Last Updated: January 1, 2020
Vrbo, part of the Expedia Group, values you as our customer and recognizes that privacy is important to you. This Privacy Statement explains how we collect, use, and disclose data when you use our platform and associated services, and tells you how to contact us.
Privacy Statement Summary
This is a summary of our Privacy Statement. To review our Privacy Statement in full, please scroll down.
1. What does this Privacy Statement cover?
This Privacy Statement is designed to describe:
• How and what type of personal information we collect and use
• When and with whom we share your personal information
• What choices you can make about how we collect, use, and share your personal information
2. What personal information do we collect and use, and how do we collect it?
We collect personal information when:
• You give us the information
• We collect it automatically
• We receive it from others
When you create an account on one of our sites, sign up to receive offers or information, or make a booking using our platform, you give us your personal information. We also collect such information through automated technology such as cookies placed on your browser—with your consent where applicable—when you visit our sites or download and use our mobile apps. We also receive information from affiliated companies within Expedia Group as well as from business partners and other third parties, which helps us improve our platform and associated tools and services, update and maintain accurate records, detect and investigate potential fraud, and more effectively market our services.
3. How is your personal information shared?
Your personal information may be shared to help you make a booking, assist you with or during your travel or stay, communicate with you (including when we send information about products and services or enable you to communicate with travel providers or property owners or managers), or to comply with the law. Our full Privacy Statement provides additional detail regarding how your personal information may be shared.
4. What are your rights and choices?
You can exercise your data-protection rights in various ways. For example, you can opt out of marketing by clicking the “unsubscribe” link in emails you receive, changing preferences in your account, as applicable, or by contacting our customer service team. Our Privacy Statement has more information about the options and data-protection rights available to you.
5. How to contact us
More information about our privacy practices is in our full Privacy Statement. You can also contact us as described below in the Contact Us section to ask questions about how we handle your personal information or to make requests about your personal information.
Categories of Personal Information We Collect
Use of Personal Information
Sharing of Personal Information
Your Rights and Choices
International Data Transfer & Privacy Shield
Updates to Privacy Statement
Categories of Personal Information We Collect
When you use our platform, mobile apps, or associated tools or services, we may collect the following kinds of personal information from you:
• Name, email address, telephone number; and home, business, and billing addresses
• Government-issued identification as required for booking or identity verification, such as passport, driver’s license, and government redress numbers; and for vacation-property owners and managers, tax identification numbers
• Payment information such as payment card number, expiration date, and billing address
• Travel-related preferences and requests such as favorite destinations and accommodation types, and special dietary and accessibility needs, as available
• Loyalty program and membership information
• Birth date and gender
• Images, videos, and other recordings
• Social media account IDs and other publicly available information
• Communications with us (such as recordings of calls with customer service representatives for quality assurance and training purposes)
• Searches you conduct, transactions into which you enter, and other interactions with you on or through our websites and apps
• Other communications that occur through the platform among partners and travelers, and in group-chat and traveler-collaboration tools
• Data you provide about other people, such as your travel companions or others for whom you are making a booking
• Information we receive about you from other Expedia Group companies and third parties such as our business and affiliate partners and authorized service providers, which may include updated contact information, demographic information, interests, and purchase history, which information we may add to your account or profile and use for market research and analysis
When you install any of our apps or use our platform, we automatically collect the following types of information from your device:
• IP address
• Device type
• Unique device identification numbers
• Internet browser-type (such as Firefox, Safari, Chrome, and Internet Explorer)
• Internet Service Provider
• Operating System
• Mobile carrier
• How your device has interacted with our online services, including pages accessed, links clicked, trips viewed, and features used, along with associated dates and times
• Details of any referring website or exit pages, as well as general geographic location (such as at the country or city-level)
When you download and use any of our mobile apps, we collect certain technical information from your device to enable the app to work properly and as otherwise described in this Privacy Statement. That technical information includes:
• Device and telephone connectivity information such as your carrier, network type, network operator, subscriber identity module ("SIM") operator, and SIM country
• Operating system and version
• Device model
• Performance and data usage
• Usage data, such as dates and times the app accesses our servers, the features and links clicked in the app, searches, transactions, and the data and files downloaded to the app
• Device settings selected or enabled, such as Wi-Fi, Global Positioning System ("GPS"), and Bluetooth (which may be used for location services, subject to your permission as explained below)
• Mobile device settings
• Other technical information such as app name, type, and version as needed to provide you with services
Permissions for Location-Based Services:
Depending on your device’s settings and permissions and your choice to participate in certain programs, we may collect the location of your device by using GPS signals, cell phone towers, Wi-Fi signals, Bluetooth or other technologies. We will collect this information, if you opt in through the app or other program (either during your initial login or later), to enable certain location-based services available within the app (for example, locating available lodging closest to you). To disable location capabilities of the app, you can log off or change your mobile device’s settings.
Use of Personal Information
We use your personal information for various purposes described below, which depend on the site you visit or the app you use.
Your Use of Online Sites, Apps, and Services:
• Book the requested travel or enable vacation-property booking
• Provide services related to the booking or account
• Create, maintain, and update user accounts on our platform and authenticate you as a user
• Maintain your search and travel history, accommodation and travel preferences, and similar information about your use of Expedia Group’s platform and services, and as otherwise described in this Privacy Statement
• Enable and facilitate acceptance and processing of payments, coupons, and other transactions
• Administer loyalty and rewards programs
• Collect and enable booking-related reviews
• Help you to use our services faster and more easily through features such as the ability to sign-in using your account within the online services and sites of some of the Expedia Group companies
Communications and Marketing:
• Respond to your questions and requests for information, and process information choices
• Enable communication between travelers and travel suppliers, such as hotels and vacation-property owners and managers
• Contact you (such as by text message, email, phone call, mail, push notification, or messaging on other communication platforms) to provide information such as travel booking confirmations and updates, for marketing purposes, or for other purposes as described in this Privacy Statement
• Market our products and services, optimize such marketing to be more relevant to you, and measure and analyze the effectiveness of our marketing and promotions
• Administer promotions such as contests, sweepstakes, and similar giveaways
Other Business Purposes and Compliance
• Conduct surveys, market research, and data analytics
• Maintain, improve, research, and measure the effectiveness of our sites and apps, activities, tools, and services
• Monitor or record calls, chats, and other communications with our customer-service team and other representatives, as well as platform communications between or among partners and travelers for quality control, training, dispute resolution, and as otherwise described in this Privacy Statement
• Create aggregated or otherwise anonymized or deidentified data, which we may use and disclose without restriction where permissible
• Promote security, verify identity of our customers, prevent and investigate fraud and unauthorized activities, defend against claims and other liabilities, and manage other risks
• Comply with applicable laws, protect our and our users’ rights and interests, defend ourselves, and respond to law enforcement, other legal authorities, and requests that are part of legal processes
• Comply with applicable security and anti-terrorism, anti-bribery, customs and immigration, and other such due-diligence laws and requirements
• Operate our business as permitted by law
Sharing of Personal Information
We share your personal information as described below and in this Privacy Statement, and as permitted by applicable law.
• Expedia Group Companies. We share your personal information within the Expedia Group companies, a complete list of which can be found at www.expediagroup.com. Expedia Group companies may share, access, and use your personal information as described in this Privacy Statement.
• Third-party service providers. We share personal information with third parties in connection with the delivery of services to you and the operation of our business (for example, to provide payment-card processing, customer service, business analytics, and fraud-prevention and compliance services, and to serve you with advertising tailored to your interests). These third-party service providers are required to protect personal information we share with them and may not use any directly identifying personal information other than to provide the services for which we have contracted them. They are not allowed to use the personal information we share for purposes of their own direct marketing (unless you have separately consented to such use under the terms provided by the third party).
• Travel suppliers. We share personal information with travel-related suppliers such as hotels, airlines, car-rental companies, insurance providers, vacation-rental property owners and managers, and where available, activity providers, and rail and cruise lines who fulfill your booking. Please note that travel suppliers may contact you to obtain additional information if and as required to facilitate your booking or to otherwise provide the travel or associated services.
• Business partners and offers. If we promote a program or offer a service or product in conjunction with a third-party business partner, we will share your information with that partner to assist in marketing or to provide the associated product or service. In most of those cases, the program or offer will include the name of the third-party business partner, either alone or with ours, or you will be redirected to the website of that business with notice. An example of such a business-partner relationship would be a third-party loyalty program for which you could earn points by completing a booking on our platform.
• Legal rights and obligations. We may disclose your personal information to enforce our policies, or where we are permitted (or believe in good faith that we are required) to do so by applicable law, such as in response to a request by a law enforcement or governmental authority, in connection with actual or proposed litigation, or to protect and defend our property, people, or other rights or interests. We may also share your personal information pursuant to a subpoena or other legal request, or as necessary to remit certain taxes in the course of processing payments as required by law or legal process.
• Corporate transactions. We may share your personal information in connection with a corporate transaction, such as a divestiture, merger, consolidation, assignment, or asset sale, or in the unlikely event of bankruptcy. In the case of an acquisition, we will inform the buyer that it may use your personal information only for the purposes disclosed in this Privacy Statement.
Your Rights and Choices
You have certain rights and choices with respect to your personal information, as described below:
• If you have an account with us, you may change your communication preferences by either (1) logging in and updating the information in your account (not available for all Expedia Group companies) or (2) contacting us through our help portal
• You can control our use of certain cookies by following the guidance in our Cookie Statement.
• You can update the accuracy of your information at any time by either logging into your account or contacting us
• If you no longer wish to receive marketing and promotional emails, you may unsubscribe by clicking the “unsubscribe” link in the email. You can also log into your account to change communication settings (not available for all Expedia Group companies). Please note that if you choose to unsubscribe from or opt out of marketing emails, we may still send you important transactional and account-related messages from which you will not be able to unsubscribe. For more information and a link to contact customer service, click here
• For our mobile apps, you can view and manage notifications and preferences in the Settings menus of the apps and of your operating system
• If we are processing your personal information on the basis of consent, you may withdraw that consent at any time by contacting us. Withdrawing your consent will not affect the lawfulness of any processing that occurred before you withdrew consent and it will not affect our processing of your personal information that is conducted in reliance on a legal basis other than consent
For questions about privacy and your rights and choices, please contact us.
For California residents:
California residents may exercise the following rights:
• To request a copy of your personal information
• To request disclosure of personal information sold or disclosed for a business purpose
• To request the deletion of personal information
• To opt out of the sale of personal information, click here
International Data Transfer
The personal information we process may be transmitted or transferred to countries other than the country in which you reside. Those countries may have data-protection laws that are different from the laws of your country.
The servers for our platform are located in the United States, and the Expedia Group companies and third-party service providers operate in many countries around the world. When we collect your personal information, we may process it in any of those countries.
We have taken appropriate steps and put safeguards in place to help ensure that your personal information remains protected in accordance with this Privacy Statement. For example, any data transfers between Expedia Group companies are governed by our intragroup agreements, which incorporate strict data-transfer terms (including the European Commission's Standard Contractual Clauses, for transfers from the EEA) and require all group companies to protect the personal information they process in accordance with applicable data-protection law. In addition, certain Expedia Group U.S. affiliates have certified with the EU-U.S. and Swiss-U.S. Privacy Shield, as explained below in the "Privacy Shield" section.
We also require that third-party service providers to whom a data transfer is made have appropriate safeguards in place to protect your personal information in compliance with applicable data protection law. The particular measures used will depend on the service provider, and our agreements with them may include European Commission approved Standard Contractual Clauses, the service provider's certification under the EU-U.S. or Swiss-U.S. Privacy Shield certification, or reliance on the service provider's Binding Corporate Rules, as defined by the European Commission.
Certain Expedia Group U.S. affiliates have certified to the EU-U.S. and Swiss-U.S. Privacy Shield frameworks and that we adhere to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfers, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement, and Liability for personal information from the EU, Switzerland, and the United Kingdom. Our certifications can be found here. For more information about the Privacy Shield principles, please visit www.privacyshield.gov. For more on our adherence to the Privacy Shield Frameworks, please see information posted here.
We want you to feel confident about using our platform and all associated tools and services, and we are committed to taking appropriate steps to protect the information we collect. While no company can guarantee absolute security, we do take reasonable steps to implement appropriate physical, technical, and organizational measures to protect the personal information that we collect and process.
We will retain your personal information in accordance with all applicable laws, for as long as it may be relevant to fulfill the purposes set forth in this Privacy Statement, unless a longer retention period is required or permitted by law. We will de-identify, aggregate, or otherwise anonymize your personal information if we intend to use it for analytical purposes or trend analysis over longer periods of time.
The criteria we use to determine our retention periods include:
• The duration of our relationship with you, including any open accounts you may have with Expedia Group companies, or recent bookings or other transactions you have made on our platform
• Whether we have a legal obligation related to your personal information, such as laws requiring us to keep records of your transactions with us
• Whether there are any relevant legal or tax-related obligations affecting how long we will keep your personal information, including contract and audit obligations, litigation holds, statutes of limitations, and regulatory investigations
Types of cookies and similar technologies
Cookies are small pieces of text sent as files to your computer or mobile device when you visit most websites. Cookies may be delivered by us (first-party cookies) or delivered by a third-party partner or supplier (third-party cookies). Cookies are either session cookies or persistent cookies. Session cookies enable sites to recognize and link the actions of a user during a browsing session and expire at the end of each session. Persistent cookies help us recognize you as an existing user, and these cookies are stored on your system or device until they expire, although you can delete them before the expiration date.
Other similar technologies
• Web beacons, gifs, and clear gifs are tiny graphics, each with a unique identifier, that are embedded invisibly on sites and in emails. Web beacons allow us to know if a certain page was visited or if ad banners on our sites and other sites are effective. We also use web beacons in our HTML-based emails to let us know whether our emails have been opened by recipients, which helps us to gauge the effectiveness of certain communications, promotions, and marketing campaigns.
• Proximity-based beacons send one-way signals over very short distances, to communicate with associated apps installed on your phone or mobile device. They can notify you, for example, about experiences related to your trip and can alert you to related deals or promotions. Beacons communicate with your device only when you are in close proximity and only if you have given consent within the relevant mobile application.
• Pixels are small objects embedded into a web page that are not visible to the user. We use pixels to deliver cookies to your computer, facilitate the log-in process, monitor the activity on our sites, and deliver online advertising.
• Tags are small pieces of HTML code that tell your browser to request certain content generated by an ad server. We use tags to show you relevant advertising and promotions.
• Local Storage Objects, such as HTML 5, are used to store content and preferences. Third parties with whom we partner to provide certain features on our site to display advertising based upon your web browsing activity use Local Storage Objects to collect and store information.
All of the technologies described above will be collectively referred to in this Cookie Statement as “cookies.”
• Help us improve your experience when visiting our sites
• Fulfill transactions and ensure our sites perform as intended
• Remember your preferences, such as language, region, or currency
• Provide you with relevant advertising and analyze performance of the ads
• Enable you to return to previous travel searches
• Identify errors on our sites
• Help with data protection and potentially detect and investigate malicious or fraudulent activity
• Help us understand traffic to our site, including time and date of the visit, time and date of the last visit, and other information
• Analyze how well our sites are performing
Types of information collected by cookies
The types of information that we collect through cookies include:
• IP address
• Device ID
• Viewed pages
• Browser type
• Browsing information
• Operating system
• Internet Service Provider
• Whether you have responded to, or interacted with, an advertisement
• Referring or referred links or URLs
• Features used and activities engaged in on our sites and in our apps
See the Categories of Personal Information We Collect section above for more information on what types of information are collected automatically.
Types and functions of cookies
Certain cookies are required or “essential” for our sites to function as intended. Essential cookies are necessary for you to navigate our site and use certain features like logging in to your account and managing your bookings. These cookies are also used to remember security settings that allow access to particular content. Lastly, we use essential cookies to collect information on which web pages visitors go to most, so we can improve our online services. You are not able to opt out of essential cookies.
Other Types of Cookies
We also use other types of cookies to make our site engaging and useful to you:
• Functional Cookies. We want to make sure that when you visit our site, your preferences (such as your preferred language), settings, and previous searches are remembered. Functional cookies enhance your experience on any Expedia Group company’s site.
• Analytics Cookies. We use analytics cookies to:
Understand our site’s performance and how it is used, including the number of visitors, how long you stay on the site, and which parts of the site you visit. We can see details about how visitors have interacted with the site, such as the number of clicks made on a given page, mouse movements and scrolling activity, search words used, and the text entered into various fields
Test different designs and features for our site
Monitor how our visitors reach our sites
Determine effectiveness of our advertising
Improve our services, including your experience on our site
Some analytics cookies can perform tasks essential or functional to online services, such as enabling site improvements and testing changes to a site.
• Advertising Cookies. Expedia Group and our third-party advertising partners may use advertising cookies to show you advertisements both on and off our sites that are based on your interests. We may allow third parties to collect information about your online activities through cookies to perform their services and may combine the information that they collect about you on our sites with other information that they have collected. These third parties include business partners who collect information when you view or interact with (1) their advertisements on our sites; or (2) our advertising or booking information on their sites and advertising networks, which collect information about your interests when you view or interact with one of the advertisements or tracking mechanisms they place on many different sites on the Internet. Our partners may make assumptions about your interests, characteristics, or preferences and add you to groups based on those assumptions in order to show you tailored advertisements. Expedia Group does not have access to the cookies these third parties may use to collect information about your interests, and the information practices of these third parties are not covered by this Cookie Statement or our Privacy Statement. Some of these companies are members of the Network Advertising Initiative, which offers a single location to opt out of ad targeting from member companies. To learn more, please click here and here.
Your information choices
You can choose not to receive tailored online advertising on this site and other sites and learn more about opting out of having your information used for tailored advertising purposes by accessing one of the following resources:
• For EEA, Switzerland, and UK: http://www.youronlinechoices.eu/
• For Canada: http://youradchoices.ca/choices/
• For U.S. and rest of world:
Note that if you choose not to receive tailored ads, you will still see online advertisements, but they will be general and less relevant to you.
How can you manage your cookies?
Do-Not-Track Signals and Similar Mechanisms.
Some web browsers may transmit "do not track" signals to sites with which the browser communicates. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether users are even aware of them. Participants in the leading Internet-standards-setting organization that is addressing this issue are in the process of determining what, if anything, sites should do when they receive such signals. We currently do not take action in response to these signals. If and when a final standard is established and accepted, we will reassess our sites’ responses to these signals and make appropriate updates to this Cookie Statement.
Updates to Privacy Statement
We may update this Privacy Statement in response to changing laws or technical or business developments. You can see when this Privacy Statement was last updated by checking the “last updated” date displayed at the top of this Statement.