Exchange Privacy Notice

Travel + Leisure Exchange Privacy Notice

Last Updated: May 15, 2025

Introduction

Travel + Leisure Co. has multiple exchange companies, which offer their products and services under various brand names including, among others, RCI, The Registry Collection, and 7Across (each an “Exchange Company” and collectively, the “Exchange Group of Companies,” “we”, “us”, or “our).  We respect your privacy. Please read this privacy notice (“Privacy Notice”) carefully to understand how we collect, disclose, and otherwise use your personal information, the rights and choices you may have with respect to your personal information, and how to assert those rights.

By accessing, visiting, or using our Services (as defined below), you acknowledge this Privacy Notice and agree to our Terms of Use. If you are not comfortable with any part of this Privacy Notice or do not agree with the Terms of Use, please immediately discontinue access or use of our Services.

We may make changes to this Privacy Notice from time to time and will post the date it was last updated at the top of this Privacy Notice. Any changes to this Privacy Notice will become effective on the “Last Updated” date indicated above. We will provide additional notice to you if we make changes to this Privacy Notice that materially affect your privacy rights.

We may also provide “just-in-time” disclosure or additional information about our information collection, use, and sharing practices for specific products or service offerings provided by our Exchange Group of Companies and their associated brands. These notices may supplement or clarify our privacy practices or provide you with additional choices about how we process your personal information.

Table of Contents

1. Scope and Applicability
2. What Information Is Collected and How Is It Collected?
3. Why and How We Use Your Information
4. When We Disclose Your Information
5. Cookies and Similar Tracking Technologies
6. Security of Your Information
7. Third Party Links
8. Social Media Pages
9. Children
10. Retention
11. Your Choices
12. Privacy Rights
13. Notice of Financial Incentive
14. Additional Notice to California Residents: California Consumers Privacy Notice
15. Additional Notice to Individuals in EEA, UK and Switzerland
16. How To Contact Us

1.     Scope and Applicability

This Privacy Notice applies to all personal information that is collected by each Exchange Company during any written, electronic, and oral communications online or offline when you:

• interact with our Exchange Group of Companies’ websites, pages, features or content that link to this Privacy Notice (collectively, the "Websites");
• interact with social media pages that we control ("Social Media Pages");
• use software applications that we make available for use on or through computers and mobile devices (the “Apps”) that link to this Privacy Notice;
• interact with us through any activities related to our Exchange Group of Companies, such as when you provide your information to our call centers (“Activities”); or
• otherwise engage with our products or services that link to this Privacy Notice (collectively, including the Websites, Apps, Activities and Social Media Pages, the "Services").

Suppliers and Business Customers. This Privacy Notice does not apply to the personal information we collect from employees or representatives of our existing and prospective business clients, suppliers, service providers, agents, consultants, advisors, business partners, investors, or other individuals acting in a commercial context. Please see our Supplier Privacy Notice for more details.

Employees and Job Applicants. This Privacy Notice does not apply to the personal information we collect from employees, contractors, job applicants, owners, directors or officers of the Exchange Group of Companies. If you are applying for a job with us, please see our Applicant Privacy Notice.

2.     What Information Is Collected and How Is It Collected?

We collect certain personal information about you and your use of our Services, including when you visit and interact with our Websites and Social Media Pages. Personal information is any information that relates to you, identifies you personally, or could be used to identify you. The definition of personal information (used interchangeably with “personal data”) depends on the applicable law based on your physical location. Only the definition that applies to your physical location will apply to you under this Privacy Notice. The personal information that we collect generally falls into three primary categories: (1) information you voluntarily provide to us; (2) information we collect from you automatically; and (3) information we collect from third parties.

Information You Voluntarily Provide. We, or service providers that assist us in providing, maintaining, and operating our Services, may collect the following types of personal information from you:

• Membership Enrollment. If you register for membership with one of our Exchange Companies, we may collect your first and last name, birthdate, military service information, occupation and status, organization, phone number, email address, home address, country, zip code, language preference, travel booking information, and payment card information. We use this information to identify eligibility for and enroll you into our membership programs.
• Ownership Enrollment. If you are the owner of a vacation ownership interest which is registered with one of our exchange companies, we may collect your and any co-owner’s first and last name, home address, country, zip code, phone number, email address, language preference, ownership interest information, travel booking information, and payment card information. We use this information to identify eligibility for and enroll your vacation ownership interest into our exchange programs.
• Account Registration and Management. We may collect information relating to the creation of membership account, such as your first and last name, member id, contract number, username, password, date of birth, email address, phone number, or postal code, military service information, or occupation information,
• Travel Information. When you book your stay at a resort or property or other travel reservation, we will collect your first and last name, email address, phone number, membership ID, address, and payment information to secure your reservation. Depending on the resort or property operator’s requirements, we may ask you to provide additional information about your trip or stay, such as your preferred location/facilities, dates, ages, number of people/children traveling with you, and/or your special requests or conditions to accommodate your stay.
• Resort Vacation Certificates Purchase. When you purchase, register, redeem Resort Vacation Certificates or personalize, gift and manage your orders, we may collect your first and last name, date of birth, phone number, email address, address, and payment card information. We use this information to identify eligibility for and provide any incentives you are eligible to receive and process your purchases.
• Customer Support. When you engage with our support team and customer support providers, we may collect records, copies of your correspondence (including email addresses), or additional information you choose to share with us.
• Promotional Activity or Sweepstakes (“Promotion”). If you choose to participate in a Promotion through our Services, we will collect and store the personal information you provide in connection with your participation in the Promotion, which may include, your name, date of birth, address email address, phone number, and/or other personal information identified in the Promotion terms. We use the information you provide to administer our Promotions. We also may use the information to communicate with you about our products, services, and other promotions.
• Feedback or Surveys. We may provide you the opportunity to participate in surveys or provide feedback about your experience. If you participate, we may request certain personal information from you, typically including contact information (such as name and email address). Participation in these surveys is entirely voluntary. We use this information to improve our services and product offerings.
• Web Forms. We may collect your or your guest’s name, email, phone number, home address, member ID, reservation confirmation number and other additional information you choose to provide when you inquire about our products or services, submit price match requests, or would like to get in touch with us for membership options. If you provide contact information, we may contact you to respond to your inquires, to learn about your level of interest in, or satisfaction with our Services.
• Testimonials. We may seek your permission to post your testimonials, written and video, on our Services. If you wish to update or delete your testimonial, you can contact us via methods identified in the “How to Contact Us” section below.
• Sensitive Information. When interacting with us in relation to our Services, we may collect certain personal information that is considered sensitive information, which may be subject to special processing conditions under the laws applicable in the jurisdiction which you reside.  For instance, we may collect the following:
  • ID information, such as your tax id number, passport, or other government identification information, which in certain locations may be used to comply with local laws. We may also collect your social security number or other government identification information to conduct due diligence such as running Office of Foreign Assets Control (OFAC) and Specially Designated Nationals (SDN) screenings.
  • Health information, such as the information you volunteer relating to any medical conditions, disabilities, allergies, or accessibility requirements you have.

Unless specifically requested, we ask that you not send us, and you not disclose, on or through the Services or otherwise to us, any sensitive personal information such as Social Security number, passport number, driver’s license number, or other government-issued identification number; financial account details, with or without any information that would permit access to the account, or credit history; or information on race, religion, ethnicity, sexual practices or sexual orientation, medical or health information, genetic or biometric information, political or philosophical beliefs, trade union membership, background check information or criminal records. 

Information We Automatically Collect. To the extent permitted under applicable law, we may automatically collect certain types of personal information about you when you use or interact with the Websites or Apps.

• Usage Data. When you browse our Websites, we automatically collect log data such as your web request, Internet Protocol (“IP”) address, browser type, domain names, referring and exit pages and URLs, pages viewed and the order of these page views, the date and time you access our servers, and other diagnostic data.
• Device Information. When you use your desktop or mobile devices to access our Services, we may be able to identify your device’s unique device identifier, MAC address, operating system, and your mobile device’s advertising ID.
• Location Information. When you use our Services, we may infer the generic physical location and geographic regions of your device from your Wi-Fi, Bluetooth and other device settings. For example, your IP address may indicate your general geographic region. Upon your permission, we may collect your mobile device’s precise geo-location to find the closest property near you. You may choose not to share your location details with us by adjusting your mobile or desktop device’s location services settings. For instructions on changing the relevant settings, please contact your service provider or device manufacturer.

Information We Collect from Third Parties. From time to time, we may obtain information about you from third party sources as required or permitted by law. These sources may include:

• Social Media. We may offer you the opportunity to engage with our content on or through third-party social networking websites, plug-ins and applications. When you engage with our content on or through third-party social networking websites, plug-ins and applications, you may allow us to have access to certain information associated with your social media account (e.g., name, username, email address, profile picture, gender) to deliver the content or as part of the operation of the third-party website, plug-in or application. When you provide information from your social media account, we may use this information to personalize your experience on our Services and on the third-party social networking websites, plug-ins and applications, and to provide you with other products or services you may request.

• Parent or Affiliate Companies. We may obtain your personal information from our parent and affiliated companies, for administrative, management, and to the extent permitted by applicable law, for promotional purposes.
• Third Party Partners.  If you are an owner of a vacation ownership interest, we may receive your personal information from your vacation ownership interest provider to enroll you as a member of one of our Exchange Companies as part of a benefit provided to you. Unless prohibited by applicable law, we may also obtain your personal information from marketing partners, analytics providers, Promotion providers, and other third-party partners so that we can better understand which of our Services may be of interest to you, market our Services to you, and to provide us information necessary to improve our Services.
• Other Individuals. We may receive certain information about you from people with whom you are family, co-owners, friends or otherwise connected. For instance, we may obtain your name and contact information when your family or friends would like to gift you Resort Vacation Certificates or if the co-owner of your ownership interest would like to enroll you in an exchange membership. Please note, if you provide us with information about someone else, please ensure you have the person’s permission to do so for the purposes detailed in this Privacy Notice.
• Single sign-on (“SSO”). SSO is an authentication method that enables you to securely authenticate your login within multiple applications and websites by using one set of credentials.  If you choose to login to our Services through a third-party platform (such as Facebook, Google, or the home website of another third-party provider) we may have access to certain information from that platform, such as your username or email address. The information we receive may vary based on your privacy settings on such platform or as otherwise controlled by the provider of such platform.
• Public Databases. Unless prohibited by applicable law, we may collect information about you that is publicly available online or from public sources, such as when we conduct due diligence screenings.

3.     Why and How We Use Your Information

We may process your personal information in connection with any of the following:

1. To Operate and Administer Our Services. We may use your personal information to provide you with the Services that you request, such as creating and managing your membership accounts and vacation ownership interest exchange programs, making reservations, or processing your purchase orders.
2. To Provide Customer Support or Respond to You. We collect any information that you provide to us when you contact us to respond to your inquiries and to fulfill your requests. Without your personal information, we cannot respond to you or ensure your continued use and satisfaction of the Services.
3. To Provide You with Service-Related Communications. We may send you administrative, account-related, ownership-related, or membership-related information to you, for example, privacy policy and terms updates, security updates, resort closings, weather events, or reminders for your upcoming reservation or other event you are attending. Service-related communications are not promotional in nature. You may not be able to unsubscribe from certain service-related communications, otherwise you may miss important developments relating to your account or the Services.
4. To Provide Marketing Communications. Subject to your marketing preferences (which may include consent to marketing under applicable law), sending you special discounts and offers, newsletters or marketing communications we believe may interest you, for our own products and services, on behalf of our Affiliates (defined below), or on behalf of our third-party partners in accordance with applicable law. Consent for SMS messages will not be shared with any other third party (including Affiliates) for marketing or promotional purposes without your consent.
5. To Infer Your Interest and Personalize Your Experience. We may process your personal information to personalizing your experience on the Services by presenting products and offers tailored to you. We may use such information to enable you to interact with our Services more easily across devices, or to recommend more relevant content to you. For example, when you enable the social sharing functionalities of your social media account(s) by interacting with our content on or through third-party social networking websites, plug-ins and applications, we may use this information to personalize your experience on our Services and on the third-party social networking websites, plug-ins and applications.
6. To Research and Develop Our Services. We may process your personal information and derive analytical and statistical data to better understand the way you use and interact with our Services, including by carrying out data analysis, audits, fraud monitoring and prevention, internal quality assurance, developing new products, enhancing, improving or modifying our Services, identifying usage trends, auditing use and functionality of our Services, determining the effectiveness of our promotional campaigns, and operating and expanding our business activities.
7. To Develop and Enhance AI Technology. When you interact with our services powered by artificial intelligence and machine learning technologies (collectively, “AI technology”), such as generative AI chatbots, you acknowledge that we may use your personal information and any user content, input, uploads, or feedback that you provide to develop, improve, and enhance machine learning models that powers such AI technology. For example, we may use personalization and take into account the conversations you are having to improve chatbot responses.
8. To Administer Promotional Events. When you participate in sweepstakes, contests, and similar promotions, we may process your personal information to administer such activities (each of which may have additional rules and could contain additional information about how we process your personal information). You have the right to decline to provide your consent and, if consent is provided, to withdraw it at any time.
9. To Facilitate Corporate Acquisitions, Mergers and Transactions. We may process any information regarding your account and your use of our Services as is necessary in the context of corporate acquisitions, mergers, or other corporate transactions.
10. To Enforce Compliance with Our Terms, Agreements and Policies. When you access or use our Services, you are bound to our Terms. We may process your personal information when actively monitoring, investigating, preventing, and mitigating any alleged or actual prohibited, illicit or illegal activities on our Services. We may also process your personal information to investigate, prevent or mitigate violations of our internal terms, agreements or policies; enforce our agreements with third parties; recover payments due to us; and protect our and others’ rights, privacy, safety, or property.
11. To Ensure the Security of the Services. We may process your personal information to combat spam, malware, malicious activities, or security risks; improve and enforce our security measures; and to monitor and verify your identity so that unauthorized users do not gain access to your information.
12. To Maintain Legal and Regulatory Compliance. Our Services are subject to certain laws and regulations which may require us to process your personal information. For example, we process your personal information to pay our taxes, to fulfill our business obligations, or as necessary to manage risk as required under applicable law, or to respond to requests by judicial process or governmental agencies.
13. With Your Consent. For any other purpose disclosed to you prior to you providing us your personal information or which is reasonably necessary to provide the Services or other related services requested, with your permission or upon your direction.

4.     When We Disclose Your Information

We may disclose your personal information as follows: 

1. We may disclose your personal information to our parent company, subsidiaries, corporate affiliates, or any other entity that is directly or indirectly controlled by, or under common control with us (“Affiliates”) for the purposes described in this Privacy Notice, including under “Why and How We Use Your Information”, unless otherwise prohibited by applicable law or by contractual agreement with our vendors, service providers or other third parties. You can find more information about our primary operating Affiliates in the Travel + Leisure Co. Annual Report as of the date the Annual Report was published or by contacting us at the contact information set forth below in the section titled “How to Contact Us.”
2. Vendors and Service Providers.We may disclose your personal information to vendors and service providers we retain in connection with our business such as: travel services companies, financial services companies, property owners associations, insurance companies, website hosting, data analysis, payment processing, order fulfillment, magazine publishers, information technology and related infrastructure provision, customer service, email delivery, credit card processing, tax and financial advisers, legal advisers, accountants, auditing services, fraud prevention, identity verification, risk assessment,  marketing, generative AI software packages, and network maintenance. These third-party service providers may have access to or process your personal information only for the purpose of providing services to us. 
3. Business Partners, Sponsors, and Other Third Parties.We may disclose your personal information to business partners, co-sponsors of Promotions, and other third parties in order to provide you with services that may interest you. For example, we may share your personal information with the owners and operators of resorts, hotels, property owners’ associations, airlines, car rental services, activity or excursion providers, travel insurance providers, credit card providers, retail stores, magazine publishers, and other third parties to facilitate reservations, to allow them to offer you their products or services, or in connection with any loyalty or membership program we may provide or a loyalty or membership program of one of our partners.  We may also co-sponsor promotions, sweepstakes, or other events with a third party and may share your personal information in connection with these events. If you provide additional information to any of these third parties, such information provided to these third parties will be subject to each third party's privacy practices and policies.
4. Resorts or Business Partners. We may share your personal information with resort or other travel operators in order to facilitate a booking you requested, to generate leads in connection with their offers to sell their products to you, to facilitate their understanding of your membership status, exchange history and utilization, or to respond to your inquiry for further information about vacations at resorts where a resort tour is either required or requested of you by the resort operator.
5. Message Boards. We may make reviews, message boards, blogs, and other such user-generated content facilities available to users. Any information disclosed in these areas becomes public information and you should always be careful when deciding to disclose your personal information. We are not responsible for privacy practices of other users including website operators to whom personal information is disclosed.
6. Change in Control.We may disclose your personal information to a third party (e.g., prospective buyers and insolvency practitioners) in connection with any change in control of any part of our business or the business of any of our Affiliates, including, without limitation, merger, consolidation, divestiture, spin-off, purchase of all or a substantial portion of our assets, dissolution, liquidation, administration, receivership or other form of insolvency.
7. Third Parties. Where permitted by applicable law we may license, sell, or otherwise share your personal information with selected third parties for compensation for their own business purposes. Once we share your personal information with a third party for such purposes, the information shared becomes subject to such third party’s privacy practices.
8. Marketing Partners. Where permitted by applicable law, we may disclose your personal information with marketing and advertising partners including, among others, Meta, Google, and Microsoft, for targeted advertising purposes, such as matching custom audience or creating lookalike audience on social media or other marketing platforms, so that we can better understand which of our Services may be of interest to you, market our Services to you, and to provide us information necessary to improve our Services. For more information about Microsoft’s privacy practices, please visit Microsoft’s privacy statement at https://www.microsoft.com/en-us/privacy/privacystatement. If you would like us to stop using your information for targeted advertising purposes, you may opt-out by filling out this form. To learn more about your choices and rights, please review the “Privacy Rights” section below.
9. Disclosure Permitted by Law.We may disclose your personal information to law enforcement authorities, government or public agencies or officials, regulators, and/or to any other person or entity having appropriate legal authority or justification for receipt of your information, if required or permitted to do so by law or legal process, to respond to claims, or to protect our rights, interests, privacy, property or safety, and/or that of our Affiliates, you or other third parties.

5. Cookies and Similar Tracking Technologies

We and our service providers may automatically collect information from you when you use the Websites and Apps using “cookies” and other tracking technologies to help us customize your experience and better manage content on our Websites and Apps, including to: (a) analyze our web traffic using an analytics package; (b) identify whether you already visited any of our affiliated websites; (c) store information about your preferences (e.g., cookie consent); and (d) to recognize when you return to our Websites and Apps. 

Cookies are small amounts of data that are stored within your computer’s Internet browser and that are accessed and recorded by the websites that you visit so that they can recognize the same browser navigating online at a later time. Information that may be collected by cookies when you use the Website may include, without limitation: the pages you visit within the Website; the date and time of your visit to the Website; the amount of time you spend using the Website; the IP address used to connect your computer to the Internet; and/or your computer and connection information such as your browser type and version, operating system and platform. 

For more information on the cookies we use on our Websites, please see our Cookie Statement.

6. Security of Your Information

We take reasonable steps to use appropriate physical, technical and organizational measures to help safeguard your personal information from loss, misuse, unauthorized access or disclosure, alteration or destruction. Unfortunately, no security system is 100% secure, thus we cannot ensure the security of all information you provide to us via the Services.

7.     Third Party Links

The Services may have links to other websites that are not operated by us. We have no control over how these third-party websites may collect your information and no liability for the practices, policies and security measures implemented on these websites. You should read the privacy notices on those other websites before you submit your information through them.

8.     Social Media Pages

Please note that we are not responsible for the collection, usage and disclosure policies and practices (including data security) of other organizations, such as Facebook, Apple, Google, Microsoft, X or any other social media platform provider, operating system provider, wireless service provider or device manufacturer, including any personal information you disclose to other organizations through or in connection with our Social Media Pages. Any posts you make on our Social Media Pages may be available to others who use those pages. Never include sensitive personal, financial, or other confidential information such as your social security number, address, phone number or email address when posting or commenting online. Please refer to the privacy policies of our social media partners when you interact with them online. 

9.     Children

We do not knowingly collect, maintain or use personal information provided by individuals under 18 years of age, and no part of our Websites and Social Media Pages are directed to individuals under the age of 18. When parents or legal guardians of children under 18 make reservations or book stays for their children through our Services, we may collect names, ages and other related information of children under 18 as necessary to deliver the requested services. For travel reservations or bookings in certain countries, we may be required by applicable laws to collect additional information about children under 18 such as sex, date of birth, address information and identification information from their parent or legal guardian. We will use the personal information collected in the course of facilitating the reservation process, and only within the limits permitted by applicable law.

If you are a parent or guardian and wish to review information collected from your child, or have that information modified or deleted, you may contact us via the method identified in the “How to Contact Us” section below. If we become aware that a child under 18 has provided us with personal information, we will terminate that user’s access to our Service and take steps to delete such information from our systems, unless we have a legal obligation to keep it.

10.  Retention

We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law. We will cease to retain your personal information or remove the means by which the personal information can be associated with you as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal information was collected and is no longer necessary for legal or business purposes. If you wish to cancel your account or request that we no longer use your information to provide you services, we may still retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

11.  Your Choices

We offer you certain choices about how we communicate with you and manage what personal information we collect from you.

• Correct or Update Your Information. If you have created a user account through the Services, you can access, update and correct the personal information you have provided in connection with your account by logging into your account through the Services.
• Change Your Marketing Preferences. We offer you certain choices about how we communicate with you. You can change your marketing preferences by:
  • Using the unsubscribe function in the email you receive from us;
  • Logging into your account (if the Service offers an account with such functionality);
  • Texting STOP in any SMS communication you receive from us;
  • Contacting us as set forth under “How To Contact Us” below.

12.  Privacy Rights

If you are located in the European Economic Area, the United Kingdom, or Switzerland (collectively, the “European Countries”) at the time your personal information is collected, please refer to Section 15 below. 

For individuals in the United States, depending on applicable law where you reside or are located, you may be able to assert certain rights identified below with respect to your personal information.  For individuals in the United States, please refer to the “What Rights Apply” section to determine the rights you have in the state where you reside.

If any of the rights listed below are not provided to you under the law that governs the processing of your personal information, we have absolute discretion in providing you with those rights.

Your rights in relation to your personal information are not absolute. Depending upon the applicable law, access to your rights under the applicable law may be denied: (i) when denial of the request is required or authorized by law; (ii) when granting the request would have a negative impact on another’s privacy; (iii) to protect our rights and properties; (iv) where the request is frivolous or vexatious, or for other reasons.

1. Right to Know/Access. You may have the right to obtain a copy, or a list of categories of the personal information that we hold about you, as well as other supplementary information.
2. Right to Correct. You may have the right to rectify, correct or update any of your personal information held by us that is inaccurate.
3. Right to Delete. Under certain circumstances, you may have the right to request that we delete the personal information that we hold about you. This right is not absolute, and we may refuse your right to delete if it is reasonably necessary for us to provide a service requested by you; to perform a contract between us; to maintain functionality and ensure security of our systems; to enable solely expected internal uses of your personal information; to exercise a right provided by law; to comply with a legal obligation, or if there are compelling legitimate grounds for keeping your personal information.
4. Right to Portability. Under certain circumstances, you may have the right to receive personal information we hold about you in a structured, commonly used, and machine-readable format so that you can provide that personal information to another entity.
5. Right Against Discrimination. You have the right not to be discriminated against for exercising any of the rights described in this section. We will not discriminate against you for exercising your privacy rights.
6. Right to Object to Automated Decision-Making. You may have the right not to be subject to a decision that is based solely on automated processing (where a decision is taken about you using an electronic system without human involvement) which significantly impacts your rights. No decision will be made by us about you solely on the basis of automated decision making which has a significant impact on you.
7. Right to Opt-Out of Sale. You may have the right to opt-out of the sale of your personal information. Like many businesses, we use cookies, pixels, and similar technology on our Websites and Apps, and we share certain personal information, such as your email address, phone number, IP address or device identifiers, to third-party advertisers in order to improve your user experience and to optimize our marketing activities.  Under the broad definition of “sell” contained in some jurisdictions’ privacy laws, this could be considered a sale.  We may also provide certain personal information, such as your contact information, to other third-parties for their own business purposes.
8. Right to Opt-Out of Sharing for Targeted Advertising. You may have the right to opt-out of the sharing of your personal information to third parties for behavioral or cross-contextual advertising purposes. Like many websites, we use cookies, pixels, and similar technology, and we share certain information, such as your email address, phone number, IP address or device identifiers, to certain third-party advertisers to improve your user experience and to optimize our marketing activities. You have the right to direct us not to share your personal information for targeted advertising purposes.
9. Right to Appeal. You may have the right to appeal if we refuse to take action on your rights request. Instructions on how to appeal will be provided to you upon such a denial, but in any event, such instructions will be substantially similar to those provided below for submitting requests.
10. Right to Obtain Third-Party List. You may have the right to request a list of specific third parties to which we have disclosed personal information.

Submitting a Request to Exercise Your Privacy Rights  

To assert your privacy rights noted above, go to our Consumer Rights Request Form available here, email us at privacy@travelandleisure.com, or call us toll-free at 1-844-510-0095, and indicate which rights you would like to exercise.

Request Cadence

Please note that depending on your state of residence, applicable law may limit how many times per year you may submit a Right to Know/Access.  We may charge a reasonable fee for multiple requests in the same 12-month period, as permitted by law.

Identity Verification

To protect your privacy, we must be able to verify your identity to confirm that the request came from you before we can process your request to exercise certain privacy rights that you may be entitled to under the applicable law.  We may contact you by phone or e-mail to verify your identity.  Depending on your request, we will ask for information such as your name, address, an e-mail address or a phone number you have used with us. For certain requests, we may also ask you to provide details about your most recent purchases or reservations.

In certain states you may designate an authorized agent to submit a request on your behalf to access or delete your personal information. To do so, you must: (1) provide that authorized agent written and signed permission to submit such request; and (2) verify your own identity directly with us. Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

Opt-Out of Cookie-Based Sales, Sharing and Targeted Advertising.  To exercise your right to opt-out of sales and targeted advertising via cookies, please click the “Cookie Settings” link in the website footer and switch off the toggle for “Targeted Advertising” and “Social Media.” Please note that you may still receive generalized ads after opting out of targeted advertising.  Your opt-out choice will only apply to your use of our Websites through the current browser or device you are using and only so long as that browser’s cookies are not erased.

If you are a resident of California or Colorado, Connecticut, Montana, New Hampshire or Texas, you may also opt-out of sharing and sales via cookies by using an opt-out preference signal. The Global Privacy Control (GPC) signal is currently the only opt-out preference signal we recognize. You can visit the GPC official site at https://globalprivacycontrol.org/#about to learn how to configure your device to send such signals. We will honor and process the opt-out preference signal in a frictionless manner. Your opt-out choice will only apply to your use of our Websites through the current browser or device you are using and only so long as that browser’s cookies are not erased. You will need to submit a separate opt-out of sharing request on each device and browser you use to visit our Websites to completely opt-out using this method.  Please note that after opting out of targeted advertising, you may still receive generalized ads.

Opt-Out of Other Types of Sales and Targeted Advertising.  To opt-out of other types of sales and targeted advertising of your personal information, please submit an Opt-Out request using our Consumer Rights Request Form that is available here.

What Rights Apply

To determine which of the rights listed above that the law in your state offers, please refer to the table below. States not listed either do not have a law providing such rights or it does not apply to our operations. 

13.  Notice of Financial Incentive

We may offer our members programs that provide certain perks, rewards, or special promotions, such as newsletters, sweepstakes, contests, incentives, discounts, or other similar promotional campaigns (collectively, the “Programs”). When you sign up for one of our Programs, we may ask you to provide your name, contact information (such as email address and/or telephone number), and for some Programs, your date of birth and information about our Services. Because our Programs involve the collection of personal information, they might be interpreted as a “financial incentive” program under California law or a “bona fide loyalty program” under Colorado law. The value of your personal information to us is related to the value of the free or discounted products or services, or other benefits that you obtain or that are provided as part of the Program.

You may withdraw from participating in a Program at any time by contacting us using the designated method set forth in the applicable Program terms. Please visit the terms and conditions page of each Program to view full details, including how to join and the Terms and Conditions for each Program.

14.  Additional Notice to California Residents: California Consumers Privacy Notice

If you are a California resident, this section applies to you in addition to the rest of this Privacy Notice. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”) requires us to disclose the following additional information related to our privacy practices.

Categories of Personal Information Collected, Used, And Disclosed

In the preceding 12 months, depending how you interact with our Services, the chart below describes the categories of “personal information” (as that term is defined under the CCPA), the sources and purpose of such collection, and the parties to whom the information was disclosed for business purpose.

Your Rights. California residents have the right to access, to correct, to delete, to portability, to opt-out of the sale or sharing of your personal information, to object to automated decision making (upon effective of regulations by the California Privacy Protection Agency), and the right not to be discriminated against for exercising any of the rights described in this section. For more information about these rights and how to exercise them, see Section 12, above. 

If you are a California resident, to the extent your sensitive personal information (as that term is defined under the CCPA) is used to infer characteristic about you, you have the right to direct us to stop such processing of your sensitive personal information for such purposes. However, we do not process any of your sensitive personal information to infer characteristic about you.

We do not knowingly sell or share (for cross-context behavioral advertising) the personal information of consumers under 18 years of age.

Shine the Light.  The California Shine the Light law permits California residents that have an established business relationship with us to request certain information regarding our disclosure of certain types of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. To make such as request, please contact us using the information below, and indicate in your message that you are a California resident making a “Shine the Light” inquiry. This request may be made no more than once per calendar year.

Retention of Personal Information.  We retain your information for as long as your account is active, as needed to provide you Services or for other purposes stated in this Policy, or as required or permitted by applicable law. For more information about the criteria for retaining personal information listed above, please refer to Section 10 above.

Do Not Track.  Your browser may allow you to adjust your browser settings so that “do not track” requests are sent to the websites that you visit. However, since uniform standards for “DNT" signals have not been adopted, we do not disable tracking technology that may be active on the Websites in response to any “do not track” requests that we receive from your browser.

15.  Additional Notice to Individuals in EEA, UK and Switzerland

This section only applies to individuals using or accessing our Services while located in the European Economic Area, the United Kingdom, or Switzerland (collectively, the “European Countries”) at the time of personal data collection. Pursuant to the General Data Protection Regulation (“GDPR”), for the sake of clarity, references to personal information in this Privacy Notice concern personal data as this term is defined under the GDPR.

We may ask you to identify which country you are located in when you use or access some of the Services, or we may rely on your IP address to identify which country you are located. If any terms in this section conflict with other terms contained in this Privacy Notice, the terms in this section shall apply to individuals in the European Countries.

Our Relationship to You

Please contact us at customerservices@europe.rci.com for more information on the data controller(s) for personal information we process. Please include your country of residence in your email.

Marketing

Based on your consent, we may inform you about our Services or invite you to event via email, online advertising, social media, telephone, or postal mail.  You may withdraw your consent for receiving marketing messages from us at any time by using the unsubscribe function in the email you receive from us.  For more information about cookies and interest-based advertising and to learn about how to manage these technologies, please see our Cookie Statement.

Legal Bases for Processing Your Personal Information

Special Conditions for Processing Your Sensitive Information

As detailed in Section 2 above, in some cases, we may process sensitive  personal information. This type of information is afforded extra protection due to its sensitive nature. For the purposes outlined in this Privacy Notice, the conditions we may rely upon as the legal basis for processing sensitive personal information are the following:

• Explicit consent - Article 9(2)(a) GDPR
• Processing necessary to protect the vital interests of an individual – Article 9(2)(c)
• Processing of data that has been manifestly made public – Article 9(2)(e)
• Processing that is necessary for the establishment, exercise, or defense of legal claims/judicial acts – Article 9(2)(f); and
• Processing is necessary for reasons of substantial public interest (with a basis in law) – Article 9(2)(g).

Your Privacy Rights

If you are located in European Countries at the time we collect your personal information, you have certain rights in relation to your personal information which are listed below. These rights are not absolute. Depending upon the applicable law, access to your rights under the applicable law may be denied: (i) when denial of the request is required or authorized by law; (ii) when granting the request would have a negative impact on another’s privacy; (iii) to protect our rights and properties; (iv) where the request is frivolous or vexatious, or for other reasons.

• Right to Access. You have the right to obtain a copy of your personal information that we hold about you, as well as other supplementary information, such as the purposes of processing, the categories of personal information that we process, and the entities to whom we disclose your personal information.
• Right to Rectification. You have the right to request us correct any of your personal information in our files that is inaccurate.
• Right to Erasure. Under certain circumstances, you may have the right to request erasure of your personal information that we hold about you. To note, this right is not absolute, and we may refuse your right to erasure if there are compelling legitimate grounds for keeping your information.
• Right to Restriction. You have the right to request that we restrict our processing of your personal information in certain circumstance. For instance, this right is available if you contest the accuracy of the personal information, or if you objected to our processing.
• Right to Object to Processing. You have the right to object to our processing of your personal information at any time and as permitted by applicable law if we process your personal data on the legal bases of consent or legitimate interests. However, we may continue to process your personal information if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law.
• Right to Portability. Under circumstances, you may have the right to receive personal information we hold about you in a structured, commonly used, and machine-readable format so that you can provide that personal information to another controller.

Submitting a Request to Exercise Your Privacy Rights 

To assert your privacy rights noted above, or if you have a question about our data processing activities please email us at customerservice@europe.rci.com and indicate which rights you would like to exercise or your questions.   

To protect your privacy, we must be able to verify your identity to confirm that the rights request came from you before we can process your request to exercise any of the privacy rights that you may be entitled. We may contact you to verify your request. Depending on your request, we may ask for information such as your transaction history, username, an e-mail address, or a phone number you have used with us.

You may also contact our Data Protection Officer at dpo@dataprivacyadvisory.com.

You also have the right to lodge a complaint with a supervisory authority or equivalent regulatory body. Contact details for data protection authorities in the European Economic Area are available here, and contact details for the United Kingdom’s ICO are available here.

International Transfer of Your Personal Data

We are an international company, and we may, subject to applicable law, transfer your information, to our Affiliates or selected third parties outside the country where you are located and where information protection standards may differ (e.g., your information may be stored on servers located in other jurisdictions). We will utilize appropriate safeguards governing the transfer and usage of your personal information, for example, Standard Contractual Clauses. We may also rely on an adequacy decision of the relevant regulatory body confirming an adequate level of data protection in the jurisdiction of the party receiving the information, or derogations in specific situations.

16.  How To Contact Us

If you have questions about this Privacy Notice or the privacy practices of Exchange Group of Companies, please contact us at privacy@travelandleisure.com and include your country and state of residence and the brand with whom you typically do business in your email. You may also call us at 1-844-510-0095.