and/or certain applicable third parties (such as governmental authorities and regulators; courts and law enforcement agencies; vendors, third party partners, contractors and service providers, including those supporting our Websites or providing us with other services needed to maintain our business, as well as lawyers, accountants, auditors, and other professional advisors; and counterparties, or potential counterparties, in connection with certain types of corporate transactions):

  • To provide services on our behalf, which may include providing customer support, processing transactions, providing IT and technical support, providing fulfillment or delivery services, providing financial services or performing statistical analysis of our Websites or our products and services;
  • To administer and operate our business;
  • To maintain your accounts and process or complete transactions requested by you;
  • To enforce our terms of use and legal notices, as required or permitted by law;
  • To protect or defend our rights or property and against fraud, unauthorized transactions, lawsuits, claims or other liabilities;
  • To comply with federal, state, or local laws, rules, regulations, national security or law enforcement requirements, and other applicable legal and regulatory requirements, including at the request of government regulators or other law enforcement officials or public authorities and the courts (including the issuance of a valid subpoena, court order or summons).
  • For purposes of pre-closing integration planning, due diligence or implementation of commercial transactions such as proposed or actual mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization or other similar business transactions, including financings or restructurings.

If we provide Personal Information to our service providers, we authorize them to use such Personal Information only in connection with the services they perform on our behalf, and for no other purpose. In addition, we endeavor to ensure that such service providers are bound by contract to establish reasonable measures to protect your Personal Information from unauthorized access, use or disclosure.

Security And Storage

We maintain technical and organizational measures designed to protect Personal Information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access. Unfortunately, no information security system can be 100% secure. As a result, although we strive to protect your Personal Information, we cannot ensure or warrant the security of your Personal Information stored on our or our vendors’ servers or transmitted via email or through our Websites against any possible loss or unauthorized access. You transmit Personal Information to us at your own risk.

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when such information is no longer necessary for the purposes for which we Process it, unless we are required by our applicable legal, regulatory or contractual obligations to keep such information for a longer period. We have established specific time limits for data deletion in our data retention policies and complete periodic review of our databases, taking into account, for example, the type of products and services provided in the context of our Websites, the length of the customer relationship, mandatory retention periods and relevant statutes of limitations. You can request copies of our data retention policies by contacting us using the details set forth at the end of this Privacy Notice.

Cookies

We also Process your Personal Information through the use of cookies on our Websites. A cookie is a small data file or piece of information that websites commonly store on your computer hard drive (or other Internet-enabled device, such as a smartphone or tablet) when a website is visited. A cookie file usually contains the name of the website from which the cookie has come from, the “lifetime” of the cookie (i.e., how long it will remain on your device) and information that can identify a return visitor each time they visit our Websites (e.g., a randomly generated unique number). Our Websites may use cookies as a way to measure activity and traffic patterns on our Websites in order to continually improve your experience. We also use cookies to compile anonymous, aggregated statistics that allow us to understand how people use our web properties and to help us improve web structure and content. These cookies do not identify you as an individual. All data is collected and aggregated anonymously.

If you do not agree to our use of cookies, you should set your browser settings accordingly or not use our Websites. Most Internet browsers are initially set up to automatically accept cookies. Your browser settings can be set to alert you before accepting cookies. You can choose to refuse cookies by turning them off in your browser. You do not need to have cookies turned on to visit our Websites, but disabling the cookies that we use may impact your experience while using our Websites. For example, you may not be able to visit certain areas of our Websites. If you use different devices to view and access our Websites (e.g., your computer, smartphone, or tablet), you will need to ensure that each browser on each device is adjusted to suit your cookie preference.

International Data Transfers

Our Websites and our products and services are hosted on servers located in the United States. If you are located in a non-U.S. jurisdiction, please note that your Personal Information will be transferred to the United States, a jurisdiction that may not provide an equivalent level of data protection as your home country. We will take appropriate steps, in accordance with applicable laws, to require or maintain an adequate level of protection and security for your Personal Information. For additional information regarding such steps, please contact us using the details set forth at the end of this Privacy Notice.

Your Rights And Choices

You may opt-out of receiving direct marketing email or messages from Switchfly at any time by notifying us via email at privacy@switchfly.com. You may also opt-out by responding to the opt-out option included with any direct marketing email or message that we send.

Additional Information for Individuals Whose Personal Data is Subject to the GDPR or the UK GDPR

Residents of the European Economic Area (“EEA”) and the United Kingdom (“UK” and such residents of either, “EEA/UK Residents”) have certain rights with respect to their personal data pursuant to the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or the UK General Data Protection Regulation (i.e., the GDPR as implemented into UK law, the “UK GDPR”), as applicable and as further described in this section. For the purposes of this section, “personal data” has the meaning given to such term in the GDPR or UK GDPR, as applicable.

The rights and disclosures herein are in addition to any other rights or disclosures applicable to you in the remainder of this Privacy Notice. Where there is a conflict between this section and other provisions of this Privacy Notice, this section will prevail for EEA/UK Residents and their rights under the GDPR and UK GDPR.

Our legal bases for collecting and using personal data:

We are entitled to use your personal data in the ways set out in this Privacy Notice on the following legal bases:

  • You have consented to the use of your Personal Information. For example, we may seek to obtain your consent for our uses of cookies or similar technologies or to send you marketing communications;
  • We need your Personal Information to provide you with our products and/or services, or to respond to your inquiries;
  • We have a legal obligation to use your Personal Information;
  • We, or a third party, have a legitimate interest in using your Personal Information, such as to ensure and improve the safety, security, and performance of our products and services, to provide you with the correct version of our Websites or carry out data analyses; and
  • We need to establish, exercise or defend our legal rights for the purposes of legal proceedings.
Your rights in connection with personal data:

Under the GDPR or UK GDPR, you may have the right to:

  • Request access and receive information about the personal data we maintain about you;
  • Update and correct inaccuracies in your personal data;
  • Restrict the Processing of your personal data;
  • Object to the Processing of your personal data under certain conditions, such as where we are relying on a legitimate interest (or that of a third party) and there is something about your particular situation which makes you want to object to Processing on this ground. You may also have the right to object where we are Processing your personal data for direct marketing purposes;
  • Delete your personal data under certain conditions; and/or
  • Transfer your personal data to another party in a machine-readable, commonly used and structured format.

If we’ve obtained your consent, then you may withdraw it any time by contacting us and free of charge. The various rights above may be limited in some circumstances and each is subject to certain exceptions or qualifications.

What we may need from you: We may request specific information from you to help us confirm your identity and your right to access and to provide you with the personal data that we hold about you or make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal data that we hold about you or we may have destroyed, erased or made your personal data anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Right to complain: In addition to the above-mentioned rights, you also have the right to lodge a complaint with a competent supervisory authority in your country. For example, in the UK you should contact the Information Commissioner’s Office at: https://ico.org.uk/global/contact-us/ or 0303 123 1113.

If you have any questions, or wish to exercise these rights, please contact us using the details provided at the end of this Privacy Notice.

Additional Information for Individuals Whose Personal Information is Subject to Certain State Laws

Residents of California and Virginia have certain rights with respect to their Personal Information pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”) and the Virginia Consumer Data Protection Act (the “VCDPA”), respectively and as further described in this section. For the purposes of this section, “Personal Information” has the meaning given to such term (or to any term of similar intent, such as “personal data”) under the CCPA and VCDPA, as and to the extent applicable to your rights and our obligations with respect to such information. Certain Personal Information is not subject to such state laws, such as, for example, certain publicly available information (as described in the CCPA or VCDPA, as applicable), Personal Information subject to the Gramm-Leach-Bliley Act, and any other Personal Information expressly exempt from such state laws.

The rights and disclosures in this section, as and to the extent applicable, are in addition to any other rights or disclosures applicable to you in the remainder of this Privacy Notice. Where there is a conflict between this section and other provisions of this Privacy Notice, this section will prevail for residents of California and Virginia, and their rights under the CCPA and VCDPA, as applicable.

For California Residents:
  • Your rights in connection with Personal Information: If you are a resident of California, under the CCPA, you may have the right to:
    • Request that we disclose what Personal Information categories we have collected, used, disclosed or sold about you, the business purposes of such collection, use, disclosure or sales, the sources from which such information was collected and the categories of third parties to whom we have disclosed or sold such information. You also have a right to receive a list of the specific pieces of Personal Information we have collected about you. You may request any or all of this information up to two times in a twelve (12) month period;
    • Request that we delete certain Personal Information we hold about you. We will assess your request and determine, under the CCPA, what Personal Information we are required to delete;
    • Choose to opt-out of the sale of your Personal Information, as well as the sharing of your Personal Information for purposes of cross-context behavioral advertising. However, as noted above, we do not currently sell your Personal Information or share your Personal Information with third parties for purposes of cross-context behavioral advertising; and
    • Request that we correct any inaccurate Personal Information we have collected about you.

The various rights above may be limited in some circumstances and each is subject to certain exceptions or qualifications.

  • Authorized Agents: You have the right to appoint an authorized agent to exercise your rights on your behalf. If an agent provides a power of attorney in compliance with California Probate Code Sections 4121-4130, we will process such request. If however, your agent does not provide such power of attorney, we may need you to provide the authorized agent written permission to us to exercise your rights in this section on your behalf. Furthermore, in addition to your written permission, we may contact you and/or your agent for further verification of your request.
  • California Shine the Light Act: If you are a resident of California, California Civil Code Section 1798.83 allows you to request information regarding the Personal Information we collected and third parties to whom we disclosed your Personal Information for the third parties’ direct marketing purposes during the preceding calendar year.
For Virginia Residents:

If you are a resident of Virginia, under the VCDPA, you may have the right to:

  • Request that we confirm whether or not we are Processing your personal data;
  • Request to access the personal data we have Processed about you;
  • Request to obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format;
  • Request that we delete certain personal data we hold about you. We will assess your request and determine, under the VCDPA, what personal data we are required to delete;
  • Choose to opt-out of the sale of your personal data, as well as the Processing of your personal data for purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. However, as noted above, we do not currently sell your personal data or Process your personal data for purposes of targeted advertising or profiling; and
  • Request that we correct any inaccurate personal data we have collected about you.
  • The various rights above may be limited in some circumstances and each is subject to certain exceptions or qualifications.

Nondiscrimination: You shall not incur or be subject to any price or quality of service difference from us for exercising any of your rights under the CCPA or VCDPA, as applicable. If you feel you have been treated unfairly for exercising any of your rights under the CCPA or VCDPA, as applicable, please contact us immediately by methods listed in the “How to Contact Us” section of this Privacy Notice.

Verification Requests: To help protect your privacy and maintain the security of your Personal Information when you request to exercise your rights under the CCPA or VCDPA, as applicable, we may require certain information from you to verify your identity as the requestor. Generally, we will ask you information that we have already collected about you to provide this verification, such as your name, address, email address, account number if applicable, and phone number. We reserve the right to ask additional questions and/or to contact you directly if, in our discretion, we determine we need additional verification.

Response Timing and Format: We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt or within the time period required under the CCPA or VCDPA, as applicable. If we require more time (up to ninety (90) days or the time period permitted under the CCPA or VCDPA, as applicable), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. If you are a resident of Virginia, you may have the right to appeal our denial of your request within a reasonable time and may exercise such right by contacting us by the methods listed in the “How to Contact Us” section of this Privacy Notice. If your appeal is denied, we will provide you with a method through which you may contact the Attorney General of Virginia to submit a complaint.

Fees: We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded and we are permitted to do so under the CCPA or VCDPA, as applicable. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Additional Information: If you have any questions, wish to exercise the rights described in this section (or, as applicable, have your authorized agent exercise any of such rights on your behalf), or need to access this Privacy Notice in an alternative format, please contact us using the details provided at the end of this Privacy Notice.

Links to Other Websites

This Privacy Notice does not apply to or govern the practices of third party companies or websites that use our products or services, that can be accessed through links contained on our Websites, or that we do not own or control. We are not responsible or liable for any linked or referenced websites or for the policies and practices followed by third parties. We encourage you to read the privacy statements of such companies or websites as their privacy statements may differ from ours. Our links to other websites or displays of any advertisements or third-party content does not mean we endorse any other website’s privacy or information security practices.

Changes to this Privacy Notice

If we make any material changes to this Privacy Notice, we will post a revised link on our Websites that notifies visitors of the change. We reserve the right to change this Privacy Notice at any time, as circumstances or requirements change. All updates are effective immediately when we post them here and apply on a go-forward basis. For this reason, you should check our Websites periodically to see if any recent changes to this Privacy Notice have been made and we encourage you to review this Privacy Notice whenever you visit our Websites so you are aware of any updates, as they will be applicable to you and your Personal Information. You can also tell if this Privacy Notice has changed recently by reviewing the Effective Date posted at the beginning of this Privacy Notice. Your continued use of our Websites following the posting of changes constitutes your acceptance of such changes.

How To Contact Us

Switchfly, Inc. is the entity responsible for the Processing of your Personal Information as described in this Privacy Notice. If you have any questions or comments about this Privacy Notice, or our privacy practices in general, please contact us via email at privacy@switchfly.com, or via regular mail at:

Switchfly, Inc
1200 17th St. Floor 10
Denver, CO 80202