How GetMyHotels handles privacy, payments, and travel regulation

EU Regulation 2016/679 and the UK GDPR govern how we process personal data of users in the EEA, UK, and Switzerland. Our lawful bases, retention windows, transfer mechanisms (SCCs + adequacy where available), and your rights of access, rectification, erasure, restriction, portability, and objection are documented in the privacy policy.

We honor the Do-Not-Sell-or-Share opt-out for targeted advertising, treat the Global Privacy Control (Sec-GPC: 1) header as an implicit opt-out, and provide CCPA-aligned access + deletion mechanisms for all California residents — extended to all US users for parity.

India's DPDPA Rules 2025 were notified in November 2025; we treat the act as binding for all India-resident users today. Substantive obligations (grievance officer, breach SLA, Consent Manager integration) come into force in November 2026 + May 2027.

Lei Geral de Proteção de Dados (Law 13.709/2018) applies to Brazilian users. Our privacy ledger, breach-notification process, and data subject rights match the GDPR baseline — LGPD requirements are a subset.

16 CFR Part 464 ('Trade Regulation Rule on Unfair or Deceptive Fees'), effective May 12, 2025, applies to short-term lodging. We disclose total price plus any mandatory fees at the earliest point in the search journey where the supplier has returned them; where the supplier has not, we render an unambiguous '+ taxes & fees' disclosure adjacent to the headline rate.

Flight result cards headline the total fare (taxes and government fees included), per DOT's full-fare advertising rule. For flights departing the EEA, UK, or Switzerland we surface a passenger-rights disclosure linking to the European Commission's EU 261 explainer.

We never see raw card numbers. Stripe (North America) and Adyen (rest of world) handle every payment under their respective PCI DSS Level 1 certifications. Our integration uses hosted payment elements + tokenized references so we sit in the lowest PCI scope (SAQ-A).

The GetMyHotels mobile app ships a privacy manifest (Apple PrivacyInfo.xcprivacy), targets Android API 36 ahead of the August 31, 2026 Play deadline, and provides in-app account deletion (Apple 5.1.1(v) / Play account-deletion URL requirement).

Our design system aims for WCAG 2.2 Level AA across web and mobile. New screens are reviewed for color contrast, keyboard navigation, semantic structure, focus states, and screen-reader labeling before merge. Existing screens are remediated on a rolling basis.