Rakuten Travel Privacy Policy

Personal Data we collect and how

We collect personal data in different ways when you use our Service. The following is a list with the categories of personal data we collect, and how we obtain it.

Information that you directly provide to us

You provide personal data to us when you use our Service. This contains:

Basic information:

• personal details (name, date of birth);

• contact details (phone number, email address, postal address or mobile number);

• flight details (flight number, flight itinerary);

• booking details (car model, location of booking, period of booking);

Financial information:

• Payment details (bank details, credit card details)

Information we collect via cookies and tracking technologies:

When you use our service, we will collect the following data using tracking technologies placed in our website. These data types are:

Identifiers for devices you have used to access our Services:

• IP address (from which your approximate location can be inferred);

• Unique devices identifiers or MAC identifiers

• Advertising related identifiers

Internet activity information: information about your visits to our website and login sessions, and usage of the Services (include what you track).

Further information about our use of Cookies and Tracking Technologies is available on our Rakuten Travel Cookie Policy.

Information that will be inferred about you from how you use the Service :

• • Interests;
• • Age range;
• • Gender.

For more details about how we process inferred information about you, including the purposes and the legal basis for which this data is collected, please see the [How we use your data and the basis on which we use it] Section.

How we use your data and the basis on which we use it

• • We always need a proper reason to process your data.
• • The basis shall be the collection of personal data for the purpose of performing our contract with you; where applicable, fulfilling our legitimate interests, only when we have a valid interest that shall not override yours (the collection of data in order to secure our Services); complying with our legal obligations; as well as, where applicable, processing personal data based on your consent (when you voluntarily request to participate in our marketing activities).
• • Please see the table below for more information regarding the purposes for which we process the types of personal data listed above, as well as our basis for such processing operations.

Your Choices

The rights and choices about your data may vary depending on your location. This includes the right to request:

• • access to your data; either if you want to know what data we have about you; or
• • get a copy of your data in a machine-readable format (right to data portability);
• • correct any information that is wrong;
• • delete your data;
• • restrict usage to the bare minimum (for example, if you ask us to delete, but we still need to keep your order history for legal reasons, like tax audits of our business);
• • object to specific uses (you can opt-out of marketing e-mails);
• • ask us where we got certain data about you, how we use it and with whom we share it;
• • withdraw your consent easily; if you do so, the lawfulness of processing based on your consent before its withdrawal will not be affected;

Please see below the rights available under the applicable law for your region.

If you want to exercise your rights with us, please get in touch with us by using the Contact section below. We will always try to find an amicable solution together.

Data Sharing

We share your data with:

• •Service providers and business partners, who help us make our service possible (they are data processors). We ensure they only have access to such information that is strictly necessary for us to provide the Services. These parties are required to secure the data they receive and to use the data for pre-agreed purposes only, while ensuring compliance with all applicable data protection regulations.
• •Law enforcement bodies where we are required to share data or with a court if necessary to enforce our claims or other legal rights.
• •Asset purchasers. In case our service or our company are fully or partly purchased by another company, data will be shared. The acquiring company will be bound by this privacy policy.
• •Advertising partners. We disclose or share your personal data, where you consent if it is required, for advertising purposes. Further information about data sharing using cookies and other device identifying technologies is available on our Rakuten Travel Cookie Policy.

Find here the list with our services providers, business and advertising partners, the data we share and the countries where they are located.

Because we operate as part of a global business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section on "International Data Transfers" below for more information.

International Data Transfers

We are a global business. That means your data will be shared to other Rakuten Group companies around the world. We also use service providers in different countries. Data are sent to them as well as indicated in the Data Sharing section above. We have taken steps to keep your data safe. We are always watching out to ensure they are trustworthy, and we have strict contracts in place.

Inside the Rakuten Group, we have BCRs (Binding Corporate Rules), a set of privacy internal rules that we apply across all the Rakuten Group companies. The BCRs are Rakuten’s global standard for the protection of privacy and processing of personal data. Rakuten’s BCRs allow secure transfers of data within the Rakuten Group companies and have been approved by the relevant Data Protection Authorities in Luxembourg and the United Kingdom. You can find them here.

Security

We have strict security measures in place in accordance with high security standards to ensure that your data are safe with us. Some of these are technical, like password rules and monitoring of log-in patterns. Others are organizational, like having proper processes and access rules in place. We do so to prevent unauthorized access or unauthorized disclosure of your information, to maintain the accuracy of such information and, when necessary, to ensure its proper destruction.
When collecting or transferring your personal information, we employ data encryption technology, and restrict access only to those persons who require it to fulfil their job responsibilities. We conduct periodic reviews of our practices to ensure that our safeguards are properly implemented and remain state of the art. We make sure to always keep up with the latest developments.

Retention

We will keep your personal information necessary to fulfil our contractual obligations for as long as we have a relationship with you. We will only retain your personal information after this time if we are required to do so to comply with the applicable laws, or if there are outstanding claims or complaints that will reasonably require your personal information to be retained.

Contact Us

Rakuten Group Inc. is responsible for the personal data we collect and process. Our main offices are in Rakuten Crimson House, 1-14-1 Tamagawa Setagaya-ku, Tokyo 158-0094.
For any questions or concerns, or if you want to make use of your rights, feel free to reach out to us anytime via travel-cars-cs-en@faq.rakuten.co.jp. Please note that when contacting us, we may ask you for certain information to verify your identity and respond to your request appropriately.
Our data protection officer can be contacted at rakuten-privacy@mail.rakuten.com. If you have any complaint, we hope we can work with you to achieve a good solution. If we are not able to, you can contact your local data protection authority.

Change to this Policy

We may update this privacy policy from time to time. If there is going to be a substantial change, we will notify you in advance.