Effective May 25, 2018
Whistle is a service provider for hotels and other hospitality clients (our “Clients”). Our Platform helps our Clients to communicate with, support, and provide various services to their guests and staff members. This Policy reflects only how we process personal data through our Platform. This Policy does not apply to Clients’ own uses of your data.
This Policy also does not apply to information processed by other third parties, for example, when you visit a third-party website or interact with third-party services, unless and until we receive your information from those parties. Please review any third parties’ privacy policies before disclosing information to them. See our list of third parties for more information regarding our sources and recipients of personal data.
We may collect and process information that relates to identified or identifiable individuals (“Personal Data”). We collect and process the following categories of Personal Data (note, specific Personal Data elements listed in each category are only examples and may change):
Personal Data about you and your identity, such as your name, ID number, photo/avatar, username, and other Personal Data you may provide on registration or purchase forms or as part of an account profile (e.g. biographical information).
Personal Data used to contact an individual, e.g. email address(es), physical address(es), phone number(s), or social media or communications platform usernames/handles, as well as a name or other salutation.
Personal Data relating to your device, browser, or application e.g. IP addresses, MAC addresses, application ID/AdID/IDFA, identifiers from cookies, session navigation history and similar browsing metadata, and other data generated through applications and browsers, including cookies and similar technologies.
Personal Data relating to your location, such as information collected from your device’s GPS, or WiFi, or other localization service.
Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, health information, or information relating to sex life or sexual orientation.
Information that a user provides in a message, free text field, or other unstructured format, including any Personal Data or Special Category Data to the extent provided by the user.
On behalf of the Client, we process Identity Data, Contact Data, Device Data and if provided, User Content when you use our Platform to communicate with or send a message to a Client or other Client users, or if you otherwise submit any User Content (e.g. on a comment board or other free form content submission form).
On behalf of the Client, we use Identity Data, Device Data, Contact Data, and User Content on behalf of the Clients as necessary to carry out the processes and transactions you request, including disclosing this information to the Client. Subject to Your Rights and Choices, we may also use this information as part of our legitimate interests in improving the design of our Platform, to create a personalized user experience, and for ensuring the security and stability of the Platform.
Client users may be able to register and create an account on our Platform. If you register, we will process Identity Data, Preferences Data and certain Contact Data.
We use the Identity Data and Contact Data as necessary to create, maintain, and provide you with important information about your account. Subject to Your Rights and Choices, we may also use this information as part of our legitimate interests in improving the design of our Platform, to create a personalized user experience, for ensuring the security and stability of the Platform, and in connection with marketing communications.
We may process Identity Data and Contact Data in connection with email marketing communications if you register for a Client account or choose to enroll to receive marketing communications or when you open or interact with our marketing communications.
We use Identity Data and Contact Data as necessary to provide marketing communications, and consistent with our legitimate business interests, we may send you marketing and promotional communications if you sign up for those communications register for our Service. See Your Rights and Choices for information about how you can limit or opt out of this processing.
We, and certain third parties, may process Identity Data, Contact Data and Device Data when you interact with cookies and similar technologies on our Site. We may receive this data from third parties to the extent allowed by the applicable partner. Please note that the privacy policies of third parties may apply to these technologies and information collected.
Subject to Your Rights and Choices, we use this information as follows:
Some of these technologies can be used by us and/or our third-party partners to identify you across platforms, devices, sites, and services.
We, and certain third parties operating on or through our Site, may engage in online behavioral advertising. This form of advertising includes various parties and services providers, including third party data controllers, engaged in the processing of personal data in connection with advertising. This form of advertising uses Device Data, Identity Data, and at times, Contact Data in order to deliver more relevant advertising to you. The parties that control the processing of Personal Data for behavioral advertising purposes may build a profile of you containing this information, and may be able to identify you across sites, devices, and over time. These services may also track whether you view, interact with, or how often you have seen an ad, or whether you complete a purchase for a good or services you were shown in an advertisement. In some cases, these parties may also develop and assess aspects of a profile about you to determine whether you are a type of person a company wants to advertise to, and determine whether and how ads you see are effective, and these third parties may augment your profile with information derived from these observations. See Your Rights and Choices for information about how you can limit or opt out of this processing.
If we process Personal Data in connection with our Platform in a way not described in this Policy, this Policy will still apply generally (e.g. with respect to Your Rights and Choices) unless otherwise stated when you provide it.
Note that we may, without your consent, also process your Personal Data on certain public interest grounds. For example, we may process information as necessary to fulfil our legal obligations, to protect the vital interests of any individuals, or otherwise in the public interest. Please see the Data Sharing section for more information about how we disclose Personal Data in extraordinary circumstances.
Information we collect may be shared with a variety of parties, depending upon the purpose for and context in which that information was provided. We generally transfer data to the following categories of recipients:
We process data on behalf of Clients, and may share your Personal Data with Clients to the extent such information was provided to us for processing on the Client’s behalf. For example, any communications sent using our Platform and all other Personal Data processed on behalf of the Client may be available to the Client and its users. These parties may engage in direct marketing, or other activities that are outside our control.
In connection with our general business operations, product/service improvements, to enable certain features, and in connection with our other legitimate business interests, we may share your Personal Data with service providers or subprocessors who provide certain services or process data on our behalf.
In order to streamline certain business operations and develop products and services that better meet the interests and needs of our customers, and inform our customers about relevant products and services, we may share your Personal Data with any of our current or future affiliated entities, subsidiaries, and parent companies.
In order to deliver certain advertisements, and develop better products and services, we may share certain Personal Data collected from our Site (as described in the Cookies and Similar Technology section above) with trusted third parties for marketing, advertising, or similar commercial purposes.
Your Personal Data may be processed in the event that we go through a business transition, such as a merger, acquisition, liquidation, or sale of all or a portion of our assets. For example, Personal Data may be part of the assets transferred, or may be disclosed (subject to confidentiality restrictions) during the due diligence process for a potential transaction.
Subject to the rights granted to other individuals, and our rights to limit or deny access/disclosure under applicable law, you have the following rights in your Personal Data. We may require that you provide additional Personal Data to exercise these rights, e.g. information necessary to prove your identity. Note: While we may notify Clients of your request, we are unable to directly fulfill rights requests regarding Personal Data we control or for which we have the necessary rights of access, and we may not have access to or control over all or some Personal Data controlled by Clients. Please contact the Client directly for data rights requests regarding Client-controlled information, and we will assist the Client as appropriate in the fulfillment of your request. You may exercise your rights by contacting us at the address below.
You may receive a list of your Personal Data that we process to the extent required and permitted by law.
You may correct any Personal Data that we hold about you to the extent required and permitted by law. You may be able to make changes to much of the information you provided directly via the Service via your account settings menu.
To the extent required by applicable law, you may request that we delete your Personal Data from our systems.
To the extent required by applicable law, we will send you a copy of your Personal Data in a common portable format of our choice.
You have the right to contact or file a complaint with regulators or supervisory authorities about our processing of Personal Data. To do so, please contact your local data protection or consumer protection authority.
Residents of California (and others to the extent required by applicable law) may request a list of Personal Data we have disclosed about you to third parties for direct marketing purposes during the preceding calendar year. This request must be written, signed, and mailed to us.
It is possible for you to use some of our Platform without providing any Personal Data, but you may not be able to access certain features or view certain content. You have the following choices regarding the Personal Data we process:
If you consent to processing, you may withdraw your consent at any time, to the extent required by law.
You have the choice to opt-out of or withdraw your consent to direct marketing communications. You may have a legal right not to receive such messages in certain circumstances, in which case, you will only receive direct marketing communications if you consent. You may exercise your choice via the links in our communications or by contacting us re: direct marketing.
You may control or limit Location Data that we collect using our Mobile App by changing your preferences in your device’s location services preferences menu, or through your choices regarding the use of Bluetooth, WiFi, and other network interfaces you may use.
You may have the right under applicable law to object to our processing of your Personal Data for certain purposes. You may do so by contacting us re: data rights requests. Note that we may not be required to cease processing based solely on an objection.
We follow and implement reasonable security measures to safeguard the Personal Data you provide us. However, we sometimes share Personal Data with third parties as noted above, and we do not have control over third parties’ security processes. Please note, we do not warrant perfect security and we do not provide any guarantee that your Personal Data or any other information you provide us will remain secure.
We retain information for so long as it, in our discretion, remains relevant to its purpose, and in any event, for so long as is required by law or as directed by our Clients. We will review retention periods periodically, and may sometimes pseudonymize or anonymize data held for longer periods, if appropriate.
Our Platform is neither directed at nor intended for use by minors under the age of majority in the relevant jurisdiction. Further, we do not knowingly collect Personal Data from such individuals. If we learn that we have inadvertently done so, we will promptly delete it. Do not access or use the Platform if you are not of the age of majority in your jurisdiction unless you have the consent of your parent or guardian.
We operate in and use service providers located in the United States. If you are located outside the U.S., your Personal Data may be transferred to the U.S. The U.S. does not provide the same legal protections guaranteed to Personal Data in the European Union. Accordingly, your Personal Data may be transferred to the U.S. pursuant to the Standard Contractual Clauses, or other adequacy mechanisms, or pursuant to exemptions provided under EU law. Contact us for more information regarding the mechanisms to ensure adequate protection of data subject to EU Law.
Feel free to contact us with questions or concerns using the appropriate address below.General inquires: firstname.lastname@example.org