Privacy Policy

Effective May 25, 2018

Who Are We?

ALTOUR is a global travel services company that serves corporate and individual client travel needs. In order to deliver your services, it is necessary for us to collect and process your personal information. We care about your privacy. This Privacy Policy explains the policies and practices we follow to protect your personal information that we hold. This Privacy Policy applies to information we collect about you either through your use of this Website www.altour.com or through other means. The server(s) that make(s) this Site available may be located outside the country from which you accessed this site, but we will collect, process and use personal information only in accordance with this policy and as required by local law in the places in which we operate.

If you have questions not answered in this policy, our Privacy Officer may be contacted directly at altour.gdpr@altour.co.uk.

Our European Union Privacy Policy can be found in the “European Union Privacy Notice“ section of this document. Our EU Privacy Shield Policy can be found in the “EU Privacy Shield“ section of this document.

What Personal Information Do We Collect?

We collect your personal information that you provide us directly in order to provide you with the products and services you have requested. In most cases, it consists of

• Full Legal Name
• Email address
• Postal address
• Phone number
• Credit card number

We may collect other information to assist you with your travel plans such as passport number, drivers' license or other government-issued identification number, date of birth, gender, airline, hotel or car rental frequent loyalty numbers, known traveler and number/global entry.

Information We Collect Through Automatic Data Collection Technologies

We collect other information, such as your IP address, search terms, and site pages you visit while on our site, whenever you visit our site, use our services, or view our online advertisements. The technologies we use for this automatic data collection may include cookies and log data.

You can learn more about how we use cookie data by reviewing our Cookie Policy which can be found in the “Cookie Policy“ section of this document.

Whenever you use a website, mobile application, or other internet service, certain information is created and retained by the website or application. This happens with our Site as well. We collect technical information when you use our Site, or information that has been made anonymous, such as:

• Log data: Our servers automatically record information when you use our Site, such as your IP address, the type of browser you are using and its settings, the third party website you visited immediately prior to accessing our Site, the operating system you are using, the domain name of your Internet service provider, the search terms you use on our Site, the specific Site pages you visit, type of product selected, the brand, order, and product identifications, and the duration of your visits.
• Cookie data: A “cookie“ is data that a website server stores on your computer. Cookies enable websites to recognize your computer and to “remember“ your entries as you move from page to page, or even when you revisit the site from time to time using the same computer.

We may also collect information pertinent to the marketing of our products and services. This information may include marketing channels, User Market IDs (CenterPoint, TNMP, etc.), Site brands and product names, contract terms, financial information and other information.

We collect and analyze this information to measure the number of visitors to the different sections of our Site, to evaluate how visitors use our Site and to provide you with advertisements that are relevant and useful to you, unless you have told us not to. We also use the information we collect to understand customer needs and trends, to carry out targeted promotional activities, and to generally help us make our Site more useful to visitors.

We may use your Site data by itself or aggregate it with similar information we have obtained from others. We may share your Site data with our affiliates and other third parties to achieve these objectives. You may obtain a list of our affiliates and third parties with whom we share your Site data by contacting us at the address below.

We reserve the right to use Internet Protocol (IP) addresses to identify a visitor when we feel it is necessary to enforce compliance with our Site's Terms and Conditions, or to: (a) fulfill a government request; (b) conform with the requirements of the law or legal process; (c) protect or defend our legal rights or property, our Site, or other users; or (d) in an emergency to protect the health and safety of our Site's users or the general public.

How We Use Your Information.

If you are a customer, an agent, an employee, or a job applicant, the personal information we hold, and use is necessary for the performance of the services contract or independent contractor or other agreement to which you are a party.

If you are a prospective customer, the personal information we collect, and use is necessary for our legitimate interest in providing you with information about the services we offer, and about which you have expressed an interest or that we believe will be of benefit to you. Where appropriate, we will obtain your consent at the time we communicate with you.

In some cases, our purpose for collecting the information is because you have expressly consented to our collection and use of your personal information.

We collect your personal information for a variety of reasons. You may provide the information to us directly, or through a tool or product provided by ALTOUR or another organization to your employer in the case of our business clients. We collect your personal information, such as name, address, email address, phone number, and credit card information in order to provide the services you have requested. Other examples of personal information that we collect include:

• From employment applicants, we or our service provider will collect contact and identification information, such as name, address, telephone number, e-mail address, date and place of birth, and driver's license number and employment and income information;
• From travel customers, we may also request information such as your passport and known traveler information, vendor loyalty programs, and other information as deemed necessary by the service provider to fulfill your request, to permit us to provide other ancillary travel services to you and to manage your travel experience.; and
• From business customers, customer relationship information, such as business contact information.

Doing Business with You. We use the personal information we have collected to allow us to evaluate your employment application, to provide the products and services you have chosen, or to manage and develop our business and operations, including:

• Establishing, managing and terminating business relations with you;
• Reviewing the products and services that we provide to you;
• Informing you of our products and services other than those that you have specifically requested;
• Informing you of products and services carefully selected third parties may wish to offer you;
• Responding to your comments or requests for information;
• Investigating and preventing fraudulent activities, unauthorized access to the services and other illegal activities;
• Protecting us against error, fraud, theft, and damage to our goods and property;
• Enabling us to comply with applicable law or regulatory requirements;
• For any other purposes about which we notify customers and users; and
• For any other reasonable business purpose to which you consent.

Email communications: If you send us an email with questions or comments, we may use your email address to respond to your questions or comments, and we may save your questions or comments for future reference. We may email you when:

• You have applied for employment with us;
• You request information about our company;
• It relates to purchases you have made from us (e.g., product updates, customer support, etc.);
• You consented to being contacted by email for a particular purpose.
• We are sending you information about our other products and services, offers, promotions and our newsletters, if this is in accordance with your marketing preferences. However, you will always be able to opt out of such communications at any time. See the 'Your Choices' section below.

How Do We Use Preference Based Advertising, Analytics, and Services?

We do not currently share your information that we collect for preference-based advertising purposes and we do not currently have any plans to do so through this Site.

If we do in the future work with third parties for preference-based advertising then we will do so in accordance with this section and you can opt out as explained below. Such third parties may include third party advertising networks and website analysis firms who use cookies and web beacons to collect non-personally identifiable information when you visit our Site and third-party sites. The information collected through cookies and/or web beacons, including your IP address, web browser, pages viewed, time spent on pages, and links clicked, is often used by these advertising networks to serve you with advertisements, while you are on our Site and/or on third party sites, that better reflect your preferences and needs. This information may be used by ALTOUR and these third parties to analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our products and services, and better understand your online activity. For more information on how this type of advertising works, go to http://www.aboutads.info/.

Who Else Do We Share Your Information with and Why?

We may share your personal information with one or several of our business partners to make initial determination of the services you may need, to process your employment application to otherwise facilitate our business operations. We also share your personal information as necessary with airlines, hotels and other providers for whose services you have requested our assistance.

We may also share your information to protect and defend the rights and property of ALTOUR.

Third Party Providers: We may use third parties to assist in processing your employment applications, fulfilling your services requests, or providing other important information to you. We require all such services providers to act in compliance with this Privacy Policy. We may also share your PII with third parties, including our affiliates, or with employees, agents, consultants and other parties who require the information to assist us to establish, maintain and manage our business relationship with you. Further, we may share your personal information with our partners and affiliates to promote other services to you that you might like or to show you ads in which you might be interested.

Email Communications: We may share your email contact information with our partners to assist with marketing our products and services. You may unsubscribe from receiving future commercial email communications from us by clicking the "unsubscribe" link included at the bottom of any marketing emails we send, or by emailing us as provided in the "Contact Us" section below. However, we reserve the right to send you transactional emails such as customer service communications in connection with the products you have purchased. For security reasons, we do not recommend that you send PII, such as passwords, social security numbers, or bank account information, to us by email.

Transfer of Assets: We do not sell or lease personal information or provide a list of our customers to third parties. However, as we continue to develop our business, we may sell or purchase assets. If another entity acquires us or all (or substantially all) of our assets, the information we have about you will be transferred to and used by this acquiring entity. Also, if any bankruptcy or reorganization proceeding is brought by or against us, all such information may be considered an asset of ours and as such may be sold or transferred to third parties.

Legal Necessity: Notwithstanding anything herein to the contrary, we reserve the right to disclose any information about you if we are required to do so by law, with respect to copyright and other intellectual property infringement claims, or if we believe that such action is necessary to: (a) fulfill a government request; (b) conform with the requirements of the law or legal process; (c) protect or defend our legal rights or property, or our Site; or (d) in an emergency to protect the health and safety of our Site's users or the general public.

What Choices Do You Have About Our Use of Your Information?

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Cookies. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent.
• Your Contact Information. If you have previously emailed us and would like us to delete your contact information from our files, please contact us at the email address below.
• Other Information. If at any point you believe the personal information we hold about you is incorrect, you want us to correct or delete that information, or you no longer want us to hold that information or contact you, you can contact us at the email address below.

You may have additional rights concerning your personal information if you reside in the European Union. These can be found in the "European Union Privacy Notice" section of this document

Accuracy of Personal Information: It is important that the personal information we hold about you is accurate and current. ALTOUR requires you to keep us informed of changes to your personal information. If your registration information changes, please send your request to us at the email address below. We take reasonable steps to verify your identity prior to honoring any such requests to help protect your privacy and security.

Accessing Your Personal Information: If you want to know what personal information ALTOUR holds about you or wish to change personal information that is inaccurate or out of date, or to withdraw your consent to our use of your personal information, please contact us at the email address below. It may not always be possible to completely remove or modify information in our databases, although we will make reasonable efforts to do so upon your request. We do not control how our partners retain, store and destroy data they have accessed in connection with assisting with providing our services. You should check their websites for more information on their practices.

Do Not Track Disclosures: Certain browsers may offer you the option of providing notice to websites that you do not wish for your online activities to be tracked for preference-based advertising purposes ("DNT Notice"). Some browsers are, by default, set to provide a DNT Notice, whether or not that reflects your preference. Providing DNT Notice is often touted as a means to ensure that cookies, web beacons and similar technology are not used for preference-based advertising purposes – that is, to restrict the collection of information your online activities for advertising purposes. Unfortunately, given how preference-based advertising works, DNT Notices may not effectively accomplish this goal. For this and a variety of other reasons, with respect to our Site, we do not take any particular action based on browser based DNT Notices. However, we do not use third-party advertisers or engage in behavioral marketing data collection for resale. Rather, if you do not wish to participate in preference-based advertising activities, you should follow the simple opt-out process identified above.

Your California Privacy Rights

If you are a resident of the State of California, you have certain rights under California law to request information concerning our data sharing activities with third parties.

Residents of the State of California, under certain provisions of the California Civil Code, have the right to request from companies conducting business in California a list of all third parties to which the company has disclosed certain personally identifiable information as defined under California law during the preceding year for third party direct marketing purposes. You may request the information in writing at the email address below. You may learn more about your rights under California's privacy laws at https://oag.ca.gov/privacy.

Safeguarding Personal Information

We take the security of your information very seriously. We have implemented industry-standard security measures to protect against the loss, misuse and alteration of the information under our control. To help ensure the confidentiality of your personal information, it is important for you to protect against unauthorized access to your password and to your computer. Be sure to sign off when finished using a shared computer.

ALTOUR will endeavor to safeguard personal information using methods that are appropriate to the sensitivity of the information. We have implemented security measures we consider reasonable and appropriate to protect against the loss, misuse and alteration of the personal information under our control. However, we cannot guarantee or warrant the security of any information you disclose or transmit to us online and are not responsible for the theft, destruction, or inadvertent disclosure of your personal information. In the unfortunate event that your information is compromised, we may notify you by e-mail or U.S. mail to the last e-mail address or postal address you have provided us in the most expedient time reasonable under the circumstances, or as otherwise required by applicable law. We may delay notification as necessary while we take measures to determine the scope of the breach and restore reasonable integrity to our system as well as for the legitimate needs of law enforcement. From time to time we evaluate new technology for protecting information, and when appropriate, we upgrade our information security systems.

Privacy of Children's Information

Our Site is not directed to children. We do not sell products or services for purchase by children. We will not knowingly collect personal information from children. If you are a parent or guardian of a child under the age of 13 and believe he or she has disclosed personally identifiable information to us, please contact us at the email address altour.gdpr@altour.co.uk. A parent or guardian of a child under the age of 13 may review and request deletion of such child's personally identifiable information as well as prohibit the use of that information.

Linked Sites

This Policy does not apply to your use of unaffiliated websites to which our Site is linked. ALTOUR is not responsible for the privacy practices or the content on linked sites. We recommend that you carefully read the privacy policies of each site you visit.

Sole Statement

This Privacy Policy as posted on this Site is the sole statement of our privacy policy with respect to this Site, and no summary, modification, restatement or other version thereof, or other privacy statement or policy, in any form, is valid unless we post a new or revised policy to the Site.

Contacting Us

To get more information about ALTOUR's privacy and information security practices, or if you (a) have questions or comments about our Privacy Policy; (b) wish to make corrections to any personal information you have provided; (c) want to opt-out from receiving future commercial correspondence, including emails, from us or our affiliated companies; or (d) wish to withdraw your consent to sharing your personal information with others, contact us as follows:

By Email: altour.gdpr@altour.co.uk

Changes to This Policy

ALTOUR may from time to time make changes to this Privacy Policy to reflect changes in legal or regulatory obligations or changes in the manner in which we deal with personal information. We will post any revised version of this Privacy Policy on our Site. Any changes will be effective on the effective date stated in the revised Privacy Policy. If there are significant changes we may provide more prominent notice or obtain your consent as required by law. If you do not wish to accept the changes, you should cease using the Site. Your continued use of the Site after we have posted a revised Privacy Policy indicates your agreement to the revisions.

This Privacy Policy was last updated on May 25, 2018.

************************

European Union Privacy Notice

This Privacy Notice applies to our processing of personal data of EU residents that is covered by the EU General Data Protection Regulation (GDPR) and is a supplement to our Privacy Policy.

Who We Are

ALTOUR International, Inc. is a travel services business headquartered in New York, New York. ALTOUR is the controller of your personal data that we have collected.

Personal Data

Personal Data is a legal term that describes any information that identifies a particular person and has special meaning under European Union law.

For purposes of the EU's General Data Protection Regulation (GDPR) personal data is any information that can identify you, either directly or indirectly, such as a name, an identification number, your IP address, data about your location, or information about your physical, physiological, genetic, mental, economic, cultural or social identity.

We are providing you this notice because we have collected some of your personal data from you. We collect your data for a variety of reasons, depending on whether you are an employee, a customer, an agent, or a vendor.

What is the Legal Basis and Purpose for Holding Your Personal Information?

If you are a customer, an employee, or a job applicant, the personal information we hold, may be used because it is necessary for the performance of the services contract to which you are a party, because it is necessary for our legitimate interest in processing such personal information in the context in which you provided it to us, or for another lawful basis. We will endeavor to inform you of the legal basis for collection of your personal information prior to or at the time we collect it.

If you are a prospective customer, the personal information we collect, and use is necessary for our legitimate interest in providing you with information about the services we offer, and about which you have expressed an interest or that we believe will be of benefit to you. If another legal basis applies to our collection and use of your data, we will endeavor to inform you prior to or at the time we collect it.

In some cases, our legal basis for collecting your personal data is because you have expressly consented to our collection and use of your personal information.

How Long Do We Keep Your Personal Data?

If you are a customer, applicant for employment, vendor or agent, we will keep your personal data on an ongoing basis for so long as we have a legitimate interest to inform you of our services, or until our contractual relationship has terminated, as the case may be. We are required to retain certain information in accordance with the law, such as information needed for income tax and audit purposes. How long certain kinds of personal data should be kept may also be governed by specific business-sector requirements and agreed practices.

Your Rights as a Data Subject

You have important rights that you may exercise to protect your personal data. You may access those rights at any time by contacting us at altour.gdpr@altour.co.uk.

You have the following rights concerning your personal data that we hold and process that you can exercise at any time:

• Right of access – you have the right to request a copy of the information that we hold about you.
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to judicial review: if ALTOUR refuses your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in the process below.

Please note: we will not be able to delete information that is required to maintain our business purpose or that is required to facilitate your contract with us. All the above requests will be forwarded on to other parties holding and processing your data where appropriate.

For more information about your personal data rights please visit the Information Commissioner Office for the United Kingdom's website at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/.

What forms of ID will I need to provide to access this?

ALTOUR accepts the following forms of ID and validation when information on your personal data is requested: You will need to send an email from the email address account associated with your personal data as stored on Altour's systems.

Under what Circumstances will ALTOUR Contact me?

Our aim is not to be intrusive, and we undertake not to ask irrelevant or unnecessary questions. Moreover, the information you provide will be subject to rigorous measures and procedures to minimize the risk of unauthorized access or disclosure.

Consent

For certain types of personal data, we have asked for your consent to use the data for certain described purposes at the time you provided it. You may withdraw your consent at any time. When you give us your consent, you are giving us permission to process your personal data specifically for the purpose identified in the consent request. Where we ask you for additional personal data, we will obtain your consent to our proposed use of that data where required, and always tell you why and how the information will be used.

You may withdraw consent at any time by sending an email to altour.gdpr@altour.co.uk

Sharing with Third Parties

We may pass your personal data on to third-party service providers contracted by ALTOUR to perform certain services for us, or to collaborate directly with you. For a complete and up-to-date list of the third parties we are currently using, please send an email to altour.gdpr@altour.co.uk

Any third parties that we may share your data with are obliged to keep your details securely, and to use them only for the purposes and to complete the tasks identified within the ALTOUR/Contractor contract. When they no longer need your data to fulfil this service, they will dispose of the details in line with ALTOUR's procedures. If we wish to pass your personal data onto any additional third parties, we will only do so once we have obtained your consent, unless we are legally required to do otherwise.

International Transfer of Personal Data

ALTOUR may transfer your personal information within ALTOUR and/or to other third parties, such as our third-party service providers. Your personal information may be transferred to, stored, and processed in a country other than the one in which it was collected. This may include the United States. When we do so, we transfer the information in compliance with applicable data protection laws. In particular, we have implemented safeguards in the form of standard data protection clauses adopted by the European Commission. The safeguards ensure compliance with the data protection requirements of the GDPR as well as your rights appropriate to the processing of your personal data. You can obtain a copy of the standard contractual clauses by contacting us at altour.gdpr@altour.co.uk

Safeguarding Personal Data

Please refer to the "Safeguarding Personal Information" section above for information about our data security measures.

Who Do I Contact to Lodge a Complaint About How My Personal Data Is Being Handled?

If you wish to raise a complaint on how we handle your personal data, you can contact our Privacy Officer as follows:

By Email: altour.gdpr@altour.co.uk

If you are not satisfied with our response you can complain to the Information Commissioner Office for the United Kingdom. Their Help Desk number is 0303 123 1113.

************************

COOKIE POLICY

To make this site work properly, we sometimes place small data files called cookies on your device. Most big websites do this too.

What are cookies?

A cookie is a small text file that a website saves on your computer or mobile device when you visit the site. It enables the website to remember your actions and preferences (such as login, language, font size and other display preferences) over a period of time, so you don't have to keep re-entering them whenever you come back to the site or browse from one page to another.

How do we use cookies?

We use cookies for the following purposes:

• Assisting you in navigation of our sites
• To help you provide feedback to us
• Analysing your use of our products, services or applications

We use the following cookies and classify cookies in the following categories:

1. Strictly necessary Cookies
2. Performance Cookies
3. Functional Cookies
4. Targeting Cookies

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Cookies Used

• OptanonConsent
• OptanonAlertBoxClosed
• PHPSESSID
• JSESSIONID

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.

Cookies Used

• _ga
• _gid
• _gat

Functional Cookies

These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

Cookies Used

• __atuvs
• __atuvc

vimeo.com

• vuid

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Cookies Used

addthis.com

• loc
• xtc
• bt2
• mus
• uid
• uvc
• di2
• vc

google.com

• APISID
• SSID
• PREF
• SID
• SAPISID
• HSID

mathtag.com

• uuidc
• uuid

doubleclick.net

• id

How to control cookies

You can control and/or delete cookies as you wish – for details, see aboutcookies.org. You can delete all cookies that are already on your computer and you can set most browsers to prevent them from being placed. If you do this, however, you may have to manually adjust some preferences every time you visit a site and some services and functionalities may not work.

EU PRIVACY SHIELD

ALTOUR has adopted this Privacy Shield Policy ("Policy") to establish and maintain an adequate level of Personal Data privacy protection. This Policy applies to the processing of Personal Data that ALTOUR obtains from Customers located in the European Union.

ALTOUR complies with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union to the United States. ALTOUR has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. ALTOUR is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/

In compliance with the Privacy Shield Principles, ALTOUR commits to resolve complaints about our collection or use of your personal information. EU individuals with inquiries or complaints regarding our Privacy Shield policy should first contact ALTOUR at: privacyshield@altour.com. ALTOUR has further committed to cooperate with the panel established by the EU data protection authorities (DPAs) with regard to unresolved Privacy Shield complaints concerning data transferred from the EU.

All ALTOUR employees who handle Personal Data from Europe are required to comply with the Principles stated in this Policy.

Capitalized terms are defined in Section XIV of this Policy.

Scope

This Policy applies to the processing of EU Residents’ Personal Data that ALTOUR receives in the United States concerning EU Residents who reside in the European Union. ALTOUR provides products and services to businesses and consumers.

This Policy does not cover data from which individual persons cannot be identified or situations in which pseudonyms are used. (The use of pseudonyms involves the replacement of names or other identifiers with substitutes so that identification of individual persons is not possible.)

Responsibilities and Management

ALTOUR has designated its Data Protection Office to oversee its information security program, including its compliance with the EU Privacy Shield program. The Data Protection Office shall review and approve any material changes to this program as necessary. Any questions, concerns, or comments regarding this Policy also may be directed to privacyshield@altour.com

ALTOUR will maintain, monitor, test, and upgrade information security policies, practices, and systems to assist in protecting the Personal Data that it collects. ALTOUR personnel will receive training, as applicable, to effectively implement this Policy. Please refer to Section VII for a discussion of the steps that ALTOUR has undertaken to protect Personal Data.

Renewal / Verification

ALTOUR will renew its US-EU Privacy Shield certifications annually, unless it subsequently determines that it no longer needs such certification or if it employs a different adequacy mechanism.

Prior to the re-certification, ALTOUR will conduct an in-house verification to ensure that its attestations and assertions about its treatment of EU Residents’ Personal Data are accurate and that the company has appropriately implemented these practices. Specifically, as part of the verification process, ALTOUR will undertake the following:

• Review this Privacy Shield policy and its publicly posted website privacy policy to ensure that these policies accurately describe the practices regarding the collection of EU Residents’ Personal Data
• Ensure that the publicly posted privacy policy informs EU Residents of ALTOUR's participation in the US EU Privacy Shield program and where to obtain a copy of additional information (e.g., a copy of this Policy)
• Ensure that this Policy continues to comply with the Privacy Shield principles
• Confirm that EU Residents are made aware of the process for addressing complaints and any independent dispute resolution process (ALTOUR may do so through its publicly posted website, Individual Customer contract, or both)
• Review its processes and procedures for training Employees about ALTOUR's participation in the Privacy Shield programs and the appropriate handling of EU Resident's Personal Data.
• ALTOUR will prepare an internal verification statement on an annual basis.

Collection and Use of Personal Data

ALTOUR provides various solutions to its Individual Customers who purchase its products. ALTOUR collects Personal Data from Individual Customers when they purchase its products, register with our website, log-in to their account, complete surveys, request information or otherwise communicate with us. For example, ALTOURindividual customers may choose to seek live support or post to a message board.

The Personal Data that we collect may vary based on the Individual Customer's interaction with our website and request for our services. As a general matter, ALTOUR collects the following types of Personal Data from its Individual Customers: contact information, including, a contact person's name, work email address, work mailing address, work telephone number, title, and company name, as well as payment information (which might include credit card and/or bank account information). Individual customers have the option to log into their accounts online and to request service online, including through a live support option; we will collect information that they choose to provide to us through these portals.

When Individual Customers use our services online, we will collect their IP address and browser type. We may associate IP address and browser type with a specific customer. We also may collect Personal Data from persons who contact us through our website to request additional information; in such a situation, we would collect contact information (as discussed above) and any other information that the person chooses to submit through our website.

The information that we collect from Individual Customers is used for selling the products and services they buy from us, managing transactions, reporting, invoicing, renewals, other operations related to providing services and products to the Individual Customer.

For certain products, ALTOUR serves as a service provider. In our capacity as a service provider, we will receive, store, and/or process Personal Data. In such cases, we are acting as a data processor and will process the personal information on behalf of and under the direction of our partners and/or agents. The information that we collect from our Individual Customers in this capacity is used for managing transactions, reporting, invoicing, renewals, other operations related to providing services to the Individual Customer, and as otherwise requested by our partner and/or agent.

ALTOUR uses Personal Data that it collects directly from its Individual Customers and for its partners indirectly in its role as a service provider for the following business purposes, without limitation:

• maintaining and supporting its products, delivering and providing the requested products/services, and complying with its contractual obligations related thereto (including managing transactions, reporting, invoices, renewals, and other operations related to providing services to an Individual Customer);
• satisfying governmental reporting, tax, and other requirements (e.g., import/export);
• storing and processing data, including Personal Data, in computer databases and servers located in the United States;
• verifying identity (e.g., for online access to accounts);
• as requested by the Individual Customer;
• for other business-related purposes permitted or required under applicable local law and regulation;
• And as otherwise required by law.

ALTOUR does not disclose personal information to third parties for purposes that are materially different than what it was originally collected for. Should this change in the future, we will provide individuals with the option to opt-out.

Disclosures / Onward Transfers of Personal Data

Except as otherwise provided herein, ALTOUR discloses Personal Data only to Third Parties who reasonably need to know such data only for the scope of the initial transaction and not for other purposes. Such recipients must agree to abide by confidentiality obligations.

ALTOUR may provide Personal Data to Third Parties that act as agents, consultants, and contractors to perform tasks on behalf of and under our instructions. For example, ALTOUR may store such Personal Data in the facilities operated by Third Parties. Such Third Parties must agree to use such Personal Data only for the purposes for which they have been engaged by ALTOUR and they must either:

• comply with the Privacy Shield principles or another mechanism permitted by the applicable EU data protection law(s) for transfers and processing of Personal Data;
• or agree to provide adequate protections for the Personal Data that are no less protective than those set out in this Policy;

ALTOUR also may disclose Personal Data for other purposes or to other Third Parties when a Data Subject has consented to or requested such disclosure. Please be aware that ALTOUR may be required to disclose an individual's personal information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements. ALTOUR is liable for appropriate onward transfers of personal data to third parties.

Sensitive Data

ALTOUR does not collect Sensitive Data from its Individual Customers.

Data Integrity and Security

ALTOUR uses reasonable efforts to maintain the accuracy and integrity of Personal Data and to update it as appropriate. ALTOUR has implemented physical and technical safeguards to protect Personal Data from loss, misuse, and unauthorized access, disclosure, alternation, or destruction. For example, electronically stored Personal Data is stored on a secure network with firewall protection, and access to ALTOUR's electronic information systems requires user authentication via password or similar means. ALTOUR also employs access restrictions, limiting the scope of employees who have access to Individual Customer Personal Data.

Further, ALTOUR uses secure encryption technology to protect certain categories of personal data. Despite these precautions, no data security safeguards guarantee 100% security all of the time.

Notifications

ALTOUR notifies Individual Customers about its adherence to the EU-US Privacy Shield principles through its publicly posted website privacy policy, available at: http://www.altour.com/Privacy-Policy and take Individual customers approval and adherence to the current policy when they provide their information to us in the transactional process.

Accessing Personal Data

ALTOUR personnel may access and use Personal Data only if they are authorized to do so and only for the purpose for which they are authorized.

Right to Access, Change or Delete Personal Data

Right to Access: Individual Customers have the right to know what Personal Data about them is included in the databases and to ensure that such Personal Data is accurate and relevant for the purposes for which ALTOURcollected it. Individual Customers may review their own Personal Data stored in the databases and correct, erase, or block any data that is incorrect, as permitted by applicable law and ALTOUR policies. Upon reasonable request and as required by the Privacy Shield principles, ALTOUR allows Individual Customers access to their Personal Data, in order to correct or amend such data where inaccurate. Individual Customers may edit their Personal Data by logging into their account profile or by contacting ALTOUR by phone or email. In making modifications to their Personal Data, Data Subjects must provide only truthful, complete, and accurate information. To request erasure of Personal Data, Individual Customers should submit a written request to local ALTOUR office.

Requests for Personal Data: ALTOUR will track each of the following and will provide notice to the appropriate parties under law and contract when either of the following circumstances arise: (a) legally binding request for disclosure of the Personal Data by a law enforcement authority unless prohibited by law or regulation; or (b) requests received from the Data Subject. If ALTOUR receives a request for access to his/her Personal Data from an Individual Customer, then, unless otherwise required under law or by contract with such Individual Customer, ALTOUR will refer such Data Subject to the Individual Customer.

Satisfying Requests for Access, Modifications, and Corrections. ALTOUR will endeavor to respond in a timely manner to all reasonable written requests to view, modify, or inactivate Personal Data.

Changes to this Policy

This Policy may be amended from time to time, consistent with the Privacy Shield Principles and applicable data protection and privacy laws and principles. We will make employees available of changes to this policy either by posting to our intranet, through email, or other means. We will notify Customers if we make changes that materially affect the way we handle Personal Data previously collected, and we will allow them to choose whether their Personal Data may be used in any materially different manner.

Questions or Complaints

EU Individual customers may contact ALTOUR with questions or complaints concerning this Policy at the following address: privacyshield@altour.com

Enforcement and Dispute Resolution

In compliance with the US-EU Privacy Shield Principles, ALTOUR commits to resolve complaints about your privacy and our collection or use of your personal information. EU individuals with questions or concerns about the use of their Personal Data should contact us at: privacyshield@altour.com

If a Customer's question or concern cannot be satisfied through this process ALTOUR has further committed to refer unresolved privacy complaints under US-EU Privacy Shield to an independent dispute resolution mechanism operated by the Council of Better Business Bureaus.

If you do not receive timely acknowledgement of your complaint, or if your complaint is not satisfactorily addressed by ALTOUR, EU individuals may bring a complaint before the BBB EU Privacy Shield program can be found at: www.bbb.org/EU-privacy-shield/for-eu-consumers . Finally, as a last resort and in limited situations, EU individuals may seek redress from the Privacy Shield Panel, a binding arbitration mechanism.

ALTOUR commits to cooperate with EU data protection authorities (DPAs) and comply with the advice given by such authorities with regard to human resources data transferred from the EU in the context of the employment relationship.

Defined Terms

Capitalized terms in this Privacy Policy have the following meanings:

"Individual Customer" means an Individual customer or client of ALTOUR from EU. The term also shall include any individual agent, representative, of an individual customer of ALTOUR and all employee of ALTOUR where ALTOUR has obtained his or her Personal Data from such Individual Customer as part of its business relationship with ALTOUR.

"Data Subject" means an identified or identifiable natural living person. An identifiable person is one who can be identified, directly or indirectly, by reference to a name, or to one or more factors unique to his or her personal physical, psychological, mental, economic, cultural or social characteristics.

"Employee" means an employee (whether temporary, permanent, part-time, or contract), former employee, independent contractor, or job applicant of ALTOUR or any of its affiliates or subsidiaries, who is also a resident of a country within the European Economic Area.

"Europe" or "European" refers to a country in the European Union.

"Personal Data" as defined under the European Union Directive 95/46/EC means data that personally identifies or may be used to personally identify a person, including an individual's name in combination with country of birth, marital status, emergency contact, salary information, terms of employment, job qualifications (such as educational degrees earned), address, phone number, e-mail address, user ID, password, and identification numbers. Personal Data does not include data that is de-identified, anonymous, or publicly available.

"Sensitive Data" means Personal Data that discloses a Data Subject's medical or health condition, race or ethnicity, political, religious or philosophical affiliations or opinions, sexual orientation, or trade union membership.

"Third Party" means any individual or entity that is neither ALTOUR nor an ALTOUR employee, agent, contractor, or representative.

‍