Hipmunk, Inc.

Privacy Policy

Effective: May 22, 2018

This privacy policy ("Policy") describes how Hipmunk, Inc. and its affiliated companies ("Hipmunk" or "us" or "we") collect, use, and share the information you provide to us or we gather from you while you access or use www.hipmunk.com (the "Site"), the Hipmunk mobile application (the "App"), and related services that link to this Policy (together, the “Services”).

We may also supplement this Policy with other privacy notices in the Services. This Policy applies only to information collected by us through the Services and does not apply to services that link to other privacy policies, including any third-party websites or services you connect to from our Services, such as travel partners, social-networking platforms, and third-party ads. Hipmunk is not responsible for the privacy practices or content of such third parties. We encourage you to read the privacy statements of those third parties.

We collect and process personal information about you with your consent and/or as necessary to provide the products you use, operate our business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfill other legitimate interests.

Personal Data Collected

As used in this Policy, “Personal Data” means information relating to you as an identified or identifiable individual. We collect Personal Data in various ways when you use our Service.

Information Provided by You. When you create an account with Hipmunk or book travel through the Service, we collect information that you provide directly to us. For example, as part of activating an account with Hipmunk, we collect your email address, name, password, and home airport or country. When you book travel through the Service, along with the booking details we may also collect billing or mailing address, phone number, travel preference information, and payment details. When you communicate with our customer support teams, we collect these communications and the information that you may provide to provide you support. We may also obtain information from other sources and combine that with information we collect on our Service, including information about bookings you make with third-party travel partners to which we refer you and social networking platforms you use to sign in.

Information About Your Use of the Service. When you use the Service, we collect information about the searches you run on the Service, such as the date and time when you initiated a search and the content of your search queries. We also collect the location from which you initiated the search using either your Internet protocol (IP) address, if you are using the Site, or precise location information from your mobile device location, if you are using the App and have enabled location permissions for Hipmunk on your device. We use this location information to improve the relevance of your searches, such as selecting a departure airport near you or suggesting a default home airport, for our own analytics, and as described in this Policy and otherwise disclosed to you on the Services. We may collect information about how you use the Service, including information about your clicks and interactions on the Services. We may retain this information and associate it with your profile information.

Third-Party Logins. You can sign in to our Services using third-party social sign-ins (e.g., Google, Facebook, and Yahoo). These social sign-in providers will share certain Personal Data with us as described in their sign-in notices or in their privacy policies, which might include information such as your name, profile picture, age range, gender, and other public information. We encourage you to review prior to signing in through the applicable service.

Calendar Integration. With your permission, the App can access your calendar information from your mobile device and use it to provide suggestions for things like flights, hotels, and cars based on your upcoming meetings and travel plans or make travel options easier to compare against such meetings or plans. If available to you, you may also be able to use the Site to integrate with other calendar platforms like Microsoft Outlook and Google Calendar, in which case we will ask you to authenticate your account using the mechanism provided by the third-party platform. You will be asked in each case whether you want to connect a calendar, and you may manage your connections and disconnect at any time in the settings menu. We may also provide email reminders to you to book travel for upcoming events and meetings. If you access the Service using the App, you may not need to provide your login credentials, as your mobile device may allow this integration automatically if you enable those permissions. When providing those credentials or enabling the permissions, we will access, collect, and use this information, including calendar invite information, as described in this Policy and associate it with other information we have about you.

Company SAP Concur Account. If your company has enabled you to connect the SAP Concur account you use through your company (“SAP Concur Account”) with your Services account, you may be provided with access to company discounts for purposes of booking business travel. By allowing your SAP Concur Account to access your personal Services account, SAP Concur and your company will receive certain information about trips you search for or book, such as date of travel, origin, destination, flight, and booking information. By allowing the Services to access your SAP Concur Account, Hipmunk will obtain certain profile and payment information that you store in your SAP Concur Account and combine it with data the Services has about you and enable the Services to update information on your SAP Concur Account, including booking and itinerary information. You may disconnect your SAP Concur Account from your Services account by visiting the account settings section of the Service. If your Services account was created using an SAP Concur Account, before you leave your company you will need to update your Services account email to a personal email account to retain control of your personal Services account.

Communications. When you communicate with us, for example through our virtual travel agent chatbot, whether via Skype, Slack, Facebook Messenger or other third-party communication services we support, we collect your contact information, home airport, and the contents of the relevant communication, which we use to enable your interactions as well as to train and improve our chatbot. Your use of these other third-party communication services remains subject to their terms of use and privacy policies.

Cookies, Analytics, and Tracking. When you use the Services through the Site, some information such as IP, device or browser information, logs, or clickstream information is automatically collected about your usage and activity to address technical support issues, understand how you use the Site, and to deliver advertising tailored to your interests. Hipmunk may use certain tracking technologies such as cookies, web beacons, or third-party analytics tools to obtain such information. You may find out more about the various tracking tools used on the Site and the choices you have by following the Cookie Preferences link on the Site footer.

App Analytics and Advertising. Our App utilizes tracking technologies from third-party service providers we have engaged to provide services on our behalf. In some cases, these are analytics providers that provide services such as application analytics and crash reporting. In other cases, these are advertising or campaign measurement providers. These providers may also automatically collect some of the information described above, including, for example, usage information, IP address, access times, browser type and language, device type, device identifiers, and Wi-Fi information. These providers may also automatically collect the above information about you through the App and on other sites and services, including personally identifiable information about your online activities over time and across different websites, devices, online services, and applications when you use our App. Some third parties help us and others associate your activities across the browsers and devices you use, or that your household uses, for retargeting, cross-device advertising, analytics, and measurement purposes. The third-party analytics and advertising providers we use include Crashlytics, Sojern, and Appsflyer. Some third-party providers allow you choices about their collection or use of your information. Some of these providers may also be members of the Network Advertising Initiative (NAI) or Digital Advertising Alliance (DAA), which each provide a simple way to opt out of ad targeting from participating companies.

Booking through Hipmunk. If you book hotels or travel through the Services, you must either have an account or create an account as part of the checkout process, and we collect information as described above. Some travel bookings are completed directly through the Services and others are completed with our travel partners. For bookings completed on our Site or through the App, we will collect information about the booking along with payment details from you including name on your payment card, card number, billing address, expiration date, security code, and phone number, and provide that information to the travel partner to complete the transaction. For other travel bookings completed directly with a travel partner through the Services, the Services may connect with the travel partner which will collect payment details from you directly in order to process your transaction. In the App, you have the option to let us save your payment details for the purpose of enabling future bookings. You may add a payment method in the App or edit or delete your saved payment information at any time in your Hipmunk account settings. Any third-party travel partners may use information you provide either to them directly, or indirectly through us, through the Services for processing transactions and also for their own purposes, so you should review their privacy statements prior to booking.

How Personal Data is Used

Hipmunk will use Personal Data as described in this Policy and as disclosed to you in the Services, which include for the following purposes:

  • operating, hosting, maintaining, connecting, and improving the Services.
  • Personalizing and customizing your Services experience, content, marketing, and recommendations, including to target content and services to more closely match your interests or location.
  • Responding to your comments and questions and providing customer service.
  • Updating you on new features and functionality of the Services, like new travel-search features, as well as promotional materials and offers, such as discounts on airfare or hotels that may become available, and other news and information about travel destinations, products and services offered by Hipmunk, other affiliated companies, and our selected partners.
  • Providing you information via email or another form of electronic notification related to your use, requests, and purchases, such as transaction confirmations, invoices, technical notices, and other notices about security, privacy, and administrative issues relating to your use of the Services.
  • Creating anonymized data sets from Personal Data to improve our and our affiliates’ products and services.
  • Enforcing our terms and conditions or protecting our business, partners, or users.
  • Protecting against, investigating, and deterring fraudulent, unauthorized, infringing, or illegal activity.
  • Linking or combining with other personal information we get from third parties, to help understand your needs and provide you with better service

How Hipmunk Shares Personal Data

If you book travel with one of our travel partners through the Services, we provide the payment details you give us to the travel partner to process the transaction.

We also share your information with third parties as described in this Policy and on the Services and as follows:

  • With your consent
  • Between SAP Concur, its corporate affiliates, and your company, if you connect your Services account with your SAP Concur Account, if applicable.
  • In an aggregated form that does not directly identify you
  • With third-party travel partners when you book travel
  • When we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities; to protect and defend the rights, property, or safety of Hipmunk, our users, or others; and in connection with the enforcement of our terms and contracts.
  • In connection with a corporate transaction, such as a divestiture, merger, acquisition, consolidation, or asset sale, or in the unlikely event of bankruptcy. We may assign or transfer your information as part of the transaction.
  • With third-party vendors, consultants, and other service providers that are working on our behalf and need access to your information to provide specific services to us as part of the Services, such as credit card processing companies, or hosting, email messaging, or SMS providers.
  • In an aggregated form that does not directly identify you.
  • As required by law and when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, or legal process served to us.

Non-personally Identifiable Information. In addition, Hipmunk may disclose aggregated, anonymized, or other types of non-personally identifiable information, including automatically collected and cookies information that is non-personally identifiable, to third parties for various purposes. For example, Hipmunk may disclose non-personally identifiable information to our travel partners or other interested third parties to assist them in understanding the usage, viewing, geographic and demographic patterns and activity on the Service, to assist them in serving your travel needs, to select the advertisements shown to you on our Service or on other websites and services, or to enhance your ability to conduct efficient and accurate searches.

Choices You Have Regarding Personal Data

We give you the choices regarding your information described in this Policy.

If you otherwise wish to ask for access, correction, or deletion of any of your information held by us, or a change in the way we use your information, please contact us at: privacy@hipmunk.com. We reserve the right to charge you a fee, as permitted by applicable law, and may decline requests that are unreasonable, prohibited by law, or are not required to be honored by applicable law.

You can update certain profile information associated with your account at any time through your account preferences page on the Service.

Email Choices. You can manage your email preferences through the selections within the Site by updating your profile settings. You can also unsubscribe from promotional emails by: (1) following the unsubscribe instructions in our emails; or (2) emailing us at privacy@hipmunk.com. You may update your email preferences from time to time. Please note that even if you unsubscribe from promotional email messages, we may still need to contact you with important transactional information related to your account and your use of the Service. For example, even if you have unsubscribed from our email messages, we will still send you emails relating directly to a travel booking or travel profile created through the Service or confirming registration.

SAP Concur Integration. As described above, you may unlink your personal Hipmunk account from your SAP Concur Account from the account settings portion of the Services. You may also use the controls within the Services to make personal travel searches or bookings that are not shared with your company. However, any information shared previously with your company is governed by the terms between SAP Concur and your company, and you will need to contact your company regarding use and retention of that data.

Cookies, Analytics, and Tracking. You also have choices regarding some of the technologies used to track your use of the Services. You may find out more about the various tracking tools used on the Site and the choices you have by following the Cookie Preferences link in the footer of the Site. Note that the settings are limited to the particular browser installed on a particular device. So if you use Services with different browsers or different devices, including a mobile device, you may have to disable the tracking cookies in the browsers of all relevant devices. It may not always be possible to disable cookies in the App, and disabling cookies on the Site will not disable tracking technologies on the App. We may not recognize or respond to every type of "do not track" signal or other mechanisms that provide consumers the ability to exercise choice regarding the collection of Personal Data about an individual consumer’s online activities over time and across third-party websites or online services, but we give you certain choices about how we collect Personal Data as described in this Policy. For more information on how we collect Personal Data for these purposes, see the Cookies, Analytics and Tracking and App Advertising and Analytics sections above.

Your California Privacy Rights

If you are a California resident who has provided information to us for personal, family, or household purposes, you have the right to request: (1) a list of third party companies to which Hipmunk has disclosed, within the past year, personally identifiable information pertaining to you for that third party's direct marketing purposes, and (2) a list of the categories of personally identifiable information disclosed. You may mail any such request to: privacy@hipmunk.com. Please note that we are required to respond to one request per California resident each year, and we are not required to respond to requests made by means other than through this e-mail address.

European Users

Hipmunk adheres to applicable data protection laws in the European Economic Area (EEA), which, if applicable to you, include the following rights:

  • Where processing of Personal Data is based on your consent, you have a right to withdraw consent at any time for future processing.
  • You have a right to request access to, rectification, or erasure of your Personal Data, or to transfer or receive a copy of your Personal Data in a usable format.
  • You have a right to object to the processing of your Personal Data under certain circumstances.
  • You have a right to lodge a complaint with an applicable data protection authority.

Hipmunk, Inc. is the controller of your Personal Data for the Services, and Concur (Netherlands) B.V., an affiliate of Hipmunk, Inc., located at Barbara Strozzilaan, 101 1083 HN, Amsterdam, The Netherlands, is our data protection representative for the EEA and Switzerland, which you may contact at privacy-request@concur.com. The data protection officer for SAP group companies is Mathias Cellarius (privacy@sap.com).

If applicable under French law, you can also send us specific instructions regarding the use of your personal information after your death by contacting us at privacy@hipmunk.com.

The services hereunder are not intended for use by the citizens of the Russian Federation who reside in Russia. If you are a Russian citizen residing in Russia, you are hereby notified that any Personal Data that you input into the services will be solely at your own risk and responsibility. You explicitly agree that we may accumulate your Personal Data and will process this data in the United States and in other countries, and that you will not hold Hipmunk accountable for any potential nonobservance of the Russian Federation legislation.

The Security of Your Information

We maintain data handling and storage practices and procedures that are designed to promote the integrity and confidentiality of the Personal Data. No method of transmission over the Internet or method of electronic storage is completely secure, however. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

We retain your Personal Data for as long as necessary to provide the Services and for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. In many cases, we will delete inactive accounts and associated profile information after two years of inactivity. Because these needs can vary for different data types in the context of different services, actual retention periods can vary significantly. The criteria used to determine retention include (1) the length of time Personal Data is needed to provide the applicable services (such as maintaining and improving the performance of the Services, enabling system security measures, and maintaining appropriate business and financial records); (2) if users have provided, created, or maintained Personal Data with the expectation that we will retain it until they affirmatively remove it (in which case we may maintain the data until actively deleted by the user); (3) whether the Personal Data is of a sensitive type (a shortened retention time may be appropriate); and (4) whether we are subject to a legal, contractual, or similar obligation to retain the data (such as mandatory data retention laws in the applicable jurisdiction, government orders to preserve data, or data that must be retained for the purposes of litigation).

How Personal Data May Be Transferred to the United States

The Services operate from data centers in multiple locations globally, including in the United States. Using the Services may result in the transfer, use, processing, or storage of Personal Data in the United States or any other country where Hipmunk operates or maintains facilities or service centers, including jurisdictions that may not have data privacy laws that provide protections equivalent to those provided in your home country. Hipmunk takes steps designed to ensure that the Personal Data is processed according to applicable law wherever the data is located and the provisions of our agreements, including any intercompany data-processing agreements among corporate affiliates.

By providing your information to us through your use of the Services, you agree to that transfer, storage, and processing of your Personal Data in the United States.

Updates and Questions

We may update this Policy from time to time without notice to you other than posting the revised policy on the Hipmunk Services or by providing such notice about or obtaining consent to changes as may be required by applicable law. If we change our Policy, we will post those changes to this Policy and change the effective date above. We encourage you to periodically review this page for the latest information on our privacy practices.

If you have any questions about this Policy, or to file any complaint regarding this policy, please contact us at the following address:

Concur Technologies, Inc.
601 108th Avenue NE, Suite 1000
Bellevue, WA 98004
Attention: Privacy Manager/Hipmunk
Telephone: (888) 883-8411

Hipmunk will investigate and attempt to resolve complaints and disputes regarding the collection, use, and disclosure of personal information by referencing the privacy principles stated in this Policy. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge).