  Commercial organisations are holding and processing an ever-increasing amount
of personal data. Policies and laws are continually changing to require these
companies to be more transparent regarding the collection, storage, processing
and sharing of this data. This paper reports our work of taking Booking.com as
a case study to visualise personal data flows extracted from their privacy
policy. By showcasing how the company shares its consumers' personal data, we
raise questions and extend discussions on the challenges and limitations of
using privacy policies to inform online users about the true scale and the
landscape of personal data flows. This case study can inform us about future
research on more data flow-oriented privacy policy analysis and on the
construction of a more comprehensive ontology on personal data flows in
complicated business ecosystems.
