Privacy Notice - HolidayMarket.ae

1. About this notice

Holiday Market Tourism LLC ("Holiday Market", "we", "us", "our") is a travel and tourism company licensed in the United Arab Emirates. We operate the online travel marketplace HolidayMarket.ae, through which you can book flights, hotels, holiday packages, staycations, attractions, transfers and related travel services. We are part of the Alfred Holdings group.

This Privacy Notice explains how we collect, use, share, and protect your personal data when you interact with us: when you visit our website, register your interest, contact our travel advisors, request a quote, make a booking, or travel on arrangements we have made for you. It is issued in accordance with Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (the "UAE PDPL") and its implementing regulations.

If anything in this notice is unclear, please contact our Data Protection Officer using the details in Section 17.

2. Who we are and how to contact us

For the purposes of the UAE PDPL, Holiday Market Tourism LLC is the data controller for the personal data described in this notice.

3. Scope of this notice

This notice applies to personal data we process about:

• Customers and prospects: individuals who register their interest, request a quote, make a booking, or otherwise interact with our services;
• Co-travellers and accompanying passengers: individuals included in a booking made by someone else, including family members and children;
• Website and app users: visitors to holidaymarket.ae and users of our mobile applications, where available.

It covers our website (https://holidaymarket.ae), our advisor and contact-center channels, and our travel agency operations.

This notice does not apply to:

• Airlines, hotels, tour operators, cruise lines, car-rental companies, insurers and other travel suppliers, who act as separate controllers for their own purposes: please refer to their own privacy notices;
• Third-party websites linked from our services.

4. The personal data we collect

We collect personal data that is necessary to provide travel services, make and manage bookings, comply with our legal obligations, and operate our business. The specific data we collect depends on the products and services you use.

4.1 Identification and contact data

• Full name (as per passport or Emirates ID)
• Date of birth and age
• Nationality
• Gender
• Passport number, dates of issue and expiry, and country of issue
• Passport copy, where required for the services you book
• Emirates ID number and copy, where required for a UAE resident booking or a visa or government service
• Residential address
• Mobile number
• Email address

4.2 Travel documents and visa data

Where we arrange a visa for you, or where it is required for your trip, we collect:

• Passport copy and passport-style photograph
• UAE residence visa details, where required by the destination country
• Details of previous visas and travel history, where required by the destination country
• Supporting documents required by the relevant authorities for the application, for example proof of accommodation, return tickets or, where a destination requires it, financial or employment confirmation

4.3 Booking and itinerary data

• Destinations, travel dates and number of travelers
• Flight details, booking references (PNR), ticket numbers, and seat and class selections
• Hotel, resort and staycation details, room types and stay dates
• Holiday package, tour, attraction, activity, transfer, car-rental and cruise details
• Meal preferences and seating requests
• Special requests and special-assistance needs (see Section 5, Sensitive personal data)
• Frequent-flyer and hotel loyalty programme numbers, where you provide them
• Your booking history with us

4.4 Co-traveller data

Where you book for other people, we collect the personal data of each traveller included in the booking (the categories described in Sections 4.1 to 4.3), provided by you as the lead booker. By providing another person’s data you confirm that you are authorised to do so and that you have made this notice available to them. This includes the data of children travelling under the booking (see Section 14).

4.5 Financial and payment data

• Payment method (card or bank transfer)
• Name on the payment method and billing address
• Tokenised card reference (we do not store full primary account numbers; see Section 11)
• Bank account name, bank name and IBAN, for refunds
• Your transaction history with us

4.6 Digital and online interaction data

When you visit our website or use our mobile application we automatically collect:

• IP address, approximate location derived from your IP address, and time-zone settings
• Device information (device type, model, operating system, screen size)
• Browser type and version and language settings
• Pages viewed, links clicked, time spent and other usage statistics
• Referral URLs (the page that brought you to our services)
• Server logs (request times, HTTP status codes, error events)
• Cookies and similar technologies (see Section 13)

4.7 Communications and recordings

• Records of calls to our advisors and contact centre (calls are recorded for quality, training, compliance and dispute-handling purposes; you are informed before the recording starts)
• Emails, SMS, in-app messages, web-chat transcripts and other written correspondence
• Feedback, complaints, survey responses and reviews you submit to us

5. Sensitive personal data

Under the UAE PDPL, certain categories of data are treated as "sensitive personal data", including data revealing a person’s health, biometric characteristics, ethnic or racial origin, political opinions, religious beliefs, or criminal record.

We process sensitive personal data only where necessary, and only in the following circumstances:

• Health and special-assistance data, where you tell us about a medical condition, disability, reduced mobility, pregnancy, allergy or dietary requirement that affects your travel arrangements (for example, wheelchair assistance at an airport or an accessible hotel room). We process this data to arrange the services you have requested and pass it only to the suppliers who need it to deliver those services. Where required, we will obtain your explicit consent.
• Data that may indirectly reveal religious beliefs, for example a halal or kosher meal preference or a booking for religious travel. We use this data only to fulfil your request and for no other purpose.
• Biometric data (such as a facial image used for identity verification), only where you have given explicit consent or where it is required by law.

Sensitive personal data is subject to additional access controls within our systems and is shared only with parties that have a clear need to receive it (such as the airline, hotel or ground handler delivering the relevant service).

6. Sources of the personal data we hold

We obtain personal data from the following sources:

• Directly from you: when you register your interest, request a quote, complete a booking, speak to an advisor, create an account, or make a payment;
• From the lead booker or your representative: for example, a family member or friend who includes you in a booking;
• From travel suppliers: airlines, hotels, tour operators and other providers, for example booking confirmations, schedule changes, ticketing updates and service information;
• From service providers acting on our behalf: booking platforms, payment processors and customer-service tools;
• From other Alfred Holdings group companies, where you use linked services and sharing is permitted (see Section 9.5).

7. Why we use your personal data and our legal basis

We process your personal data only where we have a lawful basis to do so under the UAE PDPL. The table below summarises our main purposes and the corresponding legal basis.

For sensitive personal data, we rely on the additional legal bases provided under the UAE PDPL, in particular the necessity of processing for the performance of your travel contract, for the establishment, exercise or defence of legal claims, or, where required, your explicit consent.

8. Automated decision-making and profiling

Travel prices and availability change in real time. Some of our search, pricing and fraud-screening processes use automated tools that analyse the data you provide (for example, your itinerary, travel dates and payment details) to return fares and rates from suppliers, apply offers, or flag potentially fraudulent transactions.

Under the UAE PDPL, you have the right to object to decisions made solely on the basis of automated processing where those decisions produce legal effects or similarly significantly affect you. In practice, a member of our team reviews material decisions (such as the rejection of a booking on fraud grounds) before or promptly after they are communicated to you. If you would like a human review of any automated outcome, please contact us using the details in Section 17.

9. Who we share your personal data with

We share your personal data with the categories of recipient listed below, where it is necessary for the purposes described in Section 7 and subject to appropriate safeguards.

9.1 Travel suppliers

We share the personal data necessary to make and deliver your booking with the suppliers of the services you select, including airlines, hotels and resorts, tour operators and destination management companies, attraction and activity providers, transfer and car-rental companies, and cruise lines. Each supplier is a separate data controller and will process your data under its own privacy notice and the laws of the country in which it operates.

9.2 Booking and distribution platforms

We search and book many travel services through industry booking systems and distribution partners, including global distribution systems, hotel and activity aggregators, airline and hotel connectivity platforms, and partner travel agencies and online travel agencies through which bookings are sourced or fulfilled. These parties receive the booking data needed to confirm your travel arrangements.

9.3 Visa and immigration authorities and processing centres

Where we arrange a visa for you, or where it is required for your trip, we share your data with the relevant visa application centres, embassies and consulates, and with UAE and foreign immigration and border-control authorities. Depending on the destination country, we process visa applications ourselves or engage a specialist third-party visa service provider to assist with the application and appointment; the provider receives the data needed for that purpose and acts under contractual data-protection terms. Airlines are also required to transmit passenger and travel-document details to authorities under advance-passenger-information rules.

9.4 Service providers acting on our behalf (processors)

We engage third parties to provide IT, cloud-hosting, communications, customer-service, payment-processing, document-storage, marketing and advertising, and analytics services. These providers act on our instructions under contractual data-protection terms and are not permitted to use your data for their own purposes.

9.5 Alfred Holdings group companies

We share limited personal data with other companies in the Alfred Holdings group, including to operate the myAlfred single sign-on and rewards programme where you use it. Each group company processes data under its own privacy notice and under intra-group data-protection arrangements.

9.6 Regulators, authorities and law-enforcement

We disclose personal data where required by law or in response to a lawful request, including to:

• The Department of Economy & Tourism in Dubai (DET) and other licensing authorities
• The UAE Data Office and other UAE federal and local data-protection authorities
• UAE and foreign immigration, customs and border-control authorities, in connection with your travel
• Courts, public prosecutors, police and other law-enforcement bodies
• Tax authorities

9.7 Professional advisers

We share personal data, where necessary, with our auditors, lawyers, accountants and other professional advisers, who are bound by duties of confidentiality.

9.8 In the context of a corporate transaction

If we sell, restructure, merge, demerge, or transfer all or part of our business, we may share personal data with the counterparty and its advisers, subject to appropriate confidentiality and data-protection safeguards.

We do not sell your personal data.

10. International transfers

International travel means that personal data must, by its nature, move across borders. When you book a flight, hotel or other service outside the UAE, we transfer the data needed for that booking to suppliers and, where applicable, authorities in the destination country and in any transit countries.

Under the UAE PDPL, we transfer personal data outside the UAE only where one of the following applies:

• The destination country has been recognised by the UAE Data Office as providing an adequate level of protection;
• The transfer is covered by an appropriate contractual mechanism (such as standard contractual clauses or binding corporate rules) that imposes equivalent data-protection obligations on the recipient;
• The transfer is necessary for the performance of your travel contract or for the conclusion or performance of a contract in your interest, for example to confirm your booking with an overseas airline, hotel or tour operator;
• The transfer is necessary to comply with a legal obligation, to defend legal claims, to protect the vital interests of a data subject, or for another lawful purpose recognised under the PDPL;
• You have given your explicit consent to the transfer, having been informed of the risks involved.

Overseas suppliers and authorities process your data under the laws of their own countries, which may provide a different level of protection than the UAE PDPL. You can request information about the safeguards in place for a specific transfer by contacting our DPO (Section 17).

11. Payment-card data

Where you pay by card, the card data is captured by our payment-services provider, which is PCI DSS compliant. We do not store the full primary account number (PAN), CVV or full card data on our systems. We may store a payment token (a non-sensitive reference issued by the payment provider) so that you can make further bookings or payments without re-entering your card details. The token cannot be used to make a payment outside our authorised payment channels.

12. How long we keep your personal data

We keep personal data only for as long as we need it for the purposes set out in this notice, or for as long as we are required to keep it by law.

The period for which we retain any particular category of personal data is determined by reference to:

• the nature and purpose of the processing, and whether an ongoing relationship or service is in place, for example an upcoming trip or an open refund;
• our legal and regulatory obligations, in particular UAE tax and accounting law (which requires business and accounting records to be retained for at least five years, and in some cases longer) and the record-keeping requirements attached to our licences;
• the statutory limitation periods applicable to potential legal claims under UAE law, which may extend retention of booking and payment records for several years after travel is completed;
• the need to handle complaints, disputes, chargebacks and regulatory investigations; and
• legitimate business needs, such as fraud prevention and information security.

Our internal Records Retention Schedule sets out the specific periods that apply to each category of data, and you may request a summary by contacting our Data Protection Officer.

After the applicable retention period, we securely delete the data or anonymise it so that it can no longer be associated with you. We may retain anonymised or aggregated data indefinitely for analytical and statistical purposes.

13. Cookies and similar technologies

Our website uses cookies and similar technologies for the following purposes:

• Strictly necessary: to enable core site functionality, security, and fraud prevention (cannot be disabled);
• Functional: to remember your preferences and settings;
• Analytics: to understand how our site is used and to improve it;
• Marketing: to deliver and measure the effectiveness of advertising.

You can manage non-essential cookies through the cookie banner on our website and through your browser settings. Disabling cookies may affect some site functionality.

14. Children’s data

Travel bookings routinely include children as accompanying travellers, and we process children’s personal data (such as name, date of birth and passport details) where a parent or legal guardian includes them in a booking. The lead booker is responsible for providing the child’s data and for doing so with the authority of the child’s parent or guardian.

Our website, customer accounts and marketing are intended for adults: individuals aged 18 or over. We do not knowingly market to minors or knowingly collect personal data directly from them. If you believe a minor has provided personal data to us directly, please contact our DPO so we can delete it.

15. Security of your personal data

We apply technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These measures include encryption in transit and at rest for sensitive data, access controls based on the principle of least privilege, network segmentation, logging and monitoring, regular vulnerability and penetration testing, employee training, vendor due diligence, and incident-response procedures.

No system can be guaranteed to be entirely secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the UAE Data Office and affected individuals in accordance with our legal obligations.

You can help us protect your data by using a strong, unique password for your account, by not sharing your credentials, and by reporting any suspicious activity to us promptly.

16. Your rights under the UAE PDPL

Subject to the conditions and limits set out in the UAE PDPL, you have the following rights in relation to your personal data:

• Right to information: to be informed about how we process your personal data (this notice is the principal way in which we provide that information);
• Right of access: to request a copy of the personal data we hold about you and certain information about how we process it;
• Right to rectification: to ask us to correct personal data that is inaccurate or incomplete;
• Right to erasure: to ask us to delete personal data, where we no longer have a lawful basis to keep it (this right is subject to legal and regulatory retention obligations, which mean we may not always be able to delete data on request);
• Right to restriction of processing: to ask us to limit how we use your personal data in specified circumstances;
• Right to data portability: to receive certain personal data you have provided to us in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, where technically feasible;
• Right to stop processing: to object to processing carried out for our legitimate interests or for direct marketing, and to withdraw consent at any time where we rely on consent (without affecting the lawfulness of prior processing);
• Rights in relation to automated decision-making and profiling: see Section 8;
• Right to contact the DPO: to raise any concern about how we process your personal data;
• Right to lodge a complaint with the UAE Data Office: see Section 17.

To exercise any of these rights, contact our Data Protection Officer using the details in Section 17. We may need to verify your identity before responding. We will respond within the period required by the UAE PDPL and its implementing regulations. There is normally no charge, but we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.

17. Contacting the Data Protection Officer and lodging a complaint

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our compliance with the UAE PDPL and addressing data-protection enquiries and complaints.

Data Protection Officer

Email: denis.yakimov@alfred.holdings

Postal address: Data Protection Officer, Holiday Market Tourism LLC, 18th Floor, Control Tower, Motor City, Dubai, UAE

If you are not satisfied with how we have handled your personal data or your request, you have the right to lodge a complaint with the federal data-protection regulator:

UAE Data Office Website: https://www.uaedata.gov.ae

We would, however, appreciate the opportunity to address your concerns directly before you escalate to the regulator.

18. Changes to this notice

We may update this notice from time to time, for example to reflect changes in our services, in the law, or in regulatory guidance. When we make material changes, we will post the updated notice on our website, update the "Last updated" date at the top, and, where appropriate, notify you directly. Please review this notice periodically.

19. Governing law

This Privacy Notice and any matter arising from or in connection with it is governed by the laws of the United Arab Emirates, including the UAE PDPL and its implementing regulations.

HolidayMarket.ae is operated by Holiday Market Tourism LLC, an Alfred Holdings company.