myTrips - Privacy Policy

Privacy Policy

Introduction
1. This privacy statement describes why and how Vialto Partners collects and uses personal data in connection with this MyTrips website (“website”), the myTrips application (“application”) and related professional services provided by us to your employer, or an organisation you are connected with ("your employer") (together the “services”). This privacy statement also provides information about your rights as a user of the website (“you”, “user” or “individual”). As used in this privacy statement, “Vialto Partners” (and “we”, “us”, or “our”) refers to the entity identified at vialto.com/about , its affiliates and other entities in the Vialto professional network that provide tax and/or immigration compliance and/or consulting services. Each of Vialto UK, such affiliates and other entities may be referred to in this privacy statement as a “Vialto Entity”.
2. Personal data is any information relating to an identified or identifiable living person. This privacy statement applies to personal data provided to us, both by you or by others (such as your employer) and any personal data created in connection with your use of the application. We may use personal data provided to us for any of the purposes described in this privacy statement or as otherwise stated at the point of collection.
3. When collecting and using personal data, our policy is to be transparent about why and how we process personal data. To find out more about our specific processing activities in connection with the application, please go to the relevant sections of this statement.
Security
1. We adhere to internationally recognised security standards. We have a framework of policies, procedures and training in place covering data protection, confidentiality and security and regularly review the appropriateness of the measures we have in place to keep the data we hold secure.
Changes to this privacy statement
1. We recognise that transparency is an ongoing responsibility so we will keep this privacy statement under regular review. This privacy statement will be updated as necessary to reflect any changes we may make to why and how we collect and use personal data and, where appropriate, you will be notified of changes by email or when you visit the website.
2. This statement was last updated on on the date identified at: vialto.com/about.
Data controller and contact information
1. The data controller for the personal data processed in connection with the website and the application is the entity identified at vialto.com/about. Other Vialto Entities may also be data controllers for personal data where they are engaged by your employer to provide professional services. For a list of countries where Vialto Entities are located please see vialto.com/about.
2. If you have any questions about this privacy statement or how and why we process personal data, please contact us at privacy@vialto.com or the contact information at vialto.com/about.

Collection of personal data

We will collect personal data in connection with the services as described below.

Personal data provided directly by you:
1. We ask you to provide us with personal data (e.g. as part of your traveller profile) so we can provide the services. The personal data we ask for includes your name, title, primary location, primary and secondary nationality, company address, email address, user name and telephone and details of your trips.

Personal data captured, created, inferred or derived from your use of the application:

IP address
Email address, time of sign in attempt and whether or not the sign in attempt was successful or not
The website uses small text files called ‘cookies’ which are placed on your computer to assist in providing you with a more customised website experience and to analyse your use of the website in order to help us determine how the website is used. All cookies used in the website are ‘first party’ cookies, which means that they are owned and managed by us and not by any third party. The types of cookies we use are:
1. ‘Session’ cookies. These cookies remain in your browser during your browser session only (i.e. until you leave the website).
2. ‘Persistent’ cookies. These cookies remain in your browser after the session (unless they are deleted by you).

The specific cookies we use are:

Cookie	Name	Purpose	Type
VP	ASP.NET_SessionID	To identify the current user	Session
VP	_RequestVerificationToken	Antiforgery token to prevent cyber attacks	Session
VP	VPLion	To authenticate your identity as a registered user when you log on to the Site	Persistent Duration: (20 min)

The use of cookies is now standard operating procedure for most websites. However, if you are uncomfortable with the use of cookies, most browsers now permit users to opt-out of receiving them. This can be done via the tools menu of your internet browser. If you do opt-out, please note that you may be unable to use the registration process and will not be provided with access to the website.

Personal data obtained from third party sources:
1. We do not collect personal data from third party sources. Where there is a direct integration with your employer’s travel service provider, you will receive an automatic notification to log in to the website and provide details of your trip.
2. We do not collect special category personal data in relation to the services. Special category personal data includes information about your race or ethnic origin, political opinions, religious beliefs, trade union membership, criminal records, physical or mental health, or sexual life.

Use of personal data
1. We use personal data for the following purposes:
  1. To provide the services
    Your traveler profile allows us to provide you with a personalised service tailored to your individual preferences. We use the personal data provided to us to pre-set your compliance assessments, making the process as hassle-free as possible.
  2. To maintain security
    Authenticating the identity of myTrips users, authorising access to myTrips (including preventing unauthorised access) and for other security-related purposes, including system monitoring.
  3. To operate, administer, manage and improve the website and application
    Administering the website and application, troubleshooting issues with the services and identifying areas of improvement.
  4. To maintain our administrative or client relationship management systems
    Where you are a business contact of ours, we will include your business contact details on our administrative or client relationship management systems, contact you in relation to the services and we may send you other material relevant to your interests where we are permitted to do so.
  5. To analyse how the website, application and associated services perform
    We may analyse how the website, application and associated services perform by reviewing the user data we capture and asking for and responding to feedback from you.
  6. Providing you with information about us and our range of services
    Where you are a business contact of ours, we will contact you in relation to the services and we may send you other material relevant to your interests where we are permitted to do so.
2. Our lawful basis for all of our processing in connection with the services is our legitimate interest to provide the services in a secure and efficient way to you and your employer and to operate, develop and improve our business.
When and how we share personal data and locations of processing
1. We will only share personal data with others when we are legally permitted to do so. When we share data with others, we put contractual arrangements and security mechanisms in place to protect the data and to comply with our data protection, confidentiality and security standards.
2. We will not pass your information to third parties outside of Vialto Partners for direct marketing purposes. If you don’t want us to use information we collect in connection with the services to provide you with information about our business or services, you can opt out of receiving these communications by emailing your request to us at privacy@vialto.com.
3. We share personal data processed in connection with the application as follows:
  1. Among Vialto Entities
    We share personal data processed in connection with the application with the following Vialto Entities:
    1. Vialto Entities in the UK, Australia, Canada and primarily involved in providing the services. We may transfer your personal information to other Vialto Entities where your organisation engages such firms to provide tax or immigration services. For details of Vialto Entities locations, please click here.
    2. The website and the application are hosted in the EU, in the Netherlands.
    3. For technical issues, Galaxy US Opco Inc. may be able to access personal data if necessary to resolve the technical issue and development teams may be engaged in a Vialto Entity located in India.
    4. Our business contacts are visible to and used by Vialto Partners users from other Vialto Entities to learn more about a contact, client or opportunity they have an interest in. Please see our website privacy statement for further information.
  2. We have the European Commission approved standard contractual clauses in place between Vialto Entities to provide appropriate safeguards for personal data transferred outside of the EU. The standard contractual clauses are available here.
  3. Your employer
    1. Your employer has access to personal data and scheduled reports related to the services. Typical information included in the scheduled reports includes travel information about all trips by individuals connected to your employer and the details entered in your profile. For details of the locations and purposes of processing please contact your employer.
  4. Auditors and other professional advisers
    1. We like other professional services firms have external auditors and may use other professional advisers to establish, exercise or defend our legal rights. Where relevant to an audit or a particular case, we may share personal data as necessary with our auditors or other professional advisers.
  5. Law enforcement or other government and regulatory agencies or to other third parties as required by, and in accordance with, applicable law or regulation
    1. Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.
  If you choose to delegate authority to another user so they can act on your behalf, the other user will also have access to your personal data on the website.
Data retention
1. We retain personal data processed in connection with the services for as long as we provide the services to your employer and in accordance with our retention policy. In the absence of specific legal, regulatory or contractual requirements, our baseline retention period for records and other documentary evidence created in the provision of services is 8 years.
Individuals’ rights and how to exercise them
1. You have certain rights over your personal data. Your rights are the right of access to personal data, to rectification of personal data, to erasure of personal data / right to be forgotten, to restrict processing of personal data, to object to processing of personal data, to data portability, the right to withdraw consent at any time (where processing is based on consent) and the right to lodge a complaint with a supervisory authority.
2. Please see further information about these rights and how to exercise them below.
  1. Right of access
    You have the right to obtain confirmation as to whether we process personal data about you, receive a copy of your personal data held by us as a data controller and obtain certain other information about how and why we process your personal data (similar to the information provided in this privacy statement).
    You may exercise this right by emailing us at privacy@vialto.com. We will aim to respond to any requests for information promptly, and in any event within the legally required time limits.
  2. Right to rectification
    You have the right to request for your personal data to be amended or rectified where it is inaccurate (for example, if you change your name or address) and to have incomplete personal data completed.
    To update personal data submitted to us, please email us at privacy@vialto.com or, where appropriate, by amending the personal details held on the website. When practically possible, once we are informed that any personal data processed by us is no longer accurate, we will make updates, as appropriate, based on your updated information.
  3. The right to ensure / right to be forgotten
    You have the right to obtain deletion of your personal data in the following cases:
    1. The personal data are no longer necessary in relation to the purposes for which they were collected and processed.
    2. Our lawful basis for processing is consent, you withdraw consent and we have no other lawful basis for the processing.
    3. Our lawful basis for processing is that the processing is necessary for a legitimate interest pursued by us, you object to our processing and we do not have overriding legitimate grounds.
    4. You object to our processing for direct marketing purposes.
    5. Your personal data have been unlawfully processed.
    6. Your personal data must be erased to comply with a legal obligation to which we are subject.
    To request deletion of your personal data, please email us at privacy@vialto.com.
  4. The right to restrict processing
    You have the right to restrict our processing of your personal data in the following cases:
    1. For a period enabling us to verify the accuracy of the personal data where you have contested the accuracy of the personal data.
    2. Your personal data have been unlawfully processed and you request restriction of processing instead of deletion.
    3. The personal data are no longer necessary in relation to the purposes for which they were collected and processed but the personal data are required by you to establish, exercise or defend legal claims.
    4. For a period enabling us to verify the whether the legitimate grounds relied on by us override your interests (where you have objected to processing based on it being necessary for the pursuit of a legitimate interest identified by us).
    To restrict our processing of your personal data, please email us at privacy@vialto.com.
  5. The right to object to processing
    You have the right to object to our processing of your personal data in the following cases:
    1. Our lawful basis for processing is that the processing is necessary for a legitimate interest pursued by us.
    2. Our processing for direct marketing purposes.
    To object to our processing of your personal data, please email us at privacy@vialto.com.
  6. Right to data portability
    You have a right to receive your personal data provided to us and have the right to send the data to another organisation (or ask us to do so if technically feasible) where our lawful basis for processing the personal data is consent or necessity for the performance of our contract with you and the processing is carried out by automated means.
    To exercise your right to data portability, please email us at privacy@vialto.com.
  7. Right to withdraw consent
    Where we process personal data based on consent, individuals have a right to withdraw consent at any time. We do not generally process personal data based on consent (as we can usually rely on another legal basis). Where we rely on consent for processing, to withdraw your consent please email us at privacy@vialto.com or, to stop receiving an email from a Vialto Partners marketing list, please click on the unsubscribe link in the relevant email received from us. Please see the “Use of personal data” section of this privacy statement for further details about our processing of personal data based on consent.
  8. Complaints
    We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to privacy@vialto.com. We will look into and respond to any complaints we receive.
    You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or the country in which an alleged infringement of data protection law has occurred within the EU. The Information Commissioner's Office (“ICO”) is the UK data protection regulator/supervisory authority. For further information on your rights and how to complain to the ICO, please refer to the ICO website.