If you are a resident of California, the California Consumer Protection Act (CCPA) and extended California Privacy Rights Act (CPRA) provides additional privacy rights to you.

At collection, you have the right to receive a notice of our your data is used by us. You can see more information below:

• You can see how and where we collect personal information in the past 12 months, in (Section 2, Personal Information That We Collect and How We Collect It) above.
• You can see how we process your data and the 3rd parties we share it to if we use it for commercial purposes in (Section 3, How We Use Your Personal Information and Section 4, How We Disclose Your Personal Information) above.
• You can see how long we retain your information for in (Section 7 Data Transfers and Retentions) above.

For commercial purposes, we collect, sell, or share personal information falling under the following categories: contact identifiers, characteristics or demographics, commercial or transactional information, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties with whom we engage in selling or sharing your personal information may include vendors and other entities involved in cross-context behavioral advertising.

We assure you that your personal information is not sold, as per its traditional understanding. However, it's essential to note that certain disclosures of personal information may fall under the categories of a "sale" or "share" as defined by the CPRA. According to the CPRA, a "sale" encompasses disclosures for something of value, while a "share" includes disclosures for cross-context behavioral advertising.

It's important to understand that some of the personal information we collect might be considered sensitive under the CPRA. However, rest assured that we handle sensitive personal information only for permissible business purposes outlined by the CPRA. We neither use nor disclose sensitive personal information to infer characteristics about you.

Under the CPRA, at any time you have:

• The right to understand the categories of personal information collected, categories of sources providing this information, business or commercial reasons for collecting, selling, or sharing this information, categories of third parties service providers that we share this information and specific pieces of personal information we have collected about you.
• The right to change any incorrect personal information that we maintain about you.
• The right to request to delete personal information we have collected from you.
• The right to opt-out of the sale or sharing of your personal information.

We will not discriminate against you for exercising your rights under the CCPA, CPRA. This means that we won't discriminate against you by denying goods or services, charging you a different price, or providing a different quality of goods or service just because you exercised your consumer privacy rights.

To exercise your rights outlined above, please contact us using the provided details in this document.

In order for us to effectively address your request, it is essential that we can verify your identify. Therefore, you can only exercise these rights by submitting a verifiable request. This means that you must

• Provide sufficient information for us to reasonably verify that you are the individual whose personal information we have collected or an authorized representative.
• Clearly articulate your request with enough detail for us to comprehend, evaluate, and respond appropriately.

Please be aware that if we are unable to verify your identity, we will be unable to process your request or confirm that the personal information we hold is related to you.

When submitting a verifiable request, we do not require you to create an account with us. Any personal information collected from you for the purpose of verifying your request will be used exclusively for verification purposes. We will not disclose this information further, retain it longer than necessary for verification, or use it for unrelated purposes.

If you are unable to personally submit a verifiable request, you may authorize a person registered with the California Secretary of State to act on your behalf. Additionally, as an adult, you have the authority to make a verifiable request on behalf of a child under your parental authority.

Please note that you can submit a maximum of 2 requests in a 1 year period.

When we receive your request, we will provide a acknowledgement of your verifiable request within 7 days and provide more details on how we will be handling your request.

Our response to your request will be provided within 40 days of its receipt. If we need additional time, we will inform you of the reasons as to why and the expected duration. (This may take up to 90 days)

Please note that any data related requests is by default a 12-month period. If you would like us to process any requests with a longer time period, you have the right to do so. We will fulfill such requests unless it is unfeasible or requires disproportionate effort.

At any point, if your request is denied, we will provide an explanation for our decision.

Please note that there is NO charge for processing or responding to your verifiable request, unless it is deemed manifestly unfounded or excessive. In such instances, we may levy a reasonable fee or opt not to proceed with the request. We will communicate our decision and rationale accordingly.

If you reside in Nevada, you have the right to request that we refrain from selling certain information we have collected or will collect about you.

To exercise your rights outlined above, please contact us using the provided details in this document.

In order for us to effectively address your request, it is essential that we can verify your identify. Therefore, you can only exercise these rights by submitting a verifiable request. This means that you must

• Provide sufficient information for us to reasonably verify that you are the individual whose personal information we have collected or an authorized representative.
• Clearly articulate your request with enough detail for us to comprehend, evaluate, and respond appropriately.

Please be aware that if we are unable to verify your identity, we will be unable to process your request or confirm that the personal information we hold is related to you.

When submitting a verifiable request, we do not require you to create an account with us. Any personal information collected from you for the purpose of verifying your request will be used exclusively for verification purposes. We will not disclose this information further, retain it longer than necessary for verification, or use it for unrelated purposes.

Please note that you can submit a maximum of 2 requests in a 1 year period.

When we receive your request, we will provide a acknowledgement of your verifiable request within 7 days and provide more details on how we will be handling your request.

Our response to your request will be provided within 40 days of its receipt. If we need additional time, we will inform you of the reasons as to why and the expected duration. (This may take up to 90 days)

Please note that any data related requests is by default a 12-month period. If you would like us to process any requests with a longer time period, you have the right to do so. We will fulfill such requests unless it is unfeasible or requires disproportionate effort.

At any point, if your request is denied, we will provide an explanation for our decision.

Please note that there is NO charge for processing or responding to your verifiable request, unless it is deemed manifestly unfounded or excessive. In such instances, we may levy a reasonable fee or opt not to proceed with the request. We will communicate our decision and rationale accordingly.

If you reside in Colorado, you have the right to:

• Confirm if we are processing your personal information.
• Access your personal information.
• Correct inaccuracies in your personal information.
• Delete your personal information from our systems.
• Obtain a copy of your personal information that you previously provided to us.
• Opt-out of the sale or sharing of your personal information.

For commercial purposes, we collect, sell, or share personal information falling under the following categories: contact identifiers, characteristics or demographics, commercial or transactional information, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties with whom we engage in selling or sharing your personal information may include vendors and other entities involved in cross-context behavioral advertising.

We assure you that your personal information is not sold, as per its traditional understanding. However, it's essential to note that certain disclosures of personal information may fall under the categories of a "sale" or "share" as defined by the CPA. According to the CPA, a "sale" encompasses disclosures for something of value, while a "share" includes disclosures for cross-context behavioral advertising.

It's important to understand that some of the personal information we collect might be considered sensitive under the CPA. However, rest assured that we handle sensitive personal information only for permissible business purposes outlined by the CPA. We neither use nor disclose sensitive personal information to infer characteristics about you.

We will not discriminate against you for exercising your rights under the CPA. This means that we won't discriminate against you by denying goods or services, charging you a different price, or providing a different quality of goods or service just because you exercised your consumer privacy rights.

To exercise your rights outlined above, please contact us using the provided details in this document.

In order for us to effectively address your request, it is essential that we can verify your identify. Therefore, you can only exercise these rights by submitting a verifiable request. This means that you must

• Provide sufficient information for us to reasonably verify that you are the individual whose personal information we have collected or an authorized representative.
• Clearly articulate your request with enough detail for us to comprehend, evaluate, and respond appropriately.

Please be aware that if we are unable to verify your identity, we will be unable to process your request or confirm that the personal information we hold is related to you.

When submitting a verifiable request, we do not require you to create an account with us. Any personal information collected from you for the purpose of verifying your request will be used exclusively for verification purposes. We will not disclose this information further, retain it longer than necessary for verification, or use it for unrelated purposes.

If you are unable to personally submit a verifiable request, you may authorize an authorized agent to act on your behalf. Please note that for opt-out requests, we will require written proof of the agent's permission to do so and may verify your identity directly. Additionally, as an adult, you have the authority to make a verifiable request on behalf of a child under your parental authority.

Please note that you can submit a maximum of 2 requests in a 1 year period.

When we receive your request, we will provide a acknowledgement of your verifiable request within 7 days and provide more details on how we will be handling your request.

Our response to your request will be provided within 40 days of its receipt. If we need additional time, we will inform you of the reasons as to why and the expected duration. (This may take up to 90 days)

Please note that any data related requests is by default a 12-month period. If you would like us to process any requests with a longer time period, you have the right to do so. We will fulfill such requests unless it is unfeasible or requires disproportionate effort.

At any point, if your request is denied, we will provide an explanation for our decision.

If we make the decision to refuse your request, you may appeal our decision in a reasonable time frame by contact us at customerservice@travelerchoice.com and specifying your wish to appeal. Within 45 days of our receipt of your appeal, we will inform you of any action taken or not take in response to the appeal, including an explanation of the reasons for our decision. If you disagree with the appeal's decision, you may submit a compliant to the Colorado Attorney General at https://coag.gov/file-complaint/

Please note that there is NO charge for processing or responding to your verifiable request, unless it is deemed manifestly unfounded or excessive. In such instances, we may levy a reasonable fee or opt not to proceed with the request. We will communicate our decision and rationale accordingly.

If you reside in Utah, you have the right to:

• Confirm if we are processing your personal information.
• Access your personal information.
• Correct inaccuracies in your personal information.
• Delete your personal information from our systems.
• Obtain a copy of your personal information that you previously provided to us.
• Opt-out of the sale or sharing of your personal information.

For commercial purposes, we collect, sell, or share personal information falling under the following categories: contact identifiers, characteristics or demographics, commercial or transactional information, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties with whom we engage in selling or sharing your personal information may include vendors and other entities involved in cross-context behavioral advertising.

We assure you that your personal information is not sold, as per its traditional understanding. However, it's essential to note that certain disclosures of personal information may fall under the categories of a "sale" or "share" as defined by the UCPA. According to the UCPA, a "sale" encompasses disclosures for something of value, while a "share" includes disclosures for cross-context behavioral advertising.

It's important to understand that some of the personal information we collect might be considered sensitive under the UCPA. However, rest assured that we handle sensitive personal information only for permissible business purposes outlined by the UCPA. We neither use nor disclose sensitive personal information to infer characteristics about you.

We will not discriminate against you for exercising your rights under the UCPA. This means that we won't discriminate against you by denying goods or services, charging you a different price, or providing a different quality of goods or service just because you exercised your consumer privacy rights.

To exercise your rights outlined above, please contact us using the provided details in this document.

In order for us to effectively address your request, it is essential that we can verify your identify. Therefore, you can only exercise these rights by submitting a verifiable request. This means that you must

• Provide sufficient information for us to reasonably verify that you are the individual whose personal information we have collected or an authorized representative.
• Clearly articulate your request with enough detail for us to comprehend, evaluate, and respond appropriately.

Please be aware that if we are unable to verify your identity, we will be unable to process your request or confirm that the personal information we hold is related to you.

When submitting a verifiable request, we do not require you to create an account with us. Any personal information collected from you for the purpose of verifying your request will be used exclusively for verification purposes. We will not disclose this information further, retain it longer than necessary for verification, or use it for unrelated purposes.

If you are unable to personally submit a verifiable request, you may authorize an authorized agent to act on your behalf. Please note that for opt-out requests, we will require written proof of the agent's permission to do so and may verify your identity directly. Additionally, as an adult, you have the authority to make a verifiable request on behalf of a child under your parental authority.

Please note that you can submit a maximum of 2 requests in a 1 year period.

When we receive your request, we will provide a acknowledgement of your verifiable request within 7 days and provide more details on how we will be handling your request.

Our response to your request will be provided within 40 days of its receipt. If we need additional time, we will inform you of the reasons as to why and the expected duration. (This may take up to 90 days)

Please note that any data related requests is by default a 12-month period. If you would like us to process any requests with a longer time period, you have the right to do so. We will fulfill such requests unless it is unfeasible or requires disproportionate effort.

At any point, if your request is denied, we will provide an explanation for our decision.

If we make the decision to refuse your request, you may appeal our decision in a reasonable time frame by contact us at customerservice@travelerchoice.com and specifying your wish to appeal. Within 45 days of our receipt of your appeal, we will inform you of any action taken or not take in response to the appeal, including an explanation of the reasons for our decision.

Please note that there is NO charge for processing or responding to your verifiable request, unless it is deemed manifestly unfounded or excessive. In such instances, we may levy a reasonable fee or opt not to proceed with the request. We will communicate our decision and rationale accordingly.

If you reside in Connecticut, you have the right to:

• Confirm if we are processing your personal information.
• Access your personal information.
• Correct inaccuracies in your personal information.
• Delete your personal information from our systems.
• Obtain a copy of your personal information that you previously provided to us.
• Opt-out of the sale or sharing of your personal information.

For commercial purposes, we collect, sell, or share personal information falling under the following categories: contact identifiers, characteristics or demographics, commercial or transactional information, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties with whom we engage in selling or sharing your personal information may include vendors and other entities involved in cross-context behavioral advertising.

We assure you that your personal information is not sold, as per its traditional understanding. However, it's essential to note that certain disclosures of personal information may fall under the categories of a "sale" or "share" as defined by the CTDPA. According to the CTDPA, a "sale" encompasses disclosures for something of value, while a "share" includes disclosures for cross-context behavioral advertising.

It's important to understand that some of the personal information we collect might be considered sensitive under the CTDPA. However, rest assured that we handle sensitive personal information only for permissible business purposes outlined by the CTDPA. We neither use nor disclose sensitive personal information to infer characteristics about you.

We will not discriminate against you for exercising your rights under the CTDPA. This means that we won't discriminate against you by denying goods or services, charging you a different price, or providing a different quality of goods or service just because you exercised your consumer privacy rights.

To exercise your rights outlined above, please contact us using the provided details in this document.

In order for us to effectively address your request, it is essential that we can verify your identify. Therefore, you can only exercise these rights by submitting a verifiable request. This means that you must

• Provide sufficient information for us to reasonably verify that you are the individual whose personal information we have collected or an authorized representative.
• Clearly articulate your request with enough detail for us to comprehend, evaluate, and respond appropriately.

Please be aware that if we are unable to verify your identity, we will be unable to process your request or confirm that the personal information we hold is related to you.

When submitting a verifiable request, we do not require you to create an account with us. Any personal information collected from you for the purpose of verifying your request will be used exclusively for verification purposes. We will not disclose this information further, retain it longer than necessary for verification, or use it for unrelated purposes.

If you are unable to personally submit a verifiable request, you may authorize an authorized agent to act on your behalf. Please note that for opt-out requests, we will require written proof of the agent's permission to do so and may verify your identity directly. Additionally, as an adult, you have the authority to make a verifiable request on behalf of a child under your parental authority.

Please note that you can submit a maximum of 2 requests in a 1 year period.

When we receive your request, we will provide a acknowledgement of your verifiable request within 7 days and provide more details on how we will be handling your request.

Our response to your request will be provided within 40 days of its receipt. If we need additional time, we will inform you of the reasons as to why and the expected duration. (This may take up to 90 days)

Please note that any data related requests is by default a 12-month period. If you would like us to process any requests with a longer time period, you have the right to do so. We will fulfill such requests unless it is unfeasible or requires disproportionate effort.

At any point, if your request is denied, we will provide an explanation for our decision.

If we make the decision to refuse your request, you may appeal our decision in a reasonable time frame by contact us at customerservice@travelerchoice.com and specifying your wish to appeal. Within 45 days of our receipt of your appeal, we will inform you of any action taken or not take in response to the appeal, including an explanation of the reasons for our decision. If you disagree with the appeal's decision, you may submit a compliant to the Connecticut Attorney General at https://www.dir.ct.gov/ag/complaint/

Please note that there is NO charge for processing or responding to your verifiable request, unless it is deemed manifestly unfounded or excessive. In such instances, we may levy a reasonable fee or opt not to proceed with the request. We will communicate our decision and rationale accordingly.

If you reside in Virginia, you have the right to:

• Confirm if we are processing your personal information.
• Access your personal information.
• Correct inaccuracies in your personal information.
• Delete your personal information from our systems.
• Obtain a copy of your personal information that you previously provided to us.
• Opt-out of the sale or sharing of your personal information.

For commercial purposes, we collect, sell, or share personal information falling under the following categories: contact identifiers, characteristics or demographics, commercial or transactional information, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties with whom we engage in selling or sharing your personal information may include vendors and other entities involved in cross-context behavioral advertising.

We assure you that your personal information is not sold, as per its traditional understanding. However, it's essential to note that certain disclosures of personal information may fall under the categories of a "sale" or "share" as defined by the VCDPA. According to the VCDPA, a "sale" encompasses disclosures for something of value, while a "share" includes disclosures for cross-context behavioral advertising.

It's important to understand that some of the personal information we collect might be considered sensitive under the VCDPA. However, rest assured that we handle sensitive personal information only for permissible business purposes outlined by the VCDPA. We neither use nor disclose sensitive personal information to infer characteristics about you.

We will not discriminate against you for exercising your rights under the VCDPA. This means that we won't discriminate against you by denying goods or services, charging you a different price, or providing a different quality of goods or service just because you exercised your consumer privacy rights.

To exercise your rights outlined above, please contact us using the provided details in this document.

In order for us to effectively address your request, it is essential that we can verify your identify. Therefore, you can only exercise these rights by submitting a verifiable request. This means that you must

• Provide sufficient information for us to reasonably verify that you are the individual whose personal information we have collected or an authorized representative.
• Clearly articulate your request with enough detail for us to comprehend, evaluate, and respond appropriately.

Please be aware that if we are unable to verify your identity, we will be unable to process your request or confirm that the personal information we hold is related to you.

When submitting a verifiable request, we do not require you to create an account with us. Any personal information collected from you for the purpose of verifying your request will be used exclusively for verification purposes. We will not disclose this information further, retain it longer than necessary for verification, or use it for unrelated purposes.

If you are unable to personally submit a verifiable request, you may authorize an authorized agent to act on your behalf. Please note that for opt-out requests, we will require written proof of the agent's permission to do so and may verify your identity directly. Additionally, as an adult, you have the authority to make a verifiable request on behalf of a child under your parental authority.

Please note that you can submit a maximum of 2 requests in a 1 year period.

When we receive your request, we will provide a acknowledgement of your verifiable request within 7 days and provide more details on how we will be handling your request.

Our response to your request will be provided within 40 days of its receipt. If we need additional time, we will inform you of the reasons as to why and the expected duration. (This may take up to 90 days)

Please note that any data related requests is by default a 12-month period. If you would like us to process any requests with a longer time period, you have the right to do so. We will fulfill such requests unless it is unfeasible or requires disproportionate effort.

At any point, if your request is denied, we will provide an explanation for our decision.

If we make the decision to refuse your request, you may appeal our decision in a reasonable time frame by contact us at customerservice@travelerchoice.com and specifying your wish to appeal. Within 45 days of our receipt of your appeal, we will inform you of any action taken or not take in response to the appeal, including an explanation of the reasons for our decision. If you disagree with the appeal's decision, you may submit a compliant to the Virginia Attorney General at https://www.oag.state.va.us/consumercomplaintform/start

Please note that there is NO charge for processing or responding to your verifiable request, unless it is deemed manifestly unfounded or excessive. In such instances, we may levy a reasonable fee or opt not to proceed with the request. We will communicate our decision and rationale accordingly.

If you reside in Brazil, you have the right to:

• Confirm the existence of processing activities involving your personal information.
• Access your personal information.
• Rectify incomplete, inaccurate, or outdated personal information.
• Request anonymization, blocking, or deletion of unnecessary or excessive personal information, or information processed in violation of the LGPD.
• Receive information about the possibility to provide or deny consent and the associated consequences.
• Obtain details about third parties with whom we share your personal information.
• Request, upon your explicit demand, the portability of your personal information (excluding anonymized data) to another service or product provider, ensuring the safeguarding of our commercial and industrial secrets.
• Request deletion of your personal information being processed if based on your consent, unless exceptions outlined in Article 16 of the LGPD apply.
• Revoke your consent at any time.
• Lodge a complaint concerning your personal information with the ANPD (National Data Protection Authority) or consumer protection bodies.
• Object to processing activities when not in compliance with legal provisions.
• Demand clear and adequate information regarding criteria and procedures used for automated decisions.
• Request a review of decisions solely based on automated processing of your personal information, which may affect your personal, professional, consumer, and credit profiles, as well as aspects of your personality.

We are only able to handle your personal information if we have a valid legal reason for doing so. These reasons may include:

• Your explicit consent for the relevant processing activities.
• Fulfillment of legal or regulatory obligations on our part.
• Implementation of public policies outlined in laws, regulations, contracts, agreements, and similar legal instruments.
• Conducting studies by research entities, preferably utilizing anonymized personal information.
• Execution of contracts and associated preliminary procedures, where you are a contractual party.
• Exercise of our rights in judicial, administrative, or arbitration proceedings.
• Safeguarding your or a third party's physical safety.
• Protection of health, particularly in procedures conducted by healthcare entities or professionals.
• Pursuit of our legitimate interests, ensuring they do not override your fundamental rights and freedoms.
• Credit protection measures.

We will not discriminate against you for exercising your rights under the VCDPA. This means that we won't discriminate against you by denying goods or services, charging you a different price, or providing a different quality of goods or service just because you exercised your consumer privacy rights.

To exercise your rights outlined above, please contact us using the provided details in this document.

In order for us to effectively address your request, it is essential that we can verify your identify. Therefore, you can only exercise these rights by submitting a verifiable request. This means that you must

• Provide sufficient information for us to reasonably verify that you are the individual whose personal information we have collected or an authorized representative.
• Clearly articulate your request with enough detail for us to comprehend, evaluate, and respond appropriately.

Please be aware that if we are unable to verify your identity, we will be unable to process your request or confirm that the personal information we hold is related to you.

When submitting a verifiable request, we do not require you to create an account with us. Any personal information collected from you for the purpose of verifying your request will be used exclusively for verification purposes. We will not disclose this information further, retain it longer than necessary for verification, or use it for unrelated purposes.

If you are unable to personally submit a verifiable request, you may authorize an authorized agent to act on your behalf. Please note that for opt-out requests, we will require written proof of the agent's permission to do so and may verify your identity directly. Additionally, as an adult, you have the authority to make a verifiable request on behalf of a child under your parental authority.

Please note that you can submit a maximum of 2 requests in a 1 year period.

When we receive your request, we will provide a acknowledgement of your verifiable request within 7 days and provide more details on how we will be handling your request.

Our response to your request will be provided within 40 days of its receipt. If we need additional time, we will inform you of the reasons as to why and the expected duration. (This may take up to 90 days)

Please note that any data related requests is by default a 12-month period. If you would like us to process any requests with a longer time period, you have the right to do so. We will fulfill such requests unless it is unfeasible or requires disproportionate effort.

At any point, if your request is denied, we will provide an explanation for our decision.

If we make the decision to refuse your request, you may appeal our decision in a reasonable time frame by contact us at customerservice@travelerchoice.com and specifying your wish to appeal. Within 45 days of our receipt of your appeal, we will inform you of any action taken or not take in response to the appeal, including an explanation of the reasons for our decision. If you disagree with the appeal's decision, you may submit a compliant to the Virginia Attorney General at https://www.oag.state.va.us/consumercomplaintform/start

Please note that there is NO charge for processing or responding to your verifiable request, unless it is deemed manifestly unfounded or excessive. In such instances, we may levy a reasonable fee or opt not to proceed with the request. We will communicate our decision and rationale accordingly.

If you reside in the European Economic Area, you have the right to:

• Access any personal data we have collected about you
• Address any incorrect personal data we have collected about you.
• Erase any personal data we have collected about you.
• Data portability
• Restrict or decline to our processing of your personal data.
• Request that we do not collect your personal data.
• Request that we do not share your personal data with 3rd party services for marketing and other reasons.
• Request a withdrawal of your consent at any time for any data collection we did on the consent you have previously provided.

For commercial purposes, we collect, sell, or share personal information falling under the following categories: contact identifiers, characteristics or demographics, commercial or transactional information, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties with whom we engage in selling or sharing your personal information may include vendors and other entities involved in cross-context behavioral advertising.

We assure you that your personal information is not sold, as per its traditional understanding. However, it's essential to note that certain disclosures of personal information may fall under the categories of a "sale" or "share" as defined by the GDPR. According to the GDPR, a "sale" encompasses disclosures for something of value, while a "share" includes disclosures for cross-context behavioral advertising.

It's important to understand that some of the personal information we collect might be considered sensitive under the GDPR. However, rest assured that we handle sensitive personal information only for permissible business purposes outlined by the GDPR. We neither use nor disclose sensitive personal information to infer characteristics about you.

We will not discriminate against you for exercising your rights under the GDPR. This means that we won't discriminate against you by denying goods or services, charging you a different price, or providing a different quality of goods or service just because you exercised your consumer privacy rights.

To exercise your rights outlined above, please contact us using the provided details in this document.

In order for us to effectively address your request, it is essential that we can verify your identify. Therefore, you can only exercise these rights by submitting a verifiable request. This means that you must

• Provide sufficient information for us to reasonably verify that you are the individual whose personal information we have collected or an authorized representative.
• Clearly articulate your request with enough detail for us to comprehend, evaluate, and respond appropriately.

Please be aware that if we are unable to verify your identity, we will be unable to process your request or confirm that the personal information we hold is related to you.

When submitting a verifiable request, we do not require you to create an account with us. Any personal information collected from you for the purpose of verifying your request will be used exclusively for verification purposes. We will not disclose this information further, retain it longer than necessary for verification, or use it for unrelated purposes.

If you are unable to personally submit a verifiable request, you may authorize an authorized agent to act on your behalf. Please note that for opt-out requests, we will require written proof of the agent's permission to do so and may verify your identity directly. Additionally, as an adult, you have the authority to make a verifiable request on behalf of a child under your parental authority.

When we receive your request, we will provide a acknowledgement of your verifiable request within 7 days and provide more details on how we will be handling your request.

Our response to your request will be provided within 30 days of its receipt. If we need additional time, we will inform you of the reasons as to why and the expected duration. (This may take up to 90 days)

At any point, if your request is denied, we will provide an explanation for our decision.

If we make the decision to refuse your request, you may appeal our decision in a reasonable time frame by contact us at customerservice@travelerchoice.com and specifying your wish to appeal. Within 45 days of our receipt of your appeal, we will inform you of any action taken or not take in response to the appeal, including an explanation of the reasons for our decision.

Please note that there is NO charge for processing or responding to your verifiable request, unless it is deemed manifestly unfounded or excessive. In such instances, we may levy a reasonable fee or opt not to proceed with the request. We will communicate our decision and rationale accordingly.

If you have a concern on how we process your personal data, you have the right to create a compliant with the Data Protection Authority where you reside.

• For visitors in the EEA: https://edpb.europa.eu/about-edpb/board/members_en
• For visitors in the UK: https://ico.org.uk/global/contact-us/
• For visitors in Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html
• For visitors in Liechtenstein: https://www.lvv.li/data-protection/
• For visitors in Norway: https://www.datatilsynet.no/en/about-us/contact-us/how-to-complain-to-the-norwegian-dpa/