Host Liability Insurance Privacy Notice

Date: December 1, 2025

Please note that this Notice supplements our Privacy Policy and applies to additional personal information processing which is carried out by us in order to provide Host Liability Insurance to Airbnb hosts through the Airbnb Platform.

1. Application

1.1 General Applicability

This Notice (“Notice”) provides additional information about the processing of personal information in connection with the Host Liability Insurance (“HLI”), which covers Airbnb hosts offering a Listing in the European Union. The purpose of this Notice is to inform you how Airbnb Spain Insurance Agency, SLU (“ASIA”) handles your personal information in its capacity as the insurance agency to Zurich Insurance Europe AG Sucursal en España (“Zurich Spain”).

1.2 The HLI Program

The HLI program insures Airbnb hosts for their legal liability for bodily injury or property damage to guests or others resulting from an event that happens during the hosting of a Listing, subject to the terms, conditions, and exclusions of the Host liability insurance policy. There is no cost to hosts to be insured under the HLI program. For more information about the HLI program, including coverage terms, conditions, and exclusions, please refer to the Host Liability Insurance Program Summary.

2. Who controls my personal information

2.1 Airbnb Entities

Where this Notice mentions “Airbnb,” “we,” “us,” or “our,” it refers to ASIA, which is the Airbnb entity that distributes Host Liability Insurance if you reside in the EU, acting as data processor for Zurich Spain. Airbnb Ireland UC (“AIUC”) is the controller for personal information related to your Airbnb host account and general platform use (see Airbnb’s Privacy Policy).

2.2 Zurich Spain

ASIA is the insurance agency that distributes to Airbnb hosts, who are residents or established in the European Union, the HLI on behalf of Zurich Spain. The Host Liability Insurance product is underwritten by Zurich Spain, who acts as data controller of your personal information.

2.3 Contact Us

To contact the Data Protection Officer (DPO) for Airbnb click here. To contact Zurich Spain, see its privacy notice included in the HLI Terms and Conditions or click here.

3. Personal information we collect

In connection with our role as insurance agency for the HLI program, we may process the following categories of personal information about hosts on behalf of Zurich Spain:

3.1 Personal Information Needed for Insurance Services

• Identification Data: First name, last name, date of birth, nationality, identification documents (ID, passport)
• Contact Information: Email address, telephone number, postal address

• Booking Information: host registration details, property listing information, hosting activity

3.2 Personal Information We Collect for Zurich Spain

• Claims-Related Data: Information relating to incidents, claims, or complaints under the HLI policy, including details of bodily injury or property damage
• Communication Data: Records of inquiries, complaints, requests for proof of insurance, and other communications with ASIA or Zurich Spain

Personal information is not collected when Airbnb purchases the HLI policy. Personal information is collected once hosts register on the Airbnb platform, accept the Terms of Service, and the HLI Program Summary becomes part of the Additional Legal Terms.

4. How we use personal information we collect

We only use the personal information we collect for the following purposes, on behalf of Zurich Spain:

• Provide insurance services in connection with the HLI program;
• Respond to host inquiries, coverage questions, complaints, and requests for proof of insurance;
• Participate with designated insurance claims adjusters in the management processes of insurance claims;
• Manage complaints from insured hosts or beneficiaries;
• Maintain and update HLI marketing materials, landing pages, and websites presenting HLI terms;
• Comply with legal and regulatory obligations under Spanish insurance distribution regulations and data protection laws;
• Establish and maintain workflows and processes for host support and regulatory compliance.

5. Sharing and disclosure

We act with Zurich Spain to provide you with the HLI, acting as Zurich Spain’s insurance agency. Zurich Spain is the insurance company underwriting the HLI for Airbnb hosts and is licensed to underwrite insurance products in the EU. In this capacity, Zurich Spain is the data controller of the personal information we collect as necessary to provide Airbnb hosts with insurance coverage under the HLI program, as described in Section 2 of this Notice. This includes information about the HLI program, your name, contact details, date of birth, and any other information described in Section 3 of this Notice. This information is required to meet Zurich Spain’s obligations in connection with the HLI, including any legal and regulatory obligations, in order to provide our insurance distribution services. We may also share your personal information with other third parties as set out in Zurich Spain’s Privacy Policy.

6. Legal basis for processing personal information

Your personal information is processed for the following purposes and on the following legal basis. Where legitimate interest is used as a legal basis to process your information, legitimate interests include ensuring effective insurance distribution services, providing quality customer support to hosts, and maintaining regulatory compliance.

7. Your rights

7.1 Your Rights. You benefit from rights pursuant to applicable law. These rights are: (i) right to access your personal information, (ii) right to rectify your personal information, (iii) right to erasure, (iv) right to restrict the processing of your personal information, (v) right to data portability, (vi) right to object to the processing of your personal information, (vii) right to withdraw consent, and (viii) right not to be subject to a decision based solely on automated processing. While some of these rights apply generally, certain rights apply only in limited cases. We may ask you to verify your identity and request before taking further action on your request. As ASIA acts as a data processor on behalf of Zurich Spain, certain requests may need to be forwarded to Zurich Spain as the data controller. We will inform you if this is the case and assist in facilitating your request.

7.2 Complaints. You have the right to lodge complaints about our data processing activities by filing a complaint with our Data Protection Officer, who can be reached by the “Contact Us” section above, or with relevant supervisory authorities, such as: (i) your local supervisory authority; (ii) Zurich Spain’s supervisory authority, which is the Spanish Data Protection Agency. A list of EEA data protection authorities is available here.

8. Retention

We retain your information, on behalf of Zurich Spain, as long as necessary to fulfill the purposes for which it was collected and to comply with legal and regulatory obligations. We usually retain information related to the HLI program for a period of up to four years to fulfill our contractual obligations to you. Where a legal obligation arises or retention is advisable in light of our legal position, we will retain certain personal information for a longer period, even after your account has been deleted, for example:

• To cooperate with law enforcement or public, regulatory, and government authorities: If we receive a preservation order or search warrant related to your account, we will preserve personal information subject to such order or warrant on behalf of Zurich Spain. In some jurisdictions, we may be legally obliged to retain personal information generally for specific periods of time.
• To comply with insurance regulations and legal provisions on tax and accounting: We may retain your personal information on behalf of Zurich Spain as required by insurance and tax law and to comply with bookkeeping requirements.
• To pursue or defend a legal action: We may retain, on behalf of Zurich Spain, relevant personal information in the event of a legal claim or complaint, including regulatory investigations or legal proceedings about a claim related to your personal information, or if we reasonably believe there is a prospect of litigation (whether in respect of our relationship with you or otherwise) for a period of time after the dispute has been settled or decided by a court or tribunal from which there is no further right of appeal.

Following the applicable retention period, personal information will be blocked in accordance with Article 32 of the Spanish Data Protection Act, ensuring that data is only accessible for the purpose of addressing potential liabilities arising from the processing and only while such liabilities may arise. Once the retention period has expired and no liabilities remain, personal information will be securely deleted.

9. Operating globally and international transfers

Your personal information may be transferred to recipients located outside the European Economic Area (“EEA”). We have established the necessary means to ensure an adequate level of data protection for any personal information transferred outside the EEA. For any personal information transferred from the EEA to the United Kingdom, a European Commission adequacy decision applies. We have also put in place standard contractual clauses within Airbnb and with the relevant third parties to protect personal information and comply with data protection law. We can provide further information on the means to ensure an adequate level of data protection, such as a copy of the EU Model Clauses, on request. If you would like to receive such information, please reach out to us at dpo@airbnb.com.

10. Updates to this privacy notice

We may update this Privacy Notice from time to time to reflect changes in our processing activities or legal requirements. The current version will always be available on our website and through the Airbnb platform. The effective date at the top of this notice indicates when it was last updated.