Privacy Policy

Last Updated: October 1, 2022

This Privacy Policy applies to the websites, www.curacity.com including www.insidehotels.com, https://curacity.com/roam/ (the “Sites”) and other online services (collectively, “Services”) offered by Surface Travel, Inc. d/b/a Curacity and its subsidiaries (together, “Curacity,” “us,” or “we”). 

This Privacy Policy describes the information collected through the Services, how we use and share the information, and your choices about how we use and share information.

Please read this Privacy Policy carefully. By accessing and using the Services, you acknowledge that you have read and understand this Privacy Policy. We may update this Privacy Policy from time to time, as detailed below. If you do not agree with any part of this Privacy Policy, then please do not use the Services, as this Privacy Policy is binding on upon all users of the Services. If you have a question about how your Personal Information is being used, you can contact us through the methods provided in the “How to Contact Us” section at the end of this Privacy Policy. 

HOW THIS PRIVACY POLICY APPLIES

This Privacy Policy applies to the Services that display or link to this Privacy Policy.

The Services may also be governed by separate or additional policies that apply to information about you collected by our affiliated providers, third party websites (e.g., ad serving and tracking services), hotels, airlines or car rentals with whom we work, third party service providers or are otherwise accessible through the Services. The information collected or received by third parties is subject to their respective privacy policies, which we encourage you to review. We are not responsible for compliance with these other privacy policies or practices.

INFORMATION WE COLLECT AND HOW WE USE IT

Our goal is to provide you with a safe, smooth, efficient experience and we take certain steps to protect your information. We categorize the information we collect as follows: 

• “Personal Information,” which is information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, device or household. 
• “Non-Personal Information,” which is information that cannot be used to identify a specific individual natural person and is not regulated by privacy laws.

Personal Information

We collect Personal Information through the Services, such as a first and last name, street address, email address and telephone number. 

You have choices about the Personal Information we collect. When you are asked to provide Personal Information, you may decline. However, certain Services may not be available for your use unless you provide Personal Information. Depending on how you use the Services, we collect and store the following Personal Information:

• Your responses to the offerings and advertisements presented through the Services;
• Information about the Services that you use and how you use them and other activity on the Services;
• Commercial, transaction-related information (such as credit card or other preferred means of payment, billing or shipping information, or a history of products purchased through the Services);
• Your participation in hotel- and travel-related surveys and promotions;
• Your requests for services, products, newsletters or information;
• Customer service information about you as a user of the Services, including suggestions you submit to us for review, and other correspondence with us;
• Your correspondence through the Services;
• Information you send to us, such as testimonials;
• Information we ask you to provide to authenticate yourself; and
• Device information, such your browser type and IP address that we use to administer the Services, to help identify and analyze user trends, to customize content and advertisements offered to you, and to gather broad demographic information for aggregate use;

We use your Personal Information:

• To provide customer support, products and services you request;
• To record your preferences, make reservations and discuss your reservations;
• To resolve fee and billing disputes;
• To audit compliance with our policies and contractual obligations;
• To prevent potentially illegal or prohibited activity;
• To market to you regarding our products, services and promotional offers and the products, services and promotional offers of others;
• To customize and improve the Services, advertising and marketing;
• As otherwise permitted by law; and
• For any other purpose to which you consent.

We will not collect additional Personal Information or use the Personal Information we have collected for materially different purposes without notifying you.

IF YOU ARE LOCATED IN THE EU:

We process your Personal Information on the following lawful bases:

• Your consent
• The processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms
• The processing is otherwise consistent with applicable law

BEHAVIORAL ADVERTISING

The Services may deploy online advertisements that are customized based on predictions about your interests generated from your online activity.  This type of advertising is known as “Behavioral Advertising”.  Curacity adheres to the Self-Regulatory Principles for Online Behavioral Advertising, developed by leading industry associations to apply consumer-friendly standards to Behavioral Advertising.  

To learn more about the Principles, please visit https://digitaladvertisingalliance.org/principles. 

To learn more about how to opt-out of Behavioral Advertising, please visit www.aboutads.info.  

Please note that this Privacy Policy does not cover the collection and use of information by third-party advertisers.

COOKIES AND THIRD-PARTY ADVERTISING

To enhance your experience with the Services, we may use cookies, which are small data files stored in your computer’s browser, when you visit the Services.  We may use cookies for a number of purposes, such as tracking usage patterns, measuring the effectiveness of advertising, to help serve advertisements, limiting multiple responses and registrations, facilitating your ability to navigate the Services and as part of a verification or screening process.  Cookies automatically identify your web browser whenever you visit the Services, help us determine which areas are popular and further personalize your experience on the Services.  Different cookies are used to perform different functions, which we explain further below:

• Essential Cookies, which are required so that you can navigate through the Services – for example, to display appropriate content based on the type of device you are using.
• Browsing and Functionality Cookies, which remember choices you make on our Services. For example, when you return to the Services, these cookies help remember your preferences.
• Analytics (aka Performance) Cookies, which collect information about how you use the Services, for instance, which pages you go to most often and if you get any error messages.
• Advertising Cookies, which are used to deliver advertisements that are more relevant to you and your interests. They are also used to limit the number of times you see an advertisement, as well as to help measure the effectiveness of an advertising campaign.  Please refer to www.aboutads.info for more information about cookies used for advertising.

Some web browsers (including some mobile web browsers) provide settings that allow you to control or reject cookies or to alert you when a cookie is stored in your browser. You also may be able to reject mobile device identifiers by activating the appropriate setting in your mobile device’s operating system. Although you are not required to accept cookies or mobile device identifiers, if you block or reject them, you may not have access to all features available through the Services. Further, the Network Advertising Initiative offers a means to opt-out of a number of advertising cookies. Please visit here to learn more. Note that opting-out means that the company or companies from which you opted-out will no longer deliver ads tailored to your preferences and usage patterns.

The Services and our email messages may contain a small graphic image called a web beacon that monitors and collects certain limited information about the viewer of the web page or email message. Web beacons typically are very small (generally 1-by-1 pixel) and invisible to the user, but, in general, any electronic image viewed as part of a web page or email message, including an advertisement or HTML content, can act as a web beacon. We may use web beacons or similar technologies for a number of purposes, including without limitation, to count visitors to our web pages or to monitor how our users navigate the Services, and we may include web beacons or similar technologies in emails in order to count how many emails (or particular articles, links, etc.) that we send are actually opened. Additionally, our advertising providers may use web beacons or similar technologies to personalize and measure the effectiveness of their advertisements using data gathered over time from users of the Services. 

We use Google Analytics to better understand how visitors use the Sites.  Please see https://policies.google.com/technologies/partner-sites for more information about how Google uses the information it collects through our websites. For Google Analytics’ currently available opt-outs, please see https://tools.google.com/dlpage/gaoptout/. 

Some web browsers (including Safari, Internet Explorer, Firefox, and Chrome) incorporate a "Do Not Track" ("DNT") or similar feature that signals to websites that a user does not want to have his or her online activity and behavior tracked. If a website that responds to a particular DNT signal receives the DNT signal, the browser can block that website from collecting certain personal data about the browser’s user. Not all browsers offer a DNT option, and DNT signals are not yet uniform. For this reason, many website operators, including Curacity, do not respond to DNT signals.

NOTICE OF PUBLIC POSTING AREAS

Please note that whenever you publicly disclose information about yourself online (e.g., through social networking platforms, survey questions, message boards or similar web pages), such information may be collected, exported and used by us in any manner we elect and may also be used by people that you do not know. Posting Personal Information in public places may result in unsolicited communications, including unwanted email messages or other forms of contact.  ALWAYS BE SMART ABOUT THE INFORMATION YOU PROVIDE ONLINE. WE BEAR NO RESPONSIBILITY FOR ANY ACTION OR POLICIES OF ANY THIRD PARTIES WHO COLLECT ANY INFORMATION YOU MAY DISCLOSE ON THE SERVICES.

INFORMATION WE RECEIVE FROM THIRD PARTIES

In addition to information that you provide or we collect through the Services, we may verify or collect certain information about you from third parties.  We may combine this third party information with information we have already collected from you via the Services and use this information for a variety of reasons including customizing content made available to you, providing promotions and marketing offers tailored to your preferences, improving the content of the Services, helping us to identify and analyze user trends and gathering broad demographic information for aggregate use.  Information received from third parties may include the following:

• Your activity on certain third-party sites or services for which you have consented to connect or share through your account, if accounts are available, on the Services;
• Information from other companies, such as demographic and traffic data; and
• Other information from your interaction with the Services, content and advertising, collected by third party advertisers or providers including computer and/or mobile device connection and location information, browser type, statistics on page views, traffic to and from the Services, ad data, IP address and standard web log information.

THE SERVICES ARE NOT FOR CHILDREN

The Services are not intended for minors and we do not knowingly collect Personal Information from minors. In the event that we learn that a minor has provided Personal Information to us, we delete that Personal Information as soon as possible.

SHARING INFORMATION WITH THIRD PARTIES

We may disclose your Personal Information to a third party for a business purpose.  When we disclose Personal Information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performance of the contract.

We share your Personal Information with the following categories of third parties for the following purposes:

Online Hotel and Travel-Related Services

The Services offer online hotel and other travel related services, for example, allowing you to make arrangements through the Services.  These services will ask you to provide certain Personal Information.  By making arrangements through the Services, you are authorizing us to disclose to suppliers the information required to complete the reservation and deliver the Services.  The financial information that you provide will be used by Curacity or its partners to bill you for products and services that you request and for any other uses to which you have consented.  In addition, Curacity and/or our partners will use contact information from the order form to fulfill your orders and for customer service purposes.  Curacity will not otherwise use or distribute your financial information without your prior approval.

Other Third Parties

Curacity may share or transfer the information it collects with third parties including vendors, service providers, advertisers, contractors and Curacity agents acting on behalf of Curacity and who help to operate the Services.  Examples of such service providers include third parties that provide processing, storage, technical or fulfillment services, data analysis, customer service and emails, and audio and video streaming. Curacity may provide these companies with access to user information, including Personal Information, to carry out the services they are performing for you and Curacity.  While Curacity may use third party analytics providers to evaluate and provide Curacity with information about the Services, audience and content, Curacity does not share Personal Information with these analytics service providers, but the providers may set and access their own cookies, web beacons and embedded scripts on your device and they may otherwise collect or have access to information about you.

Third Party Content 

When you are visiting the Services, certain content may be served directly by third parties.  This third party content may use cookies, web beacons, Javascript or other technologies.  We do not have access to or control the use of such technology by third parties, including the information they collect or how they use such information. We are not responsible for the practices employed by websites linked to/from the Services nor the information contained therein. To better protect your privacy, we recommend that you review the privacy policy of any third party website you visit.

Third Party Applications and Websites

Curacity may not own or operate all services or websites (e.g., hotel and other travel related websites) accessible through the Services or otherwise made available to you by Curacity. Similarly, information may be collected through services owned or operated by different parties on a particular device or through a particular application for the purpose of delivering ads or providing advertising related services or statistical reporting. As a result, when you use these third-party services, we may share your information along with the location of your computer or mobile device to enable your use of such services and for age verification and security purposes, and to allow visitors to contribute to marketing research via third party measurement software included within the application among other purposes. Curacity may offer you the option to connect your activity on the Services with certain third-party services such as Facebook or Twitter (“Third Party Services”).  When you consent to publish your information or activity on the Services to any Third Party Services, such information will be viewable by the communities on such Third Party Services and may be used by such Third Party Services in accordance with their posted privacy practices, or if another member in your friend list uses a third party application or website, it may receive your non-private member information so that you may be separately linked with your friend.  If third party applications or websites seek any further information, your consent should be requested.  We cannot guarantee that such applications or websites will follow our privacy practices, so we encourage you to always review their information sharing policies and to report any application or website that may be in violation of our privacy practices.

Employees and Service Providers

Our employees, agents and contractors must have a “need-to-know” business reason before we permit access to your Personal Information. We may share your Personal Information with services providers that help us manage or provide content or other services for the Services, such as for user forum administration; order fulfillment; statistical analyses; and administration, judging and prize fulfillment for promotions. We only allow these third parties to use your Personal Information to provide the Services and not for any other purpose without your consent. We also provide your Personal Information to a third party where you have chosen to receive certain information and have been notified that the fulfillment of such a request requires sharing your Personal Information.

To Comply with Applicable Law

We may access or disclose your Personal Information without your consent in order to: (i) protect or defend our legal rights or property, including those of our affiliated companies or their employees, agents and contractors (including enforcement of our agreements); (ii) protect the safety and security of other users of the Services or members of the public, including responding to claims that a listing or other content violates the rights of others or protect anyone’s rights, property, or safety; (iii) protect against fraud or for risk management purposes; or (iv) comply with the law or legal process or respond to a request from a government regulator.

To Protect Against Potential Fraud

We may disclose or verify your Personal Information with third parties to protect against potential fraud.

Corporate Transactions

We may share and transfer Personal Information if we are involved in a merger, sale, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy or other change of ownership or control by Curacity or any affiliated company (in each case, whether in whole or in part). If transferred in such a case, the purchaser will abide by the terms and conditions of this Privacy Policy.

INTERNATIONAL DATA TRANSFERS

We are a US-based company. If you are visiting the Services from a location outside of the U.S. and choose to provide us with Personal Information, please understand that we will process your Personal Information in the US and that we may transfer your Personal Information to third parties in other jurisdictions which may not have the same data protection laws as the jurisdiction in which you reside.

We have deployed appropriate administrative, physical and technical safeguards to ensure the protection of your Personal Information, including the standard contractual clauses approved by the European Commission to validate transfers of EEA residents’ Personal Information from the EEA to other countries. Standard contractual clauses are commitments between companies transferring Personal Information of EEA residents to protect the privacy and security of the transferred Personal Information. Please contact us for more information and to receive a copy of the standard contractual clauses we may utilize.

You acknowledge you understand that by providing your Personal Information to us, your Personal Information (i) will be used for the uses identified above in accordance with this Privacy Policy, and (ii) may be transferred to the U.S. as indicated above, in accordance with applicable law.

SECURITY OF YOUR PERSONAL INFORMATION

Curacity employs reasonable security measures designed to secure information collected through the Services. However, we cannot guarantee that your Personal Information will never be disclosed in a manner inconsistent with this Privacy Policy (e.g., as a result of unauthorized or otherwise unlawful third party access), and you transmit such information to us at your own risk. If we learn of a security systems breach, we may attempt to notify you electronically so that you can take appropriate protective steps. By using the Services, or otherwise providing Personal Information to us, you agree that we can communicate with you electronically regarding security, privacy and administrative issues relating to your use of the Services. We may post a notice via the Services if a security breach occurs. Depending on where you live, you may have a legal right to receive notice of a security breach in writing.

We use physical, technical and organizational measures designed to protect your information against unauthorized access, theft and loss. We restrict access to your Personal Information to those employees who need to know that information to service your account or perform their job functions.

Although we take precautions intended to help protect information that we process, no system or electronic data transmission is completely secure. Any transmission of your Personal Information is at your own risk and we expect that you will use appropriate security measures to protect your Personal Information. For example, if you create an account with us, you are responsible for maintaining the secrecy of your password at all times. You are responsible for activity occurring while logged into your account. 

We may suspend your use of all or part of the Services without notice if we suspect or detect any breach of security. You understand and agree that we may deliver electronic notifications about breaches of security to the email address on record on your account.

If you believe that your account or information is no longer secure, please notify us immediately at dataprivacy@curacity.com.

We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide services to you (for example, for as long as you have an account with us or keep using the Services);
• Whether we are subject to legal obligation to retain (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); and
• Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation or regulatory investigations).

CHANGES TO THIS PRIVACY POLICY

We reserve the right to change our Privacy Policy at any time. If we make changes, we will post them and will indicate at the top of this page the new effective date.  If material changes are made to this Privacy Policy that reduce your privacy rights, we will notify you by placing a prominent notice in the Services, by sending you an email at the email address we have on file for you, or some other means that we believe will notify you. We encourage you to refer to this Privacy Policy frequently to stay informed regarding our current privacy practices.

YOUR PRIVACY RIGHTS

Access to Personal Information through Your Account

If you have an account with us, you may correct, update or remove Personal Information you have provided to us at any time through your account. After signing in to your account, you may have the option of modifying or deleting your profile settings. If you do not have an account, you may exercise your privacy rights as described below.

NOTICE FOR INDIVIDUALS LOCATED IN THE EU

You also may have the right to review, correct, update, suppress, restrict or delete Personal Information that you have previously provided to us or to receive an electronic copy of your Personal Information for purposes of transmitting it to another company. 

If you are located in the EU and would like to exercise one or more of your privacy rights above, please fill out the Personal Information Request Form; Contact us by mail at Curacity, Inc., Attn: Privacy Team, 110 E. 25th Street, New York, NY 10010; or contact us by email at dataprivacy@curacity.com.

After you submit your request, we may need to contact you to learn more about what Personal Information you would like to have changed, whether you would like to have your Personal Information suppressed from our database or other limitations you would like to put on our use of your Personal Information. For your protection, we only fulfill requests for the Personal Information associated with the particular email address that you use to send us your request, and we may need to verify your identity before fulfilling your request. We will comply with your request as soon as reasonably practicable and in compliance with applicable law.

Please note that we often need to retain certain data for recordkeeping purposes and/or to complete any transaction that you began prior to requesting a change or deletion (e.g., when you enter a promotion, you may not be able to change or delete the Personal Information provided until after the completion of the promotion). Our databases and other records may have residual data which will not be removed. In addition, we also may not allow you to review certain data for legal, security or other reasons. If at any time you believe that the Services have not adhered to this Privacy Policy, please let us know. We will use good faith efforts to determine and correct the problem.

If you are an EEA resident, you have the right to lodge a complaint with a data protection authority about how we process your Personal Information.

CALIFORNIA PRIVACY NOTICE

This California Privacy Notice applies to the processing of Personal Information of residents of the State of California (“California Consumers”) as required by the California Consumer Privacy Act of 2018 (“CCPA”).

If you are a California Consumer, this California Privacy Notice explains your privacy rights and is intended to inform you at or before the time that you provide us with your Personal Information how and why we process your Personal Information. 

If this California Privacy Notice and any provision in the rest of our Privacy Policy conflict, then this California Privacy Notice controls for the processing of Personal Information of California Consumers. 

Please note:

• We may (and in some cases are required to) verify your identity before we can act on your request to exercise your privacy rights.
• We may not honor part or all of a request you make to exercise your rights under CCPA – for example, certain information we collect is exempt from this California Privacy Notice, such as publicly-available information collected from a government agency. When this occurs, we will explain why in our response.

The following table lists the categories of Personal Information in CCPA.  We indicate for each listed category whether we collect Personal Information in the category from California Consumers within the last 12 months:

CCPA offers California Consumers the following rights:

• You have the right to request information about the categories and specific pieces of Personal Information we have collected about you, as well as the categories of sources from which such information is collected, the purpose for collecting such information, and the categories of third parties with whom we share such information (the “Right To Know”).
• You have the right to request information about our disclosure for business purposes of your Personal Information to third parties.
• You have the right to request the deletion of your Personal Information (the “Right To Delete”).
• You have the right to not be discriminated against for exercising any of these rights.

In addition, a different California law (California Civil Code Section 1798.83) permits users of the Services who are California residents to request, once per year, certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. At this time, we do not disclose Personal Information to third parties for their direct marketing purposes.

HOW TO SUBMIT YOUR REQUEST TO EXERCISE YOUR PRIVACY RIGHTS

If you would like to exercise one or more of the rights above, please:

• Fill out the Personal Information Request Form.
• Call us at +1-833-461-0010.
• Send an email to dataprivacy@curacity.com

PLEASE NOTE: CURACITY DOES NOT SELL (WITHIN THE MEANING OF CCPA) PERSONAL INFORMATION TO THIRD PARTIES AND DOES NOT OFFER FINANCIAL INCENTIVES IN EXCHANGE FOR PERSONAL INFORMATION. ACCORDINGLY, WE DO NOT PROVIDE YOU WITH INFORMATION ABOUT HOW TO OPT-OUT OF SALE OF YOUR PERSONAL INFORMATION OR HOW TO OPT IN OR OPT OUT OF FINANCIAL INCENTIVES.

HOW TO CONTACT US

If you have questions about this Privacy Policy, please contact us at:

Curacity, Inc.

Attn: Privacy Team

110 E. 25th Street

New York, NY 10010

dataprivacy@curacity.com