Ultimate Jet Vacations

Privacy Policy

Ultimate Jet Vacations ("UJV," "we," "us," or "our") is committed to protecting the privacy of travel advisors, API partners, and end customers who interact with our platform, website, and booking services. This Privacy Policy explains what personal data we collect, how we use and protect it, who we share it with, and what rights you have in relation to it. It applies to www.ultimatejetvacations.com, the UJV TA Portal, the Online Booking Engine, the API platform, and any other services we provide (collectively, "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you are accessing the Services on behalf of a business or agency, you represent that you have the authority to bind that business to this Policy.

1. Information We Collect

We collect the following categories of personal data depending on how you interact with our Services:

1.1 Account and Identity Data

• Full name and job title
• Agency or company name and affiliation
• Email address, phone number, and mailing address
• Account username and login credentials
• IATA number or other professional identifiers

1.2 Booking and Transaction Data

• Travel itinerary details, including destinations, dates, and Travel Provider selections
• End customer names, contact details, and travel preferences provided by the advisor in connection with a booking
• Payment information, including billing address and card details (processed and tokenized by our PCI DSS-compliant payment processor; raw card numbers are never stored on UJV systems)
• Booking confirmation numbers, invoices, and correspondence relating to Travel-Products

1.3 Platform and Usage Data

• IP address, browser type, operating system, and device identifiers
• Pages visited, search queries, click paths, and session duration on our website and platform
• Referring website addresses and exit URLs
• API query logs, booking metadata, and platform performance data generated through use of the UJV API ("Service Data")

1.4 Communications Data

• Emails, messages, and other correspondence sent to or received from UJV
• Call records, where permitted by applicable law
• Feedback, survey responses, and support tickets

1.5 Marketing and Preference Data

• Communication preferences and opt-in or opt-out status
• Regional booking interests and travel preferences where voluntarily provided

2. Legal Bases for Processing

Where the EU General Data Protection Regulation (GDPR) applies, UJV processes personal data on the following legal bases:

• Contract performance: processing necessary to fulfill a booking or manage your account with UJV.
• Legitimate interests: processing for fraud prevention, platform security, improving our services, and internal analytics, where these interests are not overridden by your privacy rights.
• Legal obligation: processing required to comply with applicable laws, regulations, and lawful requests from public authorities.
• Consent: processing for direct marketing communications, where you have opted in. You may withdraw consent at any time by unsubscribing or contacting us at info@ultimatejetvacations.com.

3. How We Use Your Information

UJV uses the personal data we collect for the following purposes:

• Service Provision: to process bookings, manage accounts, deliver Travel-Products, and communicate with you about your reservations and itineraries.
• Business Operations: internal record keeping, financial reporting, and improving the quality and reliability of our Services.
• Platform Improvement: analyzing usage patterns, troubleshooting technical issues, and developing new features. Where possible, we use anonymized or aggregated data for this purpose.
• Marketing and Communication: sending promotional emails, newsletters, and market research invitations where you have consented or where we have a legitimate interest in doing so. You may opt out at any time via the unsubscribe link in any email or by contacting us directly.
• Targeted Advertising: We may use your information to serve targeted advertisements on third-party platforms, including Google Ads, Meta (Facebook and Instagram), LinkedIn, and Microsoft Advertising. These platforms operate their own privacy policies and data practices. You can manage your advertising preferences through each platform's settings.
• Fraud Prevention and Security: detecting, investigating, and preventing unauthorized access, fraudulent transactions, and other illegal or prohibited activities.
• Legal Compliance: complying with applicable laws, court orders, and regulatory requirements, including sanctions screening obligations.

4. Data Sharing and Confidentiality

UJV does not sell, trade, or rent personal data to third parties. We share personal data only in the following circumstances:

• Travel Providers: we share booking-related personal data (including End Customer names, contact details, and travel preferences) with hotels, DMCs, ground operators, and other Travel Providers solely to fulfill confirmed bookings. These providers are subject to their own privacy and data protection obligations.
• Payment Processors: payment data is shared with our PCI DSS-compliant third-party payment processor to authorize and process transactions. Raw card details are never stored by UJV.
• Technology and Service Providers: we engage third-party vendors to support our platform operations, including cloud hosting (AWS, GCP), CRM (HubSpot), email delivery (AWS SES), analytics (Tableau), and customer communications (Front). These vendors process data only on our behalf and are bound by appropriate data processing agreements.
• API Partners: where a booking originates through an approved API Partner, that partner receives booking confirmation data and may receive End Customer data to the extent necessary to fulfill the booking. The governance of data sharing with API Partners is described in Section 6 below.
• Legal and Regulatory Authorities: We may disclose personal data to law enforcement, regulatory bodies, or other public authorities where required by applicable law, court order, or to protect the rights, property, or safety of UJV, its users, or third parties.
• Business Transfers: in the event of a merger, acquisition, or sale of all or substantially all of UJV's assets, personal data held by UJV may be transferred to the acquiring entity. We will notify affected users of any such transfer and the applicable privacy terms.

In all cases where personal data is shared with third parties, UJV takes reasonable steps to ensure that data is protected and used only for the purposes for which it was shared.

5. Data Security and Compliance

• Security Measures: UJV implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures include encryption in transit and at rest, access controls, role-based permissions, and regular security reviews.
• Payment Data: UJV maintains full compliance with the Payment Card Industry Data Security Standard (PCI DSS). Payment data is processed through an industry-standard encrypted payment gateway. Card numbers and CVV codes are never stored on UJV's systems.
• Data Controller Status: UJV acts as an independent data controller in respect of personal data collected through its website, platform, and Services, and complies with all applicable data protection laws, including the GDPR, where applicable.
• Incident Notification: If you believe there has been a loss, unauthorized access to, or misuse of personal data held by UJV, you must notify us promptly and in no event later than 24 hours of becoming aware of the incident at info@ultimatejetvacations.com. UJV will notify affected individuals and relevant supervisory authorities as required by applicable law.
• International Transfers: UJV operates in the United States. Where personal data is transferred from the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, UJV implements appropriate safeguards, including Standard Contractual Clauses or other lawful transfer mechanisms.

6. API Partner and B2B Data Processing

UJV makes its inventory and booking services available to approved business partners ("Partners") through an application programming interface ("API"). This section describes how personal data is handled in that context.

• Independent Controllers: When Partners access the API to facilitate bookings for their end customers, both UJV and the Partner act as independent data controllers. Each party is separately responsible for its own processing of personal data in connection with those bookings, including compliance with applicable privacy laws.
• Service Data: UJV collects and retains usage and operational data generated through API activity, including query logs, booking metadata, and platform performance data ("Service Data"). UJV is the controller of this Service Data. UJV may combine Service Data with anonymized information for service improvement purposes, provided that such combined data does not personally identify any individual.
• End Customer Personal Data: Personal data relating to End Customers transmitted through the API — including names, contact details, and booking information — is processed by UJV solely to fulfill the relevant booking and comply with applicable law. UJV does not sell or share End Customer personal data received through the API with third parties except as necessary to deliver the Travel-Products booked. Partners are responsible for ensuring that End Customers have received appropriate notice of how their data will be processed and for obtaining any consents required under applicable law before transmitting that data to UJV.
• Partner Security Obligations: Partners are required to maintain appropriate technical and organizational measures to protect personal data transmitted to and from the UJV API. In the event of a data incident involving personal data processed in connection with the API, Partners must notify UJV within 24 hours of the incident becoming known.
• International Transfers: Where personal data is transferred across borders in connection with API bookings, UJV and its Partners implement appropriate transfer mechanisms, including Standard Contractual Clauses where required by applicable law.
• Governing Terms: The full data protection obligations applicable to API Partners are set out in the Data Protection and Processing Addendum (Schedule A) incorporated into UJV's API Terms of Service. A copy is available upon request at info@ultimatejetvacations.com.

7. Your Privacy Rights

Depending on your location, you may have the following rights in relation to personal data UJV holds about you:

• Access: the right to request a copy of the personal data we hold about you.
• Rectification: the right to request that inaccurate or incomplete personal data be corrected.
• Erasure: the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn consent and no other legal basis applies.
• Restriction: the right to request that we restrict processing of your personal data in certain circumstances, including while a dispute about accuracy is being resolved.
• Portability: the right to receive your personal data in a structured, machine-readable format and to transfer it to another controller, where processing is based on consent or contract and is carried out by automated means.
• Objection: the right to object to processing carried out on the basis of legitimate interests, including for direct marketing purposes. Where you object to direct marketing, we will stop processing your data for that purpose immediately.
• Withdrawal of Consent: where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at info@ultimatejetvacations.com. We will respond to all valid requests within 30 days. In some cases, we may need to verify your identity before processing your request.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect and how it is used, the right to delete personal information, the right to opt out of the sale or sharing of personal information (UJV does not sell personal information), and the right to non-discrimination for exercising your privacy rights. To submit a California privacy request, contact us at info@ultimatejetvacations.com.

8. Data Retention

UJV retains personal data for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The following general retention periods apply:

• Account Data: retained for the duration of your active account with UJV, and for up to 7 years following account closure for legal and tax compliance purposes.
• Booking and Transaction Data: retained for a minimum of 7 years following the completion of the relevant booking, in accordance with applicable financial recordkeeping requirements.
• Communications Data: retained for up to 3 years from the date of the last communication, unless a longer retention period is required for legal or regulatory purposes.
• Platform and Usage Data: retained for up to 2 years for operational and analytics purposes, after which it is anonymized or deleted.
• Marketing Data: retained until you opt out or withdraw consent, after which it is removed from active marketing lists within 30 days.

When personal data is no longer required, we delete or anonymize it in a secure manner.

9. Cookies and Tracking Technologies

• Function: UJV uses cookies and similar tracking technologies to support platform functionality, analyze website traffic, and understand how users interact with our Services. Cookies allow the platform to recognize returning users and remember preferences.
• Cookie Control: You can choose to accept or decline cookies by modifying your browser settings. However, disabling certain cookies may prevent you from accessing the full functionality of our platform, including booking features.
• Third-Party and Social Buttons: Our website includes links and social sharing buttons for platforms including LinkedIn, Facebook, and Instagram. These third-party services may collect information about your activity even if you do not click on the button, particularly if you are logged into their services. UJV is not responsible for the privacy practices of these external sites. We encourage you to review their respective privacy policies.
• Embedded Content: We may embed video and multimedia content from third-party platforms including YouTube and Vimeo. These services may collect usage data in accordance with their own privacy policies.
• Email Tracking: Emails sent by UJV may include tracking pixels or links that allow us to measure open rates and click activity. If you wish to prevent email tracking, you can disable image loading in your email client or unsubscribe from UJV communications.
• Analytics: We use analytics tools including Google Analytics to collect aggregated, anonymized data about how visitors use our website. This data is used to improve our platform and does not personally identify individual users.

10. Policy Updates

UJV may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. Where changes are material, we will provide notice by email or through a prominent notice on our platform at least 30 days before the updated policy takes effect. The effective date at the top of this policy will be updated with each revision. Continued use of UJV's Services after the effective date of any revision constitutes your acceptance of the updated policy. If you do not agree to the revised policy, you should cease using our Services and contact us to close your account.

11. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or want to report a data incident, please contact us:

Ultimate Jet Vacations
2420 NE Miami Gardens Dr. Ste 301, Aventura, FL 33180, USA
Email: info@ultimatejetvacations.com
Support: support@ultimatejetvacations.com
Phone: +1 305-830-0200

If you are located in the European Economic Area and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.