VacationCandy Privacy Policy

Effective Date: February 2026

VacationCandy (“VacationCandy,” “Company,” “we,” “us,” or “our”) operates an online marketplace platform that facilitates connections between individuals or entities offering timeshare or resort-based vacation interests (“Owners”) and individuals seeking vacation accommodations (“Guests”). This Privacy Policy (“Policy”) governs the collection, use, processing, disclosure, storage, transfer, and protection of information in connection with vacationcandy.com and any related websites, dashboards, mobile interfaces, communications, or services (collectively, the “Platform”).

By accessing or using the Platform, you acknowledge that you have read and understood this Policy.

1. Scope of This Policy

This Policy applies to information collected:

• Through the Platform;
• Through account registration and listing or booking activity;
• Through communications with VacationCandy;
• Through automated technologies used in connection with the Platform;
• From third parties in connection with marketplace operations.

This Policy does not apply to third-party websites, resorts, payment processors, or service providers that maintain their own independent privacy policies.

2. Categories of Information Collected

VacationCandy may collect, receive, or generate the following categories of information:

A. Identifiers and Contact Information

Name, email address, mailing address, telephone number, account credentials, IP address, online identifiers, and similar identifiers.

B. Commercial and Transaction Information

Listing information, reservation data, booking details, transaction records, payment-related information, payout information, and other records related to marketplace activity.

C. Financial Information

Information necessary to facilitate payments, refunds, disbursements, chargeback management, fraud prevention, and related financial processing.

D. Internet or Network Activity Information

Browsing activity, search queries, session data, device information, browser characteristics, operating system, interaction data, referral URLs, and other diagnostic or analytics data.

E. Communications and User-Generated Content

Correspondence, inquiries, reviews, messages, uploaded documentation, and other materials submitted through the Platform.

F. Geolocation Data

Approximate location data derived from IP address or device-level information, and other location-related data as permitted by law.

G. Inferences

Inferences drawn from any of the above information to create user profiles relating to preferences, booking patterns, marketplace activity, or interests.

We may collect information directly from users, automatically through technology, and from third parties including service providers, advertising networks, analytics providers, payment processors, resorts or accommodation providers, affiliates, publicly available sources, and other lawful sources.

3. Purposes of Collection and Processing

VacationCandy may collect, use, retain, disclose, and otherwise process information for legitimate business and commercial purposes, including but not limited to:

• Operating, maintaining, administering, and improving the Platform;
• Facilitating listings, reservations, transactions, payments, refunds, and related marketplace functions;
• Identity verification, reservation verification, fraud detection, risk mitigation, and abuse prevention;
• Communicating with users regarding accounts, transactions, service updates, and promotional materials (subject to applicable opt-out rights);
• Performing analytics, research, auditing, monitoring, quality assurance, and internal business operations;
• Enforcing agreements, policies, and terms;
• Complying with legal, regulatory, tax, and accounting obligations;
• Protecting the rights, safety, and property of VacationCandy, its users, and others;
• Supporting advertising, marketing, and distribution activities consistent with applicable law;
• Any other lawful purpose disclosed at the time of collection or as otherwise permitted by applicable law.

We may aggregate, anonymize, or de-identify information and use such information for any lawful purpose.

4. Disclosure of Information

VacationCandy may disclose information in the following circumstances:

A. Service Providers

To vendors, contractors, advisors, and other third parties performing services on our behalf under appropriate contractual safeguards.

B. Marketplace Participants

To other users as reasonably necessary to facilitate marketplace transactions and related communications.

C. Legal and Safety Purposes

To comply with law, subpoena, court order, or regulatory request; to enforce agreements; to detect or prevent fraud; or to protect rights, safety, and property.

D. Corporate Transactions

In connection with a merger, acquisition, restructuring, financing, sale of assets, or similar corporate event.

E. Advertising and Analytics Activities

In connection with analytics, marketing, advertising, and distribution activities, subject to applicable consumer rights.

VacationCandy does not sell personal information for monetary consideration. Certain disclosures may constitute “sharing” or “sale” under applicable state privacy statutes.

5. Cookies and Tracking Technologies

We use cookies, pixels, web beacons, log files, SDKs, and similar technologies for operational, security, analytics, personalization, and advertising purposes. Users may manage cookie preferences through browser settings or other mechanisms made available where required by law.

6. Data Retention

We retain information for as long as reasonably necessary to fulfill the purposes described in this Policy, including to comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, and protect legal interests. Retention periods vary depending on the nature of the information and applicable legal requirements.

7. Data Security

VacationCandy implements administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, alteration, or disclosure. However, no method of transmission or storage is completely secure, and we do not guarantee absolute security.

8. Privacy Rights Under U.S. State Laws

Depending on your state of residence, you may have rights under applicable privacy laws, including but not limited to:

• Right to Know / Access the personal information collected about you;
• Right to Delete personal information, subject to legal exceptions;
• Right to Correct inaccurate information (where applicable);
• Right to Data Portability;
• Right to Opt Out of the sale or sharing of personal information and targeted advertising;
• Right to Non-Discrimination for exercising privacy rights.

We may require identity verification before processing a request.

California (CCPA/CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, including the right to:

• Request disclosure of categories and specific pieces of personal information collected;
• Request deletion of personal information;
• Request correction of inaccurate personal information;
• Opt out of the sale or sharing of personal information;
• Limit the use of certain sensitive personal information (if applicable);
• Not be discriminated against for exercising your rights.

We honor legally recognized opt-out signals where required.

Utah (UCPA)

Utah residents may have rights to access and delete certain personal data and to opt out of targeted advertising or sale of personal data, subject to statutory limitations.

Colorado (CPA), Connecticut (CTDPA), and Virginia (VCDPA)

Residents of these states may have rights including access, correction, deletion, portability, and the right to opt out of targeted advertising, sale of personal data, and certain profiling activities, subject to applicable exemptions.

Additional State Laws

VacationCandy will comply with additional U.S. state privacy laws as they become effective and applicable.

9. International Users (GDPR and Similar Laws)

If you are located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with similar laws, we process personal data under one or more lawful bases, including:

• Performance of a contract;
• Legitimate business interests;
• Compliance with legal obligations;
• Consent, where required.

You may have rights to access, correct, delete, restrict processing, object to processing, request portability, and withdraw consent where applicable. Cross-border transfers may occur subject to appropriate safeguards as required by law.

10. Children’s Privacy

The Platform is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13.

11. Third-Party Services

The Platform may contain links to third-party websites or services. VacationCandy is not responsible for the privacy practices of third parties.

12. Changes to This Policy

We reserve the right to update or modify this Policy at any time. Updates will be effective upon posting unless otherwise required by law. Continued use of the Platform constitutes acceptance of the revised Policy.

13. Contact Information

To submit a privacy request or inquire about this Policy, please contact VacationCandy using the contact information provided on vacationcandy.com.

14. Your Privacy Choices / Do Not Sell or Share My Personal Information

VacationCandy does not sell, rent, trade, or otherwise disclose personal information to third parties for monetary or other valuable consideration. We also do not share personal information with third parties for cross-context behavioral advertising or targeted advertising purposes.

We do not knowingly engage in activities that constitute a “sale” or “sharing” of personal information as those terms are defined under applicable U.S. state privacy laws, including the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Virginia Consumer Data Protection Act (VCDPA), and Utah Consumer Privacy Act (UCPA).

Marketplace and Service Provider Disclosures

In order to operate the Platform, VacationCandy may disclose personal information to:

• Service providers and contractors performing services on our behalf under written agreements;
• Other marketplace participants as reasonably necessary to facilitate reservations or transactions;
• Payment processors and financial institutions for transaction processing;
• Legal or regulatory authorities where required by law.

These disclosures are made for business purposes and not for the independent commercial use of the receiving party.

Right to Confirm and Request Information

If you are a resident of a state that provides the right to confirm whether your personal information is sold or shared, you may submit a request using the contact information provided on vacationcandy.com. We will respond in accordance with applicable law.

Non-Discrimination

VacationCandy will not discriminate against any user for exercising privacy rights provided under applicable law.