You can request details of your personal information we hold. We shall then confirm and disclose additional information including the types of Personal information, the sources it originated from, the purpose and legal basis for the processing, the expected retention period and the safeguards regarding data transfers to non-EEA countries, subject to the limitations set out in applicable laws and regulations. A copy of your personal information gathered will be shared free of charge, but additional costs may be incurred to cover our administrative costs in case more copies of the above mentioned information are required.

At your request, we will correct incomplete or inaccurate parts of your Personal information, although we may need to verify the accuracy of the new information provided to us.

At your request, we will delete your personal information if:
(i) it is no longer necessary for us to retain your Personal information,
(ii) you withdraw consent which formed the legal basis for the processing of your Personal Information,
(iii) you object to the processing of your personal information and there are no overriding legitimate grounds for such processing,
(iv) the personal information was processed illegally,
(v) the personal information must be deleted for us to comply with our legal obligations.

We will decline your request for deletion if processing of your personal information is necessary:
(i) for us to comply with our legal obligations,
(ii) for the establishment, exercise or defense of legal claims, or
(iii) for the performance of a task in the public interest.

At your request, we will restrict the processing of your personal information if:
(i) you dispute the accuracy of your Personal information,
(ii) your personal information was processed illegally and you request a limitation on processing rather than the deletion of your Personal information,
(iii) we no longer need to process your Personal information, but you need your personal information in connection with the establishment, exercise or defence of a legal claim, or
(iv) you object to the processing of your personal information pending verification as to whether an overriding legitimate ground for such processing exists. We may continue to store your personal information to the extent required to ensure your request to restrict processing is respected in the future.

At your request, we will provide you free of charge with your personal information in a structured, commonly used and machine-readable format, if:
(i) you provide us with your Personal information,
(ii) the processing of your personal information is required for the performance of a contract, or
(iii) the processing is carried out by automated means.

Where we rely on our legitimate interests (or that of a third-party) to process your Personal information, you have the right to object to this processing on grounds related to your particular situation if you feel it impacts your fundamental rights and freedoms. We will comply with your request unless we have compelling legitimate grounds for the processing which override your rights and freedoms, or where the processing is in connection with the establishment, exercise or defence of legal claims. We will always comply with your objection to the processing of your personal information for direct marketing purposes.

You will not be subject to decisions with a legal or similarly significant effect (including profiling) that are based solely on the automated processing of your Personal information, unless you have given us your explicit consent or where they are necessary for the performance of the contract with us.

You have the right to withdraw consent you may have previously given us at any time. In order to exercise your right to withdraw consent we may ask you for certain identifying information to ensure the security of your Personal information.

Please contact us at privacy@itilite.com to make a request to exercise any of the above rights. We will respond to your request within 30 days, or notify you in case of any delay. In case the request, it will be supported with the appropriate reasons. Typically, no fee is charged with respect to the exercise of your rights. However, if your request is manifestly unfounded or excessive (for example, because of its repetitive character) we may charge a reasonable fee, taking into account the administrative costs of dealing with your request.

Kindly note that if you decide to exercise some of your rights, we may be unable to perform the actions necessary to achieve the purposes set out above or you may not be able to use or take full advantage of our Services.

If you are not satisfied with our response, you have the right to complain or seek advice from a supervisory authority and/or bring a claim against us in any court of competent jurisdiction.

As part of the Services, we may send you transactional, promotional, commercial and informational emails. You may opt-out from receipt of these emails and unsubscribe by clicking “unsubscribe” at the bottom of the emails you receive from us.

You have the right to object to the use of your personal information for direct marketing purposes, on a going forward basis, by emailing us at privacy@itilite.com.

For users of the ITILITE Platform, we disclose information to your employer such as your travel behavior, redemption behavior and year-end redemption reporting for tax purposes.

We disclose your first and last name and email address to our third-party messaging platform to provide user support. In accordance with the Client contracts, we may disclose your personal information to other third-party vendors that enable us to provide the Services including an email service provider to send emails on our behalf and customer support providers (together with “Sub-Processors”).

Some of these Sub-Processors may be based in locations outside the EU. Transfers to Sub-Processors are covered by the provisions in this Privacy Policy regarding notice and choice and the service agreements with our Clients. You hereby consent to our sharing of personal information with our Sub-Processors.

Our Services may contain links to other websites that are independent, are not owned or operated by us, and which may incorporate third-party information. One example is a link to google maps, which can be used for routing. These third-party sites have separate and independent privacy policies. If you access other sites using the links provided, the operators of these sites may collect information from you, which will be used by them in accordance with their privacy policy and terms of service, which may differ from ours.

We,therefore, have no responsibility or liability for the content and activities of other websites, even if they are linked to our Services. This Privacy Policy does not cover information collected on third-party websites. We encourage you to carefully review the privacy policies of any third-party sites you access.

We may also release your information when we believe release is appropriate to comply with the law, enforce our Privacy Policies, detect or prevent fraud, security or technical issues, or protect our or others’ rights, property, or safety. This includes exchanging information with other companies and organizations for fraud protection and spam/malware prevention. Because our servers that store your information are located in the U.S.A., your information may be available to U.S. government entities or agencies under a lawful court order or other legal process in the U.S.

Except as set forth above, you will be notified when your personal information may be shared with third-parties, and will be able to prevent the sharing of this information. We will share your personal information only in the ways that are described in this Privacy Policy.

When acting as a service provider, we will retain your Personal Information, which we process on behalf of our Clients for as long as needed to provide services to our Client, for as long as your account is active, or as needed to provide you services. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We retain your personal information for up to sixty (60) days after your account is closed.

We will take reasonable precautions to protect personal information from loss, misuse, unauthorized access, disclosure, alteration and destruction. We follow industry standards to protect this personal information submitted to us. All information is stored on secure cloud servers and protected with additional security layers, encryptions and passwords.

For example, our Services sit on secure servers operated by Amazon Web Services (AWS EC2). We use a method endorsed by the National Institute of Standards and Technology to protect your passwords (PBKDF2 algorithm with a SHA256 hash for password stretching). All of the data transfer is over secure HTTP protocol (HTTPS) and we deploy TLS1.2 for transport layer security. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, we cannot guarantee its absolute security.

Given that the Internet operates in a global environment and that, if you operate outside of the United States, transfer of your data is necessary for you to use any of our Services or request information from us, using the Internet to collect and process personal information necessarily involves the transmission of data on an international, or cross-border, basis. By accessing any of these Services, and/or communicating with us by email, you acknowledge and voluntarily provide your express consent to our collection, processing and disclosure of your personal information in this way, including our disclosure to Sub-Processors and third-parties located in the US and other locations outside the EU.

For users who are located outside the United States, personal information will be transferred outside of each user’s country to the United States where our servers are located and where it will be processed and stored. According to EU data protection authorities, the U.S. does not provide an adequate level of protection for the purpose of providing the Services. We will take all steps reasonably necessary to ensure that personal information is treated securely and in accordance with this Privacy Policy in respect of such transfer.

By registering for the ITILITE Platform or by accessing any of the Services you voluntarily and expressly agree to such transfer and disclosure.