Privacy Policy
May 26, 2022
WayAway is primarily
a metasearch engine for flight tickets, hotels, and other
services for travelers that is available through our websites and mobile apps.
For the purposes of this Privacy Policy, WayAway shall be considered as the
metasearch engine provided to the users via the WayAway mobile app in
the Apple, Google, and other
app stores from time to time (hereinafter “WayAway”).
User privacy is
important to us and we are doing whatever is required to protect it. In terms
of Data Processing, we ensure your rights as Data Subjects and observe the
regulations of California Consumer Privacy Act (“CCPA”), California Privacy Rights Act (“CPRA”),
Virginia Consumer Data
Protection Act (“VCDPA”), Colorado Privacy Act and other applicable legislation
of other states along with regulations of relevant state authorities as well as
other applicable laws and rules. In this Policy, we aim to openly explain how
we will possess your data and what processing standards we follow.
The present
Policy includes our policy on processing cookies or similar technologies that
are more suitable for use in online mobile apps. This Policy is also closely
related to the License Agreement, where you can find information about WayAway
mobile app functionality as well as your rights and liabilities when using the
app.
Pay close attention to this Policy. If you have any questions after reading this Policy
or if you find any errors or inaccuracies, please contact our legal team . Please
describe your problem or question in detail so that we can quickly respond to
it, help you, or correct the error and improve our services in the process.
We reserve the right to change this Policy if we make changes to our processing procedure or
need to take newly-enacted Personal Data protection legislation into account.
We’ll notify you in case of significant changes that may affect your interests,
rights, and status. In spite of everything, we guarantee that the protection of
your Personal Data is always legitimate and fair, and that your data is secure.
For starters, let’s clarify some key terms that we will use in this Policy to eliminate the
possibility of misinterpretation.
Personal Data or Personal Information
refers to any information relating to an identifiable person or household who can be directly
or indirectly identified or reasonably linked by reference to an identifier.
This definition provides for a wide range of personal identifiers to constitute
Personal Data, including an email address, identification number, device
information, location data, or online identifiers, such as cookie files or
similar technologies.
Sensitive information
means special categories of personal information, as defined by subdivision (ae) of 1798.140 of California
Privacy Rights Act (CPRA), that for instance include such identifiers as passport,
social security, driver’s license, credit card or debit card numbers and other
details of a consumer’s personal and financial documents as well as their
precise geolocation and biometric data.
Data Processing
refers to any operation or set of operations performed on Personal Data or on sets of Personal Data, whether
by automated or non-automated means, such as collection, recording, organization,
structuring, storage, adaptation, alteration, retrieval, consultation, use,
disclosure by transmission, dissemination (or otherwise making available),
alignment, combination, restriction, erasure, or destruction.
“You”, “your”, or “Data Subject”,
“Consumer” refers to a user of the WayAway mobile app, a subscriber to any service we
offer through the app, or prospective/existing clients communicating with us
via email or other means.
Data Controller
refers to a person who (either alone or jointly with other persons) determines the purposes for which, and
the manner in which, any Personal Data is, or is to be, processed. For the purposes of this Policy, the Data
Controller is Go Travel Un Limited, a Hong Kong corporation registered under the number 1658681 with a legal
address at 4007 Central Plaza, 18 Harbour Road, Wanchai Hong Kong, doing
business as WayAway.
Data Processor
, in relation to Personal Data, refers to any person (other than an employee of the Data Controller) that is
considered as a service provider to the Data Controller who processes data on behalf of the Data Controller. We
describe how we engage with Data Processors and other third parties that may
process Personal Data on our behalf in “Data Processing Conditions and Principles” section of this Policy.
Profiling
refers to any form of automated processing of Personal Data consisting of the use of Personal Data to
evaluate certain personal aspects relating to Data Subjects. Profiling is done to
analyze or predict aspects concerning that specific Data Subject’s preferences
and interests while using a particular one of our services (within this Policy
– users of the WayAway mobile app).
Account
refers to a section of the WayAway mobile app (visually represented as the “Profile” section in the app)
that is available to you after authorization (signing up) and gives you access to certain services
and features, which improve your user experience, that may not be accessed
without authorization.
We can use other terms and definitions as well, even if they are not explicitly specified in
this section, as long as they are set out in the applicable legislation or in our
When you use our mobile app and its features or when you contact us, we may collect and process
any data and information that you provide to us voluntarily, that is collected
automatically, or that we receive from other sources.
Voluntarily Provided Data
This includes any information you
provide to us yourself, such as information provided when you fill out a search form, subscribe to our
marketing and commercial communications, enter your account information, enter
into contractual relationships with us related to the usage of some of our
products (e.g., WayAway Plus subscription), send us a query or feedback,
participate in discussion boards or other social media functions via the
WayAway app and marketing special project subdomains, complete promotions or
surveys, or report a problem with our mobile app. We may also process data you
provide to our partners, including airlines and OTAs, while making a booking
after redirection.
Voluntarily provided data may include the following:
Personal Information:
⎯
Search data of available products on WayAway, including travel dates and destinations;
⎯
Respective authentication data, including, for example, social network parameters and email addresses;
⎯
Contact data entered by you in the input fields on the airline, hotel, or OTA web-resource after
redirection;
⎯
Other Personal Information contained in your queries and communications with us.
Sensitive Information:
⎯
Your personal details and respective data of people who will accompany you on a trip (this may include
PNR, your passport or debit/credit card number, etc.) that you directly provide
us with in order to receive a support with a relevant issue from our support
team;
⎯
Particulars of your payment method needed for conducting payments upon a direct agreement concluded between
you and the Data Controller (e.g.,
WayAway Plus subscription agreement);
Automatically Processed Information (incl. data received from third parties)
This information mostly consists of online identifiers or technical facts about your connection
point or in-app events processed or created, for example, via libraries and
software development kits incorporated in the mobile app for maintaining
certain features or functionality. This information includes device and
connectivity information, such as IP address (
Internet Protocol)
, unique device identifiers (such as the IMEI for phones, MAC address of the device's wireless network interface), mobile network
information, mobile operating system, time zone and language settings, local
storage, or cookie-like files and parameters.
This data is automatically collected when you use our mobile app. In some cases, this data can be created
by our software or third-party programs (mentioned in libraries and SDKs),
integrated into the WayAway app.
The list of data categories that may be automatically collected by us includes the following information:
⎯
IP-address and log
information (such as error reports);
⎯
Geolocation (meaning country
or region in terms of redirection to the appropriate market interface);
⎯
Mobile device information,
including device type/model, locale, and OS information;
⎯
Impersonalized booking data
after redirection (meaning destination, dates, and prices);
⎯
Cookies and similar tracking technologies, including local storage data, statistics, and analytics on
the use of the service and its different features, as well as interaction information and in-app events
(scrolling, clicks, timings, etc.).
The category of
data received from third parties
includes different types of data, mostly online identifiers, which we obtain from airlines, OTAs, GDS,
as well as our technical, analytical, marketing, and other partners or integrated software.
For example, we might insert advertising on our partners’ web-resources, social networks, or
advertising networks that may categorize WayAway mobile app users with similar
characteristics or interests into non-personally-identifiable data segments,
which may then be offered to their own clients, visitors, and subscribers.
We might obtain and record information that an ad was requested or shown, how many times said
ad was shown, the target geo of said ad (which will not include an IP address
or specific personally-identifiable location information), and any user interactions
with said ad or information about the page on which it appears. This
information is used for statistical purposes, analysis, reporting, and
troubleshooting. In most Data Processing situations, such information does not
allow us to identify you as a Data Subject and will be processed with an
appropriate level of protection and limitations, which the data source
establishes.
We also might collect your log-in information when you enter your Account via an applicable
authorization tool that is used on WayAway. Such information is provided by a
third party depending on what tool from the list below you use for
authorization:
⎯
Google Account
(
Go
here
to learn how to manage our access to your Google Account.
Learn more
about Google’s practices of securing sharing of user’s data)
;
⎯
Facebook Account
(Check Facebook’s privacy policy
here
);
⎯
Apple ID
(see
this page
to learn how to manage your Apple ID);
⎯
WeChat Account
(check WeChat’s privacy policy
here
);
⎯
Line Account
(check Line’s privacy policy
here
).
Types of Data That We Do Not Process
We do not process data on children, as WayAway is intended only for use by users over the age of
16 (or another age of maturity determined by applicable local laws allowing for
the independent use of Internet services like WayAway). If you are under the specified
age, you may only use WayAway with the involvement of your guardian or holder
of parental responsibility. We do not knowingly collect or process Personal
Information from children below the specified age without the consent of the
child's holder of parental responsibility. In case of doubt, we will cease the
processing of questionable data and delete it.
We do not collect and process special categories of Personal Data and genetic data without your
direct consent, such as your name, age, email, passport, and payment method
details (unless you subscribed to our marketing mailing, purchased WayAway Plus
subscription, entered an Account), phone number, home address, etc.
We do not process data that you have directly asked us to stop processing or opted out in any other way.
We also do not process any data acquired by third parties on other platforms that you click
out to from our mobile app. For instance, by clicking on the ad banner, except
for cases and particular data types directly mentioned in this Policy. Your
Data Processing on third-party platforms is carried out according to the rules
and processes set out by owners of those platforms.
Additional Information on Data Processing
Please note that, when you proceed with purchasing flight tickets or other travel services after
redirection from our mobile app to the provider carrying out the particular
service, we do not acquire, store, transmit, or process any additional
information except depersonalized information, such as prices, dates, destinations,
and a transaction identifier.
In providing Personal Data about other individuals (such as someone whose name you
are using to enter an Account or subscribe to our marketing promotions), you represent
that you have notified them of: (1) the grounds and purposes for which said
information will be used (see below), (2) the recipients of their Personal
Data, (3) and how they can access and correct this information.
The consent that you give for a third person is considered by us to be the consent of said third person.
Selling and Sharing of Personal Data.
We assure that we do not sell Personal Data to any third party. However, we may share your
personal information to our partners for business and commercial purposes as it
is described above and in “Data Processing Conditions and Principles” section of this Policy. Please, check the last
section of this Policy to get the information about your right to opt out of
sharing your personal information and the ways how you can exercise this and
other rights regarding the subject matter.
Email marketing and communications. We believe that our users would like to get more information concerning travel that is useful to improving their possible travel experience as well as information about the best deals on flight tickets, other travel products, and more (commercial information). In addition, users most probably would like this information to meet their own needs and interests. Upon authorization in the Account or when using a particular feature of the service, we offer you the chance to subscribe to our marketing newsletter to receive such news and third-party ads. You can unsubscribe from direct marketing communications by email at any time by using the opt-out form in one of the received emails or by contacting our support team.
Profiling.
It’s important for us to understand the WayAway audience, including their needs and preferences, in order to
make the service better and more convenient both generally and for each particular user.
To achieve these goals, we can create profiles of our users based on the data
collected in their interactions with WayAway in order to provide our service in
the best possible way or provide personalized ads and marketing communications
if we’ve received your consent. In any case, we never use collected data to
make automated decisions that significantly affect your interests or rights as
a Data Subject.
Just to make sure, we never show our users different prices on the analogous services they
may find using our metasearch engine and we never prohibit or block the use of
a particular feature of WayAway solely based on your online profile.
Grounds for Data Processing
In this section of the Policy, we describe the legal grounds and purposes for processing
Personal Data during your interactions with WayAway, related domains accessed
via the mobile app, or individual features of our product.
We process your data only if there are legal grounds to do so. When applicable, we receive your
consent for Data Processing, which you provide through an explicit action, such
as clicking a suitable consent-giving button or ticking a relevant box.
In other cases, data is processed (1) in your interest or to provide you with the relevant
service or functionality of the service according to the
License Agreement.
, for instance, to provide search results or fix your problem; (2) to email marketing
information about WayAway or our advertisers; or (3) to fulfill other
contractual obligations.
For example: By transferring the relevant information about your chosen flight tickets to our
partners, available in the search results, we fulfill our obligations to these
partners to properly record bookings and statistics on our side. In addition,
user data is processed in our legitimate interests, for example, to improve the
performance of WayAway or a particular feature of the metasearch service,
prevent fraud, data parsing, etc.
Purposes of Data Processing
Data Processing purposes are largely determined by WayAway’s functionality and derived from
valid grounds for Data Processing. Primarily, we strive towards improving our
service and making your experience with WayAway as efficient, secure,
convenient, and personalized as possible. We also want you to remain updated
about thrilling articles and sources with potentially useful information for
travelers, new features, new products, promo campaigns, special WayAway
projects, other interesting and beneficial deals in the travel market, and
more. In addition, we generate income by displaying third-party ads and process
data to track ad performance or select ads that may suit you better.
To present our Data Processing purposes in a more readable way, we have gathered all the
grounds, potentially applicable purposes, and the data being processed on these
grounds and for these purposes in the table below:
|
Data Category |
Grounds |
Purposes |
|
Contact information (most often, an email address, but
sometimes name and social network data) |
Consent, fulfillment of obligations, legitimate interest |
(1) Provision and personalization of features and
services as well as entering additional agreements, (2) necessary internal
analytics and research of the service, (3) providing advertising information,
(4)
monitoring, accessing, and using user-generated content
|
|
Data on searches |
Fulfillment of obligations, legitimate interest |
(1) Provision and personalization of features and
services, (2) necessary internal analytics and research of the service |
|
Data on the Account |
Consent, fulfillment of obligations, legitimate interest |
(1) Provision and personalization of features and
services as well as entering additional agreements, (2) providing advertising
information, (3) monitoring,
accessing, and using user-generated content |
|
Data on your payment method details |
Consent, performance
of a contract to which you are party |
(1) Conducting payments upon the direct agreement
between you and the Data Controller |
|
Data on the device |
Fulfillment of obligations, legitimate interest |
(1) Provision and personalization of features and
services, (2) necessary internal analytics and research of the service |
|
Similar to cookie files and other online identifiers,
including local storage data and in-app events |
Fulfillment of obligations, legitimate interest |
(1) Provision and personalization of features and
services, provision of advertising information, (2) necessary internal
analytics and research of the service |
|
Data on the use of WayAway features |
Fulfillment of obligations, legitimate interest |
(1) Provision and personalization of features and
services, provision of advertising information, (2) necessary internal
analytics and research of the service |
Confidentiality and Security
We believe that the confidentiality and security of our users’ data is key to maintaining
trusting long-term relationships with them. We are committed to protecting the
Personal Data you share with us. We use a combination of industry-standard
security technologies, procedures, and organizational measures to help protect
your Personal Data from unauthorized access, use, or disclosure.
At WayAway, we use the services of Data Processors, whose products and solutions are required
for hosting our web-resources and products, storage and collection of data,
implementing features of our mobile app, analyzing and testing the app,
Profiling, email marketing, and supporting interactions with you. Providers of
such services are carefully selected based on WayAway’s specifics and ensure the
safety of data at the appropriate level, according to the present Policy. In
most cases, such providers help us collect online identifiers, analytical files
and similar technologies.
You can always set up your preferences for collection of cookie files and other online
identifiers, including local storage data and in-app events using special
settings for the operation system of your device as well as settings for
managing your
Data Retention
We retain your Personal Information for as long as needed on the grounds of processing
purposes. Terms may also differ for particular categories of Personal
Information.
We also reserve the right to store various types of information (without any time limit) to use
for analyzing our service performance, improving its features, providing
services to you, and protecting the interests of WayAway.
Meanwhile, we give you the opportunity to control and influence the time we store and process
your data, as specified in the “Your Rights” section of the Policy.
Transferring Personal Data to Third Parties
We share Personal Information about you with third parties or non-affiliated companies
until you notify us about your decision to opt out of sharing your Personal Information, except of the
processing that takes place in order to provide services you've requested, or under the
following circumstances:
⎯
We may disclose your information to third parties when we reasonably believe we are obligated to do so by
law and/or in order to investigate, prevent, or take action regarding suspected or
actual prohibited activities, including, but not limited to, fraud and
situations involving potential threats to the physical safety of any person.
⎯
In the event we are acquired by or merge with a third party or undergo another change of control, we reserve
the right to transfer information, including any personally identifiable
information, to a successor entity.
We may disclose or otherwise allow others to access your Personal Information pursuant to a legal request, such
as a subpoena, legal
proceedings, search warrant, or court order, or in compliance with applicable
laws, if we have a good faith belief that the law requires us to do so, with or
without notice to you. Your details may also be disclosed to the police and law
enforcement agencies for the purpose of fraud detection, crime prevention, and
national security.
Уou have the following rights concerning the collection and processing of Personal Data:
The right to be informed.
In this Policy, we provide you with detailed information related to the processing of your Personal Data.
The right to know
what personal information is being collected and right to access personal information.
You can request us to disclose an exact description of categories and sources of personal data
we collect and what are the purposes of collection and sharing your
information, who are the third parties we share your data with and the list of
specific pieces of personal information we have collected about you.
The right to correct or rectify your Personal Data
if it is inaccurate, incomplete, or outdated. You are entitled to make corrections on
the Personal Data you have provided us with within the registration procedure
via using special interface features of your Account at any time.
The right to erasure (deletion or removal) of your Personal Data.
The right to restrict (block) processing.
When processing is restricted, we will continue to store your Personal Data, but not
process it any further.
Rights related to automated decision-making, including Profiling. We
do not make any decisions that might produce a legal effect on you based on
automated processing without legal grounds.
However, you may opt out of automatic processing your data unless this data is not processed by
us for business purposes. This right may be exercised via managing your data
preferences through a special Data preferences menu
.
Right to opt out of selling or sharing your data.
You can opt out of sharing your personal information to third parties for non-business purposes by managing
your data preferences through said
Data preferences menu (Do Not Share My Personal Information)
The right to limit the use of your Sensitive Information.
Please be informed that we use your Sensitive information only to provide you with the
services under a contract that you have entered into. We do not sell or share
your Sensitive Information for commercial purposes.
The right to withdraw your consent (object) to direct marketing.
The right to lodge a complaint with a supervisory authority.
You have the right to lodge a complaint with your local supervisory authority if
you have a concern about our processing practices.
The right of no retaliation following opt out or exercise of other rights.
You have the right to exercise all of the abovementioned rights for free and without any following
retaliation or discrimination against you. We respect your privacy rights and do not put any
charges or deny any services to you in case you prefer to keep your personal
information private and decide to exercise any of the said rights. However,
some of WayAway functionality/products are technically based on processing of
your data and we may not be able to perform the respective services without
certain data about you.
You can exercise all of your above rights (if implied) by
contacting us
or using the available opt-out or «manage your privacy» functionality within the
service.