Privacy Policy

Last updated: 17.02.2026

Omio Corp., a Delaware corporation with its operational headquarters located at Warschauer Platz 12, 10245 Berlin, Germany, together with its subsidiaries and corporate affiliates as detailed hereafter (“we,” “us,” “our,” or “Omio”) respect Your right to privacy and we take our responsibility to safeguard Your private information very seriously. Omio Corp. is the operator of the Omio websites (collectively, our “Service Sites”), and the Omio mobile applications (collectively, the “App”), both off which provide search and booking functionality (the “Omio Services’). Omio Corp. is the data ‘controller,’ as defined by the General Data Protection Regulation (“GDPR”) and other relevant privacy laws. You can contact us via the Help Center, and our data protection officer at [email protected]. If the Service Sites or the App connect you with third-party online services, you should carefully review the privacy policies of such third-party sites as they are not governed by our Privacy Policy.

We want to inform you about the way we collect and process Your personal data in accordance with the GDPR and the German Federal Data Protection Act (BDSG) and other applicable privacy laws.

The terms “personal data,” “sensitive personal data,” “special categories of data,” “data subject,” “processing,” “data controllers,” “processors,” “independent controller” and “controller” have the meanings assigned by the applicable legislation.

1.1 Automatically generated website visitor information

We collect information and data that is automatically transmitted or generated by Your browser each time you visit our website. Such information includes the IP address, the URLs of the site you visited before accessing our Service Sites (“referrer”), the browser used, the browser language, the operating system and user interface, the access device used, date and time of Your access, the pages viewed on our website, and the time you spend on the Service Sites. Such data is stored for a period of two years and deleted automatically thereafter. We may use this information to investigate errors, to improve the stability and functionality of the Service Sites and the App, and to assist you in completing any interrupted bookings.

1.2 Data provided by you / user accounts

Furthermore, we also collect and use the information you provide to us about Yourself, Your travel companions, and about the planning of Your trip by using the Service Sites or the App:

a) When you register on the Service Websites or the App, we request the following data: Personal data: Your name, Your email address, phone number, government-issued identification numbers, emergency contact information, billing address, payment method or credit card information, Your preferred travel connection and – where applicable – information about Your loyalty, bonus or discount cards (e.g. mileage or frequent-flyer programs, railway customer cards).

b) When you book a travel product through our Service Sites, we ask you to provide Personal Data, e.g. Your name, Your email address, phone number, government-issued identification numbers, emergency contact information, billing address, payment method or credit card information, Your preferred travel connection and – where applicable – information about Your loyalty, bonus or discount cards (e.g. mileage or frequent-flyer programs, railway customer cards). We will ask you for the data that the respective transportation provider requires to complete the booking process. Our forms show what kind of data is required for each respective booking. We cannot process Your booking without provision of the required data. Credit card information will be immediately passed on to the respective payment provider. We only store truncated credit card data (e.g. “511111******1111”) for reporting purposes and fraud analysis. When you make a booking for someone else (e.g. Your travel companion) through the Service Sites or the App, we will request Personal Data about such companion or such business. You should obtain the consent of all such individuals before providing their information to us, as those individuals may not be able to independently view their information themselves if it is provided to us under Your account. Additionally, you should obtain consent from your travel companions before opting-in to an ancillary service, such as travel insurance. When you opt-in to these services on behalf of yourself and/or your travel companions, each passenger’s data may be shared with the ancillary service provider on the basis of your consent. For more information, see Section 3.3. To the extent that Your companion(s) may need to amend or delete their information, they can reach out to us using [email protected].

c) Should you opt to additionally register for a personal profile with Omio by creating a user account, this data will be stored with us for Your future bookings.

d) If you contact us or our customer support (e.g. by email, telephone or contact form on the Service Sites), we use the data you provided (usually Your contact information and Your inquiry) to respond.

e) Call recording: When you make calls to our customer service team, you may be required to confirm that you have an existing reservation with us. Calls to our customer service team may be recorded for quality control and training purposes, which includes using the recordings to process claims and for fraud detection purposes. You can opt-out from the call recording at any time during Your conversation with our customer service team by notifying one of our agents.

f) We may invite you to take part in surveys from time to time. These surveys may help us conduct market research, analyze how to improve Your experience on the Service Sites and the App, and improve the functionality and quality of our Products. We will collect the data provided by you when you submit any such survey responses.

g) As a general rule, we do not process sensitive Personal Data or special categories of data, as defined by the applicable legislation, of users subject to this Policy. However, if it is exceptionally necessary to process such sensitive Personal Data or special categories of data to achieve the purposes described in this Policy, or as per its subsequent updates, Omio will ensure that this activity occurs in compliance with the applicable legal limitations and with appropriate safeguards.

1.3 How do we store Personal Data?

We will retain Personal Data collected from you for as long as we have an existing legitimate purpose to do so (such as the purposes set out in paragraphs a) to e) above). In some cases, We may retain Your Personal Data for longer periods, in order to comply with statutory obligations. These include fraud investigations, tax and accounting obligations, or other legal purposes in line with applicable laws.

We determine the appropriate retention period for Personal Data based on the following;

• The purpose for which we process the Personal Data,
• The nature, and sensitivity of Your Personal Data processed,
• The potential risk of harm from unauthorized use or disclosure of Your Personal Data, and
• Any applicable legal requirements (such as statutes of limitation).

Once the legitimate business purpose or legal obligation no longer exists, We will either delete or anonymize Your Personal Data.

1.4 What are Your rights regarding Your Personal Data and how can you exercise them?

In addition, We’d like to remind You that You may have rights in relation to Your Personal Data under applicable law, based on your country of residence. These may include;

• the right to data deletion,
• the right to access Your personal data,
• the right to data portability,
• the right to rectification of Your data, and
• the right to object to processing, amongst others.

You can exercise these rights at any time, subject to any statutory obligations or legal limitations that may apply, by contacting our Data Protection Team at [email protected], or by submitting a request via our Help Centre. Please note that in some cases, Omio may not be obligated to comply with Your request - for instance, where we are required by law to retain certain data, or where the data is necessary to fulfil an upcoming booking you have made with us.

1.5 Personal data belonging to minors

The Service Sites and App are intended to be used by adults only. We do not knowingly collect Personal Data from children under the age of 13. In the event that we have knowledge that a child under the age of 13 has submitted any Personal Data to us via the Services Sites or the App, we may use the email address or other contact information provided by the child for the sole purpose of responding to the child’s question or carrying out his or her request on a one-time-only basis. We will not use the email address provided by such child for any other purpose, and we will delete such information from our records once their question has been answered or the request has been fulfilled. If we become aware that we have unknowingly collected personal contact information other than an email address from a child under the age of 13, we will delete the information immediately.

1.6 Data collected via Facebook Connect

It may also be possible to log into our Service Sites using Facebook Connect. Doing so will not require you to register a separate user account with us. Instead, you may log in using Your existing Facebook account. In the process, Facebook transmits certain pieces of Your Personal Data to us. Facebook will inform you, during such registration process, about the data to be transmitted (“Facebook Data”). You will be given the explicit opportunity to consent or to refuse to the transmission of such Facebook Data. Facebook will not transmit any of Your personal Facebook Data to us without Your express permission. We will then be able to see Your Facebook username and Your public Facebook profile. We may use this Facebook Data solely for the purposes detailed in this Privacy Policy, or for purposes that we explain to you at the time we collect Your Personal Data. Conversely, Facebook will be able to see whether and when you log into our site using Facebook Connect.

You can stop using Facebook Connect login to the Service Sites at any time and, if desired, create Your own user profile account with us. Note that you can opt to use our Service Sites without creating a user account at all.

1.7. Data collection for the purpose of newsletters and marketing emails

1.7.1 Marketing emails based on consent

If you opt in to receive marketing emails, we will send you marketing emails, including information about Omio, together with promotions for offers and services whether provided by us or third-parties (e.g. travel, accommodation), on the basis of Your consent to receive marketing emails from Omio. You can unsubscribe at any time by pressing the ‘unsubscribe’ button at the footer of each marketing email. If you unsubscribe, and you have an upcoming booking with Omio, you will continue to receive transactional emails related to Your booking.

1.7.2 Marketing emails based on soft opt-in

If you make a purchase with Omio, we may send you marketing emails, including information about Omio, promotions for offers and services provided by us, for as long as you continue to use the Omio Services, and for up to 24 months after you stop using them, on the basis of Article 7(3) Gesetz gegen den unlauteren Wettbewerb. You have the option to opt-out of marketing communications at the footer of each marketing email. If you unsubscribe, and you have an upcoming booking with Omio, you will continue to receive transactional emails related to Your booking.

1.8 Data collected by cookies, web beacons and similar technology

Like most other website operators, we use cookies, web beacons, and similar technology (collectively “Tracking Facilities”) when you visit or use our Service Sites.

Cookies are small text files that are stored by Your browser on Your computer or mobile device and which allow re-identification of Your computer or mobile device, potentially across numerous websites, including the Service Sites. Some of the cookies we use are automatically deleted upon expiry of Your session, that is, when you close Your browser (these are referred to as session cookies). Other cookies remain stored on Your device and allow us, or our business partners, to recognize Your browser during subsequent visits (persistent cookies).

Our use of Tracking Facilities allows us to collect information about our users in order to provide simpler and more convenient access to our Service Sites, or to enable us to provide certain services at all.

We use Tracking Facilities for the following purposes:

• To save Your user settings such as language and currency while on using the Service Sites, and between visits.
• To store Your login status as a registered user (optional), so you do not have to log in again when returning to the Service Sites later.
• For the technical assignment of Your visit to certain servers to ensure a safe transition between pages and search queries.
• To monitor the performance of our systems (no user-based evaluation of data).
• Service providers for website analysis, retargeting, and conversion tracking may also use Tracking Facilities (see below).
• To recognise when you are forwarded to Omio from one of our loyalty programme affiliate partners, so that you can receive Your loyalty points with the relevant affiliate partner after making a purchase with us.

If you click a link on the Service Sites that takes you to the website of a provider (for example when making a booking or to buy a ticket), it is possible that such other websites also store cookies on Your computer. We have no control over these providers’ cookies and the data collected in this way and we cannot accept any responsibility for our providers’ websites or their tracking practices. We encourage you to carefully review the privacy policies of any website that you visit.

1.8.1 How do we use cookies?

We use different categories of cookies for different purposes (see below)

Category: Necessary for Use

We use strictly necessary cookies that are essential for the main features of the website to function correctly, and for You to browse the website properly. Therefore, the use of this type of cookie does not depend on Your consent. If you visit the Omio website through a link provided by one of our loyalty programme partners, you indicate Your desire to receive points from that loyalty programme after making a booking with us. We use necessary cookies to let the provider know that you made a purchase through the link on their site, so that the provider can grant you Your loyalty points after making a booking.

Category: Infrastructure

Purpose: Infrastructure cookies are first-party cookies that are necessary for you to browse the website properly and use its core features. They are essential for Us to provide You with the Omio Services, such as using our platform to search and book travel services.

Category: Security

Purpose: Security cookies are necessary to ensure an adequate level of security of our website such as user authentication for secure payment and fraud prevention. These may include third-party cookies, e.g. security cookies from the payment provider You selected when You are redirected to the payment page.

Category: Functionalities

Purpose: Core functionality cookies are necessary to ensure the proper functioning of our website and its essential features, such as travel service bookings and ticket issuance. These may include third-party cookies from our transportation providers when you are redirected to their website to finalize Your booking.

Non-necessary cookies: We also use cookies and similar technologies that help us understand how you use our website and to improve Your user experience. As such they may include third-party cookies for marketing and personalization purposes. These cookies will be stored in Your browser only with Your consent. You can choose to reject such cookies under "Settings", which might affect Your experience with our website.

Category: Performance and Statistics

Purpose: Performance & Statistics cookies are used to help understand personal and statistical use of our website to improve Your user experience. As such they may include third-party cookies and similar technologies like analytics services. It allows us to gain important insights about the use of our websites and how different settings affect Your user experience.

Category: Marketing

Purpose: Marketing cookies are used to assist our marketing efforts and improve online advertising performance. They allow us to track Your online activity in order to place personalized and relevant advertisements from third-party Ads partners. We may upload Your user identifiers received from these cookies to our Ads partner platform such as Facebook, Google and others to help improve the personalization of the advertisements.

1.9 Retargeting

Our Service Sites may use what are known as retargeting tags for presentation of interest-related advertising on third-party websites.

A retargeting tag is the name for a JavaScript element that is placed in our Service Site’s source code. If you visit a page on our Service Site that contains a retargeting tag, a provider of online advertising services (each a “Retargeting Provider”, e.g. Google, Facebook, etc.) places a cookie on Your computer and allocates it to the corresponding retargeting target group lists. The Retargeting Provider uses the cookie to gather data related to Your interests (e.g. the pages visited on the Service Sites or search queries), using pseudonymous identifies. Based on that information, the Retargeting Provider displays interest-based ads on third-party websites. No directly personally identifying data is stored or transmitted, and the usage profiles will not be merged with Your Personal Data. However, the Retargeting Provider can potentially identify you and track Your visits on our website, in particular, if you are a registered user of the particular Retargeting Provider (e.g. if you have a Google or Facebook account).

To learn more about this type of targeted advertising and Your options for preventing it, follow this link: Youronlinechoices.com

If you are a resident in Canada, you can follow this link: https://Youradchoices.ca/

You can object to usage-based online advertising by all or some providers on the same website. To access the preferences manager, click here: http://www.Youronlinechoices.com/de/praferenzmanagement

If you are a resident in Canada, you can click here: http://optout.aboutads.info/?c=3&lang=en

You can also prevent data transfer to all retargeting providers by Omio at any time by clicking the following link:

If you click the link above, we will set a persistent cookie that allows us to recognize and observe Your opt-out upon later visits to the Service Sites. Please note that it must be re-set when you delete all cookies in Your browser. Opt-out cookies prevent tracking when you visit the Service Sites with a specific device, browser and domain. To prevent cookies on different devices or browsers, you must set the opt-out cookie by clicking the opt-out button on all devices/browsers. The same applies if you visit the Service Sites under different top-level domains (e.g. Omio.com / Omio.de or omio.com / omio.it). To prevent tracking in the App, please use the App’s opt-out function (see below).

1.10 Conversion tracking

We use advertising partners to advertise our offers on third-party websites. We also use marketing tools to determine the success of our advertising measures (“Conversion Tracking”). We intend to show you advertising relevant to Your interests, to optimize our website, and to achieve a fair calculation of advertising costs.

To that end our advertising partners use cookies and web beacons (see above) to measure certain parameters related to the success of an advertising campaign, e.g. display of an ad or user clicks. The cookies are not intended to personally identify you. For the lifetime of the cookie the advertising partner can identify Your clicks on an ad and Your redirection to a certain landing page (e.g. form input, confirmation page, newsletter subscription). Based on this information, the advertising partner generates conversion statistics. These statistics show e.g. the number of users that have clicked on one of our ads. In addition, the statistics show the number of users that have reached a certain target page that has been marked with a “conversion tag” (remarketing tag, see above). The statistics do not include data that allows us to personally identify you.

We do not collect or use Personal Data in the advertising campaigns ourselves. Our advertising partners only provide us with statistical data, which allows us to identify effective advertising campaigns. We do not receive additional data, in particular no data that would allow us to identify our users.

Due to the Conversion Tracking tools, Your browser automatically connects to the server of the advertising partners. We have no influence on the scope and further use of data collected by the Conversion Tracking tools of our advertising partners. The advertising partners receive the information that you have visited certain pages on the Service Sites or clicked on one of our ads. If you are a registered user of the advertising partner (e.g. if you have a Google or Facebook account), the advertising partner can relate Your visits to such account data. Even if you are not a registered user with the advertising partner, or are not logged into Your account, the advertising partner may collect and store Your IP address.

We use Conversion Tracking with the following advertising partners:

To learn more about this type of targeted advertising and Your options for preventing it, follow this link: Youronlinechoices.com

If you are a resident in Canada, you can follow this link: https://Youradchoices.ca/

You can object to usage-based online advertising by all or some providers on the same website. To access the preferences manager, click here: http://www.Youronlinechoices.com/de/praferenzmanagement

If you are a resident in Canada, you can follow this link: http://optout.aboutads.info/?c=3&lang=en

You can also prevent data transfer to all retargeting providers by Omio at any time by clicking the following link:

If you click the link above, we will set a persistent cookie that allows us to recognize and observe Your opt-out upon later visits to the Service Sites. Please note that it must be re-set when you delete all cookies in Your browser. Opt-out cookies prevent tracking when you visit our website with a specific device, browser and domain. To prevent cookies on different devices or browsers, you must set the opt-out cookie by clicking the opt-out button on all devices/browsers. The same applies if you visit our website under different top-level domains (e.g. Omio.com / Omio.de or omio.com / omio.it). To prevent tracking in the App, please use the App’s opt-out function (see below).

1.11 Web analytics and statistics

The Service Sites use Google Analytics, a web analytics service provided by Google LLC. (“Google”). Google uses cookies (see above), which are stored on the user’s computer and allow us to analyze the use of the Service Sites. The information generated by the cookie about the use, including the user’s current, but truncated EU IP addresses are transmitted to a Google server in the USA and stored there. Since we have activated IP anonymization, Your IP address will be truncated by Google within a European Union member state or a member state of the European Economic Area before transmission to the USA. Only in exceptional circumstances will the full IP address be transferred from the EU and truncated in the USA. Google will use this information on our behalf to evaluate the use of the Service Sites, compiling reports on the activities of users of the Omio Services, and to provide other services associated with internet use. In addition, Google may also transfer this information to third-parties if required to do so by law or where such third-parties process the information on Google’s behalf. The IP address sent by Your browser to Google Analytics will not be merged with other Google data.

You can prevent the installation of cookies by changing the settings of Your browser. Please note, however, that this may prevent some of our services’ feature from working correctly. Alternatively, you can prevent the collection of cookie data and Your website usage data (including Your IP address) by Google and the processing of such data by Google by downloading and installing a browser plugin available at: http://tools.google.com/dlpage/gaoptout.

In addition, you can disable data processing by Google Analytics by clicking on the following link:
Deactivate Google Analytics

This sets an opt-out cookie that prevents the future collection of Your data when visiting the Service Sites. Please note that it must be reset when you delete all cookies in Your browser.

This website utilizes Google Analytics with the extension “_anonymizeIP()”. This extension ensures the processing of truncated IP addresses, so that no direct personal identification via IP addresses is possible.

Personal data associated with cookies, user identifiers (e.g., User-ID) and advertising identifiers (e.g., DoubleClick cookies, Android’s Advertising ID, Apple’s Identifier for Advertisers) will be deleted automatically after 14 months.

Use of Google Analytics is in accordance with the requirements agreed between the German data protection authorities and Google. Please find additional information here: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

Usage terms: http://www.google.com/analytics/terms/de.html,

Privacy policy:  http://www.google.de/intl/de/policies/privacy.

Google has incorporated the EU Standard Contractual Clauses, https://policies.google.com/privacy/frameworks?hl=en-US.

The Service Sites also use Amplitude, Inc., 2918 Gilmerton Ave Los Angeles, CA, 90064-4508 United States to analyze customer interactions and improve our digital products and marketing performance. Amplitude acts a data processor, and processes Personal Data such as IP addresses, device identifiers, and usage events on our behalf to generate aggregated analytics. This processing is based on Omio’s legitimate interest in optimizing services, and where required, your consent for analytics cookies.

1.12 Data collected by Social Plugins

The Service Sites use what are referred to as social plugins by the following social media providers:

We use the so-called 2-click solution. If you visit the Service Sites, no Personal Data is transferred to the plugin provider. You can recognize the plugin provider by the label or logo on the button. We permit you to communicate directly with the plugin provider via the button.

Only if you click the button and activate the plugin, the plugin provider receives the information that you have visited the respective page of the Service Sites. In addition, the information mentioned under Sec. 1 above is transferred by Your browser to the plugin provider. If you have an account with the plugin provider, and are logged in, the provider may relate Your visit to the Service Sites and Your additional interaction with the social plugin (e.g. clicking on the “Like” button) to Your user account (e.g. Your Facebook account).

We have no influence on the data collected and processed by the plugin provider, nor do we know the full extent of the data processing, purposes, retention terms and deletion of data by the plugin provider. Please find additional information regarding data processing by the plugin provider in their respective privacy policies linked above. These policies also include information regarding Your rights and privacy-related configuration options.

1.13 Omio.AI

The Omio.AI service is designed to operate without the need to process any personal data. It is not required to include Personal Data in prompts in order to use the service. Personal data required for booking purposes may be entered at a later stage only when Omio.AI has referred You to the booking page, or has referred You to the booking page, or may be filled automatically if your details are saved in your Omio account. This information is handled as usual in line with this Privacy Policy. We therefore request that You refrain from submitting any Personal Data when conversing withOmio.AI.

1.14 Data Breaches

In the unlikely event of any unauthorized access or acquisition of Your Personal Data, or if we experience a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Your Personal Data, where such breach poses a significant risk of harm to Your rights and freedoms, we will promptly notify you without undue delay and, where feasible, not later than 72 hours after having become aware of it. In such case, we will also inform governmental authorities of such breach as required by applicable law.

The Omio applications (collectively referred to as the “App”) are alternative ways to access offers and services provided by Omio. The App records, processes and utilizes data in the same way as the Service Sites, for the same purposes and on the same legal basis. The contents of this section of the Privacy Policy apply specifically to the App..

2.1 Additional use of App-specific data

When using the App, Omio can access additional data relating to the App and Your mobile device, e.g. the device name, device manufacturer, model, operating system version, App version or SDK (software development kit) version and the device number (IMEI), advertising identifiers (e.g. Android’s Advertising ID, Apple’s Identifier for Advertisers). If you are using an Android device, the App can also detect what Google services you have subscribed to and can prevent Your device from going into standby while the App is running.

The App, for both Android and iOS, requires Your permission in order to function properly. Once you grant such permission, the App may record Your device’s geolocation to use it for processing Your query (e.g., filling in Your location in the search form, to provide location-based services, or to suggest relevant content based on Your location). Your location data is transmitted through an encrypted connection. If you use GPS (global positioning system), the App will detect Your precise location. The data is used to fill in the search form and will not be stored otherwise. You may use Your device’s settings menu to disable location data collection at any time.

2.2 Statistics and analytics

We use data analytics services to create statistics and analytics regarding Your use of the App, the Service Sites, and our services. Data analytics services also assist when transitioning to our partner’s websites or services. We use the IP address and device identifier of Your mobile device for such purposes. In addition, we may use such information to create cross-device, pseudonymous usage profiles (“cross-device-tracking”). You can disable the analytics functionality at any time in the App preferences.

In our apps, we use "Google Analytics" and “Firebase Analytics” as analytics services provided by Google LLC. (“Google”). Google provides SDKs, which are stored on the user's device and allow us to analyze their use of the App. The information generated by the SDKs about such use, including the user’s current, but truncated IP address, are transmitted to a Google server in the USA and stored there. Since we have activated IP anonymization, Your IP address, if collected in the EU, will be truncated by Google within a European Union member state or a member state of the European Economic Area before transmission to the USA. Only in exceptional circumstances will the full IP address be transferred and truncated in the USA. Google will use this information on our behalf to evaluate the use of the App, compile reports on the activities of users of our services, and to provide other services associated with internet use. In addition, Google may also transfer this information to third-parties if required to do so by law or where such third-parties process the information on Google's behalf. The IP address sent by Your App to Google Analytics or Firebase will not be merged with other Google data.

If you are using the App, you can disable data processing by Google Analytics or by Firebase by using the switch at the bottom of this page.

This App utilizes Google Analytics with the extension “_anonymizeIP()”. This ensures processing of truncated IP addresses, so that no direct personal identification via IP addresses is possible.

Please find additional information regarding Google Analytics here:

Usage terms: http://www.google.com/analytics/terms/de.html,

Privacy policy: http://www.google.de/intl/de/policies/privacy

Google has incorporated the EU Standard Contractual Clauses https://policies.google.com/privacy/frameworks?hl=en-US.

2.3 Push messages

If you have configured Your mobile device accordingly, the App may send you push messages, e.g. to provide updates on Omio, status updates, marketing campaigns and other news, or to notify you of new services, products, and features. Push messages may also include advertising for Omio or third-party offers (e.g. travel, accommodation).

You can withdraw Your consent to receive marketing push messages at any time, free of charge, by disabling marketing push messages in the App settings or by deactivating push messages in Your device’s operating system preferences.

We use Braze (114 Sansome St Suite 1200, San Francisco, CA 9410\) to send newsletters and push notifications based on Your searches. You can find more information regarding data processing by Braze and Your rights and options regarding protecting Your Personal Data here: https://www.braze.com/privacy/

2.4 Retargeting

You can find more information about retargeting above (Sec. 1.9).

We use the following retargeting and attribution providers:

If you are using the App, you can prevent data transfer to all retargeting providers at any time by using the switch at the bottom of this page.

When clicking the opt-out switch at the bottom of this page, we will disable the SDKs that allow us to recognize you. Your opt-out will take effect upon Your first subsequent use our App (i.e., after you restart the App). The opt-out switch prevents tracking when you use the App. To prevent tracking or retargeting on the Service Sites, you must set the opt-out cookie by clicking the opt-out button in Your browser settings.

3.1 Data processing by Our subsidiaries

Omio Corp. employs Omio Travel GmbH and Omio Services GmbH, (Warschauer Platz 12, 10245 Berlin, Germany) as a service provider to, among other things, operate computer systems, handle order processing and perform customer service. We may share Your information with, and among, our affiliated in order to enhance the products and services that we provide. To the extent that affiliates have access to Your information, they will follow practices that are at least as restrictive as the practices set forth in this Privacy Policy.

Omio Travel GmbH and Omio Services GmbH are subsidiaries of Omio Corp. Your Personal Data will be forwarded to Omio Travel GmbH and/or Omio Services GmbH or collected directly by Omio Travel GmbH and/or Omio Services GmbH on behalf of Omio Corp. Omio Travel GmbH and Omio Services GmbH will process Your data solely in compliance with this Privacy Policy and only for the purposes of performing services for Omio Corp., for running the Service Sites, the App, related platforms and providing associated services. This privacy information therefore applies to data processing by Omio Travel GmbH and Omio Services GmbH as well. You can contact our data protection officer at [email protected].

We contractually oblige Omio Travel GmbH and Omio Services GmbH to observe the provisions of this privacy information, to process Your data for the aforementioned purposes only and to observe all applicable data protection and data security law and regulations.

3.2 Data transmission to travel service providers

3.2.1 Travel service providers

When you make a booking on the Service Sites or the App, we will transmit any Personal Data (including loyalty program membership information) required to execute such booking to the respective travel service provider (e.g. airline, railway or coach operator, or accommodation providers such as hotels) so that the travel service provider can process Your booking and/ or produce any personalized tickets or vouchers that may be required. Such a third-party will then process Your Personal Data under its own responsibility and in accordance with its own privacy policies. We therefore strongly recommend that you carefully review the Privacy Policy for each such travel service provider prior to making Your booking. We will also share Personal Data with our travel service providers for the purposes of fraud investigations.

Bookings may be handled by our subsidiary, Omio Voyages SAS. In such cases, we transmit the required data to Omio Voyages SAS, which processes the data on our behalf and only for the purposes of completing the booking process. Bookings for certain countries may be handled by our partner Amadeus IT Group SA (Salvador de Madariaga 1, Madrid, 28027, Spain) and its affiliates. For such bookings, we may transmit Your booking data to Amadeus, which processes the data under its own responsibility according to their data protection policy which we highly recommend you to carefully review on their website before making any such booking (see link here). Accommodation bookings may be handled by our subsidiary, Omio Travel GmbH. In such cases, we transmit the required data to Omio Travel GmbH, which processes the data on our behalf and only for the purposes of completing the booking process.

This data transfer requires that Your explicit consent is given for each booking process, pursuant to Art. 6(1)(a) GDPR.

To the extent that we participate in a corporate transaction, divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy, we will inform the buyer that it shall only use Your Personal Data for the purposes disclosed in this Privacy Policy. From time to time, we may also share aggregate or anonymous information with third-parties, including advertisers and investors. For example, we may tell our investors the number of visitors that the Service Sites receive on a monthly basis, or we may tell advertisers where the most popular travel destinations are each month.

3.2.2 Payment providers

The payment details (credit card information) for bookings made directly on the Service Sites or through the App are processed by a trusted internet payment processor, who will transmit Your data directly to the relevant credit card company.

In order to ensure that the credit card is being used by its legitimate owner, and to prevent cases of online fraud, encrypted credit card information is transferred to an external payment security service for auditing purposes. This transfer may also include additional Personal Data.

Your credit card data is processed by trusted and reliable internet payment processors. Your credit card details are encrypted (usually using the SSL protocol) before transmission to the payment processor. Your credit card data will not be disclosed to us by the payment processors.

3.2.3 Accommodation providers

In addition, the basic information of Your query (such as destination and travel time) will be forwarded to the accommodation service providers displayed in the search window (e.g. Booking.com or Airbnb) \- but only if you have explicitly included the respective service provider in the search query by selecting a checkbox. The service provider will then present you with non-binding offers matching Your search query in a new window or tab. A transfer of Personal Data (except for the IP address) does not take place on our side.

3.3 Ancillary Service Providers

Should you opt-in to receive an offer from Omio’s third-party ancillary service providers (such as insurance providers, or other travel-related service partners), on the basis of your consent, we will provide the following Personal Data to the relevant provider in order for them to deliver the selected service in connection with your journey:

• Name
• Email
• Other personal data categories as necessary

Omio and our ancillary service providers act as independent controllers. For more information on how your data is handled by the relevant provider, including information on how to exercise your rights as a data subject, please consult their privacy policy.

3.4 Other service providers

We may use third party service providers, in particular for technical and business services, tax advisors and legal counsel. This may include hosting providers, including a content delivery network to cache and provide content, statistics and analytics, providers to handle service desk and support data, provision of CRM systems, sending of newsletters/mailings, spam and fraud prevention, IT service and development providers.

In particular, we use third-party tracking tools to monitor how automated systems (including artificial intelligence tools) crawl, interpret, and index our website. For this purpose, limited technical information such as your IP address, the URL path requested (including unique identifiers), and your browser’s User Agent string may be shared with AI Tracking Tools. This processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in protecting our content, ensuring proper website indexing, and maintaining the integrity of our digital services. Data is processed only for these purposes, subject to appropriate safeguards, and retained no longer than necessary.

These service providers receive Personal Data solely for the performance of their services for us on our behalf. They are contractually obliged not to use Personal Data for other purposes. Where these service providers are hosted outside of the European Union, additional measures such as the EU Standard Contractual Clauses are taken.

3.5 International transfers

Data processing may result in data transmission to recipients outside of the EU. The data transmission is then based on the EC model contracts http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm.

Personal information may be transferred to third-parties, such as transportation providers, located in non-EU countries, in which the travel is scheduled to take place. Omio cannot provide any further information on the level of data protection offered in non-EU countries. Neither an adequacy decision in accordance with Art. 45 para. 3 GDPR or appropriate safeguards in accordance with Art 46 GDPR are required for such data transfer as it is necessary:

International transfers may occur for the purposes of performance of a contract between you and Omio or the implementation of pre-contractual measures taken at Your request (Art. 49(1)(b) GDPR); or for the conclusion or performance of a contract concluded in Your interest between Omio and another natural or legal person (Art. 49(1)(c) GDPR).

We will only process Personal Data in ways that are compatible with the purposes outlined in this Privacy Policy (or those you later authorize). We process Your Personal Data for the following purposes and on the following legal basis:

4.1 Pursuant to Art. 6(1)(b) GDPR to enter into, perform, modify or terminate a contractual relationship with you, in particular:

• to enable Your access and use of the Service Sites and the App,
• to facilitate Your search queries and bookings,
• to perform our contractual obligations,
• to personalize Your ticket or booking and to contact you with regards to the booking process or Your user account, for example to send you travel documents,
• to facilitate Your account login on the Service Sites or the App (user account functionality), to recognize you as a user and spare you from re-entering Your data upon Your revisits to the Service Sites or the App.

4.2 Pursuant to Art. 6(1)(f) GDPR based on our legitimate interests,

• to improve the Service Sites, Apps and our other services and to adapt them to the needs of our users,
• to perform internal quality checks,
• to prevent, detect, process and investigate malfunctions, incidents, fraudulent or other illegal activities, whether of Omio or of our partners, or to mitigate the risk of occurrence of the aforementioned events,
• to ensure network and information security,
• to create statistics on access channels, the use the Service Sites and App and the frequency of transition to our partner’s websites and services,
• for internal accounting and invoicing purposes with the respective transportation providers, accommodation or other partners and service providers,
• to personalize the Service Sites, the App, and our offers,
• to display advertisements and special offers that may match Your interests (or reduce Your exposure to advertising and special offers which you may find uninteresting),
• for marketing purposes and to optimize our marketing measures, including via automated decision making, to determine which of our offers are best suited to you,
• to enable Your interaction with social networks and other users, in order to improve our offers and make it more interesting for our users, to contact you, if requested by you or as necessary to fulfil the contract or as otherwise permitted by law,
• for the purpose of business process outsourcing to affiliated companies,
• enforcing obligations owed to us, and contractual terms and conditions, accounting, risk management and record keeping.

When using Personal Data to serve the above-mentioned legitimate interests, we will always balance Your rights and interests in protecting Your Personal Data against the rights and interests of our company, our affiliates, and trusted third-parties.

4.3 Pursuant to Art. 6(1)(a) GDPR based on Your consent,

• to send you newsletter emails or other marketing push messages (see above),
• to transfer data for certain bookings to our partner Amadeus and to transfer Facebook Data (see above).

4.4 Pursuant to Art. 6(1)(c) GDPR to comply with legal obligations, e.g. to observe retention periods required by trade or tax law or to comply with obligations to disclose data based on a legally binding court decision or official order.

In addition to the right to revoke Your consent given to us, where applicable, you have the right to request access to (Art. 15 GDPR) and rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) of Personal Data or restriction of processing (Art. 18 GDPR), the right to object (Art. 21 GDPR) and the right to data portability (Art. 20 GDPR).

You have the right to object to all types of processing described in this Privacy Policy for information that are based on Art. 6(1)(f) GDPR, based on grounds relating to Your particular situation (Art. 21(1) GDPR).

To the extent we process Your Personal Data pursuant to Art. 6(1)(f) GDPR for direct marketing purposes, you can object to such processing at any time without giving a reason.

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent supervisory authority for Omio is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219, 10969 Berlin, Germany
Fax: +49 (0)30 2155050
E-Mail: [email protected]

Any inquiries, complaints or questions regarding this policy or Your personal ‎information should be addressed to our Data Protection Officer at the following email address: [email protected].

You opted out of tracking for advertising purposes. Click below to change that:

We may make changes or updates to this Privacy Policy from time to time or as required in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make, and in accordance with applicable law. You can see when this policy was last updated by viewing the “last updated’ date displayed at the top of this Privacy Policy.

6.1 Additional Information for Brazilian Residents:

This Brazil-Specific Privacy Addendum (“Brazil Addendum”) applies to all Omio customers and website visitors located in Brazil. It supplements the information provided in Omio’s Privacy Policy. In the event of any conflict between this Brazil Addendum and the main Privacy Policy, the terms of this Brazil Addendum shall prevail for users in Brazil.

Omio respects Your privacy and is committed to protecting Your Personal Data. We follow best practices and comply with applicable data protection laws and regulations, including the Brazilian General Data Protection Law (“Lei Geral de Proteção de Dados” or “LGPD”), Federal Law No. 13.709/2018, which came into force on September 18, 2020.

If you are a Brazilian resident and have questions, requests, or wish to exercise Your LGPD rights, please contact our Brazilian Data Protection Officer (DPO):

Email: [email protected].

ANPD Contact Page: https://www.gov.br/anpd

6.2 Your Rights

As a Brazilian Data Subject, what are Your rights under the LGPD (Lei Geral de Proteção de Dados)?

In addition to the rights described in Section 1.4 of this Privacy Policy, In accordance with Article 18 of the LGPD, as a Brazilian resident you may avail of the following rights:

a) Confirm whether we process Your Personal Data
b) Access the Personal Data we hold about you
c) Request correction of incomplete, inaccurate, or outdated data
d) Request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed unlawfully
e) Request the portability of data to another provider
f) Request deletion of data processed based on consent
g) Receive information about public and private entities with which we share Your Personal Data
h) Be informed about Your ability to withhold consent and the consequences of doing so
i) Revoke Your consent at any time
j) Request the review of decisions made solely through automated processing of Personal Data

You may exercise any of these rights by contacting our team at [email protected]. We may require reasonable proof of Your identity before processing Your request.

6.1.2 Legal Basis for Processing Personal Data

We process Your Personal Data based on the legal grounds established in Article 7 of the LGPD and described in Section 4 of this Privacy Policy.

6.1.3 International Data Transfers

When Your Personal Data is transferred outside Brazil, we adopt appropriate safeguards in accordance with LGPD including but not restricted to User Consent.

6.2 Additional Information for California Residents

This California-Specific Privacy Addendum (“California Addendum”) applies to all Omio customers and website visitors located in California. It supplements the information provided in Omio’s Privacy Policy. In the event of any conflict between this California Addendum and the main Privacy Policy, the terms of this California Addendum shall prevail for users in California.

Omio respects Your privacy and is committed to protecting Your Personal Data. We follow best practices and comply with applicable data protection laws and regulations, including the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), and other relevant California privacy laws. California law requires us to provide you with some additional information about how we collect, use, disclose, sell and “share” Your “personal information”, each as defined in CCPA. Omio will not rent or sell Your personal information to third-parties in exchange for money.

6.2.1 Personal information we collect, and how we use, disclose, and share such personal information.

Throughout this Privacy Policy, we discuss in detail the categories of personal information we collect from and about You, and if relevant, about Your travel companions. The CCPA also requires us to provide the information in the chart below.

We will retain Your personal information for as long as reasonably necessary to fulfill the purposes for which it is collected or to comply with applicable law, including as set forth throughout this Privacy Policy. Retention periods may vary depending on the type of personal information and the ways that we use it.

6.2.2 Opt out of sharing of personal information

To opt out of our use of Your personal information for purposes that are considered “sharing” for cross-context behavioral advertising purposes (as indicated in the chart above), you can visit this link. Please note that you must complete this opt-out on each browser or device you use to access the Service.

6.2.3 California Privacy Rights

California residents may have the following rights;

• The right to be informed about the types of personal information we collect or disclose about you; the types of sources of this information; the business or commercial purpose for collecting this information; and the categories of third parties to which we disclose this information (this information is provided in this Privacy Policy).
• The right to be provided access to and/ or a copy of certain personal information we hold about you.
• The right to correct or update personal information we hold about you.
• The right to deletion of certain personal information we have about you.

Certain information may be exempt from these requests under applicable law. For example, we need certain information in order to provide the Service to you or comply with applicable law. We may take reasonable steps to verify Your identity before responding to a request. Depending on the sensitivity of the information you are requesting and the type of request you are making, this may include verifying Your name and email address. If we cannot verify Your identity, we may be unable to respond to Your requests.

To exercise these rights, you can email us at [email protected]. You may be able to designate an authorized agent to make requests on Your behalf. For us to verify an authorized agent, you must provide the authorized agent with signed, written permission to make such requests or a power of attorney. We may verify Your identity directly with you before processing the authorized agent’s request, as permitted by applicable law.

In the limited circumstances that we process sensitive personal information as defined in the CCPA (e.g., log-in information and precise geolocation data), we only use or disclose it for disclosed and permitted business purposes.

6.2.4 “Shine the Light” disclosure

California Law allows customers who are California residents to request certain information once per year regarding our disclosure of “personal information” (as that term is defined under applicable California law) to third parties for such third parties’ direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

6.2.5 GPC

Omio recognizes and honors the Global Privacy Control (GPC) signal. When our systems detect a valid GPC signal from your browser or device, we treat it as a request to opt out of the sale or sharing of your personal data, where applicable under relevant data protection laws.

6.2.6 Do Not Track

California law requires us to let you know how we respond to web browser Do Not Track (DNT) signals. Because there currently isn’t an industry or legal standard for recognizing or honoring DNT signals, we don’t respond to them at this time. Do Not Track is a different mechanism that the legally recognized GPCS browser-based opt out preference signal mentioned above.

This Addendum (the “Covered Residents Addendum”), specific to residents (the “Covered Residents”) of Colorado, Connecticut, Oregon, Texas, Utah, and Virginia, and other U.S. states with similar consumer privacy laws (the “Covered States”) applies to all Omio customers and website visitors located in the aforementioned States. It supplements the information provided in Omio’s Privacy Policy. In the event of any conflict between this Covered Residents Addendum and the main Privacy Policy, the terms of this Covered Residents Addendum shall prevail for users in the Covered States.

The consumer privacy laws in the Covered States (“State Privacy Laws”) require us to provide you with some additional information about how we collect, use, disclose Your “personal data,” and how we use personal data for “targeted advertising” purposes, each as defined in State Privacy Laws.

Throughout this Privacy Policy, we discuss in detail the categories of personal data we collect from and about Covered Residents, and if relevant, about Your travel companions. For more detail about how we use, disclose, and use such personal data for targeted advertising purposes, please see the chart in Section 6.2.1 above.

Opt out of sale of personal data or use of personal data for targeted advertising.

To opt out of our use of Your personal data for purposes that are considered “targeted advertising” (as indicated in the chart above), Covered Residents can visit this link. Please note that you must complete this opt-out on each browser or device you use to access the Service. If you have a legally recognized browser-based opt out preference signal turned on through Your browser, we recognize the preference expressed by this signal in accordance with applicable law.

Your Privacy Rights

Covered Residents may have the right to ask us to:

• Confirm whether we are processing Your personal data.
• Provide you access to and/or a copy of certain personal data we hold about you.
• Correct or update personal data we hold about you.
• Delete certain personal data we have about you.

Certain personal data may be exempt from these requests under applicable law. For example, we need certain data in order to provide the Service to you or comply with applicable law. We may take reasonable steps to verify Your identity before responding to a request. Depending on the sensitivity of the data you are requesting and the type of request you are making, this may include verifying Your name and email address. If we cannot verify Your identity, we may be unable to respond to Your requests.

To exercise these rights, you can email us at [email protected]. You may be able to designate an authorized agent to make requests on Your behalf. For us to verify an authorized agent, you must provide the authorized agent with signed, written permission to make such requests or a power of attorney. We may verify Your identity directly with you before processing the authorized agent’s request, as permitted by applicable law.

If we deny Your request to exercise these rights, you have the right to appeal our decision. We will provide information about making an appeal in our response denying the request.

7.1 Scope

This annex forms an integral part of the Omio Privacy Policy and applies specifically to the use of Omio Business. The annex governs the processing of personal data where a company administrator (the “Admin”), on behalf of their company (the “Company”) registers for and manages an Omio Business account on behalf of employees of the Company.

By creating an Omio Business account, the Admin represents and warrants that they are authorised to enter into a contract for business-to-business travel intermediation services between the Company and Omio Corp., and to accept this Privacy Policy as well as the Omio Terms and Conditions on behalf of the Company.

Except as expressly provided herein, the general provisions of the Omio Privacy Policy shall continue to apply in full force and effect. In the event of any inconsistency or conflict between this Annex and the Privacy Policy, the terms of this Annex shall prevail with respect to (i) the use of Omio Business for business travel purposes and (ii) Omio Business accounts.

7.2 Data Processing Agreement

The Parties agree that the Data Processing Agreement forms an integral part of this Privacy Policy and the wider Omio Business Agreement.