Booking.com Researcher Data Use Policy
Researchers who are granted access to Booking.com data must adhere to this Researcher Data Use Policy. Failure to comply with the terms of this Researcher Data Use Policy may result in the revocation of your access.
1. Definitions
"Approved Research" means the specific research that was expressly approved by Booking.com as part of your application.
"Authorized Researcher" or "You" means a qualified researcher accepted to partake in the Researcher Program, along with the affiliated qualified institutions and other individuals employed by these institutions whose involvement is necessary for conducting Approved Research.
"Access" means the access and permissions that you have been granted, provided your application has been approved.
"Data" means data to which Access has been granted.
2. Access and use of Data
Acceptable use. You agree that the use of Access and Data will be limited to the purpose of the Approved Research only. Any other Access or use of the Data requires additional, prior approval from Booking.com in writing. This includes use for purposes of any other research than the Approved Research. Access or Data can't be used for:
Direct or indirect development of a product
Research that serves private interests (e.g. promoting a service or product for commercial gain or driven by purely personal motives)
Discussion of non-public Data of individuals, whether they're public figures or not, or the non-public Data of public figures
Personal use
Any conduct that would harm Booking.com services or its users
Any abusive, fraudulent, or harmful behavior that would defame, abuse, harass, stalk, threaten, or otherwise infringe upon the rights of others
Encouragement or promotion of illegal activities or infringement of third-party rights
Attempts to reverse engineer any Booking.com product, service, or feature
Any other purpose not explicitly outlined in point 3.1 above.
No Data disclosure.
Subject to subsection 2, you are prohibited from disclosing, reproducing, selling, licensing, or otherwise transferring Access or Data to any individual other than an Authorized Researcher.
You may disclose Data to a third party only if required by applicable law or legal order, provided you promptly notify Booking.com unless prohibited from doing so by a legal order.
Compliance with law, third party rights, Booking.com terms of service, and service-specific terms. You will comply with all applicable (local) law, regulation, and third party rights, which include, but are not limited to, the EU General Data Protection Regulation and other laws regarding the import or export of Data or software, privacy, and local laws. You will not breach any other terms of service with Booking.com, including the Terms of Service, unless explicitly allowed in this Researcher Data Use Policy.
Technical and Organizational measures and Security requirements. Your use of Access and Data is subject to your acceptance to adhere to the technical and organizational measures and security requirements set forth by Booking.com.
Data measures. You warrant and represent that You:
Maintain and adhere to a written privacy policy that clearly and accurately describes (a) the Data that you will access, collect and store, and (b) The methods and rationale behind your use and processing of the Data.
Maintain and adhere to reasonable and appropriate administrative, organizational, technical, and physical safeguards aimed at protecting Data from inadvertent, unauthorized, or unlawful destruction or accidental loss, alteration, or destruction, and to protect against any unauthorized disclosure or access. These safeguards must be documented and must be customized to provide an appropriate level of security commensurate with the risk posed by the process and nature of the Data to be protected.
At the time of agreeing to this Researcher Data Use Policy, have no direct knowledge of any local laws that might or reasonably could significantly impair the assurances outlined in this Researcher Data Use Policy. Moreover, you commit to promptly notify the Data exporter (which will relay such notification to the pertinent authority where necessary) upon becoming aware of any such laws.
Data retention. You commit to securely retain Data solely to the extent necessary and proportionate for conducting Approved Research, and to implement Access controls to any systems containing Data. You will maintain and adhere to a documented retention plan that demonstrates a commitment to not retaining Data beyond the earliest of two years from the date of collection or 40 days after the end of the Approved Research.
Anti-circumvention. You commit not to bypass any measures implemented by Booking.com to prevent violations of this Researcher Data Use Policy.
3. Modification of Researcher Data Use Policy
Booking.com reserves the right to change the terms and conditions specified by this Researcher Data Use Policy at any time – with or without notice. Your continued Access and/or any continued use of any Data after such changes enter into effect constitutes your agreement to and acceptance of all such changes.
Privacy Statement for researchers requesting access to data under DSA
This privacy statement applies to the personal data of researchers that request access to data for the purposes of conducting research that contributes to the detection, identification, and understanding of systemic risks in the European Union under the DSA (the “Researchers”).
This privacy statement applies to any Booking.com group company responsible for the processing of the personal data within the scope of this privacy statement (hereafter referred to, as applicable, as “Booking.com” or “we” or “our”).
Booking.com B.V., located in Amsterdam, the Netherlands, is responsible for the processing of Researchers data.
This statement describes how Booking.com processes personal data collected about Researchers submitting an access request under the DSA and using the Booking.com DSA Researchers Data Request Portal.
For information about the use of cookies at Booking.com, see the separate Privacy and Cookie Statement.
Data collection
The personal data Booking.com collects in regards to Researchers are the personal data collected as part of the registration process on the Booking.com DSA Researchers Data Request Portal in the context of a request ("Researchers Access Request") and the interaction and communication with Booking.com. The personal data Booking.com collects about Researchers can include the following – depending on the specific situation, not all of the following data items may be considered personal data because they may relate to a business instead of an individual:
Personal data you give to us
General information and Contact details
We collect general information and contact data of Researchers, such as first name/last name, (business) email address, and the name of the research institution they are affiliated with (if applicable).
Communication
When communicating with Booking.com, Booking.com collects and processes such communications including contact information.
Information we collect automatically
When using the Booking.com DSA Researchers Data Request Portal, such as the online registration form or your online user account, Booking.com also collects information automatically, some of which may be personal data. This includes data such as language settings, IP address, location, device OS, log information, time of usage, URL requested, status report, user agent (information about the browser version), and operating system.
Personal data you give to us about others
By sharing other individuals’ personal data in relation to your Researches Access Request (for instance, if an individual is subject to or mentioned in your Researches Access Request), you confirm that this is done in compliance with applicable (privacy) laws and you are authorized to do so.
Processing purposes
Booking.com uses the previously described information provided by the Researchers, some of which may be personal data, as relevant, for the following purposes:
A. Registration, administration, and verification
Booking.com uses name and contact details to manage the Researchers Access Request, including first name/last name, (business) email address, and the name of the research institution they are affiliated with (if applicable) for registration, administration, and verification purposes.
B. Communication
Booking.com uses your personal data in order to communicate with you, as may be required, in relation to your Researchers Access Request and to ensure proper resolution.
C. Analytics and improvement:
Booking.com uses the information provided, which may include personal data, for analytical purposes. This is part of our drive to improve the Researchers Access Request portal and enhance user experience, for testing purposes, troubleshooting, and to improve the functionality and quality of the Researchers Access Request portal, and can also be used for analyzing the incoming requests.
Legal Bases: As applicable for purposes A to C, your personal data is necessary for Booking.com’s legitimate interests, as described under each processing purpose. When using personal data to serve Booking.com’s or a third party's legitimate interest, Booking.com will always balance your rights and interests in the protection of your information against Booking.com’s rights and interests or those of the third party.
If you wish to object to the processing set out under A to C, and no opt-out mechanism is available to you directly to the extent applicable, contact dataprotectionoffice@booking.com.
Data sharing
Sharing with third parties. We share information regarding Researchers Access Request, which may include personal data, with third parties as permitted by law and as described below.
Service providers (incl. suppliers and trusted advisors). We share personal data with third-party service providers to enable our business processes such as registration, administration, verification, and the communication in view of Researchers Access Request.
Authorities. We might share personal data with authorities when required under applicable law or regulations.
International data transfers
The transmission of personal data as described in this Privacy Statement may include overseas transfers of personal data to countries whose data protection laws are not as comprehensive as those of the countries within the European Union. Where required by European law, we shall only transfer personal data to recipients offering an adequate level of data protection. In these situations, as may be required, we make contractual arrangements to ensure your personal data is still protected in line with European standards. You can ask us to see a copy of implemented safeguards (where possible) by contacting us at dataprotectionoffice@booking.com.
Security
In accordance with European data protection laws, Booking.com observes reasonable procedures to prevent unauthorized access to, and the misuse of, information including personal data.
We use appropriate business systems and procedures to protect and safeguard information, including personal data. We also use security procedures and technical and physical restrictions for accessing and using the personal data on our servers. Only authorized personnel are permitted to access personal data in the course of their work.
Data retention
We will retain personal data for as long as we deem it necessary to manage the relationship with the Researchers, to handle Researches Access Request of a researcher, to comply with applicable laws (including those regarding document retention), resolve disputes with any parties, and otherwise as necessary to allow Booking.com to conduct its business. All personal data we retain will be subject to this Privacy Statement and our internal retention guidelines. If you have a question about a specific retention period for certain types of personal data we process about you, contact us using the contact details included below.
Your choices and rights
Depending on where you are located or the Booking.com entity processing your personal data, different rights may apply to the processing of personal data as set out in this privacy statement. As applicable:
you can ask us for a copy of the personal data we hold about you;
you can inform us of any changes to your personal data, or you can ask us to correct any of the personal data we hold about you;
in certain situations, you can ask us to erase, block, or restrict the personal data we hold about you, or object to particular ways in which we are using your personal data; and
in certain situations, you can also ask us to send the personal data you have given us to a third party.
Where we process your personal data based on legitimate interest or the public interest, you have the right to object at any time to that use of your personal data subject to applicable law.
We rely on you to ensure any personal data we hold about you is complete, accurate, and current. Always inform us promptly of any changes to or inaccuracies of your personal data.
Questions or complaints
If you have questions or concerns about our processing of your personal data or you want to exercise any of your rights you have under this Privacy Statement, contact our data protection officer at dataprotectionoffice@booking.com. All privacy related questions and complaints reported to Booking.com will be investigated. Booking.com will attempt to resolve complaints and questions in line with internal policies. You may also contact your local data protection authority with questions and complaints.
Changes to the Privacy Statement
This Privacy Statement may change. If we make material changes or changes that will have an impact on you (e.g., when we start processing your personal data for other purposes than set out above), we will contact you prior to commencing that processing.
Version/Date: February 2024
Terms and Conditions
Read our Terms and Conditions here