CCPA Privacy Policy

1. Background and scope

This Privacy Notice (“Notice”) sets out how Flight Centre Travel Group processes and protects the privacy of personal information for consumersresidingin California under the California Consumer Protection Act (“CCPA”) asmodifiedand amended by the California Privacy Rights Act (“CPRA”).

Flight Centre Travel Group is one of the world's largest travel agency groups. We need to collect,useanddisclosepersonal informationin order toperform our business functions and activities, including making and managing travel bookings on behalf of our customers. We arefirmly committedto protecting the privacy and confidentiality of personal information and tomaintainingvarious physical,electronicand procedural safeguards to protect personal information in our care.

2. What personal information do we collect?

Personal information generally means information which relates to a living individual who can be identified from that information, or from that information and other information in a person’s possession, including any expression of opinion, whether true or not, and whether recorded in material form or not, about an identified or reasonably identifiable individual, and any indication of intention in respect of an individual.

Generally, thetype of personal information we collect about you is the information that is needed tofacilitateyour travel arrangements and bookings and to arrange travel related services and/or products on your behalf.

We therefore typically process the following types of personal information about you:

• identifiers
• contact information (such as name, residential/mailing address, telephone number, email address);
• passport details, driver’s license number;
• online identifiers (such as IP address);
• loyalty program / frequent flyer details;
• Characteristics of protected classifications under California or federal law (such as race, gender, sexual orientation, age);
• Commercial Information, including records of products or servicespurchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
• Biometric information;
• Internet or other electronic network activity (such as the device and network you are using to connect with us), as further described in Section 11;
• Geolocation data;
• Audio (such as voice recordings used for quality control and dispute resolution), electronic, and visual information (such as video surveillance) used for security purposes;
• Professional or employment-related information;
• Payment account information (credit/debit card details, including card type, card number, security number and expiry date and other financial details necessary to process various transactions);
• Health information (such as your dietary requirements and health issues (if any));
• Other details relevant to your travel arrangements or required by the relevant travel service provider(s) (e.g. airlines and accommodation or tour providers); and
• Sensitive information, such as:
• social security, driver’s license, state identification card, or passport number
• racial or ethnic origin, religious or philosophical beliefs, or professional or union membership (for use in booking special rates);
• biometric information for the purpose of uniquelyidentifyingyou;
• sexual preferences or practices; and
• health information.

Please note that, when necessary for travel arrangements, we may collect from a responsible adult personal information relating to a child of any age, but we do not knowingly collect any such information directly from children.

3. How do we collect personal information?

We usually collect your personal information directly from youduring the course ofyour relationship with us. We will collect this information directly from you unless it is unreasonable or impracticable to do so.

Generally, thiscollection will occur:

• when you deal with us either in person, by telephone, letter,emailor AI chatbot;
• when you visit any of our websites; or
• when you connect with us via social media.

We may collect personal information about you:

• when youpurchaseor make enquiries about travel arrangements or other products and services;
• when you enter competitions or register for promotions;
• when you subscribe to receive marketing from us (e.g. e-newsletters);
• when you request brochures or other information from us; or
• when you provide information, or use our services, on social media.

Unless you choose to do so under a pseudonym or anonymously, we may also collect your personal information (other than sensitive information) whenyoucomplete surveys or provide us with feedback. When you contact us for other purposes, we may also collect personal information about you in relation to those purposes. For example, we may collect your personal information so we can contact you about a competition you have entered (e.g. if you win) or to respond to an enquiry or feedback you have sent to us.

In some circumstances, it may be necessary for us to collect personal information about you from a third party. This includes where a person makes a travel booking on your behalf which includes travel arrangements to be used by you (e.g. a family or group booking or a travel booking made for you by your employer). Where this occurs, we will rely on the authority of the person making the travel booking to act on behalf of any othertraveleron the booking. We may also collect personal informationthrough the use ofthird partyintegrations described in Section 9.

Where you make a travel booking on behalf of another person (e.g. a family or group booking or a travel booking made for an employee), you agree to have obtained the consent of the other person for FlightCentre to collect, use and disclose the other person's personal information in accordance with this Notice and that you have otherwise made the other person aware of this Notice.

You should let us knowimmediatelyif you become aware that your personal information has been provided to us by another person without your consent or if you did not obtain consent before providing another person's personal information to us.

We make every effort tomaintainthe accuracy and completeness of your personal information which we store and to ensureall ofyour personal information is up to date. However, you canassistus with thisconsiderably bypromptly contacting us if there are any changes to your personal information or if you become aware that we have inaccurate personal information relating to you (see section 14 below). We will not be responsible for any losses arising from any inaccurate, inauthentic,deficientor incomplete personal information that you, or a person acting on your behalf, provide to us.

4. How do we use your personal information?

Where you contact us in relation to a travel booking or query, the purpose for which we collect your personal information isgenerally toprovide you with travel advice and/or toassistyou with booking travel and/or travel related products and services. However, the purpose for collection may differ depending on theparticular circumstancesasdisclosedin this Notice (e.g. collection of your personal information for the purpose of your participation in a competition, provision of feedback, etc.).

When you book or otherwise arrange travel related products and services through us, we usually act as an agent for the relevant travel service providers (e.g. for a hotel). In this case, we process your personal information as necessaryso as toprovide the services you requested from us. This usually includes collecting personal information about you both for our internal purposes as described in this Notice and for the travel service provider for whom we act as agent (e.g. to provide you with the booked services). For example, if you book a flight through us, then we use your personal information to enable your flight to be booked anddiscloseit to the airline to enable the airline to provide the flight service to you.

Please note that these travel service providers also may use your personal information as described in their respective privacy policy and may contact you as necessary to obtainadditionalinformation about you,facilitateyour travel reservation, or provide you with your requested services. We encourage you to review the privacy policies of any third-party travel service providers whose products youpurchasethrough us. We will provide you with copies of all relevant travel service provider terms,conditionsand privacy policies on request.

We act as agent for or on behalf of many thousands of travel service providers around the world, so it is not possible for us to set out in this Noticeall ofthe travel service providers for whom we act or their locations. For more information about the disclosure of personal information to travel service providerslocatedoverseas, please refer to section 6 below.

If you have any concernsregardingthe transfer of your personal information to a travel service provider, or you wish to contact us for further information, please refer to the “Feedback / Complaints / Contact” section below (section 13).

Further purposes for which we process personal information include:

• providing you with services and tools you choose to use (for example, saving travel preferences on our websites to a wish list or saving personal information to allow for pre-population of online forms);
• identification of errors;
• protecting against, deterring,detectingand investigating fraudulent,unauthorisedor illegal activities;
• regulatory reporting and compliance;
• developing and improving our products and services and those of our related entities;
• using AI features to provide personalized travel recommendations, enhanced customer service, serviceimprovementsand service automation, withappropriate humanoversight;
• servicing our relationship with you by, among other things, creating andmaintaininga customer account and/or profile to enable our brands to service you better or presenting options on our website we think may interest you based on your browsing and preferences;
• involving you in market research, gauging customer satisfaction and seeking feedbackregardingour relationship with you and/or the service we have provided;
• tofacilitateyour participation in loyalty programs;
• for research and analysis in relation to our business and services, including but not limited to trends and preferences in sales and travel destinations and use of our websites;
• internal accounting and administration;
• tocomply withour legal obligations, including complying with law enforcement or government authority requests, and any applicable customs/immigration requirements relating to your travel;
• tocomply witha valid and authorised request, including a court order or other valid legal process;
• where we suspect that unlawful activity has been or may be engaged in and the personal information is a necessary part of our investigation or reporting of the matter; and
• other purposes as authorised or required by law (e.g. to prevent a threat to life,healthor safety, or to enforce our legal rights).

We may use AI and automated processing as the mechanism by which to process personal information to meet the purposes set outherein.

We may use your personal information to send you targeted marketing activities relating to our products and services (and those of third parties) that we think may interestyou, unlessyou have requested not to receive such information. These may include, but are not limited to, mail outs, electronic marketing and notifications as described below, and telephone calls). We will only use your personal information to send electronic marketing materials to you (including e-newsletters, email, SMS, MMS andiM) if you have not opt-ed out of receiving them. You can subscribe to receive e-newsletters and other electronic promotional/marketing materials by following the relevant links on our website or requesting one of our consultants to do so for you.

Should you no longer wish to receive promotional/marketing material from us,participatein marketresearchor receive other types of communication from us, please refer to the “Feedback / Complaints/ Subject Access Requests/ Contact” section below (section 13). You can unsubscribe from receiving electronic marketing materials by following the unsubscribe prompt in your email, SMS, MMS,iMor other form of electronic marketing. Please also see the “Your rights” section of this Notice to learn about your ability, at any time, to opt out or limit the use of your browsing behaviour for online behavioural advertising purposes (section 8 below).

5. Is personal information sold or shared with third parties?

In the preceding 12 months we “sold” (as the term “sale” is defined in the CCPA) and/or “shared” (as the term “share” is defined in the CCPA) each category of personal information as follows:

Additionalinformation can be found in Section 9. Social Media Integrations.

Notice of Right to Opt-out of Sale/Sharing

You have the right to opt out of the sale or sharing of the personal information described in this section. You may request we not “sell or share your information” by clicking thislink.

To our actual knowledge we do not sell or share the personal information consumers under 16 years of age.

6. Is personal informationdisclosedto third parties?

We will onlydiscloseyour personal information to third parties in the ways set out in this Notice and, in particular, asset out below. Note that, in this Notice, where we say “disclose”, this includes to transfer, share (including verbally and in writing) (but not within the meaning of that term as defined under CCPA), send, or otherwise make available or accessible your personal information to another person or entity.Your personal information may bedisclosedto the following types of third parties:

• our independent contractors,suppliersand service providers, including without limitation:
• suppliers of IT based solutions thatassistus in providing products and services to you (such as any external data hosting providers we may use);
• publishers,printersand distributors of marketing material;
• event and expo organisers;
• marketing, market research, research and analysis and communications agencies;
• mailing houses, freight services, courier services; and
• external business advisers (such as lawyers, accountants,auditorsand recruitment consultants);
• our related entities and brands;
• travel service providers such as travel wholesalers, tour operators, airlines, hotels, car rental companies, transferhandlersand other related service providers;
• any third party to whom we assign or novate any of our rights or obligations;
• financial institutions such as banks, when processing financial transactions;
• someone acting on your behalf
• a person making your travel booking on your behalf, where you are travelling on a booking made on your behalf by another person (for example, a family member,friendor work colleague);
• your employer, where you are an employee of one of our corporate, business or government clients and you areparticipatingin an event or travelling for work purposes;
• a person who can verify to us that they have a relationship with you (e.g. a family member) where you are not contactable, the person correctly answers our required security questions and the request is, in our opinion, in your interest (for example, wherethe person is concerned for your welfare or needs to undertake action on your behalf due to unforeseen circumstances);
• government and enforcement agencies, including
• government agencies and public authorities;
• various regulatory bodies and law enforcement officials and agencies
• enforcement agencies: and
• third-party services or applications when you use these to log into your account.

In the preceding 12 months wedisclosedpersonal informationto our service providers and/orcontractorsas follows:

We do not use ordiscloseyour sensitive personal information for purposes other than those allowed under the CCPA, including Section 7027, subsection (m).

7. Security of information

We are committed to safeguarding and protecting personal information and will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to protect any personal information provided to us from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information transmitted, stored or otherwise processed. Flight Centre has implemented various physical,electronicand organisational security proceduresin order toprotect the personal information it holds from loss and misuse, and from unauthorised access, modification,disclosureand interference. Flight Centre regularly reviews security technologies and will strive to protect your personal information as fully as we protect our own confidential information. Flight Centre is not responsible for any third party’s actions or their security controls with respect to information that third parties may collect or process via their websites, services or otherwise.

We will destroy or de-identifypersonal information once we no longerrequireit for our business purposes, or as required by law.

8. Your rights in relation to the personal information we collect

Under the CCPA, you have the right:

• to know the personal information we have collected about you, including the specific pieces of personal information collected about you, the categories of sources from which the personal information is collected, the purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information;
• to request the deletion of the personal information we have about you; and
• to request correction of inaccurate personal information we have about you;

To make a request, you may email us at Privacy@am.flightcentre.com or contact us through the web page locatedhere, or through our phone number at 877-867-2907. In most cases, you willbe requiredto provide your name and email address or phone number so that we can verify your request, and in some casesadditionalinformation may berequired. Where possible, we willattemptto match the information that you provide in your request to information we already have on file to verify your identity. If weare able toverify your request, we will process it. If we cannot verify your request, we may ask you foradditionalinformation to help us do so. We will respond to your request within the 45-daytime periodrequired by applicable law. However, we may not always be able to fullycomply withyour request, and we willnotify youin that event.

Under the CCPA, California consumers may use an authorized agent to make privacy rights requests. We require the authorized agent to provide us with proof of the California consumer’s written permission(for example, a power of attorney) thatdemonstratesauthorization tosubmita request for the California consumer. An authorized agent must follow the process described above to make a request, and we will also (a) require the authorized agent to verify the agent’s own identity and (b) confirm the agent’s authority with the California consumer about whom the request was made.

Further correspondenceregardingyour request should only be made in writing to the applicable Chief Privacy Officer as set out in section 13 below.

You will not be discriminated against for exercising your California privacy rights.

However, please note that, if yourequestthat wedeleteor stop using personal information we hold on you, this may affect our ability to provide services to you or negativelyimpactthe services we can provide to you. For example, most travel bookings must be made under the traveller's full name and must include contact details andappropriate identification(e.g. passport details). We cannot make bookings for you without that information.You must always provideaccurateinformationand you agree to update it whenever necessary. You also agree that, in the absence of any update, we can assume that the informationsubmittedto us is correct, unless wesubsequentlybecome aware that it is not correct.
You can at any time tell us not to send you marketing communications by email by clicking on the unsubscribe link within the marketing emails you receive from us or by contacting us asindicatedabove).

9. Social Media Integrations

Our websites and mobile applications may use social media features and widgets (such as “Like” and “Share” buttons/widgets) (“SM Features”). These are provided andoperatedby third party companies (e.g. Facebook) and either hosted by a third party or hosted directly on our website or mobile application. SM Features may collect information such as the page you are visiting on our website/mobile application, your IP address, and may set cookies to enable the SM Feature to function properly.

If you are logged into your account with thethird partycompany, then the third party may be able to link information about your visit to and use of our website or mobile application to your social media account with them. Similarly, your interactions with the SM Features may be recorded by the third party. In addition, the third party company may send us information in line with their policies, such as your name, profile picture, gender, friend lists and any other information you have chosen to make available, and we may share information with the third party company for the purposes of serving targeted marketing to you via the third party social media platform. You can manage the sharing of information and opt out from targeted marketing via your privacy settings for thethird partysocial media platform.

Your interactions with these SM Features are governed by the privacy policy of thethird partycompany providing them. For more information about the data practices of thesethird partycompanies, and to find out more about what personal information is collected about you and how the third party uses such personal information, please refer to their privacy policy directly.

10. IP addresses

When you access our website, use any of our mobile applications or open electronic correspondence or communications from us, our servers may record dataregardingyour device and the network you are using to connect with us, including your IP address. An IP address is a series of numbers whichidentifyyour computer, and which aregenerally assignedwhen you access the internet.

We may use IP addresses for system administration, investigation of security issues and compiling anonymised dataregardingusage of our website and/or mobile applications. We may also link IP addressesto other personal information we hold about you and use it for the purposes described above (e.g. to better tailor our marketing and advertising materials, provided you have opted in to receive electronic marketing).

11. Tracking Technologies / Cookies

We may use third-party web analytics services on our websites and mobile apps, such as those listed in our Cookies Policy. The analytics providers that administer these services use technologies such as cookies and web beacons to help us analyse how visitors use our websites and apps.

For informationregardingour use of cookies and tracking technologies, refer to our Cookies Policy on our website.

12. Linked Sites

Our websites maycontainlinks to third party websites over which we have no control. We are not responsible for the privacy practices or the content of such websites. We encourage you to read the privacy policies of any linkedthird partywebsites you visit as their privacy policy and practices may differ from ours.

13. Feedback / Complaints / Subject Access Requests / Contact

You can direct any questions or complaints about the use or disclosure of your personal information to the contact information below.

If you wish to make a Subject Access Request to inform us of a change or correction to your personal information, request a copy of the information we collect on you, request deletion of your information or would like to restrict the further processing of your data, please use the appropriate SAR link in the table below. We will respond to these requests within thetime periodrequired by the applicablejurisdiction.

Similarly, if you have any enquiries, comments or complaints about this Notice or our handling of your personal information, please contact your consultant or the Chief Privacy Officer using the details set out below and we will respond as soon aspracticable.

14. Changes to our Notice

We may amend this Notice from time to time. If we make a change to the Notice, the revised version will be posted on our website. We will post a prominent notice on our website tonotify youof any significant changes to our Notice andindicateat the end of the Notice when it was most recently updated. It is your responsibility, and we encourage you, to check the website from time to timein order todeterminewhether there have been any changes.

This Privacy Notice was last updated on 09January 2026.