Agoda Hosts Non-Hotel Accommodation Privacy Policy

Internal

Introduction

Last Updated: November 2023

This Privacy Policy describes how Agoda Company Pte. Ltd. (30 Cecil Street, Prudential Tower

#19-08, Singapore 049712) ("Agoda," "we," "us," "our") collects, uses, and shares information

about hosts or individuals becoming a host through registering your non-hotel accommodation

("NHA Accommodation") on our website (mobile and desktop) and mobile app (collectively, "Site")

or when you agree to enter into contact with us with the intention to register your NHA

Accommodation via our campaigns or third-party channels. Below is a summary of our privacy

practices. Our full Privacy Policy is available below, or you can click the links on any of the points

detailed in the summary table for further details.

1. Collection

We may collect information about you, such as your name, address, and

email address through your use of the Site or when you elect to provide them

to us via our campaigns or third-party channels.

2. Use

We may use your information to provide the requested services, to follow-up

with you when you show interest in becoming a host and to maintain and

improve the Site.

3. Sharing

We may share your information with service providers and our affiliates.

4. Privacy

Rights

You have rights related to requesting information regarding how we share

with third parties.

5. Cookies

We may use cookies and similar technologies to help provide our Site and

understand and customize your experience.

6. International

Transfers

We maintain appropriate protections for cross-border transfers as required

by law for international data transfers.

7. Security

We maintain reasonable security measures to protect your information and

require our service providers to do the same.

8. Access

Rights

You may exercise certain rights of access, correction, deletion, portability, or

object to certain processing of your information.

9. Updates to

We will notify you of any material changes by posting the updated version of

this Privacy Policy and taking other steps as needed.

10. Additional

Considerations

We have drafted this Privacy Policy in the English but certain translations are

available for your convenience.

11. Contacting

Please contact us with any questions about this Privacy Policy or our privacy

practices as detailed below.

Internal

1. Information We Collect

We collect information about you that you provide to us when using the Site, such as your name,

profile photo, phone number, e-mail address, country of residence, city, nationality, address and

banking account details for payments, government identification information, date of birth, Agoda

username and ID for login and verification. We also collect information of the NHA

accommodations that you offer on the Site such as the address of NHA Accommodation,

description of the NHA accommodation, availability of the NHA Accommodation, photographs,

video content and metadata. We may also collect information such as contact details and contact

preferences when you show interest in our services and allow our business to follow-up with you.

By visiting our Site, we may also automatically collect certain usage information, such as your IP

address, geographic data, country, browser, and information about your device's operating

system, application version, language settings, and pages that have been shown to you. If you

are using a mobile device to access our mobile app or mobile optimized Site, we might collect

information that identifies your mobile device, such as the device ID, location of the device (with

your consent), and device-specific settings and characteristics.

We may receive information about you from our affiliated group companies, affiliated entities,

business partners, or other third-party providers for the purposes described at Section “

Sharing

and Disclosure of Your Information” and subject to any contractual terms. We may also receive

information about you from other sources such as law enforcement or tax authorities that contact

Agoda in case of investigations and, in certain instances, and as permitted by applicable law,

through third party sources for fraud detection and prevention purposes.

Where required by law, we rely on the following legal bases to process information about you:

• Necessity to Perform Contract with You - we need to process your information in order to

provide our accommodation reservation services to you, answer questions and requests

from you, and provide hosts support;

• Our Legitimate Interests - we process your information for security and safety; to detect

and prevent fraud; to protect and defend the rights or property of others, or our own rights

and interests; to customize and provide our accommodation reservation services; to share

your information with affiliated group companies; and to respond to lawful requests, court

orders, and legal process;

• Compliance with Legal Obligations - we need to process your information to comply with

relevant laws and regulatory requirements;

• Consent for contacting you to become a host – we rely on your consent to follow up with

you when you show interest in our accommodation reservation services;

• Consent for Non-Essential Cookies - we rely on your consent to place non-essential

Cookies. Please see section "

Your Choices" below for details on how to opt-out of such

Cookies; and

• Protect Vital Interest - we may need to process your information in case of emergency

involving an individual's life or health.

Internal

2. How We Use the Information We Collect

We may use the information to:

• Provide you with the requested services, such as creating a user account, verifying your

identity and account, processing requests to reserve your NHA Accommodation,

confirming reservations, and communicating with you about upcoming reservations;

• Make and receive payments, including for reconciliation and invoicing purposes.

• Follow-up with you when you show interest in our services;

• Provide you with information about our services, including notifications of availability, and

system/product updates, conduct surveys, invite you to participate in referral programs or

competitions, attend and hosts events we believe may be of relevance to you, or offer and

host online forums to enable you to find answers to commonly asked questions on the

usage of Agoda's or a business partner's products and services;

• Maintain and improve the Site, understand and tailor the user experience, and for internal

training;

• Protect the security of you and the Site, including detecting and preventing fraudulent

activities, and send you security alerts;

• Exercising a right or obligation conferred or imposed by law, including responding to

authorities’ requests and other legal demands.

You will receive confirmation emails and text messages from us after you confirm a booking, these

messages contain information regarding check in and check out dates for the NHA

Accommodations that you offer on the Site. You may also receive Host review emails sent after

guests depart. Please note, these messages are part of your accommodation reservation

process, they are not marketing messages.

If you have not finalized your NHA Accommodation registration, we may send you a reminder to

complete your registration. We believe this service is useful to you because it allows you to timely

Communications on the Site

We offer you and your guests’ various means to communicate about your accommodation and

existing reservations, through the Site. You can contact us with questions about the reservations

or about your guests via the Site, and via other available channels.

We may access communications between you and your guests and may do so via automated

systems to review, scan, and analyze communications for security purposes; fraud prevention;

compliance with legal and regulatory requirements; investigations of potential misconduct;

product development and improvement; research; host engagement; and host or technical

support. We reserve the right to block the delivery of communications that we, in our sole

discretion, believe may contain malicious content, spam, or may pose a risk to you or,

customers/guests, us, or others. Please note, all communications sent or received using the Site’s

communication tools will be received and stored by us. In case reservation was made through our

business partners, guests may choose to communicate with you directly via email or other

channels that we do not control.

During calls with our support team, live listening may be done, or calls may be recorded for quality

and reference purposes which includes the usage of the recordings for the handling of claims,

Internal

training, fraud detection and reference purposes. If you would prefer that your call was not

recorded, you can opt out by terminating the call. Call recordings are kept for a limited amount of

time and automatically deleted thereafter, unless Agoda has a legitimate interest to keep such

recording for a longer period, including for fraud investigation and legal purposes.

Mobile Devices

We may send you push notifications with information about upcoming reservations, potential

future stays, or as part of any Agoda programs that you participate in. Where legally required, we

will request your express consent for it.

You may grant us access to your location information or

contact details in order to provide services requested by you. When you upload a picture or video

from your mobile device, your picture or video may also be tagged with your location information

or other metadata. Please read the instructions of your mobile device to understand how to

change the settings and enable the sharing of such information or the receipt of (or opt out of

receiving) push notifications (including Software Development Kit ("SDK") and push token data).

Different device operating systems may have different default settings, so please familiarize

yourself with such settings governing push notifications.

3. Sharing and Disclosure of Your Information

In connection with your visit to our Site and use of our services, we may share your information

as follows:

• Guests - when you as a Host have a confirmed booking, certain information is shared with

the guest to coordinate the booking, such as your full name, contact information (email,

phone number), and accommodation address. After completing a booking, guests and

Hosts may write reviews and rate each other.

• Business Partners - such as suppliers and third-party metasearch companies that we have

relationships with to redirect search queries or reservations to the Site or to enable

customer support services.

• Site Users - the Site allows Hosts to publish information that is visible to the general public

(e.g., parts of your public profile page such as your first name, your description, and city)

which are publicly visible to users who are seeking to book accommodations. This publicly

disclosed information allows user to consider the accommodation(s) you are offering on

the Site and includes the approximate locations (neighborhood and city), listing

description, calendar availability, any photographs and videos made publicly available by

the Host, aggregated demand information, and any additional information the Host

chooses to share.

• Third Party Service Providers - such as web hosting, data analysis, host support, fraud

prevention, and other add-on service providers we appoint to perform services on our

behalf.

• Our Affiliated Group Companies - we may share information about you with our affiliates

and subsidiaries, as well as with our parent corporation, Booking Holdings Inc., and its

other subsidiaries (collectively, our "Affiliated Group Companies") and we may receive

information about you from them including for any services that they may provide to us in

order to: support or perform the service requested by you (including support services); for

quality, analytical and product improvement purposes; personalize the online services and

for marketing; detect, prevent, and investigate fraudulent transactions and/or activities,

other illegal activities, and data breaches; for internal (audit/compliance) investigations; or

as otherwise required or permitted by applicable law, for example to conduct verification

and sanction list checks for compliance with applicable laws that apply to us.

Internal

• Where Required or Permitted by Law - such as to protect ourselves against liability, to

respond to subpoenas, judicial processes, legitimate requests, warrants or equivalent by

law enforcement officials or authorities, to investigate fraud or other wrongdoing or as

otherwise required or necessary in order to comply with applicable law, protect our

legitimate interests or to the purchasers in connection with any sale, assignment, or other

transfer of all or a part of our business or company. We may also, in compliance with

applicable law, disclose your information to enforce or apply the terms and conditions

applicable to our services or to protect the rights, property, or safety of Agoda, our users,

or others.

Such authorities to whom we may disclose your information to may include:

o Relevant tax authorities: where legally permissible according to applicable law,

disclose your and your guests’ data and other information relating to transactions

made through the Sites without further notice including but not limited to your and

your guests’ names, accommodation addresses, transaction dates and amounts,

tax identification number(s), contact information and other booking data. We may

also disclose accommodation and occupancy tax information including the amount

of taxes received (or due) by you from your guests where Agoda facilitates the

collection and remittance of occupancy taxes.

o Government and local government authorities: in jurisdictions where a registration,

notification, permit, or license is required with a local governmental authority to list

accommodation on sites such as ours in accordance with local law. We may share

information of you without further notice with the relevant government authority,

such as your and your guests’ names and contact details, accommodation

addresses, listing details, number of nights booked and other booking data.

• Business Reorganization - such as part of any sale, assignment or other transfer of our

business, or transition of service to another provider. We will ask for your consent if

required by applicable law.

• Search Engine Indexing - public information shared on our Site may be indexed through

third party search engines and available opt-out functionalities will be dependent upon the

terms of these third-party search engines.

We may also share information in aggregate form and/or in a form which does not enable the

recipient of such information to identify you, with third parties, for example for industry analysis

and demographic profiling.

We provide appropriate protections for such sharing as required by applicable law to prohibit third

parties from using your information for their own purposes, and to address the security and

confidentiality of your information. Except as disclosed in this Privacy Policy or as required or

permitted by applicable law, we will not disclose your information to third parties without your

consent.

4. Country-specific Privacy Rights

USA, California Privacy Rights

Under the California Consumer Privacy Act (“CCPA”), as amended by the Consumer Privacy

Rights Act (“CPRA”) (collectively, "California Privacy Law"), we provide specific disclosures about

how we use and disclose your information. This section covers how we have collected, used,

disclosed and otherwise processed your personal data over the past 12 months, as well as

additional rights you may have with respect to your personal data. This section does not reflect

our processing of personal data where an exception under California law applies.

Internal

CA Personal Information. Consistent with the “Information We Collect” section above, we may

collect certain categories of information about California residents, such as:

• Identifiers: name, address, phone number, e-mail address, address of NHA

Accommodation, government identification information, date of birth, Agoda account

password, IP address, cookie ID, and information collected via Cookies;

• Commercial Information: name of and details about your NHA Accommodation,

schedule of availability for any applicable NHA Accommodation, photographs, videos and

description of any applicable NHA Accommodation, banking account details for payments,

Site preferences and transaction history;

• Internet or Other Electronic Network Activity: browser, operating system, application

version, device ID, and pages shown, metadata of photographs or videos you upload on

our Sites; and

• Geolocation Data: physical location of your mobile device or pictures uploaded from your

mobile device.

• Audio Information: we may record your calls to our support team with your permission;

• Inferences: drawn from the information collected.

Certain CA Personal Data that we collect about you may be considered Sensitive Personal data

within the meaning of California Privacy Law, including: passport details (for transactional

purposes), payment card information (for billing and transactional purposes in connection with

accommodation services purchased), and precise geolocation information (for providing

services). Agoda only uses and discloses Sensitive Personal data as necessary in connection

with the performance of services and the provision of goods, compliance with federal, state, or

local laws, and as otherwise permitted by California Privacy Law.

Sources of CA Personal Data. Consistent with the "

Information We Collect" section above, we

may collect personal data directly from you, as well as from our affiliated group companies,

affiliated entities, business partners, or other third-party providers.

Use of CA Personal Data. We process your personal data for the business and commercial

purposes consistent with the "How We Use the Information We Collect" section above.

CA Personal Data Disclosed to Third Parties:

• Disclosure of Personal CA Personal Data for Business Purposes: We disclose the

following categories of personal data for business purposes: Identifiers, Commercial

Information, Internet or Other Electronic Network Activity, Geolocation Data, Audio

Information, and Other Information to web hosting, payment card and payment

processing, business analytics, customer service, and business partners.

• Disclosure of CA Personal Data for Commercial Purposes: We disclose the following

categories of personal data for commercial purposes: Identifiers to email providers and

survey service providers.

Retention of CA Personal Data. We retain your personal data consistent with the "Data

Retention" section below.

California Privacy Rights. As a California resident and subject to certain exceptions, you may

have the right to request: (i) deletion of your CA Personal Data; (ii) correction of inaccurate CA

Personal Data; (iii) the right to know/access the categories of CA Personal Data that we collect

about you, including the specific pieces of CA Personal Data; (iv) the categories of CA Personal

Data disclosed for a business purpose; and (v) information about the categories of CA Personal

Data about you that we have shared (as such term is defined under California Privacy Law) and

Internal

the categories of third parties to whom the CA Personal Data was shared. You may make your

request by contacting us at

PS-Privacy@agoda.com.

To protect your privacy and security, we will verify your identity before responding to such request

and may request you to provide us with information matching the identifiers and commercial

information already maintained by Agoda about you or additional proof where necessary. If you

are making this request on behalf of someone else, we may request the authorized agent provide

us with a copy of a valid power of attorney or evidence of the written authorization. You will not

be penalized for exercising your rights to your CA Personal Data.

We do not sell or share your CA Personal Data as such terms are defined by California

Privacy Law.

Authorized Agent. You can designate an authorized agent to make a request under California

law on your behalf in certain circumstances. If you use an authorized agent for this purpose, we

may ask you to verify your identity or that you provided the authorized agent signed permission

to submit a request on your behalf. If you provide an authorized agent with power of attorney

pursuant to Probate Code sections 4000 to 4465, it may not be necessary to perform these steps,

and we will respond to any request from such authorized agent in accordance with California law.

Right to Non-Discrimination. We will not discriminate or retaliate against you based solely upon

your exercising your rights under applicable law

South Korea Privacy Rights

If you are a South Korean resident, you may request information from us about how we may share

certain categories of your information with third parties as detailed above under "Sharing and

Disclosure of Your Information". We entrust the processing of your information as provided below,

accompanying such entrustment with contractual safeguards to protect your information:

Name of Trustee

Entrusted Functions

Web Hosting Trustee

Hosting databases used to maintain Host’s information.

Host Support Trustee

Responding to Host’s inquiries about Agoda's Site and services.

Analytics Trustees

Assessing how Hosts interact with the Site and third-party

websites, in order to improve and secure the Site, including for

detecting and preventing fraudulent activities.

As described in more detail under the section "How You Can Access or Change Your

Information," you may have certain data subject rights under local law.

For further information, please contact the Agoda Data Governance Officer at

[email protected]m with "South Korean Privacy Matter" in the subject line to request such further

information. You may also contact your local authorities (local numbers provided):

• Privacy Invasion Reporting Center (privacy.kisa.or.kr / dial 118)

• High-Tech Crime Investigation Division, Supreme Prosecutors’ Office (www.spo.go.kr /

dial 1301)

• Korean National Police Agency Cyber Bureau (www.ctrc.go.kr / dial 182)

However, please note that as set out in our Accommodation Property Participation Agreement,

Agoda Company Pte. Ltd. in Singapore provides the services to you, and there is currently no

entity in South Korea providing reservation services to South Korean residents.

Internal

We will retain your information for the period necessary to fulfil the purposes outlined in this

information, we will remove your information from our systems and records and/or take steps to

properly anonymize it so that you can no longer be identified from it, unless we need to keep your

information to carry out corporate tasks and achieve our business objectives or to comply with

applicable legal or regulatory obligations.

China Privacy Rights

If you are a Chinese resident, please note the following regarding the cross-border

transfer/sharing of your information.

Disclosure / Transfer of Information: We will maintain the confidentiality of your information but

may provide or transfer your information to third parties as detailed above under "Sharing Your

Information," which may include transferring your information to persons to whom we are required

to make disclosures to under applicable law within or outside the PRC.

Transfer of Information Overseas: We will generally maintain your information on servers in

Hong Kong and Singapore, or any other data centers outside the PRC. However, we may transfer

your information to third parties mentioned above who may be located outside the PRC.

India Privacy Notice

Under Indian law, we must collect, process and store PAN numbers (tax IDs) of Indian nationals

or residents in relation to any overseas payments made on our Site. The value of your transaction

with us and your PAN number will be shared with our external payment processor for disclosure

to the authorised dealer bank. We will otherwise retain your PAN number for the duration

mentioned in this Privacy Policy and collect and process your information respecting Indian law.

By proceeding with the partner registration and accepting our Privacy Policy you express your

consent to the treatment of your personal data for the determined purposes.

Japan Privacy Notice

Under Japanese privacy law, you may have the right to request further information about our

personal information processing, for example, requesting further information about our security

control measures, the procedures for exercising your privacy rights and our representative details.

If you would like to request this information, please reach out to privacy@agoda.com with “Japan

Privacy Request” in the subject line.

Turkey Privacy Notice

If you are a Turkish resident, the processing of your personal data will be subject to Law No. 6698

on Protection of Personal Data of Turkey (“Turkish Data Protection Law”). In this regard, the

following terms apply to you, and in the event of any conflict between the following additional

terms and the provisions of the rest of the policy, the following terms shall prevail.

Your rights: According to Article 11 of the Turkish Data Protection Law, you have the following

rights with respect to your personal data:

• the right to learn whether we process your personal data

• the right to request information with regard to such processing, if we process your personal

data

Internal

• the right to learn the purposes of the processing and whether they are used for such

purpose or not

• the right to know the third parties within or outside the country, to whom we transfer your

personal data

• the right to request correction of incomplete or inaccurate personal data

• the right to request deletion or destruction of your personal data under the conditions set

forth in Article 7 of the Turkish Data Protection Law

• the right to request that we notify the third parties, to whom we transferred your personal

data, about the correction, deletion and/or destruction of your personal data per your

request within the scope of the foregoing two items

• the right to object to the negative results about you that are due to the analysis of your

personal data processed solely by automated means

• the right to claim indemnification for damages incurred due to illegal processing of your

personal data

Special Categories of Personal Information: We rely on your explicit consent to process your

special categories of personal information as defined under Turkish Data Protection Law in the

absence of other applicable legal grounds.

Cookies: If you live in Turkey, we rely on your explicit consent (opt-in consent) when processing

your personal data through non-essential (i.e. Non-Functional Cookies as explained under

"Cookies") cookies.

Marketing Communications: Under E-Commerce Law No. 6563 and secondary legislation, as

a service provider, we rely on your explicit consent (opt-in consent) when sending marketing

communications to you.

International Data Transfers: In the event that we transfer your personal data to third parties in

countries other than Turkey, we will comply with the requirements under the Turkish Data

Protection Law, including obtaining your explicit consent, where and if necessary.

5. Cookies

Our Site uses and allows third parties to place cookies (session and persistent), pixels/tags,

SDKs, application program interfaces ("APIs"), and other technologies (collectively, "Cookies")

on our Site that collect and store certain information about you. Some of these Cookies are

necessary to provide, secure, and maintain the Site to you, such as to keep you logged in while

your visit our Site, while other functional/analytic Cookies are used to provide you with a better

user experience, such as:

• To personalize the Site by remembering information about your activities on the Site (e.g.,

the language you selected or your log-in details); and

• Perform website analytics, such as demographic reporting to improve our Site and

services.

Your Choices

Please review your Internet browser settings, typically under the sections "Help" or "Internet

Options," to exercise choices you have for certain Cookies. If you disable or delete certain

Cookies in your Internet browser settings, you might not be able to access or use important

functions or features of this Site, and you may be required to re-enter your log-in details.

Internal

Please also visit the following third parties' websites to exercise certain opt-out choices over

Cookies:

• Google Analytics -

https://tools.google.com/dlpage/gaoptout?hl=en

You may need to make such choices on each browser and device you may use to exercise choice

regarding certain Cookies. Lastly, at this time the Site is not configured to honor browsers' "Do

Not Track" signals.

6. International Transfers

In connection with the purposes described above, your information may be stored in locations

outside of your home country, which may have different standards of data protection than your

home country. We provide appropriate protections for cross-border transfers as required by law

for international data transfers, including information transferred to third parties, and where

necessary, we may also obtain your consent With respect to such transfers from the European

Economic Area ("EEA") to the United States and other non-EEA jurisdictions, we may rely on the

EU Model Clauses and/or the need to process your information in order to provide the requested

services (performance of a contract) to transfer your information. As permitted by applicable law,

you may request details about the suitable safeguards we have in place by contacting us as

detailed below. For Chinese residents, please see the details provided above under "China

Privacy Rights." For Turkish residents, please refer to "Turkey Privacy Rights".

7. Protecting Your Information

We maintain reasonable physical, electronic, and organizational security measures to protect your

information against accidental or unlawful destruction or accidental loss, alteration, or

unauthorized disclosure or access.

Retention

We will retain your information for the period necessary to fulfil the purposes outlined in this

When Agoda no longer needs to use your

information, we will – unless we need to keep your information to comply with applicable legal or

regulatory obligations or the information is required to carry out corporate tasks and achieve our

business objectives – remove it from our systems and records and/or take steps to properly

anonymize it so that you can no longer be identified from it.

8. How You Can Access or Change Your Information

If you wish to update your information, or in certain circumstances exercise rights to access,

correct, delete, restrict, or object to processing of your information, as well as the right to revoke

consent for certain processing or to exercise the right to data portability, please contact us by

sending an email to

PS-Privacy@agoda.com

To protect your privacy and security, we will verify your identity before responding to such request,

and your request will be answered within a reasonable timeframe. To the extent permitted by

applicable law, we reserve the right to charge a reasonable fee for such access. We may need to

retain certain information for recordkeeping purposes, to complete any transactions that you

began prior to your request, or for other purposes as required or permitted by applicable law.

Internal

9. Updates to Privacy Policy

On occasion, Agoda may revise this Privacy Policy to reflect changes in the law, our information

collection and use practices, the features of our Site, or advances in technology. If we make

revisions that change the way we collect or use your information, those changes will be posted in

this Privacy Policy and the effective date will be noted at the beginning of this Privacy Policy.

Therefore, you should review this Privacy Policy periodically so that you are up to date on our

most current policies and practices. Agoda will also prominently post such material changes prior

to implementing the change and ask for your consent if required by law.

10. Additional Considerations

A Special Note About Minors

Our Site and services are not directed to minors under the age of 18.

Language

This Privacy Policy has originally been drawn up in the English language. Translations in other

languages are available for your convenience. In case of conflict between the English language

version and a translated version, the English language version shall prevail.

11. Contacting Us

If you have any questions about this Privacy Policy or our privacy practices, please contact our

Agoda Data Governance Officer by email at pri[email protected]m, or by sending a registered letter

to the address at:

Agoda Company Pte. Ltd.

c/o Data Governance Officer

30 Cecil Street

Prudential Tower #19-08

Singapore 049712

If you reside in the EU, you may also contact our local representative, Agoda International Pte.

Ltd. (UK Branch) 9th Floor North, The Metro Building, 1 Butterwick, Hammersmith, London W6

8DL, United Kingdom, or your local data protection authority with any questions or complaints

about our privacy practices.

If you reside in Thailand, you may also contact our local representative, Agoda Services Co., Ltd.

(Head Office) 999/9 Rama 1 Road The Offices at Central World, Patumwan, Bangkok 10330,

Thailand or your local data protection authority with any questions or complaints about our privacy

practices.

If you reside in Türkiye, you may also contact our data controller representative, Esin Avukatlık

Ortaklığı, resident at Akat Mahallesi, Gül Sokak No:2/1 Beşiktaş / İSTANBUL.

***