Privacy policy

This policy covers the public website, the professional software and web and mobile traveller access. WayWiz provides software; it does not organise trips. WayWiz is responsible for processing related to its accounts, subscriptions, invoices, support requests, security and communications. The travel planner controls the processing of traveller data, which WayWiz processes on their behalf under the data processing annex to the Terms of Sale.

The site waywiz.fr has as data controller WayWiz.

Company: WayWiz (SAS — French simplified joint-stock company).

Registration: 994 676 823 (Rennes).

Registered office: 9 rue Copernic, 35220 Châteaubourg, France.

For any request, you can contact us by email at contact@waywiz.fr and by post at 9 rue Copernic, 35220 Châteaubourg, France.

Personal data is processed for creating and managing accounts and permissions, providing the software, traveller access, messages and documents, managing subscriptions, invoices and payments, responding to support requests, including through Intercom, securing the Service, preventing abuse and investigating incidents and sending service communications, permitted marketing and measuring audience according to privacy choices.

Data entrusted by the travel planner remains subject to their documented instructions. It is not sold or reused by WayWiz to target their travellers with advertising.

Contract or pre-contractual steps: Managing the professional customer’s account, subscription, software access, payments and assistance relating to that contract.

Legal obligations: Issuing and retaining accounting records, tax obligations and responding to legally binding requests from authorities.

Legitimate interests: Securing the Service, preventing abuse, managing professional contacts and answering people who are not themselves parties to the contract, taking their rights and reasonable expectations into account.

Consent: Optional trackers, marketing where consent is required and features requiring consent. Withdrawal does not affect the lawfulness of earlier processing.

Processing on behalf of the travel planner: The professional determines and explains the lawful bases for traveller processing. WayWiz acts as their processor under instructions, rather than relying on presumed general consent from travellers.

Required data includes fields marked as required in the relevant form and information needed to identify the account, provide requested access or issue invoices.

Other information and attachments are optional unless a need is explained in the relevant flow. Mobile permissions are requested for features that require them.

Refusing essential data may prevent account creation, a response or the relevant feature. Refusing optional trackers does not prevent website access; support remains available by email.

Data comes from your inputs and interactions, your device, the travel planner providing access to a record, and providers needed to deliver the Service. Professionals must inform people whose data they import. Sensitive data should only be submitted when necessary and where the legal conditions for its processing are met.

The processing described here is not intended to make solely automated decisions with legal or similarly significant effects on a person. A feature with that purpose would receive specific information.

Accounts and contacts: identity, email, professional contact details and roles and permissions.

Subscriptions and billing: plan, billing dates, invoices and payment references and status; full card details are processed by the payment provider.

Records entrusted by travel planners: travellers and contacts, travel information, quotes and invoices and messages and documents.

Support: messages, contact details provided and attachments sent to support, including through Intercom.

Technical and mobile data: connection and security logs, diagnostic data, notification identifiers, submitted media and microphone or location within the activated feature.

Audience and visit attribution: pages and interactions, pseudonymous identifiers and campaign and referral information when tracking is accepted.

Data subjects: website visitors, professional customers and their staff, travellers and contacts added by the travel planner and people contacting support.

Accounts and records in active systems: While the Service is provided; after termination takes effect, 30 days to arrange return or deletion under the Terms of Sale. Earlier deletion may be requested.

Contract evidence needed by WayWiz: Only necessary evidence is archived for 5 years after the relationship ends, or until proceedings conclude if longer retention is necessary.

Invoices and accounting records WayWiz must retain: 10 years from the end of the relevant financial year, with access limited to that obligation.

Marketing: 3 years after collection or the last contact initiated by a prospect; for customers, 3 years after the relationship ends or their last contact, unless an applicable objection or withdrawal occurs earlier.

Support requests and technical logs: As long as needed to resolve and follow up the request or detect and handle an incident; only evidence needed for an obligation or legal claim is then archived for the applicable period.

Audience and campaign measurement data: As long as needed to analyse visits and compare the relevant campaigns; individual events are then deleted or irreversibly anonymised when that monitoring is no longer necessary. Truly anonymous statistics may be retained longer.

Retention is assessed by purpose: accounting retention does not justify keeping entire travel records. Backups are isolated from ordinary use and deleted at the end of their renewal cycle; restoration reapplies deletion requests. A return request received before deletion is processed before the relevant data is erased.

You can request erasure when the legal conditions are met. Information that must remain for an obligation or legal claim is restricted to that purpose.

A response is provided within one month of receiving the request. This may be extended by two months if the complexity or number of requests justifies it; you are informed within the first month, including the reasons.

Email contact@waywiz.fr with your request and the relevant account or record. Additional identity evidence is requested only where there is reasonable doubt. For records controlled by a travel planner, WayWiz forwards the request and assists their response.

You have the following rights: access, rectification, erasure, restriction, objection, portability where applicable and withdrawal of consent for the relevant processing.

Rights are exercised subject to GDPR conditions through contact@waywiz.fr or the travel planner controlling the record. You can object to marketing at any time. Only invoices and quotes can be exported directly from the software; this functional limit does not restrict data rights or legal obligations to return data. Related requests are handled separately by support.

For any complaint, you can contact CNIL (French data protection authority).

Website: https://www.cnil.fr.

Postal address: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.

WayWiz implements measures suited to the risks: protected communications, authentication and permissions, restricted record access, maintenance and vulnerability fixes, backups and incident handling. Access is limited to people and providers who need it for their role. Users help protect security by safeguarding credentials and avoiding unnecessary sensitive data or attachments.

Data is available to authorised WayWiz staff, the professional and authorised users of a record, and providers needed for the feature used. Each recipient receives information relevant to their task. Authorities may receive data required by a legally binding request.

Primary hosting in France does not mean that every provider processes all data in France. Access or processing may occur outside the European Economic Area. It must be covered by an applicable adequacy decision or appropriate safeguards, including standard contractual clauses and supplementary measures where necessary. Contact contact@waywiz.fr for the destinations relevant to your processing and the applicable safeguards. External community services, including Discord, provide their own privacy information when you choose to join them.

Relevant providers include: Scaleway: primary Service hosting and storage in France, Stripe: payments and related data, under its role and obligations, Brevo: delivery of relevant emails, Intercom: support, messages, submitted contact details and attachments, PostHog: audience measurement tool, currently disabled on the public website, Expo and mobile operating system notification services: delivery of enabled notifications and providers for external features enabled by the professional, such as video calls and calendar synchronisation, according to the information in that flow.

This policy may be updated to reflect processing, features and applicable rules. Its latest update date appears at the top of the page.

Material changes affecting existing processing are communicated appropriately by email or notification. New consent is requested where needed; publication of a new policy does not constitute consent.