Privacy Policy
Last updated August 13th, 2025
1. INTRODUCTION AND GENERAL BACKGROUND
1.1. Traveler Innovations Limited ("Doona", "we" or "us") presents this privacy policy, as may be amended from time to time (the "Privacy Policy" or "Policy") in order to provide our website user ("User", "you" or "your") information about Doona’s privacy and data protection practices in relation to Personal Data that is collected, used and/or otherwise processed by Doona and/or third parties acting on its behalf, through the 'Rest of the Word' locale and its related domain (i.e., https://www.doona.com/) (the "Website").
1.2. When accessing, browsing and using the Website, you may be required to provide Doona with Personal Data about yourself that is protected by law. As a result, Doona, as data controller, has implemented appropriate security measures in order to protect your Personal Data.
1.3. Please note that this Privacy Policy applies to the 'Rest of the Word' locale and its related domain only (i.e., https://www.doona.com/). Doona distributors may use sub-domains and subfolders of this Website in specific jurisdictions (e.g., doona.com/fr, de.doona.com). Distributors are the data controllers for the processing of Personal Data on these websites. Distributors’ websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any Personal Data to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such distributors’ sub-domains and subfolders of this Website and the terms and conditions and privacy policies included in such sub-domains and subfolders.
1.4. This Privacy Policy supplements our Terms & Conditions and our Cookie Notice.
1.5. If you have questions or concerns regarding this Privacy Policy, please contact us at privacy@doona.com
1.6. Please see our full Privacy Policy below in order to better understand our practices in detail.
2. WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU AND FOR WHAT PURPOSES?
When we use the term “Personal Data” in this Privacy Policy, we mean individually identifiable information, namely information that identifies an individual or may, with reasonable effort, be used to identify an individual.
The table below details the categories of Personal Data, purposes, lawful basis, and processing:
3. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?
3.1. We may share your Personal Data with certain third parties that may be located outside your jurisdiction, as detailed below:
3.1.1. With our Affiliates. Your Personal Data will be shared with our affiliates to manage the Website and the companies' services.
3.1.2. Service Providers and Business Partners, including data storage providers, data security services, fraud detection and prevention services, product analytics, session or activity recording services, content transcription and analysis services, performance measurement, advertising and marketing service providers, consent manager (CMP) which is external service that provides use with the ability to allow website visitors to control and manager their cookies and other tracking preferences and consent, insurers. We share Personal Data with selected third party companies and individuals we engage to perform services on our behalf, such as improving and optimizing the Website and process Personal Data in the context of provision of analytical services to us and for operational, commercial and technical purposes related to the management of the Website and its services. We only provide such service providers with Personal Data so they can perform their required functions on our behalf.
3.1.3. Governmental, Administrative or Judiciary Authorities. We will disclose or allow government and law enforcement officials access to certain Personal Data, exclusively in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur with or without notice to you, if we have a good faith belief that we are legally compelled to do so, or that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing.
3.1.4. Corporate Transactions. We may share Personal Data in connection with any proposed or actual financing, reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).
3.1.5. Lawyers and Interested Parties. We will share Personal Data exclusively in case of the management of possible disputes and other legal matters where appropriate, including with respect to the Website; to establish, protect, or exercise our legal rights; as required to enforce the T&Cs or other contracts; to defend against legal claims or demands; to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights.
3.2 Please note that, in the preceding twelve (12) months, we have shared your internet or other electronic network activity information collected through cookies and other tracking technologies with our data analytics providers and with our Service Providers and Business Partners.
4. HOW IS YOUR PERSONAL DATA TRANSFERRED OUTSIDE OF YOUR COUNTRY?
4.1. We may host, store, process, maintain or transfer the Personal Data to various sites worldwide, outside your jurisdiction, including through cloud based service providers.
4.2. By using the Website, you hereby provide your informed consent to the use and/or processing and/or hosting, storage and/or transfer of the Personal Data to countries outside your jurisdiction or country, if such informed consent is required under applicable data protection law.
4.3. Where specific laws or regulations relating to Personal Data transfer apply to us, we will endeavor to ensure that the Personal Data is protected and transferred in a manner consistent with legal requirements.
4.4. EEA Transfers. When we transfer Personal Data from within the European Economic Area ("EEA") to countries or international organizations that are based outside the EEA, the transfer takes place on the basis of an adequacy decision by the European Commission, or in the absence of an adequacy decision, other legally permitted safeguards under the GDPR, such as standard contractual clauses ("SCCs").
5. HOW LONG DO WE STORE YOUR PERSONAL DATA FOR?
5.1. We retain Personal Data for as long as a User is using our Website.
5.2. Other circumstances in which we will retain your Personal Data for longer periods of time include:
5.2.1. where we are required to do so in accordance with legal and regulatory requirements, or
5.2.2. for us to have an accurate record of your interaction with us in the event of any inquiries or contact requests, or
5.2.3. if we reasonably believe there is a prospect of litigation.
6. HOW DO WE KEEP YOUR PERSONAL DATA SECURE?
6.1. We endeavor to maintain appropriate technical and organizational measures compliant with industry standards to protect Personal Data in particular, against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.
6.2. We implement physical, administrative, and technical policies and controls designed to help prevent unauthorized access and maintain Personal Data security and confidentiality such as, encryption in transit and at rest, periodical penetration tests, authentication and authorization controls, and secure development life cycle process.
6.3. However, although we make every effort to protect the Personal Data which you provide to us or we generate, we cannot completely ensure the security of any Personal Data you transmit to us over the internet or guarantee that this Personal Data will not be accessed, disclosed, altered, or destroyed.
6.4. If you have found a vulnerability or would like to report a security incident, you may send an email to privacy@doona.com.
7. WHAT RIGHTS DO YOU HAVE REGARDING YOUR PERSONAL DATA?
7.1. General Provisions for all Jurisdictions
7.1.1. Please note that under certain circumstances and depending on your jurisdiction, you are entitled to specific rights regarding your Personal Data (subject to some exceptions).
7.1.2. In most cases, you can exercise such rights free of charge.
7.1.3.When you ask us to exercise any of your rights under this Privacy Policy and the applicable privacy and data protection laws, we may need to ask you to provide us with certain credentials to make sure that you are who you claim you are, to avoid disclosure to you of Personal Data which is related to others that you are not authorized to receive, and to ask you questions to better understand the nature and scope of Personal Data that you request to access.
7.1.4. Applicable privacy and data protection laws in your jurisdiction may provide you with different or additional rights related to the Personal Data we collect from you, which may also apply.
7.1.5. Please note that you can deliver your request by contacting us at privacy@doona.com.
7.2 EEA Users
7.2.1. If you are based in the EEA, you have the following rights:
i. You have the right to access your Personal Data in order to obtain clear, transparent and understandable information on how we process your Personal Data and on your rights (as provided in this Privacy Policy), as well as a copy of your Personal Data.
ii. You have the right to rectify your Personal Data in case your Personal Data is obsolete, inaccurate or incomplete.
iii. You have the right to object the processing of your Personal Data when the processing is based on Doona’s legitimate interest. We will no longer process your Personal Data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, such as the respect of a legal obligation (e.g., legal obligation involving the retention of documents), or for the establishment, exercise or defense of legal claims.
iv. In certain circumstances under GDPR, you have the right to restrict the processing of some of your Personal Data during a limited period of time.
v. You have the right to withdraw your consent when it has been obtained and processing is based on consent.
vi. In certain circumstances under GDPR, you have the right to request data portability, meaning that you can receive the Personal Data originally provided by you in a structured and commonly used format or that you can request the transfer of the Personal Data you provided to another data controller. This right applies only if it fulfils certain conditions under GDPR.
vii In certain circumstances under GDPR, you have the right to delete your Personal Data (also known as the right to be forgotten).
viiii. If applicable, you may request not to be subject to a decision based solely on automated processing, including profiling, if such profiling produces a legal effect concerning you or similarly significantly affects you and if automated processing is used.
ix. You have the right to lodge a complaint with your national data protection authority where we are based. If you have a complaint about how we use your Personal Data, we will always prefer you to contact us first. If you are unsure which data protection authority to contact, please contact us at privacy@doona.com.
7.3. U.S. Users
The following rights apply to Users based in the U.S., to the extent that such Personal Data is processed in such States.
7.3.1. Rights of California Residents. If our Processing of your Personal Data is subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Right Act of 2020 ("CCPA"), you are entitled to the following rights:
i. Right to Know what Personal Data we Have Collected. You have the right to request what Personal Data we have collected, including the categories of Personal Data, the categories of sources from which the Personal Data is collected, the business or commercial purpose for collecting, selling, or sharing Personal Data, the categories of third parties to whom we discloses Personal Data, and the specific pieces of Personal Data we have collected about you.
ii. Right to Deletion. You have the right to request the deletion of your Personal Data that we collect or maintain, subject to certain exceptions.
iii. Right to Correction. You have the right to request the correction of your inaccurate Personal Data that we maintain about you.
iv. Right to Opt-Out of Sharing for Cross-Contextual Behavioral Advertising. You have the right to opt-out of the “sharing” of your Personal Data for “cross-contextual behavioral advertising,” often referred to as “interest-based advertising” or “targeted advertising”.
v. Right to Opt-Out from Selling. You have the right to opt-out of the sale of your Personal Data to third parties. We do not have actual knowledge that we sell Personal Data.
vii. Right to Limit the Use or Disclosure of Sensitive Personal Information. Under certain circumstances, to the extent we use or disclose SPI, you have the right to limit the use or disclosure of SPI.
vii. Right to Data Portability. You may request to receive a copy of your Personal Data, including specific pieces of Personal Data, including, where applicable, to obtain a copy of the Personal Data you provided to us in a portable format.
viii. Right to Non-Discrimination. You have the right to not receive discriminatory treatment if and when you exercise your rights regarding your Personal Data under the CCPA.
7.3.2. Only you may make a request related to your Personal Data. If you are a California resident a request can be made by a person registered with the California Secretary of State that you authorize to act on your behalf, in such event you must provide us with signed documentation that you have authorized an agent to act on your behalf.
7.3.3. Rights of Colorado Residents. If our Processing of your Personal Data is subject to the Colorado Privacy Act ("CPA"), you are entitled to the following rights:
i. Right to Access/Right to Know. You have the right to confirm whether and know the Personal Data we collected on you.
ii. Right to Deletion. You have the right to request the deletion of your Personal Data that we collect or maintain, subject to certain exceptions. Please note that we will delete or de-identify Personal Data not subject to one of the exceptions and will direct our subcontractors to take similar action.
iii. Right to Correction. You have the right to correct inaccuracies in your Personal Data, taking into account the nature and purposes of Processing of such Personal Data.
iv. Right to Opt-Out from Selling. You have the right to opt-out of the sale of your Personal Data to third parties. We do not have actual knowledge that we sell Personal Data.
v. Right to Opt-Out of the Use of Automated Decision Making. In certain circumstances and to the extent applicable, you have the right to opt-out of the use of automated decision making in relation to your Personal Data.
vi. Right to Data Portability. You have the right to obtain the Personal Data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the Personal Data to another entity without hindrance.
vii. Right to Non-Discrimination. You have the right to not receive discriminatory treatment if and when you exercise your rights regarding your Personal Data under the CPA.
7.3.4. Rights of Virginia Residents. If our Processing of your Personal Data is subject to the Virginia Consumer Data Protection Act, as amended ("VCDPA"), you are entitled to the same rights as Colorado residents described above in Section 7.3.3.
7.3.5. Rights of Connecticut Residents. If our Processing of your Personal Data is subject to the Connecticut Data Privacy Act ("CDPA"), you are entitled to the same rights as Colorado residents described above in Section 7.3.3.
7.3.6. Rights of Utah Residents. If our Processing of your Personal Data is subject to the Utah Consumer Privacy Act ("UCPAA"), you are entitled to the same rights as Colorado residents described above in Section 7.3.3.
7.3.7. Right of Nevada Residents. Subject to several exceptions, Nevada law allows Nevada residents to opt out of the sale of certain types of Personal Data. We currently do not “sell” Personal Data as defined in the Nevada law.
7.3.8. You can exercise your above rights by contacting us via contact details described in Section 12.
8. CHILDREN
8.1 The Website is directed towards and designed for use by persons aged 18 and older. We do not solicit or knowingly collect Personal Data from children under the age of 18.
8.2. If we nevertheless receive Personal Data from an individual who indicates that he or she is, or whom we otherwise have reason to believe is, under the age of 18, we will endeavor to delete such Personal Data from our systems.
9. DOES THIS PRIVACY POLICY APPLY TO THIRD PARTY LINKS?
91. You may, during your use of the Website, access links to or other websites operated by third parties outside of Doona, including subdomains and subfolders of this Website operated by distributors.
9.2. Please note that this Privacy Policy only applies to Personal Data that we (or third parties on our behalf) collect from or about you on the Website only and we cannot be responsible for Personal Data collected and stored by third parties, including distributors.
9.3. Third party websites, including distributors, have their own terms and conditions and privacy policies, and you should read these carefully before you submit any Personal Data to these websites.
9.4. We do not endorse or otherwise accept any responsibility or liability for the content of such third-party websites or third-party terms and conditions or policies.
10. CHANGES TO THIS PRIVACY POLICY
10.1. This Privacy Policy may change from time to time. If we decide to change our Privacy Policy, we will post new or updated privacy policy in our Website. Each version of this Privacy Policy will be identified by its effective date, which you can find at the top of this Privacy Policy. The new or updated privacy policy will be effective from the date mentioned at the top page of the new privacy policy.
10.2. If we materially change the way in which we process your previously collected Personal Data, we will provide you with prior notice, or where legally required, request your consent prior to implementing such changes.
10.3. We strongly encourage you to review this Privacy Policy periodically to ensure that you understand our most updated privacy practices.
11. CONTACT INFORMATION AND DATA CONTROLLER INFORMATION
If you have any comments or questions regarding this privacy policy or the information practices in connection with the Website, please contact us at privacy@doona.com.