Privacy Policy

Effective Date: November 5, 2026

Who We Are and Scope

Nuitée Travel Limited ("Nuitée", "we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal data in accordance with applicable data protection laws, including the European Union General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR). Nuitée is an Irish registered company (CRO: 570685) with its registered office located at Nuitée Travel Ltd, 4 Waterloo Rd, Ballsbridge, Dublin, D04 A0X3, Ireland.

This Privacy and Cookie Policy applies to personal data collected through our corporate website (https://nuitee.com) and related business communications. Personal data processed through Nuitée's travel booking platforms, APIs, developer accounts, or other specialized products may be subject to separate privacy notices, contractual arrangements, or data processing terms.

For detailed information on how we use cookies and tracking technologies, please refer to our standalone Cookie Policy.

Our Role as Data Controller or Processor

Nuitée acts as a data controller with respect to personal data collected through our Website, determining the purposes and means of its processing.

In connection with our products and services, Nuitée may act as either a data controller or data processor, depending on the nature of the processing and our relationship with the relevant customer or business partner. Such processing may be governed by separate privacy notices, contractual arrangements, or data processing agreements, as applicable.

Cookie Consent and Preference Management

When you first visit our website, you are presented with a cookie consent banner that provides clear information about the types of cookies we use and allows you to accept or decline non-essential cookies. You can manage or update your cookie preferences at any time by accessing the "Cookie Preferences" link located in the footer of our website.

Additionally, most web browsers allow you to control or block cookies through their standard settings. Please note that withdrawing consent or disabling certain cookies may impact your overall browsing experience and the functionality of specific website features.

Information We Collect

We collect information directly provided by you, automatically generated through your use of our platform, and received from third-party partners.

• Personal Identification and Contact Data: Name, business email address, direct phone number, company name, title, and account login credentials.
• Financial and Transactional Data: Payment card information, billing details, settlement logs, fee schedules, and transaction references.
• Technical and Telemetry Data: IP address, browser type and version, time zone setting, location data, operating system, device identifiers, and system diagnostics.
• Usage Data: Details regarding how you navigate our API dashboard, access documentation, submit inquiries, and use our platform features.
• Marketing and Communications Data: Your preferences for receiving technical updates, product announcements, and marketing communications.

Marketing Communications

Where required by applicable law, we will obtain your explicit consent prior to sending you direct marketing communications. You may withdraw your consent or opt out of receiving marketing messages at any time by following the unsubscribe instructions included in our communications or by contacting us directly.

How We Use Personal Data and Legal Basis

We process personal data only when an authorized legal basis applies. The table below summarizes our processing activities:

Artificial Intelligence

Customer personal data processed through Nuitée systems is strictly not used to train, retrain, or improve third-party artificial intelligence (AI) or machine learning (ML) models without express prior written opt-in consent from the client Controller.

Core Service Providers; Data Transfers

Core Service Providers

To support our website operations and online services, Nuitée engages authorized third-party service providers. Core third-party service providers include:

Where applicable, we enter into data processing agreements (DPAs) with our service providers. We may engage additional service providers and will update this list periodically to reflect any changes.

International Data Transfers

When transferring personal data outside the European Economic Area (EEA) or the United Kingdom, Nuitée relies on recognized legal transfer tools, including the EU Standard Contractual Clauses (EU SCCs - Module Two) and the UK International Data Transfer Addendum.

Categories of Data Recipients

We may share personal data with the following categories of third-party recipients where reasonably necessary to fulfill the operational and commercial purposes outlined in this policy:

• Service Providers: Third-party vendors, hosting providers, payment processors, analytics providers, and technical contractors performing services on our behalf.
• Affiliates: Parent companies, subsidiaries, and corporate affiliates within the Nuitée group structure for operational and centralized business processing.
• Business Partners: Travel suppliers, distribution partners, and commercial clients involved in fulfilling travel bookings and system integrations.
• Professional Advisers: External legal counsel, auditors, accountants, financial advisers, and insurance underwriters advising our B2B operations.
• Governmental and Regulatory Authorities: Law enforcement, supervisory bodies, courts, or tax authorities where legally required by applicable statute, court order, or regulatory obligation.
• Corporate Transaction Participants: Prospective or actual buyers, investors, or merger partners in connection with any reorganization, asset sale, financing, or acquisition of our business.

Where third parties process personal data on our behalf as Data Processors, we implement appropriate contractual safeguards, including data processing agreements (DPAs) and security requirements, to ensure your personal data remains protected in compliance with applicable data protection laws.

Security and Data Breach Response

We deploy robust administrative, technical, and physical safeguards to ensure data confidentiality, integrity, and availability. In the event of a confirmed Personal Data Breach affecting personal data, Nuitée maintains a commitment to notify relevant client Controllers and supervisory authorities without undue delay and, where feasible, within 72 hours of confirmation.

Your Data Protection Rights

Depending on your jurisdiction (including the EEA, UK, and California), you may hold the following statutory rights regarding your personal data:

• Right of Access and Portability: Request copies of your personal data or ask for structured data transfer.
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where statutory grounds exist.
• Right to Object and Restrict Processing: Object to automated processing, direct marketing, or request processing limits.
• Right to Non-Discrimination: California residents hold the right not to receive discriminatory treatment for exercising CCPA/CPRA rights.
• Right to Lodge a Complaint: If you are located in the EEA or UK and believe that our processing of your personal data infringes data protection laws, you have the right to lodge a complaint with a supervisory authority. In Ireland, the relevant lead supervisory authority is the Data Protection Commission (website: www.dataprotection.ie).

We may request information reasonably necessary to verify your identity before responding to a privacy request, but we will respond to all verified requests within the timeframes required by applicable law.

US State Privacy Rights

In addition to general disclosures, residents of US states with comprehensive privacy laws, including California under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), Virginia under the Virginia Consumer Data Protection Act (VCDPA), Colorado under the Colorado Privacy Act (CPA), Utah under the Utah Consumer Privacy Act (UCPA), and Connecticut under the Connecticut Data Privacy Act (CTDPA), have specific statutory rights regarding their personal data:

• Right to Opt-Out of Sale or Sharing and Targeted Advertising: You have the right to direct us not to sell your personal information or share it for cross-context behavioral or targeted advertising.
• Right to Correct Inaccuracies: Taking into account the nature of the personal data and the purposes of processing, you have the right to request correction of inaccurate personal data.
• Right to Appeal: If we decline to take action regarding your privacy request, you may appeal our decision by contacting us at legal@nuitee.com within a reasonable timeframe. We will inform you of any action taken or not taken in response to your appeal.

Children's Privacy

Our services are strictly designed for B2B technological integration and business transactions. They are not directed to, intended for, or structured to attract individuals under the age of 13 (or 16 where applicable under local law). We do not knowingly collect personal data from children.

If we become aware that we have inadvertently collected or received personal information from a child under the applicable age limit without verified parental or legal guardian consent, we will promptly delete that information from our databases.

Updates to This Policy

We reserve the right to update this Privacy and Cookie Policy to reflect changes in legal requirements or operational practices. Notice of material changes will be published on our home page or provided via direct email notification.

Contact Us

For questions, privacy inquiries, or data protection concerns, contact our legal team:

Email: legal@nuitee.com
Registered Office: Nuitée Travel Ltd, 4 Waterloo Rd, Ballsbridge, Dublin, D04 A0X3, Ireland