Privacy Notice

1. Controller and contact details

The controller is Wayora S.r.l., with its registered office at Via Altinate 125, 35121 Padua, Italy, tax code and VAT number 05799040281, registered with the Padua Companies Register, REA PD-493463, fully paid-up share capital of EUR 10,000.00, certified email wayora@pec.it.

For information and to exercise the rights described in this notice: privacy@wayora.ai. The Data Protection Officer (DPO) can be contacted at dpo@wayora.ai. For travel-related requests: support@wayora.ai.

2. Scope, data subjects and sources

This notice covers travel planning, booking, travel management, assistance and recruitment offered by Wayora on app.wayora.ai, as well as contacts and enquiries collected through wayora.ai. It concerns users, travellers, group participants, payers, people contacting us and job applicants. For technologies used on the public website, please also refer to the information and any choices available on that website.

We collect data directly from the individual, from the person organising or paying for the trip, from other participants within the scope of shared functions, and from operators involved in providing services, payments and assistance. Data obtained indirectly include identification and contact details, travel information, shares and booking or payment statuses; for applications they may include professional references. Anyone entering another person's data must be entitled to do so, check its accuracy and make this notice available. This does not replace Wayora's information duties under Article 14 GDPR where applicable.

3. Categories of data

Depending on the functions used, we process:

• Account and contact data: name, email, telephone number, language, account identifiers, sessions, contact verification and preferences.
• Planning and communications: destinations, dates, budget, trip composition, preferences, itineraries, messages and conversation history, invitations, assistance requests and attachments.
• Travellers and bookings: name, surname, title, date of birth or age, gender, nationality, residence and contact details; passport or other document details only when required by the service; accommodation arrangements, baggage, meeting or pickup points and other information essential to the chosen service. Requirements vary by carrier, destination and service.
• Payments and commercial relationships: amounts, currency, shares, transactions, refunds, invoicing, billing address, limited payment-method data, discounts, Wayora Miles balance and transactions. Full card details are collected by the payment service provider through its own tools; Wayora does not store the full card number.
• Technical and security data: IP address, browser and device information, network headers, application events and logs, request and transaction identifiers, essential referral information and abuse reports. Logs may contain message extracts or data included in the operation concerned.
• Notifications: email, telephone number, preferences and records of choices, device identifier or push subscription endpoint, technical keys and delivery status.
• Applications: identity, contact details, position sought, CV, professional profiles and links, introduction and any references.

Do not include unnecessary information in conversations, documents or free-text fields, particularly health data, religious beliefs or other special categories under Article 9 GDPR. For specific assistance needs, first ask support@wayora.ai for guidance. Processing such data requires an applicable Article 9 condition and specific information: performance of a contract and simply sending information voluntarily do not, by themselves, constitute explicit consent.

4. Purposes, legal bases and provision of data

Requested service. We process the data necessary to create and manage an account, plan and book a package, manage shares, payments, travel documents, Miles, changes, cancellations, refunds and assistance to perform a contract or take pre-contractual steps requested by the individual (Article 6(1)(b) GDPR). This includes relevant operational communications by email, SMS and, when enabled on the device, push notification. Device permission to receive notifications does not amount to marketing consent.

For travellers who are not parties to the contract, processing ordinary personal data necessary to organise the trip booked for them is based on the legitimate interests of Wayora and the contracting party in providing the requested service, subject to necessity and balancing against the individual's rights (Article 6(1)(f)). Relevant legal obligations also apply. This basis does not override Article 9 requirements.

Legal obligations. We process data necessary for accounting, invoicing, tax compliance, traveller protection and responses to authorities under Article 6(1)(c) GDPR.

Security and protection of rights. Fraud and abuse prevention, service reliability, complaint handling and establishing, exercising or defending rights rely on Wayora's legitimate interests in protecting users, assets, systems and contractual relationships (Article 6(1)(f)), following assessment of necessity, proportionality and balancing. You may object on grounds relating to your particular situation.

Contacts and applications. We answer pre-contractual enquiries and assess applications at the individual's request under Article 6(1)(b). Other enquiries are handled under the relevant obligation or the legitimate interest in responding to the communication received. Professional references involve the interest in verifying information relevant to the application, with appropriate information for the person contacted.

Commercial communications, where activated. Promotional communications require freely given, specific, informed and withdrawable consent (Article 6(1)(a) GDPR). The sole exception described here concerns an email address provided by the individual in the context of an actual purchase: within Article 130(4) of the Italian Privacy Code, Wayora may use it to offer its own similar services after providing appropriate information and provided there has been no objection. The basis is the proportionate legitimate interest in offering customers our own similar services (Article 6(1)(f)), exclusively under the conditions of that exception. Objecting is free and easy at collection and in every subsequent message. This exception does not extend to promotional SMS or push notifications, mere registrations, uncompleted purchases or other travellers' contact details. You may also withdraw consent or object by writing to privacy@wayora.ai, without affecting purchased services.

Providing data identified as necessary is contractual or required by law: failure to provide it may prevent the requested function or service. Optional data and choices are not a condition of purchase. Acknowledging this notice is not general consent to additional processing or undisclosed statistical purposes.

5. Assisted planning and group sharing

Assisted planning uses request text, relevant history and travel context to produce responses and suggestions. This content is sent to the language-processing service and may contain personal data: it is not necessarily anonymous. Proposals require the user's choices before proceeding with a purchase; planning does not constitute solely automated decision-making producing legal or similarly significant effects under Article 22 GDPR.

Within groups, participants and the person responsible for the trip receive information made available through shared functions, such as the itinerary, group conversations and share statuses, according to their respective roles. Avoid using shared conversations for confidential information. Travel communications may be delivered to the lead traveller or recipients associated with the trip, who may differ from the payer. Card details are not shared with other participants.

6. Categories of recipients

Persons authorised by Wayora access data for their respective duties. Relevant data may be disclosed to the following categories according to the requested service:

• Travel operators and intermediaries: air and ground carriers, accommodation establishments, activity and transfer operators, booking and ticketing systems and intermediaries. They receive searches, traveller and contact data, document requirements and necessary booking details. The billing address may be sent to a carrier requiring it; the IP address may be disclosed for booking-related antifraud checks.
• Payment service providers and banks: payment, billing, transaction and refund data, including for authentication, fraud prevention and their own obligations.
• Infrastructure, authentication, storage and hosting providers: application data, documents, accounts, traffic and logs necessary to operate and maintain the service.
• Asynchronous processing providers: events, identifiers, operation statuses and results; processing may include personal data contained in orders and booking requests, not only technical identifiers.
• Artificial intelligence providers: messages, history and context relevant to planning, responses and the requested processing. The content transmitted may include personal data and is not necessarily anonymous.
• Email and SMS providers: contact details, content and delivery data, together with attached travel documents where applicable. Push notifications involve browser or operating-system services, with endpoints and delivery metadata; notification content is transmitted in encrypted form under the protocol used.
• Support and operational alert tools: references and content necessary to handle incidents, bookings and assistance requests.
• Connectivity and routing providers: metadata for connections to booking systems; routing an encrypted connection does not in itself imply access to its content in plain text.
• Mapping, place search and illustrative content services: searches, destinations or itinerary coordinates and technical connection data when the browser contacts the service directly. Travel coordinates do not necessarily identify the user's physical location.
• Advisers, insurers, guarantors, authorities and competent bodies: data necessary for professional or legal obligations, claims, guarantees, disputes and lawful requests.

Providers processing data on Wayora’s behalf are subject to the rules for processors under Article 28 GDPR. Parties independently determining purposes and means act as controllers for their respective activities. The role depends on the processing and may differ between the activities of travel operators and payment service providers. You may request information about recipients and, where provided for by the GDPR, their identity at privacy@wayora.ai. Wayora does not sell personal data.

7. International transfers

Travel services, infrastructure, support and technology providers may entail processing or access outside the European Economic Area. A database's location in Europe does not exclude other transfers.

Transfers require an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses and, where necessary, supplementary measures. Article 49 GDPR derogations may be used only in the specific cases and on the conditions laid down by that provision; the necessity of a trip does not justify ongoing transfers to technology providers indiscriminately.

Transfer safeguards are governed by agreements signed with the parties involved. For information and to request copies of applicable safeguards, write to privacy@wayora.ai; third-party data and confidential information are protected within the limits permitted by law.

8. Retention

Data must be kept for as long as necessary for the relevant purpose, distinguishing mandatory documents and evidence from operational data:

• Accounting documents: ten years under Article 2220 of the Italian Civil Code, from the last entry or the different starting point applicable to the document, subject to further obligations or disputes requiring retention.
• Contracts, bookings, payments and assistance: to manage the relationship and open cases; afterwards, only relevant evidence for obligations and protection of rights, within applicable limitation periods. The ten-year accounting retention period does not automatically extend to every message, identity document or item of travel data.
• Accounts, itineraries and conversations: retention needs are assessed in relation to making requested functions available during the relationship, completing trips and open cases, and erasure requests. After the relationship ends, further retention is limited to data relevant to legal obligations or establishing, exercising and defending rights, within the respective applicable periods. These needs do not automatically justify keeping entire conversations or travellers’ documents.
• Logs, events, processing results and security reports: the relevant period is determined by the need to complete and verify the operation, diagnose and resolve errors and handle security incidents. Where an item constitutes evidence for a specific complaint, incident or dispute, retention concerns information relevant to that case and the periods applicable to protecting rights; it does not extend indiscriminately to all logs.
• Applications: twenty-four months from receipt, unless earlier deletion is requested where applicable or specific needs to protect rights arise.
• Marketing and objections: where communications are activated, contact details may be used while consent or the conditions of the specific exception described in Article 4 remain valid, and in any event no later than withdrawal or objection. Retention needs are also assessed against the customer relationship and the relevance of the services offered; absence of withdrawal does not alone justify unlimited retention. The minimum information necessary to respect objections and document choices is retained for that purpose and for protecting rights within the applicable periods.
• Cookies, local storage and notifications: under the periods and criteria in the Cookie Policy; logical expiry of browser data does not always coincide with its physical deletion.

Closing an account or removing an item from the interface does not, by itself, demonstrate deletion of all copies. The retention criteria above also apply to technical and backup copies and to data processed on Wayora’s behalf: inclusion in a copy is not an independent purpose justifying indefinite retention. On request, Wayora explains which data must be retained further and why.

9. Minors and applications

Accounts and purchases are reserved for adults. Minors may participate in a trip; necessary data is supplied by the adult entitled to organise it, taking parental responsibility or guardianship into account. Marketing consent is not requested from minors.

For applications, access is restricted to authorised recruitment staff and providers necessary for technical management. CVs are not published. Include only information relevant to the position; any references must be informed of the disclosure of their data. Special categories remain subject to the conditions in Article 3.

10. Security and device technologies

Wayora adopts technical and organisational measures proportionate to risks, including encrypted connections and access controls. Managing credentials, shared devices and received documents also requires care from the user. Session technologies, preferences and device functions are described in the Cookie Policy; the related choices do not constitute blanket consent to all processing in this notice.

11. Rights and complaints

Under the conditions laid down by the GDPR, you may obtain access to data and processing information, rectification, erasure, restriction and portability of data processed by automated means on the basis of consent or a contract. You may object to processing based on legitimate interests on grounds relating to your particular situation; for direct marketing you may object at any time. You may withdraw consent without affecting the lawfulness of prior processing.

Send requests to privacy@wayora.ai or contact the DPO at dpo@wayora.ai. Where reasonable doubts exist, Wayora may request only the information necessary to verify identity. We respond without undue delay and normally within one month; this may be extended by a further two months where permitted, informing you of the reasons within the first month. Statutory conditions and exceptions remain applicable.

You may lodge a complaint with the Italian Data Protection Authority or the competent authority, particularly where you habitually reside, work or where the alleged infringement occurred, and seek a judicial remedy.

12. Updates and languages

The date identifies the version of this notice. Updates are made available on this page; where changes require it, further information is provided and new choices are obtained in accordance with the law. If the language versions differ, the Italian text prevails, without limiting individuals' mandatory rights or duties of clarity and transparency in the language used.