Data Protection Principles

Odysseus Solutions, LLC ("Odysseus") provides online booking and post-booking technology to travel companies. This page explains the principles we follow when we handle personal data, including personal data that is transferred from the European Union and European Economic Area, the United Kingdom and Switzerland to the United States and other countries.

Odysseus does not participate in the EU-U.S. Data Privacy Framework or its UK and Swiss extensions. Instead, we protect international transfers through contracts with our clients, as described below.

Scope

These principles apply to:

• Personal data about current, former and prospective clients and their personnel, used to deliver our services, maintain business relationships and carry out business development.
• Personal data about our vendors, service providers and other third parties and their personnel, used to manage those relationships.
• Traveler personal data that we process on behalf of our clients when they use our booking platforms.

For traveler data, our client (the travel company) is the controller and decides why and how the data is used. Odysseus acts as a processor and handles the data only on the client's documented instructions. The client's own privacy notice also applies.

How we protect international transfers

Each client signs a Data Processing Agreement (DPA) with Odysseus that forms part of the main service agreement. The DPA sets out the subject matter, duration, nature and purpose of the processing, the types of personal data, and the obligations of both parties. Where personal data is transferred outside the EU/EEA, the UK or Switzerland, the DPA includes the transfer safeguards required for the client's region and applicable law, together with supplementary technical and organizational measures where needed.

The principles we follow

• Notice. We explain what personal data we collect and why through this page, our Privacy Policy, our client contracts and our clients' privacy notices.
• Purpose limitation. We use personal data only for the purposes for which it was collected, or for purposes the client or individual later authorizes.
• Data minimization and retention. We collect only the personal data we need and keep it only for as long as the purpose and the contract require, then delete or return it.
• Accuracy. We take reasonable steps to keep personal data accurate, complete and current for its intended use.
• Security. We protect personal data against loss, misuse, unauthorized access, disclosure, alteration and destruction. Odysseus is certified to PCI DSS as a Level 1 service provider and applies encryption, access control, logging and regular security testing. See our Data Security Statement.
• Onward transfers. We share personal data with sub-processors only under a written contract that requires at least the same level of protection as our DPA. We remain responsible to our clients for our sub-processors. On request, clients can receive our SOC 2 report and our PCI DSS Attestation of Compliance (AOC), which include the list of sub-processors.
• Requests from public authorities. If a public authority asks us for personal data, we review the request for legal validity, disclose only what is required, and, where the law allows, inform the affected client first.

Your rights

Individuals may have the right to access, correct, delete or restrict the use of their personal data, and to object to its processing. If you booked travel through one of our clients, please contact that travel company first, as it controls your data. We will help our clients respond to these requests as set out in our DPA.

For any other request, or if you cannot reach the travel company, contact us at info [at] OdysseusSolutions.com. We respond within 45 days.

Questions and complaints

If you have a question or a complaint about how we handle personal data, please contact us at info [at] OdysseusSolutions.com. You also have the right to lodge a complaint with the data protection authority in your country.

Changes to this page

We may update this page from time to time. The current version is always published here.

Effective date: to be confirmed