Virtuoso Ltd. Privacy Notice for UK Resident Consumers
Effective: December 2, 2024
This privacy notice for Virtuoso Ltd. applies to United Kingdom resident consumers and tells you what to expect us to do with your personal information.
To the extent this privacy notice conflicts with the global privacy notice of Virtuoso Ltd., this privacy notice will prevail for UK resident consumers. Likewise, this privacy notice is supplemented by our other global data privacy practices that apply generally to all data subjects in areas that are not expressly covered here and yet still apply, despite regional differences (e.g. our cookie policy).
We describe and divide this notice into the following sections to promote transparency:
Registration and contact details:
We have registered our company, Virtuoso Ltd., and our personal data collection and protection practices with the following public agencies or administrators:
1. The Information Commissioner's Office (ICO) of the UK
https://ico.org.uk
2. UK-US Data Bridge – Data Privacy Framework*
https://www.dataprivacyframework.gov/list
*Note: Virtuoso Ltd has been registered under the Data Protection Framework (and its predecessor frameworks protecting data transfers between the EU, UK, Switzerland and the US) since 2016 and is currently in the process of renewing its registration for 2025. We anticipate the registration to be completed soon for the next annual cycle of 2024-2025. We advise you to check the DPF periodically if you are interested in viewing that registration.
The following contact is provided for this notice if you need more information or have an inquiry for our organization:
Name and Title: Alex Cestero, General Counsel of Virtuoso Ltd.
Address: Virtuoso Ltd., 777 Main St Ste 900, Fort Worth, TX 76102
Email: acestero@virtuoso.com
What information we collect, use, and why:
We collect or use the following information (i) to provide services and goods, including delivery, (ii) for service updates or marketing purposes, and (iii) to comply with legal requirements.
- Names and contact details
- Addresses
- Date of birth
- Marketing preferences
- Location data
- IP addresses
- Website and app user journey information
- Records of consent, where appropriate
Lawful bases and data protection rights:
Data Protection Rights: Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are in brief set out below.
You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
- Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
- Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
- Your right to erasure - You have the right to ask us to delete your personal information. You can read more about this right here.
- Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
- Your right to object to processing - You have the right to object to the processing of your personal data. You can read more about this right here.
- Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, based on certain limitations, for example around technical limitations for a particular file type or formatting request that is not reasonable. You can read more about this right here.
- Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Lawful Basis: Our lawful basis for the collection and use of your data is based on certain types of services or activities as described below.
Our lawful bases for collecting or using personal information
(i) to provide services and goods, including delivery, (ii) for service updates or marketing purposes, and (iii) to comply with legal requirements, are one or several of the following as the case may be:
- Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
- Contract – In the event there is a paid service or subscription, we may have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
- Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
- Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability may be limited as described in your rights. Our legitimate interests are:
- Based on our legitimate interest in promoting the travel industry reliant upon your consent, we collect your information (i) to perform user analytics of the various digital media that you use to interact with us so that we may monitor the efficacy of performance and provide the best user experience or (ii) to market our partner's services related to the travel industry to you, which either directly benefit you or indirectly enhance the content you see on our websites, mobile apps, or other digital forms of communication. For example, we may send you e-mail marketing based on your selected interest to learn more about our network's travel offerings.
Where we get personal information from:
- You, as you’ve provided to us in your consent
- Publicly available sources
- Providers of marketing lists and other personal information
- Suppliers and service providers
- If you are interacting with and/or using a travel partner, such as a cruise operator, an independent travel advisor or travel agency or company, these parties may have acquired your personal information to share with us to enhance the marketing activities that those parties have agreed with you to share your information with us from time to time based on those consents.
How long we keep information:
Virtuoso Ltd’s policy for data retention is 10 years within our services and production environments from that date of lawfully obtaining your personal information.
Who we share information with:
Data processors
HubSpot
This data processor does the following activities for us: Marketing CRM used to maintain and deliver digital and print marketing campaigns.
Smartsheet
This data processor does the following activities for us: Provides forms for opting in to various Virtuoso services.
Park Communications
This data processor does the following activities for us: UK-based print marketing, including magazines
Abode2
This data processor does the following activities for us: Digital advertising for the purposes of collecting opt-ins for Virtuoso marketing campaigns.
SnowFlake
This data processor does the following activities for us: cloud-based data storage/processing.
Tableau
This data processor does the following activities for us: cloud-based Business Intelligence and Analytics Software
Microsoft Office 365
This data processor does the following activities for us: Productivity tools and cloud data storage
Microsoft Azure
This data processor does the following activities for us: Infrastructure hosting for in-house developed systems and services.
Termly
This data processor does the following activities for us: Consent management for cookies on Virtuoso web applications.
Google
This data processor does the following activities for us: Google Analytics is used to analyze Virtuoso web application usage for improving services.
Facebook
This data processor does the following activities for us: Facebook Pixel is used for monitoring user actions and ad-retargeting.
Datadog
This data processor does the following activities for us: Application performance monitoring of Virtuoso web applications.
Maxmind
This data processor does the following activities for us: IP address geolocation discovery to show more relevant results on Virtuoso web applications.
Zoho
This data processor does the following activities for us: CRM, such as when a user submits a ticket to help@virtuoso.com for support.
Others we share personal information with include:
- Organisations we need to share information with for safeguarding reasons
- Relevant regulatory authorities
- Organisations we’re legally obliged to share personal information with based on lawful request
- Social media or other marketing and information media or partners based on your consent.
Sharing information outside the UK*:
We transfer your personal information outside of the UK to the United States for data processing. When doing so, we comply with the UK GDPR or the UK-US data bridge known as the “Data Protection Framework” (DPF) and are registered with the Information Commissioner's Office of the UK, ensuring appropriate safeguards are in place.
For further information on the registration of our organization for any of the transfers described in this privacy notice, please use the links above under “Registration and Contact Details”.
*Important Notice: By providing consent to have your personal information processed by Virtuoso Ltd., you understand and agree that your information will be transferred outside of the UK and reside in servers located in the United States for the purposes of data processing described in this privacy notice.
Organization name: Virtuoso Ltd.
Category of recipient:
- Marketing Services for Travel Agencies and Travel Partners
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: Virtuoso Ltd is incorporated in the United States, which is a country-member of the US-UK data bridge (also known as Adequacy Regulations) and is registered with the Information Commissioner's Office (ICO) of the UK.
How to complain:
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
