About this privacy policy

We are GrandVillen and this privacy policy is intended for travelers who use or are considering using our products and services.

By using GrandVillen's services, you place your trust in us. We value that trust.

This privacy policy describes how we collect and otherwise process your personal data when you visit our websites, use our mobile apps, or purchase a travel-related product or service from us. Among other things, it explains your rights regarding your personal data and how you can contact us.

GrandVillen offers travel-related online services on its websites and mobile apps, as well as through third-party channels such as partner websites.

This privacy policy applies to all types of information about travelers that Grand Villen processes in all of its services. This is not the only privacy policy that GrandVillen provides to inform you about our processing of personal data. There is a similar privacy policy for GrandVillen's business partners.

GrandVillen changes its privacy policies from time to time and recommends that you review this policy occasionally to stay up to date. If GrandVillen revises a privacy policy in a way that could significantly affect individuals, the individuals affected will be notified accordingly before the changes take effect.

Terms that may appear in this privacy policy

In all privacy policies, GrandVillen uses specific terms that have a special meaning in connection with these policies and GrandVillen's services. These terms are explained here.

Term	Meaning
Platform	All websites, mobile apps, or other technologies we offer to interact with travelers and other parties in connection with travel services.
Strategic Partner	A company (such as airlines, banks, other BHI brands, or mobile device manufacturers) with which we have a contractual relationship to expand our booking offerings. These partnerships allow customers to conveniently book their travel at various locations outside of GrandVillen's direct channels, such as websites or mobile apps.
Travelers	All persons who use or intend to use our travel-related products or services on our platform, whether for themselves or for others.
Travel	One or more travel-related products or services that a traveler can select from one or more travel providers via our platform.
Travel provider	The third-party provider of accommodation (e.g., hotel, motel, apartment, bed and breakfast, or other accommodation), an attraction (e.g., a theme park, museum, or sightseeing tour), transportation (e.g., by air or ground transportation, including private and public transportation, rental cars, train or bus travel, and related transfers), and any other travel-related products (e.g., insurance) or services offered on the platform from time to time when booking a trip.
Travel Service	The online services offered and supported by GrandVillen for travel providers on the platform with regard to booking, ordering, purchasing, and payment.
Travel booking	The online booking, ordering, or payment made in connection with a trip.

 

Personal data we collect and process

Personal data we receive from you

When making a booking, you must provide your name and email address. Depending on the type of booking, you may also be required to provide your address, telephone number, payment information, date of birth, current location (in the case of on-demand services), information on whether you are traveling for business or pleasure, the names and dates of birth of your travel companions, and any preferences during your trip (e.g., information on special dietary requirements or accessibility). When booking flights and certain attractions, we may need to collect additional information from you, including your passport or ID card details or those of your travel companions. This may also be required for online check-in.

When you contact our customer service team, contact your travel provider through our platform, or reach us by phone or social media, we also collect information from you through these channels, including your name and metadata such as, in the case of phone calls, where you called from and the date and duration of the call.

If you search for possible travel bookings on our platform, you can save certain travel components in a list that we store for you. During or after your trip, we may also ask you to submit a review to inform others about your experience. When you submit reviews on the platform, we collect information that you have provided in addition to your first name or display name and avatar (if available).

When you create an account on our platform, we also store the data you enter and maintain there. This may include personal settings, credit card details, uploaded photos, and reviews. You can also add the data from one or more of your identification documents to your account details so that you do not have to re-enter this data for future bookings.

We may also receive personal data from you in other cases. For example, when you use our platform on your mobile device, you may allow GrandVillen to view your current location or grant us access to other information. This allows us to provide you with the best possible service, for example by suggesting nearby restaurants and attractions or making other recommendations.

Personal data we receive about you from others

You may use our platform to make a booking on behalf of or for other travelers. In this case, you may need to provide some information about these individuals when making the booking. If you have an account with GrandVillen, you can create an address book there to make it easier to plan and organize business trips for other people.

If you use the platform to share information about others, it is your responsibility to ensure that each person about whom you share personal data is aware that you are doing so. In addition, the person must know how GrandVillen uses their personal data (in accordance with this privacy policy).

Personal data we collect automatically

Regardless of whether you make a travel booking or not, we automatically collect certain information when you use our platform. This includes your IP address, the date and time you use our platform, and some information about your device's hardware and software (e.g., type of operating system, internet browser, and version of the mobile app you use, as well as your selected language settings). When you use our mobile apps, we collect data to identify the mobile device and to operate our app on the device (including any crashes). If you are redirected to GrandVillen from a third-party website or mobile app, we also collect this information. We also collect information about your clicks and which pages are displayed to you on our platform.

Personal data and information about you that we receive from other sources

We may also receive information about you from other sources. These include, but are not limited to:

• Other BHI companies
• Travel providers
• Strategic partners
• Other third-party companies such as marketing partners

Information we receive from these parties may be used in conjunction with data you provide directly to us on our platform for the purpose of providing services to you.

We receive personal data about you from the following sources:

• Our travel booking services are also available beyond our platform. In addition, they are integrated into the services of strategic partners. If you make a booking through a service for which the strategic partner requires GrandVillen, the strategic partner will provide us with the booking details so that we can process and handle your booking.
• Travel providers may share other information about you with GrandVillen. This may be the case if you have support questions about a pending travel booking, or if there is a dispute, major complaint (including about you), or other issue related to a travel booking.
• In some cases, we link to other business partners who offer travel bookings that may not be available on our platform. If you select these, you will be redirected to the websites of other business partners where you can make a booking. These business partners may share certain personal data with us in relation to your booking and your use of the websites or mobile apps in accordance with their own privacy policies.
• Our platform includes communication services such as email and chat messages. These services allow you to conveniently contact the travel provider you booked with to discuss details of your booking, such as the availability of parking at the accommodation. The data we collect and process also includes these communications. We may block the delivery of messages that we believe, at our sole discretion, contain harmful content or spam messages, or pose a risk to you, the travel providers, GrandVillen, or others.
• We may also receive information in aggregate form from our social media and marketing partners. This helps us measure the effectiveness of advertising and marketing campaigns.
• If you link your GrandVillen account to one of your social media accounts, you may trigger a data exchange between GrandVillen and that social media provider. You can unlink at any time by updating your GrandVillen account settings.
• We may receive confirmatory or verifying information about you from third parties. For example, in order to provide you with a verification badge, we may have a third party verify the information you provided to confirm that it is accurate and belongs to you.

 

Purposes of collecting and processing your personal data

We use your personal data for various purposes, as listed here:

1. Travel bookings:

 

First and foremost, we process your personal data to complete and process your travel booking, which is essential for the provision of this service. This includes sending communications related to the booking, such as a confirmation (including, where applicable, a purchase and/or payment receipt), changes, and reminders. In some cases, this also includes processing your personal data to enable online check-in with the travel provider or processing personal data in connection with a possible damage deposit.

In addition to your contact details (e.g., email address and phone number), we may also need booking numbers and dates to determine the duration of the booking in order to provide services.

1. Customer service

 

We support our travelers with customer service in over 40 languages and are available 24/7. In order to help you when needed, we need to share booking information with our global customer service centers. Our support services include, for example, helping you contact the right travel provider and answering any questions you may have about your booking.

In order to provide these services, we need personal data such as booking information, including, for example, the price of the booking or the manner and time of the booking.

1. User accounts

 

As a user of our services, you can create an account on our platform. With an account, you can manage bookings, take advantage of special offers, make future travel bookings more easily, and set your personal preferences.

With your personal settings, you can create lists and share them with others, share photos, and view travel services you have searched for and travel-related information you have provided to us. You can also view all reviews you have written in connection with your travels.

With an account, you can also create a public profile under your own first name or another name of your choice. In some jurisdictions, we offer an account/guest verification program. This helps to build trust and security between partners and guests. To obtain a verification badge for your account, we compare the information you provide to us with any historical data we may have about you, as well as other publicly available data. When you sign up for your GrandVillen account and want to create a GrandVillen, we may use your name and email address to pre-fill the registration form.

If you have a GrandVillen account, you can also use it to store contact information, manage your business travel bookings, or link your GrandVillen account to others.

To provide accounts, we use personal data such as login information to access your account and information about when the account is used, for example in connection with bookings and payments.

1. Marketing activities

 

We also use your information for marketing purposes, including:

• To send you personalized marketing messages, including promotions, Genius and other rewards, travel experiences, surveys, and other updates about GrandVillen products and services. This may be done via push notifications, SMS and other messaging applications, in-app notifications, or email. You can opt out of marketing messages at any time. For example, you can unsubscribe from receiving email marketing communications at any time by selecting the "Unsubscribe" link included in each communication or by managing your preferences through your account settings.
  
   

For personalized marketing messages, we may also use your interaction with our platform, such as previous bookings and behavioral data, including data collected via cookies and similar tracking technologies.

• To show you personalized marketing, including promotions, Genius and other rewards, travel experiences, surveys, and other updates about GrandVillen products and services on the GrandVillen website, in mobile apps, or on third-party websites and apps. These may be offers and recommendations that we think may be of interest to you and that you can book directly on our platform, on our strategic partners' websites, or on other third-party websites.
  
   

For personalized marketing ads, we may also use your interaction with our platform, such as previous bookings and behavioral data, including data collected through cookies and similar tracking technologies.

• To contact you, if applicable, with information about insurance products that you did not consider when making your booking.
• To organize other promotional activities and invite you and other travelers to participate in such activities based on information already collected.

To do this, we use personal data such as contact and account information, browsing data, location data and settings, as well as search queries and bookings you make from various devices.

1. Communicating with you

 

We may contact you, including by email, chatbot, post, telephone, push or platform notification, or SMS. The method of contact will depend on the contact information you have provided to us.

We process personal data from the communications you and other parties send us. There may be a number of reasons for this, including:

• Responding to and processing support requests from you or the travel provider you booked with. We offer travelers and travel providers various ways to exchange information via our platform, such as requests and comments about travel bookings via GrandVillen.
• If you have started a travel booking but have not yet completed it, we may send you an email reminding you to continue with the booking. This convenience allows you to pick up where you left off without having to search for the travel provider again or re-enter your booking details.
• If you use our travel services, we may send you a questionnaire or otherwise ask you to provide us or the travel provider with a review of your trip.
• We may send you further information about your booking, such as how to contact us if you need assistance while traveling, as well as helpful information to help you prepare for and enjoy your trip.
• Even if you do not currently have a booking, we may send you administrative messages, such as security information.
• We may send you a warning or other notification if a travel provider reports misconduct on your part.

For this purpose, we use personal data such as your first and last name, email address, and booking details, including booking number and selected locations.

1. Market research

 

We occasionally invite customers to participate in market research. If you are invited to participate in a survey, please read the accompanying information. It will tell you how your personal data will be collected and used.

1. Improvement of our services

 

We use personal data about travelers who use our platform for analysis purposes, such as to analyze how you or travelers with similar interests use our platform, or to measure our operational performance and thereby improve our travel services. We may use your user ID to measure traffic on our websites. We may use your personal data to develop and optimize our own machine learning models and artificial intelligence systems. This is a necessary part of our ongoing commitment to further optimize our services and improve the experience of our travelers.

In addition to the statistics we regularly compile about our company, we use data to test platform features and troubleshoot issues. The main goal here is to gain insight into the performance and use of our services and to determine how the website and mobile apps can be improved and adapted to make them even more user-friendly and appealing. Where possible, we use anonymized and non-identifiable personal data for these analysis purposes.

To do this, we sometimes combine the personal data we collect from you when you visit our platform or use different devices or different websites, even if you are not logged in.

For this purpose, we use personal data such as:

• Bookings made by travelers over certain periods or for certain products
• Searches performed by travelers on our websites and apps
• Travel reviews published by travelers on our websites

Our repeated analyses use solutions that pseudonymize personal data or process it in encrypted formats.

1. Display of prices applicable to you

 

When you search for accommodation, rental cars, or flights on our websites or mobile apps, for example, the prices displayed depend on a number of factors, such as whether you are located in the European Economic Area (EEA) or in another region/country outside the EEA.

In order to provide you with the price that applies to you, we use personal data such as your IP address, the type of device you are using, and the website from which you were referred to us.

1. Customer reviews and other information related to the destination

 

During and after your trip, we may ask you or your travel companion to submit a review. This invitation will ask for information about the travel provider, including the ground transportation provider, or the destination.

The review allows you to inform other travelers about the quality of the travel service you used, the destination you chose, the ground transportation, or other experiences you wish to share without revealing your identity. Reviews submitted by travelers are subject to our Terms of Use and are automatically reviewed for content and other factors to ensure that they meet our standards and content guidelines.

If you have an account with GrandVillen, you can choose to display a display name instead of your first name next to your review.

1. Call monitoring

 

When you call our customer service, we use an automated system to recognize your phone number and match it to the number you provided when you made your reservation. This saves you and us time. Our customer service representatives may still ask you for your ID to verify that you are the person who made the reservation.

For training or quality control purposes, one or more authorized persons may listen in on calls to customer service or record the call. In this quality control process, call recordings are used to handle potential complaints and legal claims, as well as to investigate indications of possible fraud.

We do not record every call to our customer service team. When a call is recorded, it is stored for a limited period of time (30 days by default). The recording is then automatically deleted unless we decide beforehand that it needs to be retained for fraud investigation or other legal purposes.

1. Ensuring secure and reliable services and fraud prevention

 

We continuously analyze and use certain personal data to prevent or detect online fraud attempts and other illegal or unwanted activities. This is necessary to keep our platform secure and trustworthy and to ensure the safety of all travelers.

We use personal data for security purposes when, among other things, you report security concerns, when others report security concerns related to you, or when we need to identify individuals in relation to a user account or booking. In doing so, we may need to temporarily hold certain bookings pending completion of an assessment. If there are signs of serious misconduct, we may cancel your upcoming bookings or refuse you future bookings on our platform.

In the event of security concerns, we may process information from public sources to prevent or detect harm. It is impossible to prevent some information from containing special categories of personal data.

To detect and prevent fraud and limit other misuse of our platform, we may use your personal data and examine your behavior on our platform to assess the risk of a particular action or transaction you are seeking to undertake. This makes it easier for us to assess, for example, whether a bot is using the platform and is not a legitimate user, or whether a user is making an unlawful payment using a stolen credit card.

For these purposes, we use your contact details, other identifiers (such as IP addresses), booking information including canceled bookings, reviews, account information, browser data, location data, communication data, or other information that you or another person has provided to us, including images, videos, or other media transmitted on our platform.

1. Legal purposes

 

In certain cases, we may need to reuse your information for the following purposes:

• Processing and settling legal claims and disputes
• Handling potential regulatory investigations
• Enforcing our booking terms and conditions
• Compliance with lawful requests from law enforcement agencies
• Compliance with laws and regulations applicable to GrandVillen

For example, we may need to process your booking history, the details of one or more bookings, and the corresponding payment information.

Legal bases for the processing of personal data

In order to process your personal data as described above, GrandVillen relies on several legal bases in the applicable data protection regulations. We have compiled an overview of these below:

Purpose of processing personal data	Legal basis and comments
A. Travel bookings: B. Customer service	Here, GrandVillen relies on the legal basis that the processing of personal data is necessary for the performance of a contract with you, in particular to complete and manage the booking. If the necessary personal data is not available, GrandVillen cannot complete the booking with the travel provider and cannot provide you with customer service.
C. User accounts D. Marketing activities E. Communication with you F. Market research G. Improvement of our services H. Displaying the prices applicable to you I. Customer reviews and other information related to the destination J. Call monitoring K. Ensuring secure and reliable services and preventing fraud	Unless otherwise stated in this overview, the collection and processing of your personal data for these purposes is based on the legitimate interests of GrandVillen or a third party.Before we process personal data to meet the legitimate interests of GrandVillen or a third party, GrandVillen weighs your rights and interests in protecting personal data against the rights and interests of GrandVillen or those of the third party. Legitimate interests include, for example, preventing financial damage from online fraud, sharing customer travel experiences with potential travelers, and publicly announcing offers that we believe may be of interest. In the unlikely event that GrandVillen should process special categories of personal data in connection with Purpose K, we may rely on the fact that the processing concerns personal data that is obviously published due to the individual or other legal bases, as may be assessed at that time.
L. Legal purposes	GrandVillen also refers, where applicable, to compliance with legal obligations (such as lawful requests from law enforcement authorities).
Categories of general purposes	GrandVillen will obtain your consent prior to processing your personal data, where required by applicable law. This will also be done for direct marketing purposes or where otherwise required by law.

If you wish to object to the processing listed in C to L and there is no direct option available to you (e.g., in your account), please contact us as described under Your Rights.

How we share personal data within the GrandVillen group of companies

We may receive personal data about you from other companies in the BHI group (such as Agoda or OpenTable) or share your personal data with them for the following purposes:

1. To provide services (including preparing, managing, and processing bookings or processing payments)
2. To provide customer service
3. To detect, prevent, and investigate fraudulent or other illegal activities and data breaches. Companies within BHI may need to share personal data about certain individuals to ensure the protection of all platform users, for example, from online fraud attempts.
4. For analysis and product optimization purposes, to the extent permitted by applicable law
5. To provide you with personalized offers or send you marketing communications, where permitted
6. For hosting and technical support purposes and for the general maintenance and security of this shared data
7. To ensure compliance with applicable laws

Where applicable and unless otherwise stated, GrandVillen refers to its legitimate interests in purposes A to F in order to collect and share your personal data. For purpose G, we refer to compliance with legal requirements (such as lawful law enforcement requests), where applicable. We also ensure that the flow of data between companies within the BHI Group complies with applicable laws. This includes obtaining your consent, where necessary, before sharing your personal data with other companies within the BHI Group.

How we share personal data with third parties

Under certain circumstances, we share your personal data with third parties. These third parties include:

The travel provider with whom you have made your booking

 

To complete your travel booking, we will send the relevant booking details to the travel provider you have selected.

Depending on the booking and travel provider, the data we share may include: your name, contact details, and payment details, the names of your traveling companions, and any other relevant information (such as check-in/check-out dates), including any preferences you specified when making your booking.

In some cases, we also forward some summary information about you to the travel provider. This may include:

• Whether your account is verified
• Whether you have booked with the travel provider in the past
• The number of bookings you have made with us
• The absence of reports to GrandVillen of misconduct associated with you
• The percentage of bookings you have canceled on our platform in the past
• Whether you have submitted reviews of previous bookings

If you have a question about your trip, we may contact the travel provider so that they can address it. If payment is not made directly to GrandVillen at the time of booking, we will need to forward your credit card details to the travel provider you have selected for payment processing.

In order to handle any claims or disputes or other customer service issues relating to the trip, we may share your contact details and other information about the booking, claim, or dispute with the travel provider as necessary. This may include, for example, your email address and a copy of the booking confirmation to confirm the booking or the reasons for the cancellation.

Travel providers process your personal data outside of GrandVillen's control, for example, to prepare for guests' arrival and departure. Travel providers may also request additional personal data, e.g., to provide additional services and to comply with local requirements and restrictions. If the travel provider has a privacy policy, please read it to find out how your personal data is processed.

Connectivity Providers

 

Many travel providers engage special third-party companies (often referred to as "connectivity providers") to automate the forwarding of booking information from GrandVillen and other companies in the travel industry to them.

Connectivity providers work on behalf of travel providers (rather than GrandVillen) and forward booking information to them so that they can manage the bookings in their systems.

Third-party service providers

 

We use service providers to assist us in providing our travel services. The services provided by these third-party companies include the following:

• Customer service
• Industry and market research
• Fraud detection and prevention (including checks to prevent fraud)
• Processing of insurance claims
• Payment processing
• We use third parties for electronic payment processing, chargeback processing, and collection services. In some cases, payment service providers may use your personal data for their own purposes, such as to detect and prevent fraud and to comply with applicable legal requirements.
• If you or the owner of the credit card used to make a booking request a chargeback, we must provide certain booking details to the payment service provider and the relevant financial institution so that the chargeback can be processed. This information may include a copy of the booking confirmation or the IP address used to make the booking.
• We may also pass on information to the relevant financial institutions if we consider this to be absolutely necessary to combat fraud, for example to prevent the misuse of stolen credit cards.
• Marketing services
• We sometimes share some of your personal data (e.g., characteristics) with advertising partners as part of marketing our travel services through third parties. (This is to ensure that advertising is shown to the right target group.)
• Through techniques such as hashing specific personal data (e.g., email address or phone number), we enable comparison with data from one or more databases. Such techniques limit the use of the selected personal data that a company receives from us.
• When we share audience information with advertising partners and other third parties, we ensure that your personal data is aggregated and pseudonymized so that advertising partners and other parties cannot directly identify you (e.g., by using verified data clean rooms). These pseudonymized insights are used to develop tailored media proposals and pitches for our partners.
• As part of the account verification process, we may share some of your account information (such as your name, email address, phone number, passport number, mailing address), your linked social media account, your passport, or other identification documents with third parties. A third party may use a recognition system to verify that you are a real person and not a bot. This process is automated and the data is not stored for longer than is necessary for verification.

Other commercial third parties

 

In some cases (e.g., in the event of disputes or legal claims, or in the context of audits), we may need to share your personal data with employees of service providers. These employees may include legal advisors at law firms and auditors. We only share your personal data to the extent necessary, and the sharing is done in accordance with the contractual and other obligations applicable to this data.

Competent authorities

 

If we are requested by law enforcement agencies and other authorities to provide personal data about one or more travelers in connection with a possible criminal case, we follow specific protocols. We may also need to share personal data with law enforcement agencies in connection with possible cases of fraud.

We follow similar protocols when, for example, EU and local laws require us to disclose personal data to the competent authorities, such as the tax office, in addition to disclosing personal data to . We may be required to disclose personal data to the following entities:

• To comply with a legal obligation, e.g., under applicable law for short-term rentals
• To protect and defend our rights or the rights and interests of our business partners

Other business partners

 

In other cases, we may share personal data with other business partners. These include:

• Insurance companies: If insurance claims are made that affect you and a travel provider, we may disclose the necessary data (including personal data) to the insurance company and its appointed representatives for further processing.
• Other travel providers: You may receive a "partner offer" from us. For accommodation marked as a "partner offer," the booking is handled by a travel provider that is not the same as the accommodation you booked. As part of the booking process, we must forward certain personal data to this travel provider. When booking a partner offer, please read the information provided during the booking process or in the booking confirmation. This will tell you more about the travel provider and how it will process your personal data.

Protective measures for the global transfer of personal data

GrandVillen connects travelers and partners worldwide. The data we receive from you as described in the privacy policy may be accessed, transferred to, or stored in countries that do not have the same data protection laws as the country in which you originally provided the information. In any case, we apply appropriate safeguards to ensure that 's cross-border transfer of personal data complies with applicable law. We also ensure that your data continues to be protected to a comparable degree.

In particular, if you are located in the European Economic Area (EEA) and your personal data is transferred to third-party service providers in countries that are not considered adequate by the European Commission, we establish and implement appropriate contractual, organizational, and technical measures with these third-party companies. This is done by applying the standard contractual clauses approved by the European Commission, by reviewing the countries to which the data may be transferred, and by introducing special technical and organizational mechanisms.

In certain cases, we transfer your data outside the EEA because this is necessary to fulfill the contract concluded with you. For example, if you book with a travel provider or strategic partner outside the EEA, it is likely that data relating to this booking will need to be transferred outside the EEA.

When transferring personal data outside the United Kingdom (UK), we comply with the mechanisms and safeguards that apply to the UK.

For data transfers within the GrandVillen group, we have introduced binding corporate policies as an additional safeguard to ensure that your data is adequately protected even when transferred outside the European Economic Area.

You can request further information about the security measures we have in place by contacting us as described in Your Rights.

Information about specific markets, products, and services

Depending on the type of product or services you use, as well as other factors (such as your place of residence), you will receive additional information from us that supplements or even replaces the information contained in this privacy policy . Therefore, please also read the following sections, if they apply to you, to get a complete picture.

Ground transportation

If you have booked transport with us, the information in this section applies to you. This supplements or replaces the content of other parts of this privacy policy.

In addition to the information in the section Personal Data that we may receive from you, when you book a rental car, we may also ask for your address, billing address, telephone number, date and place of birth, passport and driver's license details, officially issued identification documents (if required by law), and the names of all additional drivers. When booking private or public transportation, we may ask you (if you book a ride such as a car or airport transfer) to provide a pick-up and drop-off address. We may also need your date of birth (or age range for certain public transportation tickets, e.g., for children or seniors) and the names of other passengers.

In addition to the points described in the section Personal data we receive from other sources, car rental companies and private or public transport companies may also share information about you with us. This may happen, for example, if you need assistance with a current booking or have questions about it, or if disputes or other problems arise in connection with a booking.

In addition to what is stated in the section How we share personal data with third parties, if the car rental company you have selected on our platform participates in our pre-registration program, the information we share may also include your email address, telephone number, date of birth, place of birth, passport details, and driver's license information, if you have provided this information. Providing additional pre-registration information facilitates pick-up, but is not mandatory, and you can pick up your rental car without providing pre-registration information.

Please note that we may sometimes be required to share your personal data with parties affiliated with the ground transportation provider in order to complete and manage the booking, as instructed by the provider. This may include other companies in the provider's group or service providers, drivers, or fleet companies that process the data on behalf of the provider.

Car rental companies may also request additional personal data, for example to provide additional services or to comply with local regulations. Please note that any information you provide directly to the companies from which you receive the vehicle and/or related products will be stored and used in accordance with their privacy policies and terms and conditions.

Car rental companies may also request additional personal data, for example to provide additional services or to comply with local regulations. Please note that any information you provide directly to the companies from which you obtain the vehicle and/or related products will be stored and used in accordance with their privacy policies and terms and conditions.

Insurance

The information in this section applies when you purchase insurance on our platform. It supplements or replaces the content of other parts of this privacy policy.

Several parties may be involved in the insurance offer, including intermediaries, insurers, and other parties. If GrandVille is involved, it acts as an intermediary and authorized agent or appointed representative (depending on the jurisdiction) on behalf of the insurer and offers insurance products and services to GrandVille customers.

Please review the information provided at the time of booking for more details about us and the parties that work with us to offer you these products and services. For details about the insurer, please refer to the insurance policy and related documents provided to you.

When we offer insurance, we may need to use and share relevant personal data in connection with the product. This data relates to you as a potential or actual policyholder, the beneficiaries under the policy, family members, claimants, and other parties involved in the event of a claim:

• In order to compile quotes, provide insurance coverage, and process insurance claims, some personal data provided to us during the booking process ("general order data") may need to be shared with other departments at GrandVillen. You may also be asked to provide additional information, such as the names of family members or other beneficiaries, or details of a claim ("insurance-related data").
• If you submit a claim under an insurance policy, it may be processed directly by the insurer. This means that you may be asked to provide personal data in order to submit the claim directly to the insurer. The insurer will inform you accordingly at the time the information is requested. If the insurer processes the claim, GrandVillen may receive information about the status of the claim in order to assist you through customer service.

If you would like to know more about GrandVillen's handling of your rights regarding personal data collected through the GrandVillen platform, please contact us as indicated under Your Rights.

Insurance-related call recordings may be retained for up to 12 months to comply with certain provisions of insurance-related laws and regulations. If you purchase an insurance product by telephone, we may review and confirm your insurance purchase in the event of a dispute.

How we protect personal data

Our employees, processes, and technologies actively contribute to the protection of your personal data.

Among other things, we take the following measures:

• We implement a comprehensive set of security policies, procedures, and protocols.
• We employ staff who have been specially trained in cybersecurity and data protection.
• We regularly train our employees on security risks and carry out awareness-raising measures.
• We use state-of-the-art security technologies such as encryption and data leak prevention to protect data from unauthorized disclosure or deletion.
• We monitor processes, systems, and data assets.
• We use multiple systems to prevent and detect fraud and continuously monitor our systems for security purposes.
• We operate identity and access management as well as other logical and physical access restrictions to ensure that only authorized personnel can access personal data.
• We maintain and test protocols for responding to reported incidents and data breaches.
• We regularly review and improve our security systems, procedures, and protocols.
• We require third parties we engage to implement similar measures.

We follow best practices when storing and, where legally permissible, destroying personal data. In general, we store your personal data for as long as necessary to fulfill the following purposes:

• So that you can use our services and we can provide them
• To prevent and detect online fraud attempts and/or other illegal activities
• To comply with legal requirements (laws in the area of accounting and taxation)
• To settle disputes and lawsuits

How you can further protect your personal data at GrandVillen

Although not required when using the GrandVillen platform, we recommend the following:

1. Create an account, if possible on our platform. With an account, you can protect access to your data, such as your booking history and wallet, by setting a secure password and using two-factor authentication.
2. Use unique passwords for each online service, including your GrandVillen account. If you use the same account and password combination for multiple services and a data breach occurs at one of the service providers, criminals will typically attempt to use this combination to misuse your user account and other online services. If we detect such malicious attacks affecting travelers, we take immediate countermeasures, such as blocking compromised accounts and notifying account holders.
3. Read the articles on online fraud prevention and data protection (and follow the instructions contained therein). Online fraud attempts typically involve social engineering and phishing methods. For example, fraudsters may pose as a specific accommodation and request payment from a traveler even though it is not necessary. If you suspect fraud in connection with your booking, please notify customer service.

 

How we use cookies and other tracking technologies

When you use our services, including our mobile apps, we may use cookies and other tracking technologies, which we collectively refer to as "cookies" at . This section provides information about how we use cookies.

What are cookies?

A web browser cookie is a small text file that is stored by a website in the data that a web browser automatically stores on your computer or mobile device. This allows the software to store information about the content you access and engage with for the following purposes:

• Remembering your preferences, settings, and bookings that you may not have completed
• Analyzing how you use our services

We also use other types of cookies. For example, our websites, emails, and mobile apps may contain small transparent image files or lines of code to track how you use our websites, email messages, and mobile apps.

What are cookies used for?

The cookies we use can be divided into three categories: functional cookies, analytical cookies, and marketing cookies.

Functional cookies	Functional cookies ensure that our websites and mobile apps work properly so that you can create an account, log in, and manage your bookings. They also store your currency, language, and previous searches. These technical cookies must be enabled in order to use the website and services.
Analytical cookies	Analytical cookies help us and our partners collect information about your use of the website and mobile app. This allows us to determine how visitors use our platform and how we can improve the website and services.
Marketing cookies	Marketing cookies, including social media cookies, collect information about your browsing behavior. This helps us and our partners decide which products to show you on and off our website. They also help us deliver personalized content and advertising on our platform, on other websites, and in push and email messages. The personalized content is based on your browsing behavior and the services you have booked. Marketing cookies also enable you to share or like pages on social media.

We work with selected third-party companies to collect and process data. We sometimes share information (such as your email address or phone number) with some of these third-party providers so that they can link the information to other data they collect separately (and usually independently of GrandVillen). This helps us to target specific audiences or deliver targeted advertising.

What options do you have?

Where required by law, we give you the option to opt out of analytical and marketing cookies. Most browsers also allow you to choose which cookies you accept and which you reject. For more information, please refer to your browser's help section. If you choose to disable certain functional cookies, you may not be able to use some parts of our services.

How we use AI and make automated decisions

We constantly strive to promote innovation and improve customer satisfaction through new technologies such as artificial intelligence (AI). We currently use AI for the following purposes:

Ensuring secure and reliable services and fraud prevention	AI systems that use machine learning monitor our platforms for fraud attempts, complaints, and possible misconduct by travelers or travel providers much faster and more accurately than would be possible through manual monitoring alone. The AI systems scan transactions and content (including user-submitted content, such as images) on our platform for risk indicators. Transactions and content identified as indicating a higher risk of fraud are flagged for human review and may be hidden or removed from the platform.
Displaying the content that best suits you	We use additional AI systems to improve the customer experience and personalization on the platform. This includes using AI to predict the optimal/most suitable product category for you and to bring it to your attention. This may include sending you details of a trip that we think you might be interested in, showing you tailored offers for complementary trips on our website, and ordering search results so that the best matches appear at the top of your feed.
AI trip planner and interactive chat	We sometimes use AI to develop interactive chats (e.g., GrandVillen's AI travel planner). This allows you to ask questions about a trip or service and benefit from AI-generated answers or suitable route suggestions. The AI travel planner uses all the personal data you provide, as well as your search and booking history on our platform, to give you tailored recommendations.
Call summary	In addition to our normal call recording process, we may use AI to transcribe and summarize calls to improve the efficiency and speed of our customer service and to help you with questions about your booking. Any personal data you provide to us during a call, including your booking information, may be included in the AI summary.
Intelligent voice assistance	Depending on your location, we may offer you an option called "Intelligent Voice Assistant" during your call, which uses AI to help you with your request. This service allows you to ask questions about your booking to an AI-powered agent, who can provide you with relevant answers and actions to assist you with specific actions related to your booking. This AI-powered agent uses any personal data you share with it, as well as your booking information on our platform and with certain trusted third-party providers we use to provide this solution.
Improving our services	We use AI to improve travel services in accordance with the information provided in the section "Purposes of collecting and processing your personal data." This includes identifying trends, monitoring platform activity, fixing website and app errors, and improving performance and cost efficiency. Personal data may be used to develop, train, and fine-tune AI systems such as generative AI models. These models allow you to ask questions about a trip or service in natural language and receive AI-generated relevant answers or travel suggestions. In turn, AI systems are trained, optimized, and used to improve the effectiveness of the other purposes set out in this Privacy Policy, including AI systems designed to maintain the trustworthiness of our platform. We also use the personal data you provide to us in interactive chats to develop, train, and optimize AI systems to improve our ability to detect and redact personal data. This improves our services by helping us limit the use of your personal data to what is strictly necessary and prevent the storage of sensitive personal data that you may inadvertently submit to us.

We have a legal basis for using AI systems in accordance with data protection laws. The legal basis for the use of AI generally follows the general purpose of processing as set out in the section on the purposes of collecting and processing your personal data:

• Beyond preventing and detecting fraud, we may have a legitimate interest in developing AI systems to reduce our costs, improve the efficiency and quality of our processing, enhance our privacy-enhancing technologies, and offer better products to our customers. We always determine whether your rights and freedoms are unlawfully infringed by the processing of your personal data and only proceed if your rights do not outweigh these legitimate interests.
• In other cases where we may use AI, we will obtain your consent where necessary.

We evaluate our AI in terms of data protection principles such as minimization, accuracy, and purpose limitation. We also take precautions to prevent inaccuracies in data, negative impacts, and biases in our use of AI, for example by:

• Pseudonymizing personal data
• Developing our own systems so that we have to share less data with third parties
• Reassessing the use of AI systems to ensure that risks continue to be adequately mitigated

For more information on the security mechanisms we implement, which also apply to the personal data we process when training or using AI, please see How we protect personal data.

We do not currently use any exclusively automated systems, including those that use artificial intelligence, to make decisions about you that would have legal or other comparable effects on you. Should this change, we will inform you and ensure that appropriate mechanisms are in place to protect your rights.

In some cases, decisions are made without review by an employee, but only after it has been determined that the decision will not have a significant impact on you.

In cases where there are significant consequences for an individual, such as when monitoring fraud attempts, our systems may provide information and insights to aid in a decision, but the decision itself will always be made with human involvement. If a system identifies a potential problem, one of our employees will review the matter and make an informed decision.

If you would like to know more about our use of AI systems or object to the use of your personal data in connection with AI, please contact us as described in Your Rights.

How we handle personal data of minors

Our services are not intended for persons under the age of 18. We do not knowingly collect personal data about persons younger than 18 (collectively referred to as "minors") unless such data is provided by a parent or guardian or with their consent. In the following rare cases, we may need to ask parents or guardians for the data of minors:

1. As part of a booking
2. When purchasing other travel services
3. In other exceptional cases (e.g., for offers aimed at families)

If we discover (e.g., through a customer service inquiry) that we have processed personal data of minors without the valid consent of their parents or legal guardians, the data will be deleted.

Your rights

We want you to have control over how we use your personal data. You have the following options:

Right	Description
Access	You can request that we provide you with a copy of the personal data we hold about you.
Correction	You can inform us at any time of any changes to your personal data or request that we correct any personal data we hold about you. You can make some of these changes yourself if you have an account. We trust you to ensure that your personal data is complete, accurate, and up to date.
Deletion	You can ask us to delete the personal data we hold about you if, for example, the data is no longer needed or we asked for your consent and you later revoked it.
Restriction	In certain situations, you can ask us to block the personal data we hold about you or restrict its processing, and you can object to a specific way in which we use your personal data.
Portability	In some cases, you may also request that we send you specific personal data that we have received from you so that it can be transferred to a third party.
Withdrawal of consent	If we collect and use your personal data on the basis of your consent, you have the right to withdraw this consent at any time in accordance with applicable law.
Object	If we process your personal data on the basis of a legitimate interest or in the public interest, you have the right to object to this use of your personal data at any time in accordance with applicable law.

At GrandVillen, you have several options for exercising your rights or communicating questions and concerns regarding your personal data:

Directly in your account	If you have an account with GrandVillen, you can access much of your personal data on the websites or in the mobile apps. You can generally add to, update, or remove the information you have provided to us in your account settings.
By email	If you are unable to perform an action directly from your account or via our personal data disclosure request form (e.g., because a particular option is not available), you can exercise the rights of the data subject mentioned in this statement by contacting our data protection team (which includes our data protection officer) at the email address provided in the section Our Company and How We Comply with Data Protection Laws. You can also contact us in the same way if you have any questions about this privacy policy or any complaints or concerns about the processing of your personal data. We recommend that you indicate your country of residence when contacting us through this channel so that we can best respond to your request.
By mail	If you wish to exercise your rights by post, please write to our data protection team using the postal address provided in the section "Our company and how we comply with data protection laws." Postal inquiries are usually answered electronically.

Before we can process your request, we may need to verify your identity to protect your personal data. We do this by asking you questions about your previous bookings with us. We will respond to your request as soon as possible.

If you are not satisfied with the handling of your request or have other concerns regarding your personal data, you can also contact your local data protection supervisory authority.

 

 

Our company and how we continue to comply with data protection laws

The following companies are relevant in connection with this statement:

Company name	Postal address	Email address for data protection matters	Comments
GrandVillen	Flottenstraße 56 13407 Berlin	info@grandvillen.de	Operates the platform and acts as the controller for the processing of personal data in accordance with this privacy policy, unless expressly stated otherwise. This is the EU representative of GrandVillen

GrandVillen's data protection officer can also be contacted using the contact details provided.

GrandVillen is subject to a number of laws and regulations, including those relating to the protection of personal data and their enforcement by data protection supervisory authorities and other authorities.

GrandVillen may be contacted by law enforcement agencies seeking certain personal data, for example in connection with criminal investigations or missing persons reports. Similarly, other authorities may contact GrandVillen with immediate or recurring requests for information in connection with, for example, short-term rental laws or consumer protection laws.