Privacy Statement
March 13, 2025
First things first – your privacy is important to us. That might be the kind of thing all these notices say, but we mean it. You place your trust in us by using Xullu.com services, and we value that trust. That means we’re committed to protecting and safeguarding your personal data. We actin our customers’ best interests and are transparent about the processing of your personal data.
This document (“this Privacy Statement” or “our Privacy Statement”) describes how we use and process your personal data, provided in a read able and transparent manner. It also tells you what rights you can exercise in relation to your personal data and how you can contact us. Please also read our Cookie Statement, which tells you how Xullu.com uses cookies and other similar tracking technologies.
If you’ve used us before, you know that Xullu.com offers online travel-related services through our own websites and mobile apps, as well as other online platforms such as partners’ websites and social media. We’d like to point out that all the info you’re about to read generally applies to not one, not two, but all of these platforms.
In fact, this single privacy statement applies to any kindof customer information we collect through all of the above platforms or by anyother means connected to these platforms (such as when you contact our customerservice team by email).
If you are one of our business partners, make sure to alsocheck out our Privacy Statement for Business Partners to understand howpersonal data is further processed as part of the business relationship.
We might amend this Privacy Statement from time to time, sowe recommend visiting this page occasionally to make sure you know where youstand. If we make any updates to the Privacy Statement that will impact yousignificantly, we’ll notify you about the changes before any new activitiesbegin.
Terms we use in this Privacy Statement
“Trip” refers to the various different travel products andservices that can be ordered, acquired, purchased, bought, paid, rented,provided, reserved, combined, or consummated by you from the Trip Provider.
“Trip Provide” refers to the provider of accommodation (e.g.hotel, motel, apartment, bed & breakfast, landlord), attractions (e.g.(theme) parks, museums, sightseeing tours), transportation provider (e.g. carrentals, cruises, trains, flights, bus tours, transfers), tour operators,travel insurances, and any other travel or related product or service as fromtime to time available for Trip Reservation on the platform.
“Trip Service” refers to the online purchase, order,(facilitated) payment, or reservation service as offered or enabled by Xullu.comregardingvarious products and services as from time to time made available by TripProviders on the platform.
“Trip Reservation” refers to the order, purchase, payment,booking, or reservation of a Trip.
What kind of personal data does Xullu.com collect?
We can’t help you book the perfect Trip without information,so when you use our services there are certain things we ask for. This istypically routine info – your name, preferred contact details, the names of thepeople traveling with you, and your payment info. You might also decide tosubmit additional info related to your upcoming Trip (e.g. your anticipatedarrival time).
In addition to this, we also collect info from the computer,phone, tablet, or other device you use to access our services. This includesthe IP address, the browser used, and your language settings. There are alsosituations when we receive info about you from others or automatically collectother info.
This is the general overview but if you’d like to know moreabout the information we collect, we go into more detail below.
Read more about the personal data we collect
Why does Xullu.com collect and use your personal data?
The main reason we ask for personal details is to help youorganize your online Trip Reservations and ensure you get the best possibleservice.
We also use your personal data to contact you about thelatest deals, special offers, and other products or services we think you mightbe interested in. There are other uses, too. If you’d like to find out whatthey are, read on for a more detailed explanation.
Read more about why Xullu.com collects your data
How does Xullu.com share your data with third parties?
There are different parties integrated into Xullu.comservices, in various ways and for various reasons. The primary reason we shareyour data is to provide the Trip Provider with the relevant info to completeyour Trip Reservation.
We also involve other parties to provide you with the Xullu.comservices. This includes, for example, financial institutions, advertisers,subsidiaries of the Xullu.com corporate group, and the other companies thatform the Booking Holdings Inc. corporate group. Or, in some cases, if we’rerequired to by law, we might share your data with governmental or otherauthorities
Below, we go into more detail about how the information youshare with us is used and exchanged with these parties.
Read more about data and our ground transport services
How is your personal data shared and further processed forinsurance services?
We work with different parties when offering insurance services.Follow the link below to understand how your data is used and shared forinsurance purposes and learn about the responsibilities of the partiesinvolved.
Read more about data and insurance products and services
How does Xullu.com process communications that you and yourTrip Provider may send via Xullu.com?
Xullu.com can help you and Trip Providers exchange info orrequests about services and existing Trip Reservations through the Xullu.complatform. If you want to find out more about how Xullu.com receives and handlesthese communications, read on here.
Read more about how these communications are processed
How does Xullu.com make use of mobile devices?
We offer free apps that we also collect and process personaldata through. This works in much the same way as our website, but they alsoallow you to benefit from the location services available on your mobiledevice(s).
Read more about how we use data from mobile devices
How does Xullu.com make use of social media?
The use of social media may be integrated into Xullu.comservices in various ways. These will involve us collecting some of yourpersonal data, or the social media provider receiving some of your info. Ifyou’d like to learn more about how this information is used and exchanged, readon.
Read more about how we use social media data
What security and retention procedures doXullu.com put inplace to safeguard your personal data?
We’ve implemented a range of procedures to preventunauthorized access to and the misuse of personal data that we process.
Read more about security and retention procedures
How does Xullu.com treat personal data belonging tochildren?
Unless indicated otherwise, Xullu.com is a service you’reonly allowed to use if over you’re older than 16. We only process informationabout children with the consent of their parents or legal guardians, or whenthe information is shared with us by the parents or legal guardians themselves.
Read more about the personal data of under 16
How can you control the personal data you’ve given to Xullu.com?
Among others, you have the right to review the personal datawe keep about anytime and request access to or deletion of your personal databy submitting this form. To find out more about your rights to control yourpersonal data, read on.
Read more about how you can control your personal data
Who is responsible for the processing of personal data onthe Xullu.com website and apps?
Xullu.com controls the processing of personal data for theprovision of its services. That includes its websites and mobile apps, exceptfor some exceptions that are clarified in this privacy statement.
Read more about Xullu.com responsibility for personal data
Country-specific provisions
Depending on the law that applies to you, we may be requiredto provide some additional info. If applicable, you’ll find additional info foryour country or region below.
Read more about country-specific provisions
What kind of personal data does Xullu.com collect?
Okay, so you’re looking for some more in-depth info. Here’sa closer look at what we collect.
Personal data you give to us.
Xullu.com collects and uses the info you provide us. Whenyou make a Trip Reservation, you are (at a minimum) asked for your name andemail address.
Depending on the Trip Reservation, we may also ask for yourhome address, telephone number, payment information, date of birth, currentlocation (in the case of on-demand services), the names of the people travelingwith you, and any preferences you might have for your Trip (such as dietary oraccessibility requirements). In some cases, you may also be able to check-inonline with the Trip Provider, for which we will ask you to share passportinformation or a driver’s license and signatures.
If you need to get in touch with our customer service team,contact your Trip Provider through us, or reach out to us in a different way(such as social media) we’ll collect information from you there, too. Thisapplies whether you are contacting us with feedback or asking for help usingour services.
You might also be invited to write reviews to help informothers about the experiences you had on your Trip. When you write a review onthe Xullu.com platform, we’ll collect any info you’ve included, along with yourdisplay name and avatar (if you choose one).
There are other instances where you’ll provide us withinformation as well. For example, if you’re browsing with your mobile device,you can decide whether to allow Xullu.com to see your current location or grantus access to some contact details. This helps us to give you the best possibleservice and experience by, for example, showing you our city guides, suggestingthe nearest restaurants or attractions to your location, or making otherrecommendations.
If you create a user account, we’ll also store your personalsettings, uploaded photos, and reviews of previous bookings there. This saveddata can be used to help you plan and manage future Trip Reservations orbenefit from other features only available to account holders, such asincentives or other benefits.
You can also choose to add details from your identificationdocuments to your user accounts, so you don’t have to submit this info for eachindividual Trip Reservation.
We may offer you referral programs or sweepstakes, andparticipating in these will mean providing us with relevant personal data.
Personal data you give us about others.
If you have Xullu.com for Business account, you can keep anaddress book there to make it easier to plan and manage business travelarrangements for others.
In some cases, you might use Xullu.com to share informationwith others. This can take the form of sharing a wish list, taking part in atravel community or participating in a referral program, as described when youuse the relevant feature.
At this point, we must make it clear that it’s yourresponsibility to ensure that the person or people you have provided personaldata about are aware that you’ve done so, and that they have understood andaccepted how Xullu.com uses their information (as described in this PrivacyStatement).
Personal data we collect automatically.
Whether or not you end up making a Trip Reservation, whenyou visit our websites or apps, we automatically collect certain info. Thisincludes your IP address, the date and time you accessed our services, thehardware, software, or internet browser you used, and info about yourcomputer’s operating system like application versions and your languagesettings. We also collect information about clicks and which pages were shownto you.
If you’re using a mobile device, we collect data thatidentifies the device, as well as data about your device-specific settings andcharacteristics, app crashes, and other system activity. When you make a TripReservation using this kind of device, our system registers how you made yourreservation (on which website), and/or which site you came from when youentered the Xullu.com website.
Personal data we receive from other sources.
It’s not just the things you tell us, though—we may alsoreceive information about you from other sources. These include businesspartners, such as affiliate partners, subsidiaries of the Xullu.com corporategroup, other companies inXullu company, and other independent third parties.
Anything we receive from these partners may be combined withinformation provided by you. For example, Xullu.com Trip Reservation servicesaren’t only made available via Xullu.com and the Xullu.com, but are alsointegrated into the services of affiliate partners you can find online. Whenyou use any of these services, you provide the reservation details to ourbusiness partners who then forward your details to us.
We also integrate with third party service providers tofacilitate payments between you and Trip Providers. These service providersshare payment information, so we can administer and handle your TripReservation, making sure everything goes as smoothly as possible for you.
We also collect info when we receive a complaint about youfrom a Trip Provider (e.g. in the case of misconduct).
Another way we might receive data about you is through thecommunication services integrated into our platforms. These communicationservices offer you a way to contact the Trip Provider you’ve booked with todiscuss your stay. In some cases, we receive metadata about these communicationactivities (such as who you are, where you call from, and the date and lengthof the call).
We may also receive information about you to show you morerelevant ads, such as the additional cookie data Xullu.com social mediapartners make available to us. Please read the section “Why does Xullu.comcollect and use your personal data? for more information.
When you link your Xullu.com user account to your socialmedia account, you might trigger exchanges of data between Xullu.com and thatsocial media provider. You can always choose not to share that data.
Trip Providers may share info about you with Xullu.com, too.This could happen if you have support questions about a pending TripReservation, or if disputes or other issues arise about a Trip Reservation.
Why does Xullu.com collect and use your personal data?
We use the info collected about you for various purposes.Your personal data may be used in the following ways:
Trip Reservations: First and foremost, we use your personaldata to complete and administer your online Trip Reservation – which isessential for us to provide this service for you. This includes sending youcommunications that relate to your Trip Reservation, such as confirmations(including, where applicable, providing you with proof of purchase and/orpayment), modifications, and reminders. In some cases, this may also include processingyour personal data to enable online check-in with the Trip Provider orprocessing personal data in relation to possible damage deposits.
Customer service: We provide international customer servicefrom our local offices in more than 20 languages and are here to help 24/7.Sharing relevant details such as reservation info or info about your useraccount with our global customer service staff allows us to respond when youneed us. This includes helping you to contact the right Trip Provider and respondingto any questions you might have about your Trip Reservation (or any otherquestions, for that matter).
Account facilities: Xullu.com users can create an account onour website or apps. We use the info you give us to administer this account,enabling you to do several useful things. You can manage your TripReservations, take advantage of special offers, make future Trip Reservationseasily, and manage your personal settings.
Managing personal settings lets you keep and share lists,share photos, view previously searched Trip Services, and check othertravel-related info you've provided. You can also see any reviews you’vewritten.
If you want, you can share certain info as part of your useraccount by creating a public profile under your own first name or a screen nameyou choose.
If you’re a Xullu.com for Business account holder, you canalso save contact details under that account, manage business reservations, andlink other account holders to the same Xullu.com for Business account.
Online groups: We give account holders the chance to connectand interact with each other through online groups or forums, such as travelcommunities.
Marketing activities: We use your information for marketingactivities. These activities include:
Use your contact information to send you regular news abouttravel-related products and services. You can unsubscribe from email marketingcommunications quickly, easily, and anytime. All you need to do is click the"Unsubscribe" link included in each newsletter or other communicationor manage your preferences via your account settings.
Based on your info, individualized offers might be shown toyou on the Xullu.com website, on mobile apps, or on third-party websites/apps(including social media sites), and the content of the site displayed to youmight be personalized. These could be offers that you can book directly on the Xullu.comwebsite, on co-branded sites, or other third-party offers or products we thinkyou might find interesting.
When you participate in other promotional activities (suchas sweepstakes, referral programs, or competitions), only relevant informationwill be used to administer these promotions.
Communicating with you: There might be other times when weget in touch, including by email, by chatbot, by mail, by phone, or by text.Which method we choose depends on the contact information you’ve previouslyshared.
We process the communications you send to us. There could bea number of reasons for this, including:
Responding to and handling any requests you or your bookedTrip Provider have made. Xullu.com also offers customers and Trip Providersvarious ways to exchange information, requests, and comments about TripProviders and existing Trip Reservations via Xullu.com. For more information,read the section titled “How does Xullu.com process communications that you andyour Trip Provider send through Xullu.com?”
If you have started but not finished a Trip Reservationonline, we might contact you to invite you to continue with your reservation. Webelieve this additional service benefits you because it allows you to carry onwith a Trip Reservation without having to search for Trip Providers or enteryour reservation details again.
When you use our services, we might send you a questionnaireor invite you to provide a review about your experience with Xullu.com or theTrip Provider.
We also send you other material related to your TripReservations, such as how to contact Xullu.com if you need assistance whileyou’re away, and information that we feel might be useful to you in planning ormaking the most of your Trip. We might also send you material related toupcoming Trip Reservations or a summary of previous Trip Reservations you madethrough Xullu.com.
Even if you don’t have an upcoming Trip Reservation, we maystill need to send you other administrative messages, which could includesecurity alerts.
In case of misconduct, we may send you a notice and/orwarning.
Market research: We sometimes invite our customers to takepart in market research. Review the info that accompanies this kind ofinvitation to understand what personal data will be collected and how it’sused.
Improving our services: We also use personal data foranalytical purposes and product improvement. This is part of our commitment toimproving our services and enhancing the user’s experience.
In this case, we use data for testing and troubleshootingpurposes, as well as generating statistics about our business. The main goalhere is to get insights into how our services perform, how they are used, andultimately to optimize and customize our website and apps, making them easierand more meaningful to use. As much as possible, we strive to use anonymizedand de-identified personal data for this analytical work.
Providing the best price applicable to you, depending onwhere you are based: When you search our apps or website (e.g. to find accommodation,rental car, or flight), we process your IP address to confirm whether you’re inthe European Economic Area (EEA) or another country. We do this to offer youthe best price for the region (EEA) or country (non-EEA) where you’re based.
Customer reviews and other destination-related info: Duringand after your Trip, we might invite you to submit a review. We can also makeit possible for the people you’re traveling with or whom you booked areservation for to do this instead. This invite asks for information about theTrip Provider or the destination.
If you have a Xullu.com account, you can choose to display ascreen name next to your review, instead of your real name. If you’d like toset a screen name, you can do that in your account settings. Adding an avataris also possible.
By completing a review, you agree that it can be displayed(as described in detail in our Terms and Conditions) on, for example, therelevant Trip Provider information page on our websites, on our mobile apps, onour social media accounts and social media apps, or on the online platform ofthe relevant Trip Provider or business partner’s website. This is to informother travelers about the quality of the Trip Service you used, the destinationyou have chosen or any other experiences you choose to share.
Call monitoring: When you make calls to our customer serviceteam, Xullu.com uses an automated telephone number detection system to matchyour telephone number to your existing reservations. This helps save time forboth you and our customer service staff. However, our customer service staffmay still ask for authentication, which will help to keep your reservationdetails confidential.
During calls with our customer service team, live listeningmight be carried out or calls might be recorded for quality control andtraining purposes. This includes the usage of the recordings for the handlingof complaints, legal claims, and for fraud detection.
We do not record all calls. In the case that a call isrecorded, each recording is kept for a limited amount of time before beingautomatically deleted. This is unless we have determined that it’s necessary tokeep the recording for fraud investigation or legal purposes. You can read moreabout this below.
Promotion of a safe and trustworthy service: To create atrustworthy environment for you, the people you bring with you on your Trip, Xullu.com’sbusiness partners and our Trip Providers, we continuously analyze and usecertain personal data to detect and prevent fraud and other illegal or unwantedactivities.
Similarly, we use personal data for risk assessment andsecurity purposes, including when you report a safety concern, or for theauthentication of users and reservations. When we do this, we may have to stopor put certain Trip Reservations on hold until we’ve finished our assessment.
Legal purposes: Finally, in certain cases, we may need touse your information to handle and resolve legal claims and disputes, forregulatory investigations and compliance, to enforce the Xullu.com onlinereservation service terms of use or to comply with lawful requests from lawenforcement.
Providing your personal data to Xullu.com is voluntary.However, we may only be able to provide you with certain services if we canonly collect some personal data. For instance, we can’t process your TripReservation if we don’t collect your name and contact details.
If we use automation to process personal data that produceslegal effects or similarly, significantly affects you, we’ll always implementthe necessary measures to safeguard your rights and freedoms. This includes theright to obtain human intervention.
To process your personal data as described above, we rely onthe following legal bases:
As applicable, for purpose A and B, Xullu.com relies on thelegal basis that the processing of personal data is necessary for theperformance of a contract, specifically to finalize and administer your TripReservation.
If the required personal data is not provided, Xullu.comcannot finalize the Trip Reservation, nor can we provide customer service. Inview of purposes C to L, Xullu.com relies on its (or third parties’) legitimateinterest, to provide and improve services and to prevent fraud and otherillegal acts (as set out more specifically under C to L).
When using personal data to serve Xullu.com’s or a thirdparty's legitimate interest, Xullu.com will always balance your rights and interestsin the protection of your personal data against Xullu.com’s rights andinterests or those of the third party. For purpose M, Xullu.com also relies,where applicable, on compliance with legal obligations (such as legal lawenforcement requests).
Finally, where needed under applicable law, Xullu.com willobtain your consent prior to processing your personal data, including for emailmarketing purposes or as otherwise required by law.
If you wish to object to the processing set out under C to Land no opt-out mechanism is available to you directly (for example, in youraccount settings), contact us at dataprotectionoffice@xullu.com.
How does Xullu.com share your data with third parties?
In certain circumstances, we’ll share your personal datawith third parties. These third parties include:
The Trip Provider You Booked: In order to complete your TripReservation, we transfer relevant reservation details to the Trip Provideryou've booked. This is one of the most essential things we do for you.
Depending on the Trip Reservation and Trip Provider, thedetails we share can include your name, contact and payment details, the namesof the people accompanying you, and any other info or preferences you specifiedwhen you made your Trip Reservation.
In certain cases, we also provide some additional historicalinfo about you to the Trip Provider. This includes whether you’ve alreadybooked with them in the past, the number of completed bookings you’ve made withXullu.com, confirmation that no misconduct has been reported about you, thepercentage of bookings you’ve canceled in the past, or whether you’ve givenreviews about past bookings.
If you have a question about your Trip, we may contact theTrip Provider to handle your request. Unless payment is made during the bookingprocess, via the Xullu.com website, we will forward your credit card details tothe booked Trip Provider for further handling (assuming you’ve provided us withthose details).
In cases of Trip Reservation-related claims or disputes, wemay provide the Trip Provider with your contact details and other informationabout the booking process, as needed to resolve the situation. This caninclude, but might not be limited to, your email address and a copy of yourreservation confirmation as proof that a Trip Reservation was made or toconfirm reasons for cancellation.
For completeness, Trip Providers will further process yourpersonal data outside of the control of Xullu.com. Trip Providers may also askfor additional personal data, for instance to provide additional services, orto comply with local restrictions. If available, please read the PrivacyStatement of the Trip Provider to understand how they process your personaldata.
Connectivity Providers: Note: Certain Trip Providers mayneed us to share your personal data with a contracted Connectivity Provider tobe able to finalize and administer your reservation. Connectivity providers acton behalf of Trip Providers and help them to manage their reservations.
Your local Xullu.com office: To support the use of Xullu.comservices, your details may be shared with subsidiaries of the Xullu.comcorporate group, including customer service. To find out more about the Xullu.comcorporate group, visit About Xullu.com.
Third-party service providers: We use service providersoutside of the Xullu.com corporate group to support us in providing ourservices. These include:
Customer support
Market research
Fraud detection and prevention (including anti-fraudscreening)
Insurance claims
Payment
We use third parties to process payments, handlechargebacks, or provide billing collection services. When a chargeback isrequested for your Trip Reservation, either by you or by the holder of thecredit card used to make your reservation, we need to share certain reservationdetails with the payment service provider and the relevant financialinstitution so they can handle the chargeback. This may also include a copy ofyour reservation confirmation, or the IP address used to make your reservation.We may share information with relevant financial institutions, if we considerit strictly necessary for fraud detection and prevention purposes.
When a chargeback is requested for your Trip Reservation,either by you or by the holder of the credit card used to make yourreservation, we need to share certain reservation details with the paymentservice provider and the relevant financial institution so they can handle thechargeback. This may also include a copy of your reservation confirmation, orthe IP address used to make your reservation.
We may also share information with relevant financialinstitutions, if we consider it strictly necessary for fraud detection andprevention purposes.
Marketing services
We share personal data with advertising partners, includingyour email address, IP address, and telephone number, as part of marketing Xullu.comservices via third parties (to ensure that relevant advertisements are shown tothe right audience). We use techniques such as hashing to enable the matchingof your email address, IP address, and/or telephone number with an existingcustomer database, to prevent this data from being used for other purposes. Forinfo on other personalized advertisements and your choices, read our CookieStatement.
Advertising partners
We use advertising partners, such as metasearch providers,to allow you to compare our offers with offers from other Online TravelAgencies (OTAs). When you make a reservation withXullu.com after using anadvertising partner, we will send the details of the reservation that you madeon Xullu.com to that partner.
Other professional third parties: In certain cases (such asdisputes or legal claims or as part of auditing activities), we may need toshare your personal data with professional advisors. These advisors includeparties such as law firms or auditors. We only share your personal data to theextent that it is necessary and such third parties process this data in linewith their own professional obligations.
Competent authorities: We disclose personal data to lawenforcement to the extent that it is required by law or is strictly necessaryfor the prevention, detection, or prosecution of criminal acts and fraud, or ifwe are otherwise legally obligated to do so. We may need to further disclosepersonal data to competent authorities to comply with a legal obligation (e.g.under short-term rental laws), to protect and defend our rights or properties,or the rights and properties of our business partners.
Business partners: We work with many business partnersaround the world. These business partners distribute and advertise Xullu.comservices, including the services and products of our Trip Providers.
When you make a reservation on one of our business partners’websites or apps, certain personal data that you give them, such as your nameand email address, your address, payment details, and other relevantinformation, will be forwarded to us to finalize and manage your TripReservation.
If customer service is provided by the business partner, Xullu.comwill share relevant reservation details with them (as and when needed) in orderto provide you with appropriate and efficient support.
When you make a reservation through one of our businesspartners’ websites, the business partners can receive certain parts of yourpersonal data related to the specific reservation and your interactions onthese partner websites. This is for their commercial purposes.
When you make a reservation on a business partner’s website,take the time to read their privacy notice as well if you’d like to understandhow they process your personal data.
For fraud detection and prevention purposes, we may alsoexchange information about our users with business partners – but only whenstrictly necessary.
If an insurance claim is made concerning you and a TripProvider, we may provide the necessary data (including personal data) to theinsurance company for further processing.
Partner Offer: We may present you with a “Partner Offer.”When you book a stay marked “Partner Offer,” your reservation will befacilitated by a Trip Provider who is separate from the accommodation you’rebooking. As part of the reservation process, we’ll need to share some relevantpersonal data with this business partner.
If you book a Partner Offer, review the information providedin the booking process or check your reservation confirmation for moreinformation about the Trip Provider and how they will further process yourpersonal data.
The Booking Holdings Inc. corporate group: Read about how weshare your personal data with the Booking Holdings Inc. corporate group.
Xullu.com is a global business. The data that we collectfrom you, as described in this Privacy Statement, could be made accessible by,transferred to or stored in countries which may not have the same dataprotection laws as the country in which you initially provided the information.In such cases, we will protect your data as described in this PrivacyStatement.
This may also be applicable if you are in the EuropeanEconomic Area (EEA). Countries where your data may be transferred to may nothave laws that provide the same level of protection for your personal data aslaws within the EEA. Where this is the case, we will put appropriate safeguardsin place to make sure that these transfers comply with European privacy law.
When your data is transferred to third-party serviceproviders, we establish and implement appropriate contractual, organizational,and technical measures with them. This is done by putting in place StandardContractual Clauses as approved by the European Commission, by examining thecountries to which the data may be transferred, and by imposing specifictechnical and organizational security measures.
In certain specific cases, we transfer your data outside theEEA because it is in your interest or is necessary to conclude or fulfil thecontract we have with you. For example, when you make a reservation on Xullu.comor through a business partner, we might need to transfer your data to a TripProvider or business partner who is located outside the EEA.
You can ask us to see a copy of our implemented safeguards(where possible) by contacting us at agent@xullu.com.
How is your personal data shared within the Expedia.com Inc.corporate group?
Xullu.com is part ofan affiliate program of the Expedia Inc.corporate group. More information is available onExpedia.com.
We may receive personal data about you from other companiesin the Expedia Inc. corporate group, or share your personal data with them, forthe following purposes:
To provide services (including making, administering, andmanage reservations or handle payments)
To provide customer service
To detect, prevent, and investigate fraudulence or otherillegal activities and data breaches
For analytical and product improvement purposes
To send you personalized offers or marketing with yourconsent, or as otherwise permitted by applicable law
For hosting, technical support, overall maintenance, andmaintaining security of such shared data
To ensure compliance with applicable laws
As applicable and unless indicated otherwise, for purposes Ato F, Xullu.com relies on its legitimate interests in sharing and receivepersonal data. For purpose G, Xullu.com relies, where applicable, on compliancewith legal obligations (such as lawful law enforcement requests).
For example, Xullu.com works closely with Autoeurope.com tooffer ground transportation services to customers. For more info, read How isyour personal data shared and further processed for ground transport services?
All companies within the Booking Holdings Inc. group ofcompanies may need to exchange personal customer data to ensure all users areprotected from fraudulent activities on its online platforms.
How is your personal data shared and further processed forground transport services?
Xullu.com Transport Limited, trading as Autoeurope.com, is aprivate limited liability company, incorporated under the laws of the UnitedKingdom with offices at 100 New Bridge Street, London, EC4V 6JA.
Xullu.com and Autoeurope.com work together closely to offeryou ground transport services via Xullu.com websites and apps, such as cars.xullu.com.
The ground transportation services offered by Xullu.comwebsites and apps are operated by Autoeurope.com, under the Xullu.com brand.This means that when you're booking or browsing for ground transport servicesvia the app or website, Xullu.com and Autoeurope.com are collectivelyresponsible for the collection and use of your personal data.
In addition to the data, we process to allow you to searchfor ground transport services and make your booking, Xullu.com and Autoeurope.comcan also use your personal data independently. This is in line with thepurposes set out in this Privacy Statement and the Autoeurope.com PrivacyNotice.
For further information about the relationship between Xullu.comand Autoeurope.com, and to exercise your rights regarding your personal datathat is collected via the Xullu.com websites and apps, please feel free tocontact Xullu.com at any time. You can do this via the email address under “Whois responsible for the processing of personal data via Xullu.com and how tocontact us?”.
How is your personal data shared and further processed forinsurance services?
aig.com isanaffiliatecompany of Xullu.com with work closely together to offer customers differentinsurance products and services for Trip Reservations, for example, roomcancellation insurance.
The offering of insurance can involve multiple parties, suchas intermediaries, underwriters, and other agents. Where Xullu.com is involved,it will act as the intermediary and authorized agent or appointedrepresentative (depending on the jurisdiction) on behalf of the insurer, byoffering insurance products and services to Xullu.com customers.
Please review the information provided during the bookingprocess for more information about Xullu.com and the parties who work togetherwith Xullu.com to offer you these products and services. The details of theinsurer will be visible in the insurance policy and related documentationprovided to you.
When offering insurance, Xullu.com and Xullu.com may have touse and share personal data that is relevant to the insurance product. Thisdata relates to you as a potential or actual policyholder, the beneficiariesunder a policy, family members, claimants, and other parties involved in aclaim:
To provide offers, arrange insurance cover and handleinsurance claims, some personal data, provided to us during the bookingprocess, (“General Order Data”) may have to be shared with Xullu.com. You mayalso be asked to provide additional information, such as names of familymembers or other beneficiaries or details about a claim (“Insurance-SpecificData”).
If you make a claim under an insurance policy, this claimmay be directly handled by the insurer. This means that you may be asked toprovide personal data to submit the claim directly to them. The insurer willinform you accordingly at the point of collecting your information. When yourclaim is handled by the insurer, Xullu.com may receive information about thestatus of your claim to provide you with customer support services.
When Xullu.com acts as an intermediary for insuranceproducts and services via Xullu.com, the two companies are jointly responsiblefor the collection of Insurance-Specific Data and its transmission from Xullu.comto Xullu.com. However, Xullu.com actsFas the sole controller for any processingoutside of the Xullu.com. Any personal data collected by Xullu.com forinsurance purposes will be processed as set out in this Privacy Statement.
For further information about the relationship between Xullu.comand Xullu.com, and to exercise your rights regarding personal data that iscollected via the Xullu.com website and apps, please contact us.
How does Xullu.com process communications that you and yourbooked Trip Provider may send via Xullu.com?
Xullu.com can offer you and Trip Providers various ways tocommunicate about the Trip Services and existing Trip Reservations, directingthe communications via Xullu.com. This also allows you and your Trip Providerto contact Xullu.com with questions about your Trip Reservation through thewebsite, our apps, and the other channels that we provide.
Xullu.com accesses communications and may use automatedsystems to review, scan, and analyze communications for the following reasons:
Security purposes
Fraud prevention
Compliance with legal and regulatory requirements
Investigations of potential misconduct
Product development and improvement
Research
Customer engagement (including providing you info and offersthat we believe might interest you)
Customer or technical support
We reserve the right to review or block the delivery ofcommunications that we, at our sole discretion, believe might contain maliciouscontent or spam, or pose a risk to you, Trip Providers, Xullu.com, or others.
All communications sent or received using Xullu.comcommunication tools will be received and stored by Xullu.com. Trip Providersand Business partners you’ve booked a Trip Reservation through might alsochoose to communicate with you directly by email or through other channels thatXullu.com does not control.
How does Xullu.com make use of mobile devices?
We offer free apps for a range of different mobile devices,as well as versions of our regular website that are optimized for browsing on aphone and tablet.
These apps and mobile websites process the personal detailsyou give us in a similar way that our website does. They also allow you to uselocation services to find Trip Services nearby, if you want.
With your consent, we may send you push notifications withinformation about your Trip Reservation. You can also grant us access to yourlocation data or contact details to provide services you request. If you uploadpictures to our platform, these pictures may include location information(known as metadata) as well. Please read your mobile device’s instructions tounderstand how to change your settings and control the sharing of this categoryof data.
When you choose to use our “Voice Assistant” to search ourservices or manage your bookings, your speech will be anonymously translatedinto text by a third-party service provider. You will need to give us access toyour device's microphone to use this feature.
To optimize our services and marketing activities, and tomake sure we give you a consistent user experience, we use something known as“cross-device tracking.” This can be done with or without the use of cookies.For more general information about cookies and other similar technologies,please see our Cookie statement.
With cross-device tracking, Xullu.comcan track user activityacross multiple devices. As part of cross-device tracking, we may combine datacollected from a particular browser or mobile device with data from anothercomputer or device used by the same customer.
In order to optimize the content of the Xullu.comnewsletter, we combine searches and reservations made from different computersand devices. You can unsubscribe from the Xullu.com newsletter at any time.
Personalized ads shown to you on other websites or in appscan be offered based on your activities on linked computers and devices. Bychanging the cookie settings on your device (see our Cookie statement under“What are your choices?”), you can change your cross-device tracking settingsfor advertisement purposes. You should know that logging out of your Xullu.comaccount doesn’t mean that you will no longer receive personalized ads.
How does Xullu.com make use of social media?
At Xullu.com, we use social media in different ways. We useit to facilitate the use of online reservation services, to promote our TripProviders’ travel-related products and services, and to advertise, improve, andfacilitate our own services.
The use of social media features can result in the exchangeof personal data between Xullu.com and the social media service provider, asdescribed below. You’re free to not use any of the social media featuresavailable to you.
Sign in with your social media account. We offer you theopportunity to sign in to a Xullu.com user account with one of your social mediaaccounts. We do this to reduce the need for you to remember different usernamesand passwords for different online services.
After you’ve signed in once, you’ll be able to use yoursocial media account to sign into your Xullu.com account. You can decouple yourXullu.com user account from your chosen social media account any time you wantto.
Integration of social media plugins: We have also integratedsocial media plugins into the Xullu.com website and apps. This means that when youclick or tap on one of the buttons (such as Facebook’s “Like” button), certaininformation is shared with these social media providers.
If you’re logged into your social media account when youclick or tap one of these buttons, your social media provider may relate thisinformation to your social media account. Depending on your settings, theymight also display these actions on your social media profile, to be seen byothers in your network.
Other social media services and features. We may integrate othersocial media services (e.g. social media messaging) for you to interact with Xullu.comor your contacts about our services.
We may maintain social media accounts and offer apps onseveral social media sites. Whenever you connect with Xullu.com through socialmedia, your social media service provider may allow you to share informationwith us.
If you choose to share, your social media provider willgenerally inform you about which information will be shared. For example, whenyou sign into a Xullu.com user account using your social media account, certaininformation from that account may be shared with Xullu.com. This includes youremail address, your age, and the profile pictures you’ve saved—depending onwhat you authorize in your social media account.
When you register with a Xullu.com social media app orconnect to a social media messaging service without a Xullu.com user account,the information you choose to share with us may include the basic informationavailable in your social media profile (including your email address, statusupdates and a list of your contacts).
We’ll use this info to help provide you with the service yourequested, for example, to forward a message you want to send to your contactsor to create a personalized user experience on the app or our websites. Itmeans that—if you want us, we can customize our services to fit your needs,connecting you and your friends to the best travel destinations, as well asanalyzing and enhancing our travel-related services.
Your social media provider will be able to tell you moreabout how they use and process your data when you connect to Xullu.com throughthem. This can include combining the personal data they collect when you use Xullu.comthrough them with info they collect when you use other online platforms alsolinked to your social media account.
If you decide to connect using your Facebook or Googleaccount, review the following links for info about how these parties use datathey receive: Facebook and Google.
What security and retention procedures doXullu.com put inplace to safeguard your personal data?
We observe reasonable procedures to prevent unauthorizedaccess to and the misuse of personal data.
We use appropriate business systems and procedures toprotect and safeguard your personal data. We also use security procedures andtechnical and physical restrictions for accessing and using personal data onour servers. Only authorized personnel are permitted to access personal data inthe course of their work.
We’ll keep your personal data for as long as is necessary toenable you to use our services or to provide our services to you (includingmaintaining any Xullu.com user accounts you may have), to comply withapplicable laws, resolve any disputes and otherwise to allow us to conduct ourbusiness, including to detect and prevent fraud and/or other illegalactivities. All personal data we keep about you as a Xullu.com customer iscovered by this Privacy Statement.
For added protection, we strongly recommend that you set uptwo-factor authentication for your Xullu.com user account. This adds an extraauthentication step, to make sure that anyone who gets hold of your usernameand password (e.g., through phishing or social engineering) won’t be able toget into your account. You can set this up in the Security section of youraccount settings.
How does Xullu.com treat personal data belonging tochildren?
Our services aren’t provided for children under 16 yearsold, and we’ll never collect their data unless it’s provided by (and with theconsent of) a parent or guardian. The limited circumstances we might need tocollect the personal data of children under 16 years old include: as part of areservation, the purchase of other travel-related services, or in otherexceptional circumstances (such as features addressed to families). Again, thiswill only be used and collected as provided by a parent or guardian and withtheir consent.
If we find out that we processed info of a child under 16without the valid consent of a parent or guardian, we reserve the right todelete it.
How can you control the personal data you’ve given to Xullu.com?
We want you to be in control of how your personal data isused by us. You can do this in the following ways:
We want you to be in control of how your personal data isused by us. You can do this in the following ways:
You can ask us for a copy of the personal data we hold aboutyou.
You can inform us of any changes to your personal data, oryou can ask us to correct any of the personal data we hold about you. Asexplained below, you can make some of these changes yourself, online, when youhave a user account,
In certain situations, you can ask us to erase, block orrestrict the processing of the personal data we hold about you, or object toparticular ways in which we are using your personal data,
In certain situations, you can also ask us to send thepersonal data you've given us to a third party.
Where we use your personal data on the basis of yourconsent, you’re entitled to withdraw that consent at any time, subject toapplicable law.
Where we process your personal data based on legitimateinterest or public interest, you have the right to object to that use of yourpersonal data at any time, subject to applicable law.
We rely on you to make sure that your personal info iscomplete, accurate, and current. Let us know about any changes to orinaccuracies in your personal info as soon as possible.
If you have a Xullu.com user account, you can access a lotof your personal data through our website or apps. You’ll generally find theoption to add, update, or remove information we have about you in your accountsettings.
Users with a Xullu.com account can also request that wedelete your account through the Xullu.com app. Note that app features can varybetween operating systems and their third-party software providers.
If any of the personal data we have about you isn’taccessible through our website or apps, you can send us a request.
If you want to exercise your right of access or erasure, allyou need to do is complete and submit the Data Subject Request for Xullu.comCustomers form. For any requests about this Privacy Statement, to exercise anyof your other rights, or if you have a complaint, contact our Data ProtectionOfficer at dataprotectionoffice@xullu.com. You can also contact your local dataprotection authority.
If you’d like to object to your personal data beingprocessed based on legitimate interest and there’s no way to opt out directly,please contact us at agent@xullu.com.
Who is responsible for the processing of personal data via Xullu.comand how do you contact us?
Xullu.com controls the processing of personal data as describedin this Privacy Statement, except where explicitly stated otherwise. Xullu.comis a private limited liability company incorporated under the laws of the U.S.A.and has its offices at 17797 N. Perimeter Dr, Suite D-105, Scottsdale AZ 85255.
If you have any questions about this Privacy Statement, orabout our processing of your personal data, please contact our Data ProtectionOfficer at dataprotectionoffice@xullu.com and we’ll get back to you as soon aspossible.
For questions about a reservation, please contact ourcustomer service team on the customer service contact page.
Requests from law enforcement should be submitted using theLaw Enforcement process.
Country-specific provisions
Depending on the law that applies to you, we may be requiredto provide some additional information. If applicable, you will find additionalinformation for your country or region below.
Cookie statement
Whenever you use our online services or apps, we use cookiesand other online tracking technologies (which we’ll also refer to as “cookies”for the purpose of this Cookie Statement).
Cookies can be used in various ways, including making the Xullu.comwebsite work, analyze traffic, or for advertising purposes.
Read below to learn more about what a “cookie” is, how they’reused, and what your choices are.
What are cookies and other online tracking technologies?
How are cookies used?
What are your choices?
What are cookies and online tracking technologies?
A web browser cookie is a small text file that websitesplace on your computers or mobile device’s web browser.
These cookies store info about the content you view andinteract with to remember your preferences and settings or analyze how you useonline services.
Cookies are divided into “first party” and “third party”:
First party cookies are the cookies served by the owner ofthe domain. In our case, that’s Xullu.com. Any cookie we place ourselves is a“first-party cookie.”
Third-party cookies are cookies placed on our domains bytrusted partners that we’ve allowed to do so. These can be social mediapartners, advertising partners, security providers, and more.
And they can be either “session cookies” or “permanentcookies”:
Session cookies only exist until you close your browser,ending what’s called your “session.” Then they’re deleted.
Permanent cookies have a range of lifespans and stay on yourdevice after the browser is closed. On the Xullu.com platform, we try to onlyserve permanent cookies (or allow permanent cookies to be served by thirdparties) that have a limited lifespan. However, for security reasons or inother exceptional circumstances, sometimes we may need to give a cookie alonger lifespan.
Web browser cookies may store info such as your IP addressor other identifiers, your browser type, and info about the content you viewand interact with on digital services. By storing this info, web browsercookies can remember your preferences and settings for online services andanalyze how you use them.
Along with cookies, we also use tracking technologies thatare very similar. Our website, emails, and mobile apps may contain smalltransparent image files or lines of code that record how you interact withthem. These include “web beacons,” “scripts,” “tracking URLs,” or “softwaredevelopment kits” (known as SDKs):
Web beacons have a lot of different names. They might alsobe known as web bugs, tracking bugs, tags, web tags, page tags, trackingpixels, pixel tags, 1x1 GIFs, or clear GIFs.
In short, these beacons are a tiny graphic image of just onepixel that can be delivered to your device as part of a web page request, in anapp, an advertisement, or an HTML email message.
They can be used to retrieve info from your device, such asyour device type, operating system, IP address, and the time of your visit.They are also used to serve and read cookies in your browser or to trigger theplacement of a cookie.
Scripts are small computer programs embedded within our webpages that give those pages a wide variety of extra functionality. Scripts makeit possible for the website to function properly. For example, scripts powercertain security features and enable basic interactive features on our website.
Scripts can also be used for analytical or advertisingpurposes. For example, a script can collect info about how you use our website,such as which pages you visit or what you search for.
Tracking URLs are links with a unique identifier in them.These are used to track which website brought you to the Xullu.com website orapp you’re using. An example would be if you clicked from a social media page,search engine, or one of our affiliate partners’ websites.
Software Development Kits (SDKs) are part of our apps’source code. Unlike browser cookies, SDK data is stored in the app storage.
They’re used to analyze how the apps are being used or tosend personalized push notifications. To do this, they record uniqueidentifiers associated with your device, like your device ID, IP address,in-app activity, and network location.
All these tracking technologies are referred to as “cookies”here in this Cookie Statement.
How are cookies used?
Cookies are used to collect info, including:
IP address
Device ID
Viewed pages
Browser type
Browsing info
Operating system
Internet service provider
Timestamp
Whether you have responded to an advertisement
A referral URL
Features used or activities engaged in on the website/apps
They allow you to be recognized as the same user across thepages of a website, devices, between websites, or when you use our apps. Whenit comes to purpose, they’re divided into three categories: Functional cookies,analytical cookies, and marketing cookies.
Functional cookies
These are cookies required for our websites and apps tofunction and must be enabled for you to use our services.
Functional cookies are used to create technologicallyadvanced, user-friendly websites and apps that adapt automatically to yourneeds and preferences, so you can browse and book easily. This also includesenabling essential security and accessibility features.
More specifically, these cookies:
Enable our website and apps to work properly, so you cancreate an account, sign in, and manage your bookings.
Remember your selected currency and language settings, pastsearches, and other preferences to help you use our website and appsefficiently and effectively.
Remember your registration info so you don’t have to retypeyour log-in credentials each time you visit our website or app. (Don’t worry,passwords are always encrypted.)
Analytical cookies
These cookies measure and track how our website and apps areused. We use this info to improve our website, apps, and services.
More specifically, these cookies:
Help us understand how visitors and customers like you use Xullu.comand our apps.
Help improve our website, apps, and communications to makesure we're interesting and relevant.
Allow us to find out what does and doesn't work on ourwebsite and apps.
Help us understand the effectiveness of advertisements andcommunications.
Teach us how users interact with our website or apps afterthey’re shown an online ad, including ads on third-party websites.
Enable our business partners to learn whether their customersmake use of any accommodation offers integrated into their websites.
The data we gather through these cookies can include whichweb pages you’ve viewed, which referral/exit pages you’ve entered and leftfrom, which platform type you’ve used, which emails you’ve opened and actedupon, and date and timestamp info. It also means we can use details about howyou’ve interacted with the site or app, such as the number of clicks you makeon a given screen, your mouse and scrolling activity, the search words you use,and the text you enter various fields.
Marketing cookies
These cookies are used by Xullu.com and our trusted partnersto gather info about you over time, across multiple websites, applications, orother platforms.
Marketing cookies help us to decide which products,services, and interest-based ads to show you, both on and off our website andapps.
More specifically, these cookies:
Categorize you into a certain interest profile, for example,based on the websites you visit and your click behavior. We use these profilesto display personalized content (e.g. travel ideas or specific accommodation)on Xullu.com and other websites.
Display personalized and interest-based ads both on the Xullu.comwebsite, our apps, and other websites. This is called “retargeting” and isbased on your browsing activities, such as the destinations you’ve searchedfor, the accommodations you’ve viewed, and the prices you’ve been shown. It canalso be based on your shopping habits or other online activities.
Retargeting ads can be shown to you both before and afteryou leave Xullu.com since their aim is to encourage you to browse or return toour website. You might see these ads on websites, apps, or in emails.
Integrate social media into our website and apps. Thisallows you to like or share content or products on social media such asFacebook, Instagram, YouTube, Twitter, Pinterest, Snapchat, and LinkedIn.
These “like” and “share” buttons work using pieces of code fromthe individual social media providers, allowing third-party cookies to beplaced on your device.
These cookies can be purely functional but can also be usedto keep track of which websites you visit from their network, to build aprofile of your online browsing behavior, and to show you personalized ads.This profile will be partly built using comparable info the providers receivefrom your visits to other websites in their network.
To read more about what social media providers do with yourpersonal data, take a look at their cookie and/or privacy statements: Facebook(includes Instagram, Messenger, and Audience Network), Snapchat, Pinterest, andTwitter. Be aware that these statements may be updated from time to time.
We work with trusted third parties to collect data. We mayoccasionally share info with these third parties, such as your email address orphone number. These third parties might link your data to other info theycollect to create custom audiences or deliver targeted ads. For info about howthese third parties process your data, look at the following links: How Googleuses information, Facebook's data policy.
Non-cookie techniques – email pixels
We may also use techniques like pixels, which we don’t markas cookies because they don’t store any info on your device.
We sometimes place pixels in emails like newsletters. A“pixel” is an electronic file the size of a single pixel that’s placed in theemail and loaded when you open it. By using email pixels, we can see if themessage was delivered, if and when you read it, and what you click.
We also receive this info about the push notifications wesend you. These statistics provide us with feedback about your readingbehavior, which we use to optimize our messages, and make our communicationsmore relevant to you.
What are your choices?
To learn more about cookies and how to manage or deletethem, visit Allaboutcookies.org or the help section of your browser.
Under the settings for browsers like Internet Explorer,Safari, Firefox, or Chrome, you can choose which cookies to accept and reject.Where you find these settings depends on the browser you use:
Cookie settings in Chrome
Cookie settings in Firefox
Cookie settings in Internet Explorer
Cookie settings in Safari
If you choose to block certain functional cookies, you maynot be able to use some features of our services.
In addition to specific settings that we may offer on Xullu.comand apps, you can also opt out of certain cookies:
Analytics
To prevent Google Analytics from collecting analytical dataon certain browser types visit the following link: Google Analytics Opt-outBrowser Add-on (only available on desktop).
Advertising
We always aim to work with advertising and marketingcompanies that are members of the Network Advertising Initiative (NAI) and/orthe Interactive Advertising Bureau (IAB).
Members of the NAI and IAB adhere to industry standards andcodes of conduct and allow you to opt out of behavioral advertising.
Visit www.networkadvertising.org to identify NAI membersthat may have placed advertising cookies on your computer. To opt out of anyNAI member's behavioral advertising program, just check the box thatcorresponds to that company.
You may also want to visit www.youronlinechoices.com orwww.youradchoices.com to learn how to opt out of customized ads.
Your mobile device may allow you to limit the sharing ofinfo for retargeting purposes through its settings. If you choose to do so,remember that opting out of an online advertising network doesn't mean you’llno longer see or be subject to online advertising or marketing analysis. Itjust means the network you opted out of won't deliver ads customized to yourweb preferences and browsing patterns anymore.
Some websites have “Do Not Track” features that allow you totell a website not to track you. We’re currently unable to support “Do NotTrack” browser settings.
How to contact us
If you have any questions about this cookie statement, write us at agent@xullu.com.
Our cookie statement may also be updated from time to time. If these updates are substantial, particularly relevant to you, or impact your data protection rights, we’ll get in touch with you about them. However, we recommend visiting this page regularly to stay up to date with any other (less substantial or relevant) updates.
