Booking.com: Hotels & Travel

"We may share some of your personal data (such as identifiers) with advertising partners, as part of the marketing of our trip services via third parties. We use techniques such as hashing specific personal data (e.g. email address, telephone number) to enable matching with data in one or more of their databases. We work with selected third-party companies to collect and process data."

Booking.com shares personal identifiers with advertising partners for targeted marketing and enables cross-matching of user data across third-party databases.

"We may combine personal data we collect from you during different visits to our platform or visits on different devices or different websites of ours, even when you are not logged in. We also collect information about clicks you make and which pages are shown to you from our platform."

Booking.com tracks and links user activity across different devices, sessions, and websites — even when users are not logged in — to build unified behavioral profiles.

"If you're using our platform from your mobile device, you can decide to allow Booking.com to use your current location or grant us access to other details. This helps us give you the best possible service. To do this, we use personal data such as your contact and account information, browsing data, location data and preferences, searches, and reservations you make from different devices."

Booking.com collects location data from devices and uses it for marketing, personalization, and shares it with third parties including advertisers and BHI group companies.

"Booking.com amends its privacy notices from time to time and recommends that you visit this notice occasionally to stay informed. If Booking.com makes updates to a privacy notice that could significantly impact persons, it will take steps to inform these persons about such changes before they go into effect."

Booking.com reserves the right to change its privacy notice at any time, with notification only promised for changes that could 'significantly impact' users — leaving minor but meaningful changes unnotified.

"Generally, we keep your personal data for as long as is necessary to: Enable you to use our services or to provide our services to you. Prevent and detect online fraud attempts and/or other illegal activities. Comply with legal obligations such as those from accounting and tax laws. Resolve any disputes and legal claims."

Booking.com provides only vague retention criteria ('as long as necessary') without specific timelines for most data categories, allowing indefinite retention under broad justifications.

"Whether or not you make a trip reservation, when you use our platform, we automatically collect certain information. This includes your IP address, the dates and times you use our platform, and some information about your device's hardware and software (such as the type of operating system, internet browser and mobile app version you use, your chosen language settings). When you use our mobile apps, we collect data identifying the mobile device."

Booking.com automatically collects device identifiers and hardware/software information from all visitors regardless of whether they make a reservation.

"If you can't perform an action through our websites or mobile apps (for example, because certain personal data we have about you isn't accessible online), you can easily submit your request to us via this Data Subject Request form. To protect your personal information, we may need to verify your identity before completing your request. We will do this by asking you questions about your previous reservations with us."

Account and data erasure cannot be done directly in-app for all data — users must submit a formal request form and undergo identity verification, adding friction to the deletion process.