PRIVACY POLICY

We collect and use personal data only for specified, legitimate purposes and in accordance with applicable data protection laws. Depending on the processing activity and jurisdiction, we may rely on your consent, the performance of a contract or pre-contractual steps, compliance with a legal obligation, our legitimate interests where permitted, protection of vital interests, or another basis recognised by applicable law.

Where we rely on legitimate interests, these may include administering member and guest relationships, responding to enquiries, preventing fraud, maintaining information security, improving our services and managing our business, subject to applicable balancing and other legal requirements. Where consent is required, we will request it appropriately and you may withdraw it without affecting processing already lawfully carried out.

Depending on how you interact with Karma, we may collect: contact and identification details (name, address, email, telephone number, nationality and, where necessary, passport or identification information); demographic and preference information; account credentials and login records; and website, device, cookie, usage and approximate location information.

We may also collect membership and vacation ownership information, including membership identifiers, agreements, entitlements, benefits, renewals, upgrades, cancellations and related account records; reservation and travel information, including booking references, stay dates, accompanying guests and accommodation preferences; and financial and transaction information, including payment details, fees, invoices, refunds and outstanding balances.

Other information may include communications, enquiries, complaints, customer-service and concierge records, call recordings where used and lawfully notified, sales and marketing preferences, consent records, security logs and information relevant to suspected fraud or misuse.

Where necessary to provide requested services, we may process accessibility, health-related or dietary information. Such information may be sensitive or special-category data under applicable law and will be handled subject to any additional legal requirements, including explicit consent where required. We do not seek more information than reasonably necessary for the relevant purpose.

We collect information directly from you when you use our websites or apps, book a stay, enter into a membership or vacation ownership arrangement, communicate with us, participate in promotions, complete forms or use our services.

We may also receive information from travel agents, booking platforms, property operators, other Karma Group entities, business partners, payment providers, service providers and persons making reservations on your behalf, where lawful and relevant to the services requested.

Our websites and digital services may automatically collect technical and usage information such as IP address, browser and device characteristics, visit and interaction information and cookies, subject to applicable law and your choices.

We may process personal data to: provide, administer and fulfil accommodation, booking, membership, vacation ownership, concierge and related services; manage accounts, entitlements, payments, renewals, complaints, refunds and customer support; communicate about reservations, contractual matters and service updates; and verify identity where necessary.

We may also use personal data to maintain and improve our services and systems, monitor service quality, investigate suspected fraud and security incidents, protect our rights and property, comply with legal and regulatory duties, maintain financial and accounting records, and establish, exercise or defend legal claims.

Subject to applicable consent and marketing laws, we may send information about Karma products, promotions, member benefits, upgrades, events and related offerings, and analyse preferences to make communications more relevant. You may opt out of direct marketing at any time.

Where required by applicable law, we will provide additional information at the point of collection about the specific purposes and legal bases relevant to a particular service or jurisdiction.

We may contact you about services, membership benefits and offers where permitted by applicable law. Where consent is required for email, telephone, messaging applications or other direct marketing, we will obtain it. Where a lawful existing-customer exception applies, we will observe its conditions.

You may opt out of marketing by following the unsubscribe instructions in a communication or contacting privacy@karmagroup.com. Opting out of marketing will not prevent essential booking, account, security or contractual communications.

We do not disclose identifiable customer information to advertisers for their independent marketing except where permitted by law and subject to any required consent. We may use advertising and analytics partners for audience measurement or advertising, as described in our cookie information and subject to applicable choices.

We may share personal data with relevant Karma Group companies, property operators, booking and travel partners, payment processors, technology and hosting providers, professional advisers, insurers, regulators, law enforcement agencies and other parties where necessary for the purposes described in this Policy or required by law.

We engage third-party service providers, including contact centres, customer-service, membership administration, reservations and concierge providers, to assist in delivering our services. These providers may access or process relevant contact, membership, booking, account and service-request information on our behalf, subject to applicable contractual, confidentiality, security and data protection obligations.

Such providers may operate outside the country in which you reside. The involvement of a service provider does not necessarily mean that it may use your information for its own purposes. We require service providers acting on our instructions to process information only for authorised purposes, subject to applicable law.

We may disclose information in connection with an actual or proposed corporate transaction, reorganisation or transfer of assets, subject to appropriate safeguards. We may share information that has been effectively anonymised so that individuals are no longer identifiable.

Karma Group operates internationally. Personal data may be accessed, stored or processed in countries other than your country of residence, including countries where Karma Group entities, properties, service providers or support teams operate. The laws in those countries may differ from those in your home jurisdiction.

Where applicable law restricts international transfers, we will use an appropriate lawful transfer mechanism or safeguard, such as the European Commission’s Standard Contractual Clauses (EU SCCs) pursuant to Article 46(2)(c) of the EU GDPR or the UK Information Commissioner’s Office (ICO) approved International Data Transfer Agreement, which may include an adequacy decision, approved contractual clauses, other legally recognised safeguards or an applicable statutory exception. We will take any additional measures required by applicable law.

You may contact privacy@karmagroup.com to request further information about safeguards relevant to your personal data, subject to legal and confidentiality restrictions. Using a Karma service does not, by itself, replace any transfer safeguard required by law.

We maintain technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure, having regard to the nature of the information and relevant risks. Measures may include access controls, staff confidentiality obligations, monitoring and appropriate service-provider controls.

No method of electronic transmission or storage can be guaranteed to be completely secure. If we become aware of a suspected personal data incident, we will assess and investigate it, take appropriate containment and remediation steps, and notify affected individuals and competent authorities where required by applicable law.

Please report suspicious communications purporting to come from Karma, including requests for payment details or account credentials, through our official contact channels. We will never treat this Policy as a waiver of statutory data protection obligations.

Our websites may use essential cookies for functionality and security, and, where applicable, analytics, preference and advertising cookies. We use tools such as Google Analytics where implemented to understand website usage and improve our services.

Where required, non-essential cookies and similar technologies will be used only after obtaining the necessary consent, and you will be able to manage or withdraw your choices through the available cookie controls. Further details of cookie categories, providers and retention periods should be provided through our cookie notice or consent interface.

You may also manage cookies through browser settings, although disabling essential cookies may affect website functionality. The availability and operation of particular cookies may differ between Karma websites.

We may use technology providers, including providers offering artificial intelligence or machine learning functionality, to support customer service, operational efficiency, analytics, security or digital services where actually implemented and permitted by law.

Where personal data is processed through these tools, we will assess the relevant purpose, lawful basis, provider arrangements and safeguards. We will provide any additional notices and rights required for automated decisions that produce legal or similarly significant effects. We do not intend this provision to authorise unrestricted use of personal data for AI model training.

We retain personal data for as long as reasonably necessary for the purposes for which it was collected, taking account of the duration of membership or contractual relationships, applicable legal and accounting requirements, limitation periods, disputes, security needs and relevant retention obligations.

Different categories of data may have different retention periods. In all cases, membership, transaction, and financial records are retained for a maximum of 7 years post-contract to fulfill tax and statutory accounting purposes and applicable statutory limitation periods. Marketing and technical data are retained for shorter periods, or until you withdraw consent or object to processing. When no longer needed, data will be securely deleted or anonymised, subject to legal requirements.

Depending on the laws applicable to your personal data, you may have rights to request access, correction, erasure, restriction of processing, portability, objection to processing and withdrawal of consent, and rights relating to certain automated decisions. These rights may be subject to statutory conditions and exceptions.

To exercise your rights, please use https://karmagroup.com/gdpr-form/ or email privacy@karmagroup.com. We may need to verify your identity before responding and will respond within the period required by applicable law.

You may also complain to the competent data protection or supervisory authority in the jurisdiction applicable to your concern such as :

In the United Kingdom:
You may submit a complaint to the Information Commissioner’s Office (ICO).

• Website: https://ico.org.uk/make-a-complaint/

• Helpline: +44 303 123 1113

• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

In the European Economic Area (EEA):
You may lodge a complaint with the data protection supervisory authority of the EU member state where you habitually reside, where your place of work is located, or where an alleged infringement has taken place.

• A full directory and contact list of all national EEA Data Protection Authorities is maintained by the European Data Protection Board (EDPB) and can be accessed at:
  https://www.edpb.europa.eu/about-edpb/our-members_en

We encourage you to contact us first so that we can try to resolve the issue promptly.

Our websites may link to websites, booking platforms and services operated by third parties. Those parties may process personal data under their own privacy notices. Please review their notices before providing information directly to them.

Where information about accompanying guests, children or other individuals is supplied in connection with a booking or membership, the person providing it should ensure that they are authorised to do so and that any required notices or consents have been provided. We apply additional protections where required for children’s personal data.

We may update this Policy to reflect changes in our services, processing practices or applicable law. The latest version will be published on our website with its effective or last-updated date. Where required, we will provide additional notice or seek consent for material changes.

For questions or requests relating to this Policy or personal data, please email privacy@karmagroup.com, visit https://www.karmagroup.com/contact-us or submit a request via this form.