TripIt Privacy Policy
Effective: May 22, 2018

This privacy policy ("Policy") describes how Concur Technologies, Inc., Concur Holdings (Netherlands) B.V., and their affiliated companies through the TripIt business unit ("TripIt" or "us" or "we") collect, use, and share the information you provide to us or we gather from you while you access or use www.tripit.com (the "Site"), the TripIt mobile application (the "App"), and related services that link to this Policy (together, the “TripIt Services”).

We may also supplement this Policy with other privacy notices in the TripIt Services. This Policy applies only to information collected by us through the TripIt Services and does not apply to services that link to other privacy policies, including any third-party websites or services you connect to from our TripIt Services, such as social-networking platforms or connected third-party applications. TripIt is not responsible for the privacy practices or content of such third parties. We encourage you to read the privacy statements of those third parties.

We collect and process personal information about you with your consent and/or as necessary to provide the products you use, operate our business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfill other legitimate interests.

Personal Data Collected
As used in this Policy, “Personal Data” means information relating to you as an identified or identifiable individual. You provide Personal Data directly into the TripIt Services. For example, as part of activating an account with TripIt, we collect your name, email address and password, and home airport or country. If you create the account using one of the available social networking or third-party platform connection options (a “social sign-in” like Google, Facebook, or Yahoo), we will collect your associated email address and related profile information from the social sign-in provider. You may also identify your company or employer, as well as provide a photo of yourself. You may also provide us with additional email addresses for purposes of collecting itinerary information and to ensure that you retain access to your account even if you no longer have access to your primary email address.

To take full advantage of features and functionality of the TripIt Services, you may also provide us with additional information for your profile, such as date of birth, or your travel preferences, like seat and meal preference. And you may input emergency contact details and government-issued identification numbers needed for travel, such as your passport or driver license number. This information helps you to keep your itinerary and travel information in one place. If you wish to receive alerts via text messages, you must provide your mobile phone number. If you purchase additional TripIt Services, such as upgrading your account to TripIt Pro, we will collect certain billing and payment information. We process any payments using third parties, and we would retain only the last four digits of your credit card number and expiration date. Some services may not be available or function correctly if you are not willing to provide personal information.

We may also collect Personal Data from other sources and combine that with Personal Data we collect from you through the TripIt Services, as described below.

Company SAP Concur Account
If your company has enabled you to connect the SAP Concur account you use through your company (“SAP Concur Account”) with your TripIt Services account, by allowing the TripIt Services to access your SAP Concur Account, the TripIt Services will have access to account profile, itineraries, and traveler preferences contained within your SAP Concur Account. The TripIt Services may use and store this Personal Data and combine it with other Personal Data maintained by the TripIt Services. Travel itineraries available to your SAP Concur Account will also be collected into your TripIt Services account so that you may manage these itineraries with the TripIt Services.

Third-Party Connected Services
The TripIt Services also enable you to connect your TripIt Services account with third-party applications and service providers. You can find information about many of these applications within the “Supported Apps” portion of the Site, and third-party applications that connect to the TripIt Services will usually indicate that they connect to the TripIt Services. These connected third-party applications may enable Personal Data about you to be transferred into the TripIt Services. For example, if you book airline travel using a connected third-party application from the airline, the corresponding booking information may be transferred into the TripIt Services. Your use of any third-party applications is subject to the terms and conditions you have agreed to with such third parties, including third-party privacy notices, and TripIt is not responsible for the quality or accuracy of third-party data available to the TripIt Services from third parties.

Connecting Your Email and Reward Accounts
You can choose to enable us to access one or more of your email accounts by connecting such account(s) with your TripIt account. If you connect your email account, the TripIt Services will automatically access and analyze the contents of emails in your email account(s) on an ongoing basis for the purpose of identifying travel and travel-reward related emails that may contain recent travel bookings, boarding passes, or reward-program statements. Once identified, travel itinerary and reward-program information is then extracted from your emails into your TripIt Services account so that you may access this information in the TripIt Services. TripIt’s access to the email account is authorized through the email provider’s access mechanism. If you choose to have the TripIt Services track your travel-reward points, the TripIt Services will store account details for each of your travel-reward accounts, including your sign-in user name and password for tracked accounts. This information will be used to enable the TripIt Services, directly or indirectly through third-party service providers, to automatically access your applicable reward accounts and analyze and extract information from such accounts for use in the TripIt Services. You will be asked in each case whether you want to connect a third-party email or reward account. You may manage your connections to email and reward accounts and disconnect at any time in the settings menu and Point Tracker menu, respectively.

Third-Party Social Sign-Ins
You can sign in to our TripIt Services using third-party social sign-ins (e.g., Google, Facebook, and Yahoo). These social sign-in providers will share certain Personal Data with us as described in their sign-in notices or in their privacy policies, which might include information such as your name, profile picture, age range, gender, and other public information. We encourage you to review prior to signing in through the applicable service.

Cookies, Analytics, and Tracking
When you use the TripIt Services through the Site, some information such as Internet protocol (IP) address, device or browser information, logs, or clickstream information is automatically collected about your usage and activity to address technical support issues and understand how you use the Site. TripIt may use certain tracking technologies such as cookies, web beacons, or third-party analytics tools to obtain such information. You may find out more about the various tracking tools used on the Site and the choices you have by following the Cookie Preferences link on the Site footer. Our App utilizes tracking technologies from third-party service providers we have engaged to provide services on our behalf. In some cases, these are analytics providers that provide services such as application analytics and crash reporting. In other cases, these are advertising or campaign measurement providers. These providers may also automatically collect some of the information described above, including, for example, usage information, IP address, access times, browser type and language, device type, device identifiers, and Wi-Fi information. These providers may also automatically collect the above information about you through the App and on other sites and services, including personally identifiable information about your online activities over time and across different websites, devices, online services, and applications when you use our App. Some third parties help us and others associate your activities across the browsers and devices you use, or that your household uses, for retargeting, cross-device advertising, analytics, and measurement purposes. The third-party analytics and advertising providers we use include: Google Analytics, Crashlytics, and Apsalar. Some third-party providers allow you choices about their collection or use of your information. Some of these providers may also be members of the Network Advertising Initiative (NAI) or Digital Advertising Alliance (DAA), which each provide a simple way to opt out of ad targeting from participating companies.

Contacts
From the Site, you can access and import contacts from your other online address books, like Google, Yahoo, and Outlook. If you would like us to invite another individual to join the TripIt Services, you may provide us their email address so that we may send them an invitation on your behalf to visit the TripIt Services. When using the App, the App may also access your device contacts if you enable those permissions.

Location Data
Certain features of the TripIt Services may collect precise geolocation data, including through GPS (global positioning systems), IP address, and other location-based technologies. Additional information about these features is provided below, along with the settings screens for the features in the App.

How Personal Data Is Used
TripIt will use Personal Data as described in this Policy and as disclosed to you in the TripIt Services, which include for the following purposes:

Creating and maintaining your travel itineraries and your profile and otherwise providing, operating, hosting, maintaining, connecting, and improving the TripIt Services.
Responding to your comments and questions and providing customer service.
Training and operating automated systems that recognize and extract travel and reward-program information from emails.
Updating you on new features and functionality of the TripIt Services, as well as other news and information about products and services offered by TripIt, other affiliated companies, and our selected partners.
Providing you information via email or another form of electronic notification related to your use, requests, and purchases, such as transaction confirmations, invoices, technical notices, and other notices about security, privacy, and administrative issues relating to your use of the TripIt Services.
Personalizing your TripIt Services experience, content, marketing, and recommendations, including to target content and services to more closely match your interests or location.
Creating anonymized data sets from Personal Data to improve our and our affiliates’ products and services.
Enforcing our terms and conditions or protecting our business, partners, or users.
Protecting against, investigating, and deterring fraudulent, unauthorized, infringing, or illegal activity.
Choices You Have Regarding Personal Data
Profile and Transaction Information
Through the profile and settings pages within the Site and the App, you can update profile information associated with your account at any time, such as contact and payment information, travel preferences, privacy and sharing settings, and alerts and connected applications. Depending upon the type of access you grant to third parties, such as third-party applications that you have granted access to your account or team members that you’ve allowed to manage your itineraries, they may also be permitted to edit the information you have provided to us and to designate others to access and edit such information. You may change who has access to your information by changing your publishing options in your account settings. You may choose to display certain information you give us in your public profile. Our Site may offer publicly accessible blogs or community forums. You should be aware that any information you choose to share in these areas may be read, collected, and used by others.

If you otherwise wish to ask for access, correction, or deletion of any of your information held by us, or a change in the way we use your information, please contact us at: privacy-request@concur.com. We reserve the right to charge you a fee, as permitted by applicable law, and may decline requests that are unreasonable, prohibited by law, or are not required to be honored by applicable law.

Location Data
The TripIt Services provide features that require your precise location and the use of location services on your mobile device through the App. Some of these features may be available only to users of the premium “Pro” version of the TripIt Services. You may enable or disable these TripIt Services within the App and the privacy settings in your mobile device. Features such as Go Now (alerts you about important events, such as when you should leave for your drive to the airport based on your current location, flight status, and real-time traffic conditions) and Terminal and Gate Reminders (alerts you to your terminal and gate number when you’re close to the airport) require that location services on your mobile device be set to always provide location information, but these features only begin to detect your location a few hours prior to your scheduled departure and do not continuously collect your location. The TripIt Services may also provide you with navigation services within certain airports or between destinations based on your itinerary or destinations that you have specified. These services require that location services on your mobile device be enabled only when you are using the App.

SAP Concur Account
If your company subscribes to certain business travel and expense solutions from Concur Technologies, Inc. or Concur Holdings (Netherlands) B.V. (“SAP Concur”), you may connect or disconnect your SAP Concur Account from your TripIt account within the TripIt Services or from your SAP Concur Account. Once connected, any itineraries or travel information within the TripIt Services may be available to your company. This may include your personal itineraries within the TripIt Services unless you exclude them using the “Link to Concur” setting or delete them from your SAP Concur Account. If you choose to disconnect your TripIt Services account from your SAP Concur account, or you no longer have access to your SAP Concur Account, any Personal Data shared with your company prior to such time is governed by the terms between your company and SAP Concur or one of its corporate affiliates, and you will need to contact your company regarding use and retention of that data. If you intend to continue to use your TripIt Services account after you no longer have access to your SAP Concur Account, you will need to update your TripIt Services account email to a personal email account.

Connections with Other Services
Other third-party services you have chosen to connect with the TripIt Services may be enabled or disabled through selections in the Site or the App. You usually can also enable or disable connections through the third-party services themselves. Certain third-party services we may feature through our TripIt Services give you social-media options to interact with buttons or widgets that let you “like” information or post information about your activities publicly from the TripIt Services to third-party sites and platforms or privately within your network. By connecting your TripIt Services account with third-party services, you enable third-party services to access the TripIt Services API and gain access to your itinerary information, as well as your profile information. Their use of this information is governed by their user terms with you and their privacy policies.

Email and Marketing Choices
You can manage your email preferences through the selections within the Site or the App by updating your email subscription settings. You can also unsubscribe from promotional emails by: (1) following the unsubscribe instructions in our emails; or (2) emailing us at privacy-request@concur.com. You may update your email preferences from time to time. Please note that even if you unsubscribe from promotional email messages, we may still need to contact you with important transactional information related to your account and your use of the Service. For example, even if you have unsubscribed from our email messages, we will still send you emails relating to security, billing, or account services such as password reset.

Push and Text Message Alerts
You may manage the push message alerts regarding flight delays, gate changes, and other alert information specific to your itinerary sent by the TripIt Services to your mobile device through the settings page in the Site or within the App. Similarly, you may manage text message alerts through the settings page in the Site or within the App, and you may always opt out of text message alerts by replying STOP to any text message sent by TripIt.

Connections, Groups, and Sharing Your Travel Information
The TripIt Services enable you to keep in touch with your contacts and other members of the TripIt Services when you travel, such as by importing your contacts as described above. You may also invite other TripIt Services users to become connections in your personal network within the TripIt Service or search for and join groups of TripIt Services users so that you can more easily coordinate travel and share travel information. In your settings menu, you may configure certain privacy controls that enable the sharing of profile information, traveler information, and itinerary information and statistics with other users or with the general public (including external search engines). You can share specific itineraries with both TripIt Services users and non-users. If we send an email itinerary on your behalf to a non-user, you represent that you have permission to direct us to email such person.

Cookies, Analytics, and Tracking
You also have choices regarding some of the technologies used to track your use of the TripIt Services. You may find out more about the various tracking tools used on the Site and the choices you have by following the Cookie Preferences link in the footer of the Site. Note that the settings are limited to the particular browser installed on a particular device. So if you use TripIt Services with different browsers or different devices, including a mobile device, you may have to disable the tracking cookies in the browsers of all relevant devices. It may not always be possible to disable cookies in the App, and disabling cookies on the Site will not disable tracking technologies on the App. We may not recognize or respond to every type of "do not track" signal or other mechanisms that provide consumers the ability to exercise choice regarding the collection of Personal Data about an individual consumer’s online activities over time and across third-party websites or online services, but we give you certain choices about how we collect Personal Data as described in this Policy. For more information on how we collect Personal Data for these purposes, see the “Cookies, Analytics and Tracking” section above.

How TripIt Shares Personal Data
The TripIt Services may share your Personal Data as described in this Policy and as follows:

With your consent.
Between SAP Concur, its corporate affiliates, and your company, if you connect your TripIt Services account with your SAP Concur Account, if applicable.
With third parties to the extent that you have enabled a connection between your TripIt Services account and a third-party service.
With other TripIt users or the public through your public profile in accordance with your privacy settings, if you share itineraries, and if you grant another TripIt user access to manage or view your travel plans.
When we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities; to protect and defend the rights, property, or safety of TripIt, our users, or others; and in connection with the enforcement of our terms and contracts.
In connection with a corporate transaction, such as a divestiture, merger, acquisition, consolidation, or asset sale, or in the unlikely event of bankruptcy. We may assign or transfer your information as part of the transaction.
With third-party vendors, consultants, and other service providers that are working on our behalf and need access to your information to provide specific services to us as part of the TripIt Services, such as credit card processing companies, or hosting, email messaging, or SMS providers.
In an aggregated form that does not directly identify you.
As required by law and when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, or legal process served to us.
How Personal Data May Be Transferred to the United States
The TripIt Services operate from data centers in multiple locations globally, including in the United States. Using the TripIt Services may result in the transfer, use, processing, or storage of Personal Data in the United States or any other country where TripIt operates or maintains facilities or service centers, including jurisdictions that may not have data privacy laws that provide protections equivalent to those provided in your home country. TripIt takes steps designed to ensure that the Personal Data is processed according to applicable law wherever the data is located and the provisions of our agreements, including any intercompany data-processing agreements among corporate affiliates.

By providing your information to us through your use of the TripIt Services, you agree to that transfer, storage, and processing of your Personal Data in the United States.

Rights for Certain Users
TripIt adheres to applicable data protection laws in the European Economic Area (EEA), which, if applicable to you, include the following rights:

Where processing of Personal Data is based on your consent, you have a right to withdraw consent at any time for future processing.
You have a right to request access to, rectification, or erasure of your Personal Data, or to transfer or receive a copy of your Personal Data in a usable format.
You have a right to object to the processing of your Personal Data under certain circumstances.
You have a right to lodge a complaint with an applicable data protection authority.
Concur Technologies, Inc. is the controller of your Personal Data for the TripIt Services, and Concur (Netherlands) B.V., an affiliate of Concur Technologies, Inc., located at Barbara Strozzilaan, 101 1083 HN, Amsterdam, The Netherlands, is our data protection representative for the EEA and Switzerland, which you may contact at privacy-request@concur.com. The data protection officer for SAP group companies is Mathias Cellarius (privacy@sap.com).

If applicable under French law, you can also send us specific instructions regarding the use of your personal information after your death by contacting us at privacy-request@concur.com.

The services hereunder are not intended for use by the citizens of the Russian Federation who reside in Russia. If you are a Russian citizen residing in Russia, you are hereby notified that any Personal Data that you input into the services will be solely at your own risk and responsibility. You explicitly agree that we may accumulate your Personal Data and will process this data in the United States and in other countries, and that you will not hold TripIt accountable for any potential nonobservance of the Russian Federation legislation.

Security and Retention of Personal Data
We maintain data handling and storage practices and procedures that are designed to promote the integrity and confidentiality of the personally identifiable information. No method of transmission over the Internet or method of electronic storage is completely secure, however. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

We retain your Personal Data for as long as necessary to provide the TripIt Services and for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types in the context of different services, actual retention periods can vary significantly. The criteria used to determine retention include (1) the length of time Personal Data is needed to provide the applicable services (such as maintaining and improving the performance of the TripIt Services, enabling system security measures, and maintaining appropriate business and financial records); (2) if users have provided, created, or maintained Personal Data with the expectation that we will retain it until they affirmatively remove it (in which case we may maintain the data until actively deleted by the user); (3) whether the Personal Data is of a sensitive type (a shortened retention time may be appropriate); and (4) whether we are subject to a legal, contractual, or similar obligation to retain the data (such as mandatory data retention laws in the applicable jurisdiction, government orders to preserve data, or data that must be retained for the purposes of litigation).

Updates and Questions
We may update this Policy from time to time without notice to you other than posting the revised policy on the TripIt Services or by providing such notice about or obtaining consent to changes as may be required by applicable law. If we change our Policy, we will post those changes to this Policy and change the effective date above. We encourage you to periodically review this page for the latest information on our privacy practices.

If you have any questions about this Policy, or to file any complaint regarding this policy, please contact us at the following address:

Concur Technologies, Inc.
601 108th Avenue NE, Suite 1000
Bellevue, WA 98004
USA
Attention: Privacy Manager/TripIt
Telephone: (888) 883-8411
privacy-request@concur.com
TripIt will investigate and attempt to resolve complaints and disputes regarding the collection, use, and disclosure of personal information by referencing the privacy principles stated in this Policy. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge).