Dreampass Privacy Policy
You can familiarize yourself with our privacy practices, accessible via the headings below
Terms and Definitions
Terms and definitions used in this Privacy Policy shall correspond the terms set in Dreampass User T&Cs and/ or Dreampass Loyalty Program T&Cs, except if otherwise set herein:
Account Holder
a Client of Dreampass, who have created the Dreampass account (also within Mobile App) based on specific terms.
CC Holder
a holder of credit/debit payment card with which Clients pay for Dreampass’s and/ or Suppliers’ services.
Client, “you”, “your”
a consumer, natural person, a party of service contract with Dreampass. Solely for this Privacy Policy all Members, Travelers, CC Holders and Account Holders are the Clients of Dreampass, except if otherwise set herein, in service contracts, Dreampass T&Cs, account agreements and similar documents specifying current relationships between the Client and Dreampass and/ or Supplier.
Controller
a natural or legal person, which, alone or jointly with others, determines the purposes and means of the processing of personal data. The term “business” shall have the same meaning as a Controller
Dreampass , “we”, “our”, “us”
DreamPass LLC is an operator of Platforms, as well as an operator of Loyalty Program effective for Trevolution Group brands (in the future other brands might be added as well). Dreampass ensures for Clients of Trevolution Group to:
• manage their flights, bookings, travel preferences and related travel content within Dreampass account (also single Mobile App) (Travellers); this option is available only for purchases made with Suppliers after January 1st, 2024, as well as
• be entitled to extra benefits (rewards etc.) and use special offers as Members.
• manage their flights, bookings, travel preferences and related travel content within Dreampass account (also single Mobile App) (Travellers); this option is available only for purchases made with Suppliers after January 1st, 2024, as well as
• be entitled to extra benefits (rewards etc.) and use special offers as Members.
Dreampas account / Trevolution Group Account
the account with DreamPass i.e. verified email address and phone number created either through Trevolution Brands websites or DreamPass App.
Member
a Client participating in Dreampass Loyalty Program in accordance with the specific terms.
Mobile App
a mobile application “Dreampass” (or similar name) available on App Store, Google Play and other stores of mobile applications and operated by Dreampass which additionally functions as the marketplace that enables Suppliers to market travel and other services and enter into service contracts.
Personal data
any information related to the identifiable or identified Client. The term “Personal information” shall have the same meaning as Personal data.
Platforms
websites, Mobile App, other applications, email, voice calls and text messages, and social media accounts of Dreampass.
Privacy Policy
this legal statement explaining how Dreampass collects, handles, processes, and respects its Clients' Personal data on Platforms.
Processing
any operation or set of operations which is performed on Personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
Processor
a natural or legal person, which processes Personal data on behalf of the Controller. The term "Service provider" shall have the same meaning as a Processor
Service Provider
a person that processes Personal data on behalf of Dreampass and/ or the current Supplier and that receives from or on behalf of Dreampass and/ or the current Supplier Clients’ Personal data for purposes set in service contracts. A Service Provider is prohibited from:
(A) Selling Personal data for monetary or other valuable consideration;
(B) Sharing Personal data with third parties for cross-context behavioral advertising;
(C) Retaining, using, or disclosing Personal data for any purpose other than for those specified in the contract;
Additionally, the Service Provider is entitled to process Personal data if it is absolutely necessary (1) to retain and employ another service provider or (2) for the purposes compatible with those mentioned in service contract: the protecting or exercising its legal claims, complying with tax/ accounting/ AML and other laws, preparing statistics in aggregated form, debugging and repairing errors that impair existing functionality of data processing system or ensuring data security, preventing fraud.
(A) Selling Personal data for monetary or other valuable consideration;
(B) Sharing Personal data with third parties for cross-context behavioral advertising;
(C) Retaining, using, or disclosing Personal data for any purpose other than for those specified in the contract;
Additionally, the Service Provider is entitled to process Personal data if it is absolutely necessary (1) to retain and employ another service provider or (2) for the purposes compatible with those mentioned in service contract: the protecting or exercising its legal claims, complying with tax/ accounting/ AML and other laws, preparing statistics in aggregated form, debugging and repairing errors that impair existing functionality of data processing system or ensuring data security, preventing fraud.
Supplier
a supplier of travel products and other useful services for Travelers (for example, money remittance or insurance) offered through Dreampass account (also within Mobile App). Clients conclude service contract with the current Supplier.
Travel/Travel products
means a ready-to-use services, also called Travel Products and Services, rendered by Dreampass and/ or Suppliers, including, but not limited to flight tickets, car rentals, hotel bookings, transfers from/ to airportetc.
Traveler
a passenger, driver, guest or other person, who consume Suppliers’ services based on contract between the Client and the current Supplier. For example, the Client purchased flight tickets or booked a car/ hotel for their family members, who are Travelers.
NOTE: A Client and a Traveler can be the same person.
a part of Dyninno Group trading under the different brands and selling different products within travel industry.
About This Privacy Policy
Your privacy is of significance to Dreampass!
We are committed to maximally avoid risky processing of your Personal data, as well as to process only as much data as it would be absolutely necessary for achievement of our purposes or providing services upon your request taking into consideration the proportionality principle.
We regret that, if there is any information in this Privacy Notice with which you disagree, your only recourse is to leave our Platform immediately.
This Privacy policy:
• applies to your Personal data processed during you are visiting our Platforms, including installing and using of Mobile App,
• aims to give you information on how Dreampass processes your Personal data,
• is instrumental in Dreampass Personal data protection system.
Dreampass processes your Personal data in material compliance with the following principal provisions:
• Dreampass respects and complies with the requirements of the applicable data protection legislation.
• We are fair and maximally transparent with you regarding your Personal data processing and protection.
• By default, we are processing only a Personal data, which:
- is necessary to achieve the current purpose;
- is accurate and, where necessary, kept up to date.
• Upon achievement of a purpose we are either deleting your Personal data or anonymizing it, so it is impossible to identify you. The only exception are cases, where the current Personal data is required for another purpose set herein or compatible with the initial one (for example, after the service rendered we might need to keep some data to comply with the requirements of the tax and other legislation
• When data is being processed for security, statistical and analytical purposes, we are applying anonymization or additional safeguards preventing any undue impact on your person (functional separation).
• We perform and constantly improve organizational and technical measures ensuring Personal data protection against any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the data.
• We conduct staff training on a regular basis regarding data protection matters.
• We carry out all the necessary measures, so the relevant safeguards to be included in agreements with our partners, as well as responsibilities are clearly shared subject to the requirements of relevant data protection leguslation.
This Privacy Policy does not relate to:
• your relations with the current Supplier, when you interact with the current Supplier using our Platforms; in this case, Dreampass performs the role of a Service Provider, and you should refer to the Supplier’s privacy policies and related documents (T&Cs etc.);
• B2B relations, where the end-customer of Dreampass/Supplier is a legal person, non-profit organisation and any other establishment other than the Client.
By using our Platforms, you acknowledge that we process your Personal data in accordance with this Privacy Policy.
For the purposes of EU/UK legislation, we are a controller of your Personal Data.
This Privacy Policy was last updated on 01.06.2024.
We keep Privacy Policy under regular review. Dreampass might make minor amendments to this Privacy Policy which shall not adversely affect your privacy, except if laws set otherwise. In case of material changes Dreampass will definitely publish such amendments and amended Policy on our Platforms and, as far as possible, notify you either by email or by pop-up windows when you are using our Platforms next time. Amendments shall enter into force on the Effective Date (date when last updates were made). Actual version of the Privacy Policy is published on our Platforms.
We are committed to maximally avoid risky processing of your Personal data, as well as to process only as much data as it would be absolutely necessary for achievement of our purposes or providing services upon your request taking into consideration the proportionality principle.
We regret that, if there is any information in this Privacy Notice with which you disagree, your only recourse is to leave our Platform immediately.
This Privacy policy:
• applies to your Personal data processed during you are visiting our Platforms, including installing and using of Mobile App,
• aims to give you information on how Dreampass processes your Personal data,
• is instrumental in Dreampass Personal data protection system.
Dreampass processes your Personal data in material compliance with the following principal provisions:
• Dreampass respects and complies with the requirements of the applicable data protection legislation.
• We are fair and maximally transparent with you regarding your Personal data processing and protection.
• By default, we are processing only a Personal data, which:
- is necessary to achieve the current purpose;
- is accurate and, where necessary, kept up to date.
• Upon achievement of a purpose we are either deleting your Personal data or anonymizing it, so it is impossible to identify you. The only exception are cases, where the current Personal data is required for another purpose set herein or compatible with the initial one (for example, after the service rendered we might need to keep some data to comply with the requirements of the tax and other legislation
• When data is being processed for security, statistical and analytical purposes, we are applying anonymization or additional safeguards preventing any undue impact on your person (functional separation).
• We perform and constantly improve organizational and technical measures ensuring Personal data protection against any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the data.
• We conduct staff training on a regular basis regarding data protection matters.
• We carry out all the necessary measures, so the relevant safeguards to be included in agreements with our partners, as well as responsibilities are clearly shared subject to the requirements of relevant data protection leguslation.
This Privacy Policy does not relate to:
• your relations with the current Supplier, when you interact with the current Supplier using our Platforms; in this case, Dreampass performs the role of a Service Provider, and you should refer to the Supplier’s privacy policies and related documents (T&Cs etc.);
• B2B relations, where the end-customer of Dreampass/Supplier is a legal person, non-profit organisation and any other establishment other than the Client.
By using our Platforms, you acknowledge that we process your Personal data in accordance with this Privacy Policy.
For the purposes of EU/UK legislation, we are a controller of your Personal Data.
This Privacy Policy was last updated on 01.06.2024.
We keep Privacy Policy under regular review. Dreampass might make minor amendments to this Privacy Policy which shall not adversely affect your privacy, except if laws set otherwise. In case of material changes Dreampass will definitely publish such amendments and amended Policy on our Platforms and, as far as possible, notify you either by email or by pop-up windows when you are using our Platforms next time. Amendments shall enter into force on the Effective Date (date when last updates were made). Actual version of the Privacy Policy is published on our Platforms.
Data Accuracy
When you as a Client submit Personal data (your own, Travelers’, CC Holders’ etc.) to us, you tell us that the information is true, accurate, complete and current. You are also telling us that you have the authorization to provide Personal data to us. Please keep us informed if Personal data changes during your relationship with us.
The Categories of Personal Data We Process
Dreampass may process different kinds of Personal data which we have grouped together as follows:
• Identifiers or Identity Data such as a first/ middle/ last name, alias, postal address, unique personal identifier (cookie), date of birth, online identifier Internet Protocol address, or other similar identifiers.
• Contact Data includes (billing address, delivery address, email address and telephone numbers). Any contact data (emails, phones etc.) provided by you throughout any interaction will be treated as Clients’ contacts and saved in your profile for future communications, unless specifically requested not to be stored (one-time communication only).
• Commercial Information, including requested price quotes, products or services purchased or other purchasing or consuming histories or tendencies, as well as Financial Data (bank account and payment card details) and Transaction Data (details about payments to and from you and other details of products and services you have purchased from us and/ or Suppliers).
• Network Activity Information, including , but not limited to Technical Data (your login data, e-Evidence about provided electronic consent, browser type and version, browsing history, search history, time zone setting and location, browser plug-in types and versions, operating system and Platform, and other technology on the devices you use to access our Platforms), and information regarding your interaction with our Platforms (Usage Data).
• Geolocation data (country, state or city).
• Audio (e.g. call records) and Electronic (e.g. email threads) information.
• Inferences (conclusions) drawn from any collected Personal data, including, but not limited to Profile Data (your preferences, characteristics, psychological trends, behavior, attitudes, intelligence, feedback and survey responses) and Marketing Data (your preferences in receiving marketing from us and our partners and your communication preferences).
• Security and Maintenance related data: where we reasonably suspect fraud or face bugs/errors - details of such offences, bugs or errors to fix and/ or prevent it in the future.
We also might process Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your Personal data, but is not considered Personal data in law as this data will not directly or indirectly reveal Clients’ identity. For example, we may aggregate your Network Activity Information to calculate the percentage of Account Holders accessing a specific Platform feature. However, if we combine or connect Aggregated Data with your Personal data, so that it can directly or indirectly identify the Client, we treat the combined data as Personal data which will be used in accordance with this Privacy Policy.
Customer support. If you choose to contact our customer support we will collect any inquires, complaint or other information that you may submit to our support team.
We do NOT specifically process:
• special categories of Personal data (sensitive data); this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data;
• Personal data about children, except in cases where it might be indirectly implied by nature of services (e.g. the air ticket booked with one of Suppliers for a passenger who is a child);
• Personal data about criminal convictions and offences.
On your request, we might transfer special categories of Personal data (sensitive data) to Suppliers or process it within specific services. For example, health, disability, immigration/visa / dietary information might be needed to book a specific seats or services from Suppliers, also health data might be required to receive refunds (for refundable tickets).
• Identifiers or Identity Data such as a first/ middle/ last name, alias, postal address, unique personal identifier (cookie), date of birth, online identifier Internet Protocol address, or other similar identifiers.
• Contact Data includes (billing address, delivery address, email address and telephone numbers). Any contact data (emails, phones etc.) provided by you throughout any interaction will be treated as Clients’ contacts and saved in your profile for future communications, unless specifically requested not to be stored (one-time communication only).
• Commercial Information, including requested price quotes, products or services purchased or other purchasing or consuming histories or tendencies, as well as Financial Data (bank account and payment card details) and Transaction Data (details about payments to and from you and other details of products and services you have purchased from us and/ or Suppliers).
• Network Activity Information, including , but not limited to Technical Data (your login data, e-Evidence about provided electronic consent, browser type and version, browsing history, search history, time zone setting and location, browser plug-in types and versions, operating system and Platform, and other technology on the devices you use to access our Platforms), and information regarding your interaction with our Platforms (Usage Data).
• Geolocation data (country, state or city).
• Audio (e.g. call records) and Electronic (e.g. email threads) information.
• Inferences (conclusions) drawn from any collected Personal data, including, but not limited to Profile Data (your preferences, characteristics, psychological trends, behavior, attitudes, intelligence, feedback and survey responses) and Marketing Data (your preferences in receiving marketing from us and our partners and your communication preferences).
• Security and Maintenance related data: where we reasonably suspect fraud or face bugs/errors - details of such offences, bugs or errors to fix and/ or prevent it in the future.
We also might process Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your Personal data, but is not considered Personal data in law as this data will not directly or indirectly reveal Clients’ identity. For example, we may aggregate your Network Activity Information to calculate the percentage of Account Holders accessing a specific Platform feature. However, if we combine or connect Aggregated Data with your Personal data, so that it can directly or indirectly identify the Client, we treat the combined data as Personal data which will be used in accordance with this Privacy Policy.
Customer support. If you choose to contact our customer support we will collect any inquires, complaint or other information that you may submit to our support team.
We do NOT specifically process:
• special categories of Personal data (sensitive data); this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data;
• Personal data about children, except in cases where it might be indirectly implied by nature of services (e.g. the air ticket booked with one of Suppliers for a passenger who is a child);
• Personal data about criminal convictions and offences.
On your request, we might transfer special categories of Personal data (sensitive data) to Suppliers or process it within specific services. For example, health, disability, immigration/visa / dietary information might be needed to book a specific seats or services from Suppliers, also health data might be required to receive refunds (for refundable tickets).
If You Fail to Provide Personal Data
Where we collect Personal data required by law or under the terms of a contract, and you fail to provide that data when requested, we may not be able to render services to you (for example, to accept you as a Member or Account Holder). In this case, we may have to cancel a service you requested from us, but we will notify you if this is the case at that time.
Data Sources
We use different methods to collect Personal data from and about you including through:
Information you give to us. We collect Personal data directly from you (using life chat, online forms or via email, voice call/ messenger). Any contact data (emails, phones etc.) provided by you throughout any interaction will be treated as your personal contacts and saved in your profile for future communications, unless specifically requested not to be stored (one-time communication only). For example, when you create Dreampass account (also within Mobile App), subscribe to one of our Membership Tiers within Loyalty Program or newsletters/promotions, request a quote, contact our customer support, provide feedback during surveys etc.
When we chat with you (e.g. WhatsApp, Facebook, regular sms etc.) the chat might be accidentally closed/ removed, there might be interruptions, slow internet connection etc. We may contact you later via automated phone and text messages or email (if available) in order to restore our communication started within the chat. No purchase necessary. You can opt out from further communication by replying to sms/ email or notifying us during the phone call.
Passively collected Personal data. For example, we might collect information (e.g. cookies, pixels, other identifiers and signals) about your interaction with Platforms to build aggregated analytical and statistical reports, which later help us to improve UX and quality of our services. During legally binding activities (tick the checkbox and agree with T&Cs, submit the specific form, making payments etc.) we might collect e-Evidence, like IP address, timestamp, user-agent and other identifiers, which might be necessary to protect and exercise our legal claims, but, on the other hand, to protect you from fraud and possible identity theft.
Due to the online nature of our business, call records, email communication and chat messages play a crucial role in protection / establishing claims of Dreampass/Suppliers, fraud prevention and similar legal purposes which are compatible and expected by an average user. In this case we apply multi-level and multi-role access system, which effectively protects communication data from misuse and allows us to timely delete unnecessary data.
We use passively collected information to enhance and personalize your experience and provide you with offers and services that may be of interest to you.
At the same time, we might include into Dreampass account (also within Mobile App) options, so you can disable/ enable and use other control settings to limit or allow us to collect information passively.
Personal data from Suppliers (Dreampass as a Service Provider). If you agree, we request, collect, store and display (to you) Personal data controlled by Suppliers. For example, you decided to manage the flights purchased from the current Supplier within Dreampass account/ Mobile App (purchase upsell products, use benefits of Loyalty Program etc.) or you want to use financial/ insurance service available in Dreampass Account (also within Mobile App).
Personal data from other service providers. We collect your Personal data using service providers. This can include when you log in using a service provider platform, such as Facebook. In addition, we might integrate service providers' software that collects information about users for security reasons.
Information you give to us. We collect Personal data directly from you (using life chat, online forms or via email, voice call/ messenger). Any contact data (emails, phones etc.) provided by you throughout any interaction will be treated as your personal contacts and saved in your profile for future communications, unless specifically requested not to be stored (one-time communication only). For example, when you create Dreampass account (also within Mobile App), subscribe to one of our Membership Tiers within Loyalty Program or newsletters/promotions, request a quote, contact our customer support, provide feedback during surveys etc.
When we chat with you (e.g. WhatsApp, Facebook, regular sms etc.) the chat might be accidentally closed/ removed, there might be interruptions, slow internet connection etc. We may contact you later via automated phone and text messages or email (if available) in order to restore our communication started within the chat. No purchase necessary. You can opt out from further communication by replying to sms/ email or notifying us during the phone call.
Passively collected Personal data. For example, we might collect information (e.g. cookies, pixels, other identifiers and signals) about your interaction with Platforms to build aggregated analytical and statistical reports, which later help us to improve UX and quality of our services. During legally binding activities (tick the checkbox and agree with T&Cs, submit the specific form, making payments etc.) we might collect e-Evidence, like IP address, timestamp, user-agent and other identifiers, which might be necessary to protect and exercise our legal claims, but, on the other hand, to protect you from fraud and possible identity theft.
Due to the online nature of our business, call records, email communication and chat messages play a crucial role in protection / establishing claims of Dreampass/Suppliers, fraud prevention and similar legal purposes which are compatible and expected by an average user. In this case we apply multi-level and multi-role access system, which effectively protects communication data from misuse and allows us to timely delete unnecessary data.
We use passively collected information to enhance and personalize your experience and provide you with offers and services that may be of interest to you.
At the same time, we might include into Dreampass account (also within Mobile App) options, so you can disable/ enable and use other control settings to limit or allow us to collect information passively.
Personal data from Suppliers (Dreampass as a Service Provider). If you agree, we request, collect, store and display (to you) Personal data controlled by Suppliers. For example, you decided to manage the flights purchased from the current Supplier within Dreampass account/ Mobile App (purchase upsell products, use benefits of Loyalty Program etc.) or you want to use financial/ insurance service available in Dreampass Account (also within Mobile App).
Personal data from other service providers. We collect your Personal data using service providers. This can include when you log in using a service provider platform, such as Facebook. In addition, we might integrate service providers' software that collects information about users for security reasons.
Why Do We Process Personal Data?
We process Personal data for the following purposes:
Purpose / legal ground (for EU/UK)
Activity
To create and manage an account with Dreampass (also in Mobile App)
Legal ground: contractual obligations
Legal ground: contractual obligations
(a) to register you as an Account Holder
(b) to ensure access to the Mobile App services
(c) to allow access to Suppliers’ services
(b) to ensure access to the Mobile App services
(c) to allow access to Suppliers’ services
To register you as a Member and manage your records within Loyalty Program
Legal ground: contractual obligations
Legal ground: contractual obligations
(a) to Create a member record in our system
(b) to manage payments
(c) to ensure calculation of benefits (Rewards and Vouchers) within your membership record
(d) to allow you to use membership benefits (Rewards and Vouchers) within transactions with Suppliers
(b) to manage payments
(c) to ensure calculation of benefits (Rewards and Vouchers) within your membership record
(d) to allow you to use membership benefits (Rewards and Vouchers) within transactions with Suppliers
To ensure exchange with Personal data and other information between you and the current Supplier
*In this process Dreampass is a Service Provider and all questions regarding privacy matters must be addressed to the current Supplier. See also Requests and Complaints section
*In this process Dreampass is a Service Provider and all questions regarding privacy matters must be addressed to the current Supplier. See also Requests and Complaints section
(a) to provide you with communication means
(b) to ensure secure payments for the rendered the services
(c) to store and display your profile/historical purchase and other data from the current Supplier
(d) to share with the current Supplier information about benefits you are eligible for under the Loyalty Program
(b) to ensure secure payments for the rendered the services
(c) to store and display your profile/historical purchase and other data from the current Supplier
(d) to share with the current Supplier information about benefits you are eligible for under the Loyalty Program
To recover debts
Legal ground: legitimate interests
Legal ground: legitimate interests
in case of post-payment methods, where we did not receive money, we might initiate the collection of debts, also by engaging external collection partners
For solely internal uses that are based on your relationship with us or compatible with the context in which Personal data was collected
Legal ground: legitimate interests
Legal ground: legitimate interests
To manage our relationship with you which will include:
(a) notifying you about changes to our terms or Privacy Policy
(b) asking you to leave a review (feedback) or take a survey
(c) sending holiday greetings
(d) managing your requests, when you are exercising your rights set in
COMPLAINTS/REQUESTS
(a) notifying you about changes to our terms or Privacy Policy
(b) asking you to leave a review (feedback) or take a survey
(c) sending holiday greetings
(d) managing your requests, when you are exercising your rights set in
COMPLAINTS/REQUESTS
To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity
Legal ground: legitimate interests
Legal ground: legitimate interests
to administer and protect our Platforms (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
To identify and repair errors that impair existing intended functionality
Legal ground: legitimate interests
Legal ground: legitimate interests
(a) to manage your requests to fix bugs and errors
(b) to use investigation results for similar cases in the future
(c) to maintain backup and archive systems and restore data (if necessary);
(b) to use investigation results for similar cases in the future
(c) to maintain backup and archive systems and restore data (if necessary);
To comply with a legal obligation
Legal ground: legal obligations
Legal ground: legal obligations
1. to manage tax matters
2. bookkeeping and accountancy of transactions
3. to manage consolidated reports and annual financial reports
4. to comply with the requirements of licenses, registrations and permissions obtained Dreampass, including industry standards
5. to comply with AML, sanction screening and similar requirements
6. to adhere to other specific laws and rules
2. bookkeeping and accountancy of transactions
3. to manage consolidated reports and annual financial reports
4. to comply with the requirements of licenses, registrations and permissions obtained Dreampass, including industry standards
5. to comply with AML, sanction screening and similar requirements
6. to adhere to other specific laws and rules
To exercise or defend legal claims of Dreampas and/ or Suppliers
Legal ground: legitimate interests
Legal ground: legitimate interests
1. to manage complaints
2. to comply with requests, subpoenas and other enforcement notices issued by regulators, courts and law enforcement agencies
3. to protect and exercise legal claims of Dreampass and/ or the current Supplier before court, authority or law enforcement agency
2. to comply with requests, subpoenas and other enforcement notices issued by regulators, courts and law enforcement agencies
3. to protect and exercise legal claims of Dreampass and/ or the current Supplier before court, authority or law enforcement agency
We might process Personal data for other purposes only if:
• those purposes are compatible with initial one communicated to you at or before the collection; or
• the information on new purpose is explained to you at the time of the collection of data and/ or specific consent received.
If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
• those purposes are compatible with initial one communicated to you at or before the collection; or
• the information on new purpose is explained to you at the time of the collection of data and/ or specific consent received.
If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
Your Choices and Links to Other Websites
As a customer-oriented business we respect and value your expectations. As a result, you are able to make announcements and queries at any time regarding your concerns in privacy matters. Each of our marketing message or notifications within Platform have an opt-out button or you can change preferences (opt-out) at all from such communication at any time.
You cannot unsubscribe/ reject servicing and administrative messages (for example, changes in terms of Loyalty Program, communication within refund and chargebacks cases, notifications on changes in T&Cs, Privacy Policy, resolving disputes, responses to your requests).
Our Platforms may contain links to third-party websites/applications. If you click such links, please note that those 3rd parties have their own privacy policies and that we do not accept any responsibility or liability for their policies or their processing of your Personal data. Please check these policies before you submit any Personal data to such third party websites and applications.
You cannot unsubscribe/ reject servicing and administrative messages (for example, changes in terms of Loyalty Program, communication within refund and chargebacks cases, notifications on changes in T&Cs, Privacy Policy, resolving disputes, responses to your requests).
Our Platforms may contain links to third-party websites/applications. If you click such links, please note that those 3rd parties have their own privacy policies and that we do not accept any responsibility or liability for their policies or their processing of your Personal data. Please check these policies before you submit any Personal data to such third party websites and applications.
How We Share Your Personal Data
Corporate affiliates and change of control
We may share Personal data with our affiliates/ associated companies. Also if Dreampass itself (or part of its business) is sold or otherwise changes control, owners would have access to your Presonal data for the uses set out herein.
Service providers
We may share Personal data with suppliers who perform services on our behalf and have agreed in writing to protect and not further disclose your information.
Payment service providers and travel vendors
If you use Suppliers’ services and book through the Platforms, we may share Personal data with the payment service providers, acquirer banks and the travel vendors you have booked with. This can include , but not llimited to online travel agencies, hotels, airlines, car rental companies, and travel insurance providers. These third parties will process your Personal data in accordance with their T&Cs and privacy statements. For example, if you contact our customer support, they may need to share information about your request with the relevant Supplier or travel vendor in order to assist you.
Business partners
We may share your PI with various business partners. Some of these business partners may process personal data for fraud detection, including, but not limited Identifiers, Contact Data and Network Activity Information , also to detect, prevent, or otherwise address fraud, security or technical issues. We may ask our partners to create a survey, form, application, or questionnaire, so we know the degree of your satisfaction with our services. Some of these business partners may offer you services or products that we believe you may be interested in. We may also share your information as otherwise described to you at the time of collection.
Information shared in public
If you provide us reviews on our services or services of Suppliers, you authorize us to publish it on all our Platforms under the screen name you provided. You also authorize us to aggregate it with other reviews.
Authorities
We may disclose personal data, if required by law, for example to law enforcement or other authorities. This includes court orders, subpoenas and orders arising from legal processes, and administrative or criminal investigations. We may also disclose Personal data if the disclosure is necessary for the prevention, detection or prosecution of criminal acts or to prevent other damage, or in response to a legal action or to enforce our rights and claims.
Suppliers
Due to marketplace nature of Dreampass we will share Personal data with Suppliers on your request.
On the other hand, when you as a Member use the services of Suppliers, we will process minimally necessary data to calculate benefits you are eligible for.
Benefits provided within the Loyalty Program must be shared with the current Supplier, so you are able to receive Suppliers’ services as a Member (privileged user).
On the other hand, when you as a Member use the services of Suppliers, we will process minimally necessary data to calculate benefits you are eligible for.
Benefits provided within the Loyalty Program must be shared with the current Supplier, so you are able to receive Suppliers’ services as a Member (privileged user).
Prevention of fraud and other malicious activity
If false or inaccurate information is provided and fraud or other malicious activity (e.g. IT security issues, hacker attacks etc.) is identified or suspected, your Personal data may be passed to fraud prevention agencies or other competent organisations and may be recorded by us or by them.
Regarding transfers to third countries and international organizations from the EU/UK, please see more information here.
Regarding transfers to third countries and international organizations from the EU/UK, please see more information here.
Storage and Security
Our servers and data centers are located in the U.S./EU and our service providers may be located there and in other countries. By providing us Personal data, you agree that Personal data may be transferred to and stored in these countries. These countries may have different and/or less stringent privacy/data protection and data security rules than those of your own country. As a result, Personal data may be subject to access requests from governments, courts, or law enforcement in those countries according to laws in those countries. Subject to the applicable laws of such countries, we will provide the necessary safeguards to protect Personal data, e.g. by obtaining from recipients of Personal data written (also contractual) commitments based on the EU model clauses. Dreampass has security procedures intended to keep Personal data stored in our systems protected from unauthorized access, blocking and misuse. Our systems are configured with data encryption, or scrambling technologies and firewalls constructed to industry standards. We also use Secure Socket Layer (SSL) technology that protects Personal data you send over the Internet. Personal data may only be accessed by persons within our organizations, or our Service Providers to carry out the uses indicated in this Privacy Policy.
We have put in place appropriate security measures to prevent Personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to Personal data to those employees, agents, contractors and other service providers who have a business need to know and who is under the appropriate obligation of confidentiality.
We have put in place procedures to deal with any suspected Personal data breach (incident) and will notify you and any applicable regulator of a breach where we are legally required to do so.
We require our partners to comply with high levels of confidentiality and best practice in privacy and security standards and we regularly review these standards and practices.
We have put in place appropriate security measures to prevent Personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to Personal data to those employees, agents, contractors and other service providers who have a business need to know and who is under the appropriate obligation of confidentiality.
We have put in place procedures to deal with any suspected Personal data breach (incident) and will notify you and any applicable regulator of a breach where we are legally required to do so.
We require our partners to comply with high levels of confidentiality and best practice in privacy and security standards and we regularly review these standards and practices.
Retention Periods
We will only retain Personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain Personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period, we consider the amount, nature and sensitivity of Personal data, the potential risk of harm from unauthorised use or disclosure of Personal data, the purposes for which we process Personal data and whether we can achieve those purposes through other means or without processing Personal data (for example, aggregated information or pseudonymised data).
There might be cases when retention periods are set in T&Cs, for example, if Dreampass account or Mobile App has not been used for the current period or benefits received within Loyalty Program have not been used for a current period. We will definitely do our best and notify you by asking if you want to keep your account active or notifying you about expiry of benefits. If no reply is received, the account will be closed and Personal data will be deleted, securely destroyed or anonymized unless such data is required to be stored for certain legitimate business purposes including for accounting, dispute resolution or fraud prevention purposes.
There might be cases when retention periods are set in T&Cs, for example, if Dreampass account or Mobile App has not been used for the current period or benefits received within Loyalty Program have not been used for a current period. We will definitely do our best and notify you by asking if you want to keep your account active or notifying you about expiry of benefits. If no reply is received, the account will be closed and Personal data will be deleted, securely destroyed or anonymized unless such data is required to be stored for certain legitimate business purposes including for accounting, dispute resolution or fraud prevention purposes.
Requests and Complaints
Under certain circumstances, you are entitled to:
• access your Personal data. This enables you to receive a copy of Personal data we hold about you and to check correctness and integrity of Personal data. The disclosure might be limited to the 12-month period preceding the receipt of verifiable request.
• Request correction of Personal data that we hold about you. This enables you to request any incomplete or inaccurate Personal data to be corrected, though we may need to verify the accuracy of the new personal data you provide to us. The certain Personal data can be viewed and corrected within Dreampass account (also within Mobile App).
• Request to delete. You are able to submit a verifiable request and ask us to delete your Personal data. Please, be aware:
- If you were registered in Loyalty Program and created Dreampass account (also installed Mobile App), we will delete your personal data from both Loyalty Program and Dreampass account;
- there are some cases when we might reject your request.
• We do not sell your personal information, except if opt-out option is provided or consent received, depending on legislative requirements.
For the purposes of EU/UK legislation additional conditions might be applied, for more information see here.
Due to the remote nature of our services, it is important for us to keep communicating through the same email (Verified Email), which was used by you to create an account, request a price quote or purchase product from Suppliers. The Verified Email is the key communication channel for us, so we can give quick answers and prevent Personal data disclosure to any accidental or malicious third party.
We are also working on developing another verified and secure communication channel - chatting within Mobile App chat. Please keep your device safe from 3rd parties.
You might also submit a request through the voice call, but still legally important cases must be resolved via Verified Email, due to law requirements and in order to protect our legal claims.
If you submit your request through the authorised agent or by using third party service we will ask for additional verification by contacting you via Verified Email.
NONDISCRIMINATION: We shall not discriminate (deny services, charge different prices, provide different levels of quality) against you because you exercised any of the rights set herein. This right might be limited in case, if the difference in prices or levels or quality is reasonably related to the value provided to you by your Personal data. We might obtain your opt-in consent and provide to you financial incentives, so you agree to provide additional Personal data or not to request the deletion of your Personal data.
FEES and DENIALS: You will not have to pay a fee to exercise any of the rights set herein. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive (more than twice in a 12-month period) or excessive. Alternatively, we could refuse to comply with your request in these circumstances. We might also refuse to act on your request, when we are not in a position to identify you and verify your request or the requested fee was not paid. We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal data (or to exercise any of your other rights). This is a security measure to ensure that Personal data is not disclosed to any person who has no right to receive it. We may also contact you (via email, phone or messenger) to ask you for further information in relation to your request to speed up our response.
TERMS: We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. The maximum response time shall not exceed 90 days.
COMMON REQUESTS: If, on your request, Personal data is shared with Suppliers or Suppliers provided it to Dreampass and later you exercise any of the rights set herein, we will perform the part where we are not a Service Provider. Regarding the rest we will inform the relevant Supplier and they should contact you separately. At the same time, if it does not contravene laws, our or Suppliers’ policies we will perform your request in full, also on behalf of the current Supplier.
REQUESTS WITHIN LOYALTY PROGRAM: Due to benefits of the Program are being gained by you and later consumed by using Suppliers’ services, you agree that Personal data about those benefits cannot be processed in isolation (separately for Dreampass’s and Suppliers’ purposes). As a result, Dreampass as a central contact point and manager of those benefits is fully liable for exercising rights set herein, including communication with Suppliers about amounts of benefits, evidence of gaining those benefits etc.
!!! Additionally, if you request to delete your Personal data related to Loyalty Program, we will be forced to (1) STOP your membership and (2) delete your personal data and all benefits.
CONTACTS: you can submit your complaint/request at privacy@dreampass.app
Some rights can be exercised directly from Dreampass account (also within Mobile App).
• access your Personal data. This enables you to receive a copy of Personal data we hold about you and to check correctness and integrity of Personal data. The disclosure might be limited to the 12-month period preceding the receipt of verifiable request.
• Request correction of Personal data that we hold about you. This enables you to request any incomplete or inaccurate Personal data to be corrected, though we may need to verify the accuracy of the new personal data you provide to us. The certain Personal data can be viewed and corrected within Dreampass account (also within Mobile App).
• Request to delete. You are able to submit a verifiable request and ask us to delete your Personal data. Please, be aware:
- If you were registered in Loyalty Program and created Dreampass account (also installed Mobile App), we will delete your personal data from both Loyalty Program and Dreampass account;
- there are some cases when we might reject your request.
• We do not sell your personal information, except if opt-out option is provided or consent received, depending on legislative requirements.
For the purposes of EU/UK legislation additional conditions might be applied, for more information see here.
Due to the remote nature of our services, it is important for us to keep communicating through the same email (Verified Email), which was used by you to create an account, request a price quote or purchase product from Suppliers. The Verified Email is the key communication channel for us, so we can give quick answers and prevent Personal data disclosure to any accidental or malicious third party.
We are also working on developing another verified and secure communication channel - chatting within Mobile App chat. Please keep your device safe from 3rd parties.
You might also submit a request through the voice call, but still legally important cases must be resolved via Verified Email, due to law requirements and in order to protect our legal claims.
If you submit your request through the authorised agent or by using third party service we will ask for additional verification by contacting you via Verified Email.
NONDISCRIMINATION: We shall not discriminate (deny services, charge different prices, provide different levels of quality) against you because you exercised any of the rights set herein. This right might be limited in case, if the difference in prices or levels or quality is reasonably related to the value provided to you by your Personal data. We might obtain your opt-in consent and provide to you financial incentives, so you agree to provide additional Personal data or not to request the deletion of your Personal data.
FEES and DENIALS: You will not have to pay a fee to exercise any of the rights set herein. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive (more than twice in a 12-month period) or excessive. Alternatively, we could refuse to comply with your request in these circumstances. We might also refuse to act on your request, when we are not in a position to identify you and verify your request or the requested fee was not paid. We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal data (or to exercise any of your other rights). This is a security measure to ensure that Personal data is not disclosed to any person who has no right to receive it. We may also contact you (via email, phone or messenger) to ask you for further information in relation to your request to speed up our response.
TERMS: We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. The maximum response time shall not exceed 90 days.
COMMON REQUESTS: If, on your request, Personal data is shared with Suppliers or Suppliers provided it to Dreampass and later you exercise any of the rights set herein, we will perform the part where we are not a Service Provider. Regarding the rest we will inform the relevant Supplier and they should contact you separately. At the same time, if it does not contravene laws, our or Suppliers’ policies we will perform your request in full, also on behalf of the current Supplier.
REQUESTS WITHIN LOYALTY PROGRAM: Due to benefits of the Program are being gained by you and later consumed by using Suppliers’ services, you agree that Personal data about those benefits cannot be processed in isolation (separately for Dreampass’s and Suppliers’ purposes). As a result, Dreampass as a central contact point and manager of those benefits is fully liable for exercising rights set herein, including communication with Suppliers about amounts of benefits, evidence of gaining those benefits etc.
!!! Additionally, if you request to delete your Personal data related to Loyalty Program, we will be forced to (1) STOP your membership and (2) delete your personal data and all benefits.
CONTACTS: you can submit your complaint/request at privacy@dreampass.app
Some rights can be exercised directly from Dreampass account (also within Mobile App).
How Dreampass Responds to "Do Not Track" Signals
Some browsers have a “Do Not Track” feature that lets you tell websites that you do not want to have your online activities tracked. These features are not yet uniform, so we are not currently set up to respond to those signals.
Cases When We Might Deny the Deletion of Personal Information
• to comply with law requirements;
• to perform a transaction initiated by you;
• to exercise or defend our legal claims;
• to comply with official request submitted by local, state or federal authorities;
• cooperation with law enforcement concerning activities that may violate the law;
• to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
• to prevent from adversely affecting the rights and freedoms of other customers, including passengers, payment card holders;
• to debug to identify and repair errors that impair existing intended functionality;
• solely for the internal analytical, risk management, quality assurance, training and statistical purposes, applying additional safeguards additional safeguards preventing any undue impact on customer’s person (functional separation);
• to ensure integrity of archiving and backup systems.
• to perform a transaction initiated by you;
• to exercise or defend our legal claims;
• to comply with official request submitted by local, state or federal authorities;
• cooperation with law enforcement concerning activities that may violate the law;
• to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
• to prevent from adversely affecting the rights and freedoms of other customers, including passengers, payment card holders;
• to debug to identify and repair errors that impair existing intended functionality;
• solely for the internal analytical, risk management, quality assurance, training and statistical purposes, applying additional safeguards additional safeguards preventing any undue impact on customer’s person (functional separation);
• to ensure integrity of archiving and backup systems.
DATA TRANSFERS TO THIRD COUNTRIES AND INTERNATIONAL ORGANIZATIONS OUTSIDE EU/ UK
We might transfer your data to third country providing safeguards, so the level of your data protection is not undermined. Such transfers might take place in cases, if:
• we have to perform an agreement concluded with you;
• we have to carry out pre-contractual measures in order to prepare a contract;
• if you consented to the proposed transfer;
• transfer is based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the EU/UK;
• transfer is based on adequacy decision made by the European Commission (e.g. the EU-U.S. Data Privacy Framework)/UK Government (e.g. the UK-US Data Bridge Regulations) or standard data protection clauses adopted by the relevant authority, e.g. when we share the data with associated companies located outside EU or UK or when we use data storage facilities of our partners operating in the USA under relevant safeguards;
• other cases may be applicable (you shall be informed prior to any such transfer).
• we have to perform an agreement concluded with you;
• we have to carry out pre-contractual measures in order to prepare a contract;
• if you consented to the proposed transfer;
• transfer is based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the EU/UK;
• transfer is based on adequacy decision made by the European Commission (e.g. the EU-U.S. Data Privacy Framework)/UK Government (e.g. the UK-US Data Bridge Regulations) or standard data protection clauses adopted by the relevant authority, e.g. when we share the data with associated companies located outside EU or UK or when we use data storage facilities of our partners operating in the USA under relevant safeguards;
• other cases may be applicable (you shall be informed prior to any such transfer).
ADDITIONAL INFORMATION ON CLIENTS’ RIGHTS REQUIRED BY EU/ UK LEGISLATION
Right to be informed
If personal data is not collected directly from you, the right to be informed shall not apply when:
• obtaining or disclosure of your data is expressly laid down by applicable legislation, or
• the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
• we are prohibited to inform you on it, if and insofar as the data must remain confidential subject to an obligation of professional secrecy regulated by applicable legislation, including a statutory obligation of secrecy.
In such cases we will provide appropriate safeguards.
Right to erasure
Cases, when you have the right to obtain from controller the erasure of your data:
• your data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw consent on which the processing is based and we have no other legal ground for the processing;
• you object to the processing pursuant to law requirements and there are no overriding legitimate grounds for the processing, or you object against the processing for the marketing purposes;
• your personal data have been unlawfully processed;
• your personal data have to be erased for compliance with a legal obligation in applicable legislation to which the we are subject.
The erasure of your personal data is not applicable, and your request might be refused when under the EU/UK legislation to the extent that processing is necessary:
• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by applicable legislation to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
• for reasons of public interest in the area of public health in accordance with applicable legislation;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with law requirements in so far as the right to inform data subjects is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• for the establishment, exercise or defense of legal claims.
Right to restriction of processing
You are entitled to obtain from us restriction of processing where one of the following applies:
• you are contesting the accuracy of your data, for a period enabling us to verify the accuracy of your data;
• the processing is unlawful and you oppose the erasure of your data and request the restriction of their use instead;
• we no longer need your data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
• you have objected to processing pursuant to law requirements pending the verification whether our legitimate grounds override those of your interests.
Nonetheless the restriction of processing, we will still be entitled to:
• Store your data;
• Process your data in any manner, if:
○ You have consented to it;
○ We have to establish, exercise or defend our legal claims;
○ The rights of another person shall be protected;
○ There are reasons of important public interest.
Right to data portability
You are entitled to transmit your data, which you have provided from one controller to another controller, where:
• the processing is based on consent or on a contract; and
• the processing is carried out by automated means.
Unfortunately, there might be cases when your data transmission to another controller is not technically feasible. In this regard we will try to do our best in providing maximum support, so another controller receives your data.
Automated individual decision-making, including profiling
You are entitled not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision:
• is necessary for entering into, or performance of, a contract between you and us; or
• is authorized by applicable legislation to which Dreampass is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• is based on your explicit consent.
Right to lodge a complaint
If we are not able to resolve any dispute or claim arising from your data processing under this Policy in an amicable way, you are entitled to lodge a complaint with an appropriate supervisory authority (for EU or for UK).
Right to object
In case controller processes your data:
• the performance of a task carried out in the public interest, or in the exercise of official authority vested in us, or • for the purposes of the legitimate interests pursued by us or by a third party,
you are entitled to object to such processing, specifying in your request the particular situation (reason for objection).
We will not process your data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
There are also other cases set by applicable legislation, when you are entitled to object, as well as the conditions under which the right to object might be exercised.
If personal data is not collected directly from you, the right to be informed shall not apply when:
• obtaining or disclosure of your data is expressly laid down by applicable legislation, or
• the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
• we are prohibited to inform you on it, if and insofar as the data must remain confidential subject to an obligation of professional secrecy regulated by applicable legislation, including a statutory obligation of secrecy.
In such cases we will provide appropriate safeguards.
Right to erasure
Cases, when you have the right to obtain from controller the erasure of your data:
• your data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw consent on which the processing is based and we have no other legal ground for the processing;
• you object to the processing pursuant to law requirements and there are no overriding legitimate grounds for the processing, or you object against the processing for the marketing purposes;
• your personal data have been unlawfully processed;
• your personal data have to be erased for compliance with a legal obligation in applicable legislation to which the we are subject.
The erasure of your personal data is not applicable, and your request might be refused when under the EU/UK legislation to the extent that processing is necessary:
• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing by applicable legislation to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
• for reasons of public interest in the area of public health in accordance with applicable legislation;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with law requirements in so far as the right to inform data subjects is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
• for the establishment, exercise or defense of legal claims.
Right to restriction of processing
You are entitled to obtain from us restriction of processing where one of the following applies:
• you are contesting the accuracy of your data, for a period enabling us to verify the accuracy of your data;
• the processing is unlawful and you oppose the erasure of your data and request the restriction of their use instead;
• we no longer need your data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims;
• you have objected to processing pursuant to law requirements pending the verification whether our legitimate grounds override those of your interests.
Nonetheless the restriction of processing, we will still be entitled to:
• Store your data;
• Process your data in any manner, if:
○ You have consented to it;
○ We have to establish, exercise or defend our legal claims;
○ The rights of another person shall be protected;
○ There are reasons of important public interest.
Right to data portability
You are entitled to transmit your data, which you have provided from one controller to another controller, where:
• the processing is based on consent or on a contract; and
• the processing is carried out by automated means.
Unfortunately, there might be cases when your data transmission to another controller is not technically feasible. In this regard we will try to do our best in providing maximum support, so another controller receives your data.
Automated individual decision-making, including profiling
You are entitled not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision:
• is necessary for entering into, or performance of, a contract between you and us; or
• is authorized by applicable legislation to which Dreampass is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• is based on your explicit consent.
Right to lodge a complaint
If we are not able to resolve any dispute or claim arising from your data processing under this Policy in an amicable way, you are entitled to lodge a complaint with an appropriate supervisory authority (for EU or for UK).
Right to object
In case controller processes your data:
• the performance of a task carried out in the public interest, or in the exercise of official authority vested in us, or • for the purposes of the legitimate interests pursued by us or by a third party,
you are entitled to object to such processing, specifying in your request the particular situation (reason for objection).
We will not process your data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
There are also other cases set by applicable legislation, when you are entitled to object, as well as the conditions under which the right to object might be exercised.