Privacy Policy

PRIVACY POLICY - website - for US Resident Customers

Last Updated: May 15, 2026

This Privacy Policy applies to U.S. residents who access or use WeRoad’s website at www.weroad.com or WeRoad’s related services.

Introduction

WeRoad (“WeRoad,” “we,” “us,” or “our”) is committed to protecting the privacy of our users’ Personal Information (as defined below). This Privacy Policy describes how we collect, use, retain, disclose, process, and transfer your Personal Information when you use any website owned or operated by WeRoad or its affiliates that links to, references, or displays this Privacy Policy (collectively, the “Sites”) or otherwise communicate with us (collectively, the “Services”). WeRoad is a travel organizer that combines travel services into curated group trips (“Tourist Packages”) sold through www.weroad.com. For purposes of this Privacy Policy, “you” and “your” means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you agree to the collection, use, and disclosure of your Personal Information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services. “Personal Information” is generally known as information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, postal address, telephone number, location data, online identifiers, device identifiers, demographic information, payment or credit information, employment description, biometric data, identity documents, photographs or other media files, user-generated content, or browsing and interaction data, and that is not otherwise publicly available. Please note that the definition of Personal Information depends on your citizenship and physical location and may include other types of information. Only the legal definition that applies to your physical location will apply to you under this Privacy Policy.

Updates to This Privacy Policy

We may update this Privacy Policy from time to time, and we will provide notice of any such changes as required by law. The date this Privacy Policy was last updated is identified at the top of the page. We will notify you of changes by updating the “Last Updated” date and posting the updated Privacy Policy on the Sites. You should check the Sites periodically to see the current Privacy Policy and any changes we have made to it. If you do not agree with this Privacy Policy or any changes to it, you should not use or access the Services.

Children’s Data

The Services are not intended to be used by children, and we do not knowingly collect any Personal Information about children under 18 years of age. If we learn that we have collected or received Personal Information from a child under 18 without verification of parental consent, we will delete that information. If you are the parent or guardian of a child who has provided us with their Personal Information, you may contact us using the contact details set out below to request that it be deleted. As of the effective date of this Privacy Policy, we do not have actual knowledge that we “share” or “sell” (as those terms are defined in applicable law) Personal Information of individuals under 18 years of age.

Your Personal Information We Collect

The information that we collect and use varies depending on how you interact with our Sites and Services. In addition to the specific uses described below, we may use any of the information we collect for the purposes described in the “How We Use Your Personal Information” section of this Privacy Policy.

Information You Provide to Us. You may provide us with the following Personal Information:

• Basic contact details including your name, address, phone number, and email, for example when you contact us through the “Contact Us” feature on the Sites.

• Order information including your name, billing address, shipping address, payment confirmation, email address, and phone number when you make a purchase on the Sites.

• Account information including your username, password, and security questions.

• Customer support information including the information you choose to include in communications with us, for example, when sending a message through the Services.

• Job application information including your name, address, phone number, email address, resume or C.V., and other information you provide when you apply for a job through the Sites.

• Contests, surveys, and sweepstakes data including your name, username, and email address when you participate in promotions.

• Online community data including your username, photo, and biographical information such as your occupation, social media profiles, company name, and areas of expertise, if you register for an online community that we host.

• Social media data that you provide when you communicate with us via third-party social media sites or otherwise communicate with us.

• Demographic information including your age, date of birth, gender, and other demographic details you may provide to us.

• User content and media files including photographs, videos, documents, comments, reviews, or other content that you upload, submit, or otherwise provide through the Services.

• Identity documents including copies of government-issued identification, such as a driver’s license or passport, if you provide them to us for verification or other purposes.

• Biometric information including fingerprints, facial recognition data, voiceprints, or other biometric identifiers, if you provide or we otherwise collect such information in connection with the Services.

• Trip booking information including your passport or government-issued identification number, date of issue and expiry, nationality, place and date of birth, and tax identification number where required for travel.

• Flight and travel details including departure airport, flight number, and itinerary information you choose to share in your MyWeRoad account.

• Health and dietary information including any allergies, intolerances, dietary requirements, medical conditions, disabilities, or special needs you voluntarily disclose to us for trip planning purposes or, in the case of cancellations, information contained in a medical certificate.

• Emergency contact information including the name and contact details of a family member or friend that you voluntarily provide to us for emergency communication purposes during your trip.

• Driving license and willingness to drive, where relevant to a particular trip itinerary.

• Incident and conduct information including data relating to any facts, incidents, or behaviors that occurred during a trip, where relevant to WeRoad’s duty of care obligations or the WeRoader Manifesto.

• Satisfaction survey responses provided after the conclusion of a trip.

• Gift card or voucher recipient data, including the name and contact details of any person to whom you send a WeRoad gift card or voucher.

Payment Information

You may provide your credit card number and billing information when you make a purchase on our Sites. When you place an order on our Sites, we will share your payment information with our third-party payment processor, Stripe, Inc. Stripe, Inc. will use and process your payment information according to its own privacy policy, available at https://stripe.com/privacy. We will have no liability for any data processed by Stripe, Inc.

Information We May Automatically Collect

When you visit our Sites and use our Services, we may automatically collect certain information about your device and usage, including information about your web browser, IP address, time zone, operating system, access times, and referring URLs. Additionally, we may collect information about the individual web pages you view, what websites or search terms referred you to our Sites, and information about how you interact with the Sites. We collect this information using the following technologies:

• “Cookies” are small data files placed on your device that enable our systems to recognize your browser and remember certain information. For more information about cookies and how to disable cookies, visit http://www.allaboutcookies.org.

• “Log files” track actions occurring on the Sites and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.

• “Clear gifs,” “pixel tags,” and “web beacons” are electronic files used to record information about how you browse the Sites.

• Device information including your device type, unique device identifiers, hardware model, operating system and version, mobile network information, screen resolution, and language preferences.

• Location information including your approximate geographic location as inferred from your IP address, time zone, or other technical data, and, where you have provided consent, your precise geolocation data.

We use WeRoad’s third-party marketing analytics providers (to be confirmed by client), which may set cookies or otherwise collect information about your internet usage when you browse the Sites. You may opt out of such tracking by adjusting your browser cookie settings to block third-party cookies or by using the Global Privacy Control signal described below. To opt out of interest-based or targeted advertising facilitated by third-party tracking technologies used on the Sites, you may visit the Digital Advertising Alliance’s opt-out page at https://optout.aboutads.info or the Network Advertising Initiative’s opt-out page at https://optout.networkadvertising.org. For further details about cookies, please see the “Privacy Technology Practices” section below.

Information Collected from Other Sources

We may obtain Personal Information from third parties and combine it with information we collect through the Sites or our services. For example, we may have access to certain data from third-party social media services if you create or log into your account through such services or otherwise provide us with access to data from those services.

Sensitive Personal Information

In certain circumstances, we may collect sensitive categories of Personal Information, such as identification documents, precise geolocation data, or biometric information. Where required under applicable law, we will collect and process such sensitive Personal Information only with your explicit consent. In connection with WeRoad’s travel services, sensitive personal information may include health information, dietary requirements, and medical documentation disclosed voluntarily in connection with a trip booking or cancellation. WeRoad collects and processes such information solely to facilitate the proper delivery of the travel package or to process a cancellation request, and retains it only for the duration necessary to fulfill that purpose. If you choose not to provide consent or withdraw your consent for the collection of sensitive Personal Information, we may not be able to provide you with certain features, services, or information that rely on the processing of such data.

How We Use Your Personal Information

When you interact with the Sites we use a variety of technologies to process data. In some instances, that data may be your Personal Information. The legal bases we rely upon to process your Personal Information include: (a) the performance of a contract with you (e.g., to fulfill your orders and provide the Services); (b) our legitimate interests (e.g., to improve the Sites, to detect fraud, and to conduct analytics), provided that such interests are not overridden by your rights and interests; (c) your consent, where you have provided it (e.g., for marketing communications); and (d) compliance with a legal obligation to which we are subject. Where we rely on your consent as the legal basis for processing your Personal Information, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to such withdrawal. Where we rely on legitimate interests, we will carry out a balancing test to ensure that your interests, rights, and freedoms do not override our legitimate interests. You may contact us for further information regarding the specific legal basis we rely upon for each processing activity. We may use the Personal Information we collect about you for a variety of purposes, including to:

• Provide, maintain, and improve the Sites and our Services;

• Process and complete transactions and send you related information, including purchase confirmations and invoices;

• Manage your account and provide you with customer service;

• Communicate with you, including to send you marketing communications, newsletters, offers, promotions, and information about contests and events;

• Personalize and improve your experience on the Sites;

• To monitor and analyze trends, usage, and activities in connection with the Sites and our services;

• Detect, investigate, and prevent fraudulent transactions, unauthorized access to the Sites, and other illegal activities;

• Send you technical notices, updates, security alerts, and administrative messages;

• Comply with legal obligations; and

• Establish, exercise, or defend a legal claim.

• Organize and deliver your booked travel package, including coordinating with accommodation providers, airlines, transport operators, local guides, and other third-party travel suppliers;

• Add you to a WhatsApp group with other trip participants and the trip coordinator to facilitate pre-departure and on-trip communications;

• Monitor and report any conduct that may violate applicable law or the WeRoader Manifesto, for the safety and enjoyment of all participants;

• Respond to abandoned booking inquiries to assist you in completing your reservation;

• Send post-trip satisfaction surveys to improve the quality of WeRoad’s services;

• Manage emergency communications during your trip using emergency contact details you have provided.

Sharing Your Personal Information

We may share your Personal Information with the following categories of recipients:

(a) Affiliates and Subsidiaries. We may share your Personal Information, including identifiers, contact details, commercial information, and account information, with our affiliates and subsidiaries for purposes consistent with this Privacy Policy.

(b) Service Providers. We may share your Personal Information, including identifiers, contact details, commercial information, internet or electronic network activity information, and geolocation data, with third-party service providers that perform services on our behalf, such as hosting, data analysis, payment processing, order fulfillment, information technology, customer support, and analytics providers. Such service providers may include accommodation providers (hotels and other lodging facilities), car rental companies, airlines, local transport operators, travel insurance providers, local tour guides, and other third parties whose services form part of your booked travel package. Such third parties are bound by contractual obligations to keep Personal Information confidential and to use it only for the purposes for which we disclose it to them.

(c) Payment Processors. We may share your payment and billing information, including your name, billing address, and credit card number, with our third-party payment processor as described in the “Payment Information” section of this Privacy Policy.

(d) Marketing and Advertising Partners. We may share your identifiers, internet or electronic network activity information, and commercial information with marketing and advertising platforms to facilitate marketing communications and analytics on our behalf.

(e) Professional Advisors. We may share your Personal Information, including identifiers, contact details, commercial information, and professional or employment-related information, with professional advisors such as lawyers, auditors, and insurers where necessary in the course of the professional services they render to us.

(f) Business Successors. In the event of a merger, acquisition, reorganization, bankruptcy, dissolution, sale of all or a portion of our assets, or similar transaction or proceeding, your Personal Information may be among the assets transferred or disclosed to the acquiring entity or successor. In such circumstances, we will use reasonable efforts to require the recipient to honor this Privacy Policy or notify you before your Personal Information becomes subject to a different privacy policy.

(g) Customer Relationship Management Providers. We may share your identifiers, contact details, and commercial information with customer relationship management providers to facilitate our business operations and improve our Services.

(h) Trip Participants and Coordinators. Flight and travel details you elect to share via your MyWeRoad account may be shared, in anonymized form, with other participants on the same trip and the trip coordinator, solely to facilitate group logistics. Your contact details may also be added to a WhatsApp group with fellow participants.

Notwithstanding the foregoing, we may disclose your Personal Information, including any of the categories described in this Privacy Policy, to third parties in the following circumstances: (a) to comply with applicable law, regulation, legal process, or enforceable governmental request, including court orders, subpoenas, or other lawful requests by public authorities; (b) to cooperate with law enforcement agencies or other governmental authorities in connection with investigations or other legal proceedings; (c) to enforce our terms of service, this Privacy Policy, or other agreements, including investigation of potential violations thereof; (d) to detect, prevent, or otherwise address fraud, security, or technical issues; (e) to protect the rights, property, or safety of WeRoad, our users, or the public, as required or permitted by law; or (f) where disclosure is otherwise necessary to establish, exercise, or defend legal claims.

Data Retention and Deletion

We may retain your Personal Information for a period of time consistent with the original purpose of collection outlined in this Privacy Policy. We determine the appropriate retention period for data on the basis of the amount, nature, and sensitivity of your Personal Information processed, the potential risk of harm from unauthorized use or disclosure of your Personal Information, and whether we can achieve the purposes of the processing through other means, as well as on the basis of applicable legal requirements, such as applicable statutes of limitation.

After expiry of the applicable retention periods, your Personal Information will be deleted. If there is any Personal Information that we are unable, for technical or legal reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of such data.

By way of illustration, WeRoad currently retains: navigation and browsing data for up to 36 months; marketing and promotional communication preferences for up to 5 years from the date of collection (or until you withdraw consent); post-trip satisfaction survey data for up to 36 months (after which it is anonymized); images and videos published on WeRoad’s platforms for up to 5 years from the date of publication (unless you withdraw consent earlier); emergency contact details for up to one month following the conclusion of your trip; and health or medical information disclosed in connection with a booking or cancellation for the duration of the applicable limitation period or as required to defend a legal claim.

If you wish to deactivate your account or obtain further information on applicable data retention policies and periods, please contact us via email at privacy@weroad.com, but note that we may retain certain data as required by law or for legitimate business purposes. In some cases, we may not be able to remove your Personal Information, in which case we will let you know if we are unable to do so and why.

Transfer to Other Countries

We, along with our affiliates and trusted third-party providers, may process your Personal Information in countries other than the United States. The data privacy laws in these countries may differ from, and potentially offer less protection than, those in the United States. In such instances, we will ensure that the transfer of your Personal Information is carried out in accordance with applicable privacy laws and that appropriate contractual, technical, and organizational measures are in place. Before transferring Personal Information across borders, we will take reasonable steps to ensure that the recipient provides a comparable level of protection as required under the applicable data protection laws of your jurisdiction.

Use of Artificial Intelligence Services

We may use artificial intelligence (“AI”) and machine learning tools and services provided by third parties in connection with our business operations, including but not limited to customer support, content generation, data analysis, customer relationship management, and internal process optimization. Such AI tools may include, without limitation, Microsoft Copilot and HubSpot. When we use AI services, your Personal Information (including your email address, phone number, and other contact details) may be processed by such tools for the purposes described in this Privacy Policy. AI tools may associate your email address and contact information with customer actions, such as meetings, email communications, and other interactions, in order to facilitate customer relationship management and improve our Services. Additionally, AI tools may summarize, analyze, and aggregate data derived from your Personal Information for internal business purposes, including reporting, trend analysis, and operational optimization. We do not use AI for automated decision-making that produces legal or similarly significant effects concerning you. No decisions regarding your eligibility for services, employment, credit, or any other material determination are made solely by AI without human review and oversight. Any AI service providers that process your Personal Information on our behalf are bound by contractual obligations to maintain the confidentiality and security of such data and to process it only in accordance with our instructions and applicable data protection laws. 

Promotional Emails

You may sign up to receive email marketing messages from us. You may opt out at any time by clicking the “unsubscribe” button in the emails you receive. Please note that even if you opt out of receiving marketing emails, we may still send you a response to any “Contact Us” request as well as administrative emails (for example, in connection with a password reset or account update) that are necessary to facilitate your use of the Sites. You have the right to object to the use of your Personal Information for direct marketing purposes by emailing us at privacy@weroad.com. We will respond to your objection in accordance with the law that applies to you.

Privacy Technology Practices

We use cookies and similar tracking technologies to collect and use Personal Information about you.  Cookies are small files that a website or its service provider transfers to your device through your web browser (if you allow) that enable the website’s systems to recognize your browser and capture and remember certain information.  We use both session cookies (which expire once you close your browser) and persistent cookies (which stay on your device until you delete them). We also use other technologies such as clear gifs, pixel tags, and web beacons to collect information about our users in order to help us deliver better service and user experience. Clear gifs, pixel tags, and web beacons are small, transparent image files or code snippets embedded in web pages or emails that allow us to track whether a page or email has been viewed, to record the time and date of such viewing, and to collect information such as your IP address and browser type. Unlike cookies, these technologies cannot be disabled through browser cookie settings alone. We use cookies to help us remember and process the items in your shopping cart, understand and save your preferences for future visits, and compile aggregate data about traffic and interaction with the Sites. Most web browsers are initially set up to accept cookies. You may manage or disable cookies through your browser settings by accessing the privacy or security settings in your browser (. Please note, however, that disabling or deleting cookies may affect the functionality of the Sites, and certain features, such as your shopping cart and saved preferences, may not function properly if cookies are disabled. To limit the collection of information through clear gifs, pixel tags, and web beacons, you may disable the loading of images in your browser or email client settings, or use browser extensions designed to block tracking pixels; however, doing so may impair the display and functionality of certain content on the Sites and in our email communications. For more information about cookies and how to disable cookies, visit http://www.allaboutcookies.org.

Opt-Out of Tracking for Advertising and Profiling Purposes

To the extent that we or our third-party service providers use cookies or similar tracking technologies for advertising, marketing, or profiling purposes, you may opt out of such tracking by visiting the opt-out pages provided by industry self-regulatory organizations, such as the Network Advertising Initiative (https://optout.networkadvertising.org) or the Digital Advertising Alliance (https://optout.aboutads.info), to opt out of interest-based advertising by participating companies. Please note that opting out of advertising or profiling tracking does not mean you will no longer see advertisements; rather, the advertisements you see may be less relevant to your interests. Additionally, certain opt-out mechanisms, such as browser-based cookie controls, are device- and browser-specific, meaning you will need to opt out on each device and browser you use to access the Sites.

Do Not Track Signals

Some browsers have incorporated “do not track” features. By using these settings, your browser may send a signal to our Sites not to collect tracking information. Please note that we do not currently alter our Sites’ data collection and use practices when we see a “do not track” signal from your browser.

Global Privacy Control

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to the websites you visit to opt out from certain types of data processing, including data “sales” and “sharing” as defined under applicable privacy laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

Location Data Controls

We may collect location data, including geolocation data derived from your IP address or device settings, when you use the Sites or Services. You may control the collection of precise location data by adjusting the location settings on your device or browser. Disabling location services on your device will prevent us from collecting precise geolocation data, although we may still derive approximate location information from your IP address. If you wish to request deletion of location data previously collected, you may do so by contacting us at privacy@weroad.com.

Data Security

We will take appropriate physical, technical, and organizational measures to protect Personal Information from loss, misuse, unauthorized access, disclosure, alteration and destruction.  We follow generally accepted standards to protect your Personal Information both during transmission and while it remains in our possession. We offer the use of a secure server.  All Personal Information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our payment gateway provider’s database, only to be accessible by those authorized with special access rights to such systems, and who are required to keep the information confidential.

You may access your account information and our service only using an individual user ID and password. To protect the confidentiality of your information, you must keep your password confidential and not disclose it to any other person. Please advise us immediately if you believe your password has been misused. In addition, always logout and close your application when you finish your session. Please note that we will never ask you to disclose your password in an unsolicited phone call or email.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Services. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Services.

Third-Party Links and Features

Our Sites may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms, may also be viewable by other users of the Services and users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services. Our Sites may also include features from social media websites such as Facebook, Twitter, LinkedIn, YouTube, and other platforms. These features may collect your IP address and information about which page you are visiting on our Sites, and may set a cookie to enable the feature to function properly. This Privacy Policy does not apply to these features. Your interactions with these features are governed by the privacy policy and other policies of the companies providing them.

Exercising Your Rights

It is always your choice whether or not to provide us with Personal Information.  If you do provide Personal Information to the Sites, you are giving your voluntary and express consent to the collection, use, processing, retention, transfer, and disclosure of your Personal Information as described in this Privacy Policy.  If you choose not to provide the requested information, you may not be able to access certain features or functions of the Sites.

Depending on the law that applies to you, you may have the right to request access to, correction of, or deletion of your Personal Information, or to request that your Personal Information be transferred to another person. If applicable, you may revoke your consent, object to, or block processing of your Personal Information, or otherwise exercise your rights by emailing a request to us at privacy@weroad.com.   We will respond to your request in accordance with the law that applies to you.

Your Personal Information that we processed prior to your request may not be deleted from our Sites’ system records but will be blocked from further processing without your permission.  A request to revoke consent or block processing of your Personal Information may not apply to information collected by cookies or used internally to recognize you and/or facilitate your visits to the Sites, or to information we may keep to comply with legal requirements.

We will retain your Personal Information as long as necessary to facilitate your use of our Sites as described in this Privacy Policy.  When you cancel your subscription to any product or service or delete your account, we will retain and use your Personal Information only as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), provides you with certain rights regarding your Personal Information. This section describes your CCPA rights and explains how to exercise those rights. For purposes of this section, “Personal Information” has the meaning given in the CCPA and does not include information that is publicly available, deidentified, or aggregated.

Collection, Retention and Disclosure of Personal Information

We collect the following categories of Personal Information, which are defined under California Civil Code Section 1798.136(v)(1):  

• Category A: Identifiers such as your real name, alias, postal address and similar identifiers;

• Category B: Personal information categories listed in the California Customer Records Statute such as your real name, address, telephone number, and credit card information;

• Category C: Protected Classification Characteristics under California law such as your age, sex and gender;

• Category D: Commercial information, including records of personal property or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;

• Category F: Internet or other similar network activity such as information on how you interact with our Site;

• Category H: We may collect geolocation data only at the city or region level, as derived from your IP address, we do not collect precise geolocation;

• Category H: Audio, which may be collected in the form of customer service calls;

• Category K: We may derive inferences from your browsing and purchase history to improve our services and marketing.

We do not collect Category E (biometric information), Category I (professional or employment-related information) or Category J (non-public education information). We do not collect Sensitive Personal Information, which may include government issued-ID numbers, precise geolocation or ethnic background.

We retain each category of Personal Information listed above for as long as reasonably necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, and in accordance with applicable legal, tax, and regulatory retention requirements. 

The categories of third parties to whom we disclose Personal Information for a business purpose include: affiliates and subsidiaries, service providers, payment processors (including Stripe, Inc.), hosting providers, analytics providers, marketing and advertising platforms, customer relationship management providers, professional advisors (such as lawyers, auditors, and insurers), business successors (in the event of a merger, acquisition, or similar transaction), and government authorities or law enforcement agencies (where required by applicable law or legal process).

Sources of Personal Information

We collect Personal Information from the following categories of sources: (a) directly from you (e.g., when you create an account, make a purchase, or contact us); (b) indirectly from you (e.g., through your use of the Sites); (c) from third parties (e.g., social media platforms, analytics providers, and advertising networks); and (d) from publicly available sources.

Business and Commercial Purposes for Collecting Personal Information

We collect and use Personal Information for the business and commercial purposes described in the “How We Use Your Personal Information” section of this Privacy Policy, including: (a) providing, maintaining, and improving the Sites and our services; (b) processing transactions and fulfilling orders; (c) communicating with you; (d) marketing and advertising; (e) detecting, preventing, and responding to security incidents and fraud; (f) debugging and repairing errors; (g) performing internal research and analytics; and (h) complying with legal obligations.

Sale and Sharing of Personal Information

We do not sell your Personal Information as that term is defined under the CCPA. We do not share your Personal Information for cross-context behavioral advertising purposes. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age.

Your CCPA Rights

Subject to certain exceptions, as a California resident you have the following rights:

• Right to Know. You have the right to request that we disclose to you the categories and specific pieces of Personal Information we have collected about you, the categories of sources from which your Personal Information was collected, the business or commercial purposes for collecting or selling your Personal Information, and the categories of third parties with whom we share your Personal Information.

• Right to Delete. You have the right to request that we delete Personal Information that we have collected from you, subject to certain exceptions provided by law.

• Right to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you.

• Right to Opt-Out of Sale or Sharing. You have the right to opt out of the sale or sharing of your Personal Information. As noted above, we do not currently sell or share your Personal Information.

• Right to Limit Use of Sensitive Personal Information. To the extent we collect sensitive Personal Information (as defined under the CCPA), you have the right to limit our use and disclosure of such information to purposes permitted by the CCPA.

• Right to Data Portability. To the extent required by the CCPA, you have the right to request that we transfer your Personal Information to another entity, in a structured, commonly used, machine-readable format, to the extent technically feasible.

• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices or rates, provide you a different level or quality of goods or services, or suggest that you may receive a different price or rate or different level or quality of goods or services, because you exercised your CCPA rights.

Exercising Your CCPA Rights

To exercise any of the rights described above, you may submit a verifiable consumer request to us by emailing privacy@weroad.com. Only you, or a person you have authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. We will verify your identity before fulfilling your request by matching information you provide with information we have on file. We will respond to your request within forty-five (45) days of receiving it. If we require more time (up to an additional forty-five (45) days), we will inform you of the reason and the extension period in writing. You may make a verifiable consumer request for access or data portability no more than twice within a twelve (12) month period. Please submit your verifiable consumer request to: privacy@weroad.com with the subject line ‘CCPA Request’.

Authorized Agents. 

You may designate an authorized agent to submit a request on your behalf. To do so, you must provide the authorized agent with written permission to act on your behalf, and we may require you to verify your own identity directly with us and confirm that you provided the authorized agent permission to submit the request.

Automated Decision Making Technologies

Automated decision-making technologies (ADMTs) are technologies that process Personal Information and use computation to execute a decision and either replace or substantially replace human decision-making, resulting in decisions made without human involvement. Decisions are significant when they result in the provision or denial of employment or independent contracting opportunities or compensation, education enrollment or opportunities, housing, healthcare services, or financial or lending services. Advertising is not a significant decision.  We do not currently use ADMT to make significant decisions about applicants, so we do not provide ADMT opt-out rights.

California “Shine the Light” Law 

In addition to the rights described above, California Civil Code Section 1798.83 permits California residents to request information regarding the disclosure of their Personal Information by us to third parties for the third parties’ direct marketing purposes. To make such a request, please contact us by email at privacy@weroad.com.

Contact Us

If you have questions or requests regarding this Privacy Policy or the processing of your Personal Information, please contact WeRoad at privacy@weroad.com

PRIVACY POLICY - website - for UK Resident Customers

Information document pursuant to and for the purposes of articles 13/14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) This information applies to the website www.weroad.com the "Site" and to its users, both visitors and travellers who purchase one or more trips (“Data Subjects” or "Users").

DATA CONTROLLER

WeRoad UK Limited, company number: 13313382 and registered office address at WeWork Moor Place, 1 Fore Street Avenue, London, EC2Y 9DT, United Kingdom is the controller and responsible for the Users Personal Data (collectively referred to as the “Data Controller”, “Owner”, "we", "us" or "our" in this Privacy Policy). We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If the User has any questions about this privacy policy, including any requests to exercise legal rights. Please contact the data privacy manager using the details set out below.

Email Address: privacy@weroad.com

Address: WeWork Moor Place, 1 Fore Street Avenue, London, EC2Y 9DT, United Kingdom

The Controller has appointed a Data Protection Officer (DPO) pursuant to Article 37 of the UK GDPR. The Data Protection Officer can be contacted at the following email address: dpo@weroad.com

The User has the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). The Owner would, however, appreciate the chance to deal with the Users concerns before the User approaches the ICO so please contact the Owner in the first instance.

TYPE OF DATA PROCESSED

We may process the following personal data:

• Access and navigation data (for example: information on the browser used by the User, pages visited, date, time and duration of each visit, as well as other parameters relating to the operating system and the User's IT environment).

• Contact details (email and/or telephone)

• Personal data: Name, surname, place and date of birth, tax code, sex (gender), passport and/or identity document (number, date of issue, expiry date)

• License and willingness to drive

• other personal data transmitted voluntarily: In some areas of the Site ( https://www.weroad.it/contatti, https://www.weroad.it/become-our-partner) it is possible to contact the Data Controller by email at address booking@weroad.com, by telephone or WhatsApp, via the Owner's Facebook® group or via the Owner's Instagram profile, to request information or clarifications relating to WeRoad trips and the possibility of creating partnerships.

• Data relating to User preferences collected following the booking of a trip and relating to age, gender, and purchasing preferences shown by Users.

• Payment data such as credit card / IBAN ("Bank Data")

• Data relating to the round-trip flight purchased by the user

• Image and/or voice

• Contact details in case of emergencies (of a family member/friend)

• Information about flights

• Data contained in surveys

• Data of the beneficiary of the gift card/voucher

• Data relating to facts/incidents that occurred during the trip, including any behavior in violation of the law or the WeRoader Manifesto (part of the travel agreement with each User participating in a trip)

• Cookies For all information on the cookies active on the Site and on the related processing of personal data, we invite you to read the relevant information in the "Cookie policy" section of our Site.

In some cases we may also process some particular data:

• allergies and intolerances, state of health, special needs communicated voluntarily by the User;

• Data contained in the medical certificate in case of cancellation of the booking.

("Personal data")

PURPOSE AND LEGAL BASIS OF THE PROCESSING

NAVIGATION OF THE SITE: Personal Data may be processed for the collection of anonymous statistical data on the use of the Site by Users, as well as for monitoring the functioning of the Site. The legal basis is the legitimate interest of the Data Controller to operate and control the Site and to obtain data on its use or your consent (Art. 6, par. 1, lett. f) GDPR). The interest of the Data Controller has been balanced with that of the User who will thus be able to use an increasingly performing and optimized Site. The provision of Personal Data is optional, but failure to provide it, by disabling cookies in the browser, may prevent you from accessing all the functions of the Site. The Data does not persist for more than 36 months and is deleted immediately after its aggregation (except for any need to ascertain crimes by the competent Judicial Authority). Our cookie policy is available in the "Cookie policy" section on our Site.

RESPONDING TO CONTACT REQUESTS: You can contact the Data Controller by email at booking@weroad.com, by phone or WhatsApp or through the Data Controller's Facebook® group, to request information or clarifications relating to WeRoad trips and the possibility of creating partnerships and in general in relation to the services offered; to respond to the various requests of Users (for example through the services Avvisami, Newsletter, participation in AperiRoad and WeMeet). The legal basis is the execution of pre-contractual obligations to which the Data Subject is a party (art. 6, par. 1, lett. b) GDPR). The provision is necessary to follow up on the request. In the event of failure to provide Personal Data, WEROAD will not be able to respond to the request. WEROAD will delete the Personal Data processed to respond to requests within 1 year from the date of closure of the management of the request. WeRoad may store tickets in anonymous and aggregate form for internal reporting purposes (by tickets we mean the requests we receive).

USE OF THE CHATBOT: The Data Controller provides users with a virtual assistant (chatbot) through which it is possible to request information regarding the services offered. For its operation, the chatbot does not require the user to provide any personal data. The only data collected is the session ID, generated when the user starts a conversation with the chatbot. This data cannot be linked to an identified or identifiable individual. If, during the interaction with the virtual assistant (chatbot), the user voluntarily provides personal data (such as, for example, name, surname, email contact details or travel-related information), such data will be processed, in accordance with the principles set out in this privacy notice, exclusively within the scope of the requested chatbot service. Users are invited not to share third parties’ personal data or special categories of personal data, such as health-related data, with the chatbot. The legal basis for the processing is the performance of pre-contractual measures requested by the data subject (Art. 6(1)(b) UK GDPR). Personal data processed for handling requests will be retained for a maximum period of 12 months from the closure of the ticket. After this period, the data will be deleted. WeRoad may retain tickets in anonymous and aggregated form for statistical and internal reporting purposes.

RESPOND TO A REQUEST ABOUT A TRAVEL SHIFT ("NOTIFY ME"): the User can ask to receive information about a travel or a specific departure and save it in his/her own account. The legal basis of the processing is the execution of pre-contractual and contractual obligations to which the Data Subject is a party (art. 6, par. 1, lett. b) GDPR). The provision of Personal Data is necessary to follow up on the request of the Data Subject. In the event of failure to provide such data, WEROAD will not be able to follow up on the request of the Data Subject to be notified about the confirmation of a travel shift. The data will be retained for the time necessary to achieve the pursued purpose.

BOOKING A TRIP: finalization of a travel booking through the Site and management of the booking made. The legal basis is the execution of pre-contractual and contractual obligations to which the Data Subject is a party (Art. 6(1)(b) UK GDPR). With reference to any special category data provided (for example, health status, any allergies), the legal basis is the express consent of the Data Subject (Art. 9(2)(a) UK GDPR), and such processing is carried out in accordance with the conditions set out in Schedule 1 of the Data Protection Act 2018. The provision is necessary to follow up on the booking request. In the event of failure to provide the Data, WEROAD will not be able to follow up on the request and finalize the purchase and, with reference to the special category data, will not be able to follow up on the specific needs requested. The Data is stored until the execution of the purchase contract and, in any case, not beyond the limitation periods established by law and except in cases of defense in court. The special category data will be stored until the execution of the contract and for a further 6 months, unless a further term is necessary to exercise or defend a right.

USE THE “MYWEROAD” PERSONAL AREA: the user who has booked a trip, has the possibility of accessing a personal area within MyWeRoad, protected by a password chosen by the User, which allows, for example, to manage and check the status of the booking and/or modify the data provided during the booking of a trip. The legal basis is the execution of pre-contractual and contractual obligations to which the Data Subject is a party (Art. 6(1)(b) UK GDPR). With reference to any special category data provided (for example, any allergies and/or intolerances), the legal basis is the express consent of the Data Subject (Art. 9(2)(a) UK GDPR), and such processing is carried out in accordance with the conditions set out in Schedule 1 of the Data Protection Act 2018. The provision is optional. In the event of failure to provide the Data, the user will not be able to use the personal area. The Data are stored until the Data Subject cancels their account. The Data Controller reserves the right to verify the user's interest in maintaining the account in the event of prolonged inactivity over time. The Owner may cancel, upon notification, inactive accounts.

The interested party may update their data at any time.

SHARING OF INFORMATION RELATING TO INTERNATIONAL FLIGHTS: the user who has booked a trip has the possibility to enter the data of their international flights in their personal MyWeRoad area. This information could be shared, anonymously, to the participants of the same package purchased and to the group leader of the aforementioned in order to facilitate the management of the groups, and may also be visible to all users holding a MyWeRoad account. The legal basis for processing is the data subject’s consent (Art. 6(1)(a) UK GDPR). Providing such data is always optional. Each interested party may object to the processing at any time by removing the information from the appropriate section within the personal area. There will be no negative repercussions on the user in case of failure to enter and/or opposition to the treatment. The data will be kept for the time necessary to pursue the purpose described above.

BE INCLUDED IN THE WHATSAPP GROUP OF THE TRIP YOU ARE PARTICIPATING IN: Users who have purchased a trip are included in a WhatsApp group formed by the other participants and the group leader. The group is used to exchange organisational communications relating to the trip and is activated before departure. The legal basis of the processing is the legitimate interest of the Data Controller (art. 6, par. 1, lett. f) UK GDPR) to allow the organization of the trip and communications between the participants in the trip and the group leader. The group is necessary to provide information and update to all the participants. The interest of the Data Controller has been balanced with that of the Data Subject who will be able to stay updated through communications within the group. The Data Subject can object to the processing at any time, either by leaving the WhatsApp group or by sending their request to the Data Controller. There will be no negative repercussions on the user in the event of objection to the processing. The data will be stored for the time necessary to pursue the purpose described above.

CONTACT USERS WHO HAVE ADDED A TRIP IN THE CART: in the event of a booking not completed, contact the relevant Users by email. The legal basis is the legitimate interest of the Data Controller (Art. 6(1)(f) UK GDPR) to contact the User to ask whether he/she is still interested in finalising the purchase or whether he/she needs more information in relation to a particular destination. The interest of the Data Controller has been balanced with that of the user who will thus be able to complete, at a later time, the booking of a trip not yet completed. The interested party may object to the processing. There will be no negative repercussions on the interested party in the event of objection to the processing. The data will be retained for the time necessary to achieve the purpose described above.

CANCELING A RESERVATION: in the event that a user requests a cancellation of a reservation. The legal basis is the execution of pre-contractual and contractual obligations to which the interested party is a party (Art. 6(1)(b) UK GDPR) and, with respect to the data contained in the medical certificate, the legal basis is the consent of the Data Subject (Art. 9(2)(a) UK GDPR), and such processing is carried out in accordance with the conditions set out in Schedule 1 of the Data Protection Act 2018. The provision is necessary to follow up on the cancellation request. WEROAD will retain the data within and no later than the limitation periods established by law and except in cases of defense in court.

COMMUNICATIONS IN CASES OF EMERGENCY: in order to manage communications for extraordinary emergency cases, the User may be asked to provide contact details of a family member or friend. The data processing is carried out in the legitimate interest of the Data Controller to allow the best management of emergencies, pursuant to Art. 6(1)(f) UK GDPR. The User who provides the personal data of a third party (such as a family member or friend) must ensure that such third party has been informed of this privacy policy prior to providing their data. WEROAD will delete the data once the trip ends and in any case after 1 month from the return.

SENDING OF COMMERCIAL/PROMOTIONAL COMMUNICATIONS: for direct marketing purposes, such as sending newsletters, information and commercial communications, updates on the latest launches, offers and promotions relating to WEROAD services. Such communications may be sent through various contact channels, including email, telephone, SMS, instant messaging systems, social media and app push notifications. The legal basis is the consent of the interested party (Art. 6(1)(a) UK GDPR) and, in relation to electronic communications, Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The provision is optional. In case of failure to provide the Data, WEROAD will not be able to regularly update the interested party on its offers and promotions. The interested party can revoke the consent given at any time by clicking on the "unsubscribe" link included in the marketing email received, by modifying preferences in the MyWeRoad personal area, by disabling notifications through the App or device settings or by sending an email to privacy@weroad.com. The Data processed for this purpose will be stored and processed for 5 years, without prejudice to the revocation of consent by the interested party. The Data Controller may periodically verify the user’s continued interest in receiving commercial and promotional communications, including by sending specific communications aimed at confirming the willingness to continue receiving such communications. In the absence of a response or in case of withdrawal of consent, the data will no longer be used for marketing purposes.

In the event that the interested party has contacted WEROAD, WEROAD may contact or send the interested party communications of a commercial nature relating to the request received. In this case the legal basis of the processing is the legitimate interest of WEROAD to promote its services to the interested parties pursuant to Art. 6(1)(f) UK GDPR. The provision is necessary for the pursuit of the legitimate interest of the Data Controller which is equally balanced with the legitimate interest of the interested parties. The processing is not mandatory and the interested party may object to said processing at any time by sending an email to privacy@weroad.com. WEROAD will delete the Personal Data processed to respond to requests within 1 year from the closing date of the management of the request. WEROAD may contact the interested party again within this

SOFT-SPAM: The email address may be processed to send the interested parties emails relating to the promotion of WEROAD services similar to the services already purchased, in accordance with Regulation 22 of the PECR. The legal basis is the legitimate interest of the Data Controller to promote its services to existing customers. The interested party may object to the use of his/her email address at any time by clicking on the "unsubscribe" link in the email received or by sending an email to privacy@weroad.com. WEROAD will no longer use the email address in the event of opposition - opt-out by the interested party or after 36 months from the date of the last commercial contact with the interested party.

USER SEGMENTATION: for sending personalized commercial communications based on age and type of travel purchased. The legal basis is the legitimate interest of the Data Controller (Art. 6(1)(f) UK GDPR) to improve its commercial offer. The interest of the Data Controller has been balanced with that of the user to be able to receive commercial communications in line with their interests. The provision is optional. There will be no negative repercussions on the user in the event of opposition to the processing. The data will be stored for 5 years from the date of the last trip.

CONDUCTING SATISFACTION SURVEYS: Users who have completed a trip will receive an email communication regarding a satisfaction survey. The legal basis is the legitimate interest of the Data Controller (Art. 6(1)(f) UK GDPR) to evaluate and improve the quality and satisfaction with respect to the services offered. The provision is optional. Failure to provide the Data, however, will not allow us to evaluate the expectations and satisfaction of customers with respect to the services offered by the Data Controller. The Data will be stored for 36 months from the time of collection and will subsequently be anonymized and aggregated.

PUBLICATION OF IMAGES OF INTERESTED PARTIES ON THE SITE OR SOCIAL CHANNELS OF WEROAD: the images/videos collected during the trip with WEROAD may be published by the Data Controller on the Site or on social channels and/or travel diaries. The legal basis for this processing is the consent of the Data Subject (Art. 6(1)(a) UK GDPR). The travel participant will be informed of the creation of the photographs/videos both in the contractual context and during the trip and will be asked to provide consent prior to any publication. The interested party may withdraw consent at any time either by asking not to participate in the shots/filming, or by requesting the removal of the published content by writing to privacy@weroad.com. The provision of consent is optional. There will be no negative repercussions on the user in the event of refusal or withdrawal of consent. The data will be stored for 5 years from the publication of the images unless there is a withdrawal of consent or a request for removal of the images.

REPORTS RELATING TO FACTS/ACCIDENTS AND/OR NON-COMPLIANT BEHAVIOURS: The Data Controller may collect and process data relating to facts, incidents, behaviors attributable to the Traveling User, which do not comply with the law or the WeRoader Manifesto. The legal basis is the legitimate interest of the Data Controller (Art. 6(1)(f) UK GDPR) to verify that the travel experience complies with the company standard and monitor/report facts and/or behaviors that are not in line with the WeRoader Manifesto or the law. The report may be made through the group leader, travel companions and local partners. The travel participant is informed of this possibility from the moment the travel contract is signed. Furthermore, the participant is notified in the event that there is a report by the group leader that concerns him/her and the same has the possibility to oppose and lodge a complaint. The data will be stored for 36 months from the collection of the report.

MANAGEMENT OF ANY CLAIMS AND DEFENSE IN COURT: the legal basis is the execution of pre-contractual and contractual obligations of which the interested party is a party (Art. 6(1)(b) UK GDPR) as well as the legitimate interest of the Data Controller (Art. 6(1)(f) UK GDPR). The provision is necessary both to allow the Data Controller to respond to requests made by interested parties and to defend their rights against the interested party or third parties before the competent authorities. The Data is stored for the duration of the claim and in any case within the limitation periods indicated by the law (usually 3 years without prejudice to a possible longer period, if related to personal injury).

CORPORATE OPERATIONS: Sharing personal data in connection with, or during negotiations of extraordinary operations of all or a portion of WEROAD's business. The legal basis is the legitimate interest of the Data Controller (Art. 6(1)(f) UK GDPR). Data processing is necessary for WEROAD's legitimate interest in following up on the negotiation and execution of corporate transactions. The data stored for this purpose will be deleted at the end of the operation.

Furthermore and without prejudice to the above, the Data Controller undertakes to base the processing of Personal Data on the principles of minimization, verifying on an annual basis the need for their conservation for a period of time not exceeding that required by the purposes for which the data were collected and processed. The Data Controller may retain Personal Data to comply with the law or to exercise or defend any rights or claims in legal proceedings. Once the purposes for which the Personal Data were collected and processed have been achieved, the Data Controller will implement appropriate measures to make them anonymous, so that the interested party cannot be identified.

RECIPIENTS OF THE DATA

The Data will be processed by employees and collaborators of the Data Controller expressly authorized to process the Data on the basis of the instructions and after adopting suitable measures to protect the Data in relation to all the purposes indicated above.

The following subjects may become aware of the Data in relation to the processing purposes envisaged by this privacy policy and may process the Data both as independent data controllers and as data processors duly appointed by the Data Controller (the list of such managers and independent data controllers are available upon request via e-mail to be sent to privacy@weroad.com):

• subjects that carry out activities functional to achieving the aforementioned purposes, i.e. companies that provide IT infrastructures and IT support and consultancy services, companies that provide data analysis and development services, as well as law, accounting and auditing firms;

• other companies that belong to the Group to which WEROAD is part and which provide services to WEROAD;

• hotels and other accommodation facilities, car rentals, airlines, companies that provide travel insurance policies and other third parties who provide the services necessary for the realization of the booked trip;

• group leader;

• local tourism partners, for example, local travel agencies, tourist guides;

• companies offering payment and booking services;

• insurance companies.

DATA TRANSFER OUTSIDE THE UK AND EEA

In the course of providing its services, the Data Controller may transfer Personal Data outside the United Kingdom and the European Economic Area ("EEA"), for example where the travel destination is located in a country outside the UK and EEA, or where suppliers, partners or group companies involved in the delivery of the services are established outside those territories. The Data Controller is committed to ensuring that all such transfers are carried out in compliance with Chapter V of the UK GDPR and the Data Protection Act 2018.

Where Personal Data is transferred outside the UK and EEA, the Data Controller relies on one or more of the following safeguards, as applicable to the circumstances of the transfer:

• ensuring that the country or territory to which the personal data will be transferred has been deemed to provide an adequate level of protection by the Secretary of State pursuant to section 17A of the Data Protection Act 2018; or

• entering into the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as approved by the Information Commissioner under section 119A of the Data Protection Act 2018, or relying on such other appropriate safeguards as are recognised under Article 46 of the UK GDPR.

  Where no adequacy decision applies and it is not practicable to put in place an IDTA or other appropriate safeguard, as is frequently the case with local, in-destination suppliers such as local tour guides, small accommodation providers and local transport operators, the Data Controller relies on the derogations set out in Article 49(1) of the UK GDPR, in particular: (i) Article 49(1)(b), where the transfer is necessary for the performance of the contract between the Data Controller and the User (i.e. the booking and delivery of the trip); and/or (ii) Article 49(1)(c), where the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the User between the Data Controller and a third party (e.g. the Data Controller booking accommodation, transport or excursions on behalf of the User).

DATA PROCESSING METHODS

The Data will be processed in compliance with the principles of correctness, lawfulness and transparency, through manual and automated methods and through the use of paper and electronic means, in any case within the limits of the purposes of the data processing(s) established by this information and, in any case, always guaranteeing the security and confidentiality of the Data.

AUTOMATED DECISION-MAKING AND PROFILING: The Data Controller does not carry out any processing that involves solely automated decision-making, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects the Data Subject within the meaning of Article 22 of the UK GDPR. Where the Data Controller carries out profiling for the purposes of tailoring marketing communications (as described in the "User Segmentation" section above), such profiling does not involve solely automated decision-making and does not produce legal or similarly significant effects on Users. The Data Subject has the right to object to profiling at any time by contacting the Data Controller at privacy@weroad.com.

Change of purpose.

The Owner shall only use the User’s Personal Data for the purposes for which it was collected, unless the Owner reasonably considers that it needs to be used for another reason and that reason is compatible with the original purpose. The User can request an explanation as to how the processing for the new purpose is compatible with the original purpose. The User will be notified if the Owner intends to use their Personal Data for an unrelated purpose and an explanation will be given as to the lawful basis. The Owner may process Personal Data without the User’s knowledge or consent in compliance with the above rules, where this is required or permitted by law

The rights of Users

Users may exercise certain rights regarding their Personal Data processed by the Owner.

In particular, Users have the right to do the following:

• Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.

• Object to processing of their Personal Data. Users have the right to object to the processing of their Personal Data if the Owner is relying on a legitimate interest (or those of a third party). Users may object to such processing by providing a ground related to their particular situation to justify the objection. Where Personal Data is processed for direct marketing purposes, Users may object to that processing at any time without providing any justification. To learn whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

• Access their Data. Users have the right to learn if Personal Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Personal Data undergoing processing.

• Verify and seek rectification. Users have the right to verify the accuracy of their Personal Data and ask for it to be updated or corrected. The Owner may have to verify the accuracy of any new Personal Data provided by the user.

• Restrict the processing of their Personal Data. Users have the right, under certain circumstances, to restrict the processing of their Personal Data. In this case, the Owner will not process their Personal Data for any purpose other than storing it. Certain circumstances include establishing the accuracy of the Personal Data, where the use of the Personal Data is unlawful but the User does not want it erased, where the User needs the Owner to hold the Personal Data longer than they need to in order to establish, exercise or defend legal claims or where the User has objected to their use of Personal Data but the Owner needs to verify whether there are any overriding legitimate interests to allow the Owner to use it.

• Have their Personal Data deleted or otherwise removed. Users have the right, under certain circumstances, to obtain the erasure of their Personal Data from the Owner. Users can do this where there is no good reason for the continuation of the processing or where the User has successfully exercised their right to object to processing, where the Owner has processed the Personal Data unlawfully or where the Owner is required to erase the Personal Data to comply with a local law. There may be specific legal reasons that prevents the Owner from erasing the Personal Data, the User will be notified where this is the case.

• Receive their Personal Data and have it transferred to another controller. Users have the right to receive their Personal Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to controller third party without any hindrance. This provision is applicable provided that the Personal Data is processed by automated means and that the processing is based on the User's consent, on a contract which the User is part of or on pre-contractual obligations thereof.

• Lodge a complaint. Users have the right to lodge a complaint with the Data Controller regarding the processing of their Personal Data by contacting the Data Controller using the contact details set out in this privacy policy or by sending an e-mail to "privacy-complaints@weroad.com". The Data Controller will acknowledge receipt of the complaint and respond in accordance with its data protection complaints procedure. Users also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand. The ICO will expect you to have done this before reviewing your complaint.

How to exercise these rights

Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.

The Owner may need to request specific information from the User to help confirm identity and ensure the Users right to access their Personal Data (or to exercise any other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. The Owner may also contact the User to ask for further information in relation to the request to speed up response times.

Cookies

This Website uses Trackers. To learn more, the User may consult the Cookie Policy.

Additional information about Data collection and processing

Legal action

The User's Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Website or the related Services.

The User declares to be aware that the Owner may be required to reveal Personal Data upon request of public authorities.

Additional information about User's Personal Data

In addition to the information contained in this privacy policy, this Website may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, this Website and any third-party services may collect files that record interaction with this Website (System logs) use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Website and/or - as far as technically and legally feasible - sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

Should the changes affect processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.

Glossary

Lawful basis

Legitimate interest. the interest of the Owner in conducting and managing their business to enable the Owner to provide the best service/product and the best and most secure experience. The Owner will consider and balance any potential impact on the User (both positive and negative) and the rights of the User before processing any Personal Data for legitimate interests. The Owner will not use Personal Data for activities where the interests are overridden by the impact on the User (unless consent has been provided by the User or are otherwise required or permitted to by law). The User can obtain further information about the assessment of legitimate interests against any potential impact on the User in respect of specific activities.

Performance of contract. Processing of Personal Data where it is necessary for the performance of a contract between the Owner and the User to take steps at the Users request before entering into a contract.

Comply with a legal obligation. Processing of Personal Data where it is necessary for compliance with a legal obligation that the Owner is subject to.

PRIVACY POLICY for NON-UK Resident Customers

Information notice pursuant to and for the purposes of Articles 13/14 Regulation (EU) 2016/679 (GDPR)

DATA CONTROLLER

WeRoad SPA, a company part of the OneDay Group, which has its registered office at Viale Cassala, 30, Milan, 20143, tax code and VAT number 10380820968 (and which shall hereinafter be referred to as "WEROAD" or "Owner").

Contacts:

• by email privacy@weroad.com

• by mail Viale Cassala no. 30 – 20143 Milan

• The Controller has appointed a Data Protection Officer (DPO) pursuant to Article 37 of Regulation (EU) 2016/679 (GDPR). The Data Protection Officer can be contacted at the following email address: dpo@weroad.com

TYPE OF DATA PROCESSED

This information applies to the www.weroad.com website and other web pages that link to www.weroad.com

(all the web pages mentioned above, together will be referred to as the "Site").

- Navigation data automatically gathered by the Site: access and navigation data

Whenever Users access the Site, the computer systems and software procedures used to operate the Site acquire, in the course of their normal operation, access and navigation data (e.g. information on the browser used by the User, pages visited, date, time and duration of each visit, as well as other parameters relating to the User's operating system and computer environment - the "Browsing Data").

- Contact data (email and/or telephone)

- Personal data (Name, surname, place and date of birth, tax code, sex (gender), passport and/or identity document (number, date of issue, expiry date)

- other personal data provided voluntarily

On some areas of the Site (https://www.weroad.com/contacts) it is possible to contact the Owner, by email at booking@weroad.com, by phone or WhatsApp or via the Owner's Facebook® group, to request information or clarification relating to WeRoad trips and the opportunity to create partnerships.

- User preference data

Data collected as a result of Users booking a trip and relating to age, sex, and purchase preferences shown by Users.

- Driving License and willingness to drive

- Email address

(i) To activate the "Notify me" function, which allows you to be notified by email (rendered as contact data): when a WeRoad travel route is confirmed, the email addresses of users concerned are requested.

(ii) Users are also able to provide their email to WEROAD as contact information when subscribing to a newsletter service, in order to enable the user to benefit from this service and, as a result, to receive email updates on package tour destinations, the world of travel that is possible thanks to WEROAD, and other related activities of the Controller.

(iii) To contact users who have initiated a booking but have not completed it.

- First name, surname, place and date of birth, tax code, sex (gender), passport (number, issue date, expiry date) ("Personal Data"), address, email address, mobile phone number, emergency contact telephone number ("Contact data"), credit card / IBAN data ("Bank Data"), return flight information (date, time, flight number), passport scan (if required for booking purposes), ID card scan (if required for booking purposes), driving licence scan (if required for booking purposes), driving readiness, allergies and intolerances, health conditions, special needs

Gathered in certain areas of the Site where Users are required to provide specific personal data to book and purchase their WeRoad trip.

- The Interested Parties' image

Potentially collected during the trip made with WEROAD.

- First name, surname, beneficiary's first name, beneficiary's surname ("personal data"), address, beneficiary's address, beneficiary's email address, beneficiary's mobile phone number ("contact data"), credit card/IBAN data ("bank data")

Gathered in some areas of the Site where Users are required to provide specific personal data in order to purchase products from the WeRoad Shop, such as gift cards and vouchers. When the products are purchased for a third party, the data of the beneficiary is also requested.

- Data included on a medical certificate in case of cancellation

- Data relating to the round-trip flight purchased by the user

- Image and/or voice

- Contact details in case of emergencies (of a family member/friend)

- Information about flights

- Data from surveys

Data collected through surveys, both before departure and once the trip has ended, sent to users who have booked a trip.

- Data relating to facts/incidents that occurred during the trip, including any behavior in violation of the law or the WeRoader Manifesto (part of the travel agreement with each User participating in a trip)

- Cookies

The Site uses a number of computer techniques to directly acquire personal data identifying the user, consisting of "strings of code": "cookies".

For all information on the cookies enabled on the Site and the related processing of personal data, we invite you to read the relevant information in the "Cookie policy" section on our Site.

In some cases we may also process some particular data:

• allergies and intolerances, state of health, special needs communicated voluntarily by the User;

• Data contained in the medical certificate in case of cancellation of the booking.

PURPOSE AND LEGAL BASIS OF THE PROCESSING

NAVIGATION OF THE SITE: Personal Data may be processed for the collection of anonymous statistical data on the use of the Site by Users, as well as for monitoring the functioning of the Site. The legal basis is the legitimate interest of the Data Controller in making it work. and to control the Site and obtain data on its use or your consent (Art. 6, par. 1, letter f) GDPR). The interest of the Owner has been balanced with that of the User who will thus be able to benefit from an increasingly high-performance and optimized Site. The provision of Personal Data is optional, but failure to provide it, by disabling cookies in the browser, could prevent you from accessing all the functions of the Site. The Data is not stored for more than 36 months and is deleted immediately after its aggregation (except any need for ascertainment of crimes by the competent Judicial Authority). Our cookie policy is available in the "Cookie policy" section on our Site.

RESPONDING TO CONTACT REQUESTS: it is possible to contact the Owner, via email at booking@weroad.com, by telephone or WhatsApp or via the Owner's Facebook® group, to request information or clarifications relating to WeRoad trips and the possibility of creating partnerships and in general in relation to the services offered; to respond to various requests from Users (for example through the Notify Me, Newsletter, participation in AperiRoad and WeMeet services). The legal basis is the execution of pre-contractual obligations of which the interested party is a party (art. 6, par. 1, letter b) GDPR). The provision is necessary to follow up on the request. In case of failure to provide Personal Data, WEROAD will not be able to respond to the request. WEROAD will delete the Personal Data processed to respond to requests within 1 year from the closing date of the management of the request. WeRoad may store tickets in anonymous and aggregate form for internal reporting purposes (by tickets we mean the requests we receive).

USE OF THE CHATBOT: The Data Controller provides users with a virtual assistant (chatbot) through which it is possible to request information regarding the services offered. For its operation, the chatbot does not require the user to provide any personal data. The only data collected is the session ID, generated when the user starts a conversation with the chatbot. This data cannot be linked to an identified or identifiable individual. If, during the interaction with the virtual assistant (chatbot), the user voluntarily provides personal data (such as, for example, name, surname, email contact details or travel-related information), such data will be processed, in accordance with the principles set out in this privacy notice, exclusively within the scope of the requested chatbot service. Users are invited not to share third parties’ personal data or special categories of personal data, such as health-related data, with the chatbot. The legal basis for the processing is the performance of pre-contractual measures requested by the data subject (Art. 6(1)(b) GDPR). Personal data processed for handling requests will be retained for a maximum period of 12 months from the closure of the ticket. After this period, the data will be deleted. WeRoad may retain tickets in anonymous and aggregated form for statistical and internal reporting purposes.

RESPOND TO A REQUEST ABOUT A TRAVEL SHIFT ("NOTIFY ME"): The User can ask to receive information about a travel or a specific departure and save it in his/her own account. The legal basis of the processing is the execution of pre-contractual and contractual obligations of which the interested party is a party (art. 6, par. 1, letter b) GDPR). The provision of Personal Data is necessary to follow up on the interested party's request. In case of failure to provide this information, WEROAD will not be able to follow up on the interested party's request to be notified about the confirmation of a travel shift. The data will be kept for the time necessary to achieve the purpose pursued.

BOOKING A TRIP: finalizing the booking of a trip through the Site and managing the reservation made. The legal basis is the execution of pre-contractual and contractual obligations of which the interested party is a party (art. 6, par. 1, letter b) GDPR). With reference to any particular data provided (for example the state of health, any allergies), it is the express consent of the interested party (art. 9, par. 2, letter a) GDPR). The provision is necessary to follow up on the booking request. In case of failure to provide the Data, WEROAD will not be able to follow up on the request and finalize the purchase and, with reference to particular data, will not be able to follow up on the specific needs requested. The Data is stored until the execution of the purchase contract and, in any case, for 3 years (or not later than the limitation periods provided for by law and except in cases of defence in court). The particular data will be retained until the execution of the contract and for a further 6 months, unless a further period is necessary to exercise or defend a right.

USE THE “MYWEROAD” PERSONAL AREA: the user who has booked a trip has the possibility of accessing a personal area within MyWeRoad, protected by a password chosen by the User, which allows, for example, to manage and check the status of the booking and/or modify the data provided when booking a trip. The legal basis is the execution of pre-contractual and contractual obligations of which the interested party is a party (art. 6, par. 1, letter b) GDPR). With reference to any particular data provided (for example, any allergies and/or intolerances), it is the express consent of the interested party (art. 9, par. 2, letter a) GDPR). The provision is optional. In case of failure to provide the Data, the user will not be able to use the personal area. The user reserves the right to verify the user's interest in maintaining the account in the event of prolonged inactivity. The user may delete inactive accounts upon notice.

SHARING OF INFORMATION RELATING TO INTERNATIONAL FLIGHTS: the user who has booked a trip has the option to enter the data of their international flights in their personal MyWeRoad area. This information could be shared, anonymously, to the participants of the same package purchased and to the group leader of the aforementioned in order to facilitate the management of the groups, as well as communication between the trip participants and the group leader. The legal bases of the processing are the consent of the interested party (art. 6, par. 1, letter a GDPR), the execution of the contractual and pre-contractual relationship of which the interested party is a party (art. 6, par. 1, letter b GDPR), or the legitimate interest of the Data Controller (art. 6, par. 1, letter f) GDPR). The interest of the Owner has been balanced with that of the interested parties to allow them to organize travel efficiently and effectively, based on the flights of all the participants of the various groups. Entering the data is always optional. Each interested party may object to the processing at any time by removing the information from the appropriate section within the personal area. There will be no negative repercussions on the user in case of failure to enter and/or opposition to the treatment. The data will be kept for the time necessary to pursue the purpose described above.

BE INCLUDED IN THE WHATSAPP GROUP OF THE TRIP YOU ARE PARTICIPATING IN: Users who have purchased a trip are included in a WhatsApp group made up of the other participants and the group leader. The group is used to exchange organizational communications relating to the trip and is activated before departure. The legal basis of the processing is the legitimate interest of the Data Controller (art. 6, par. 1, letter f) GDPR) to allow better organization of the trip and communications between the trip participants and the group leader. The interest of the Owner has been balanced with that of the Interested Party who will be able to keep himself updated through communications within the group. The interested party can object to the processing at any time, either by leaving the WhatsApp group or by sending their request to the Data Controller. There will be no negative repercussions on the user in case of opposition to the treatment. The data will be stored for as long as necessary for the pursuit of the purpose described above.

CONTACT USERS WHO HAVE ADDED A TRIP IN THE CART: in the event of an unfinished booking, contact the relevant Users by email. The legal basis is the legitimate interest of the Data Controller (art. 6, par. 1, letter f) GDPR) to contact the User to ask if he still has an interest in finalizing the purchase or if he needs more information in relation to a particular goal. A maximum of three communications are sent. The interest of the Owner has been balanced with that of the user who will thus be able to complete, at a later time, the booking of a trip that has not yet been completed. The interested party can object to the processing. There will be no negative repercussions on the interested party in case of opposition to the treatment. The data will be stored for as long as necessary for the pursuit of the purpose described above.

CANCELING A RESERVATION: in the event that a user requests a cancellation of a reservation. The legal basis is the execution of pre-contractual and contractual obligations of which the interested party is a party (art. 6, par. 1, letter b) GDPR) and of the data contained in the medical certificate, consent (art. 9 , par. 2, letter a) GDPR). The provision is necessary to follow up on the cancellation request. WEROAD will retain the data within and, at the latest, after the period of limitation provided for by law and except in cases of defence in court.

COMMUNICATIONS IN CASES OF EMERGENCY: in order to manage communications for extraordinary emergency cases. The interested party is invited to submit this information also to his family members whose contact details are provided. The data processing is carried out in the legitimate interest of the Data Controller to allow the best management of emergencies, pursuant to article 6, par. 1, letter. f) GDPR. WEROAD will delete the data once the trip ends and in any case after 1 month from the return.

SENDING OF COMMERCIAL/PROMOTIONAL COMMUNICATIONS: for direct marketing purposes, such as sending newsletters, information and commercial communications, updates on the latest launches, offers and promotions relating to WEROAD services, via newsletter, via email or telephone, also by automated means (SMS, social media). The legal basis is the consent of the interested party (art. 6, par. 1, letter a) GDPR). The provision is optional. In case of failure to provide the Data, WEROAD will not be able to regularly update the interested party on its offers and promotions. The interested party can revoke the consent given at any time by clicking on the "unsubscribe" link included in the marketing email received or by sending an email to privacy@weroad.com. The Data processed for this purpose will be stored and processed for 5 years, without prejudice to the revocation of consent by the interested party.

In the event that the interested party has contacted WEROAD, WEROAD may contact or send the interested party communications of a commercial nature relating to the request received. In this case the legal basis of the processing is the legitimate interest of WEROAD to promote its services to the interested parties pursuant to article 6, par. 1, letter. f) GDPR. The provision is necessary for the pursuit of the legitimate interest of the Data Controller which is equally balanced with the legitimate interest of the interested parties. The processing is not mandatory and the interested party may object to said processing at any time by sending an email to privacy@weroad.com. WEROAD will delete the Personal Data processed to respond to requests within 1 year from the closing date of the management of the request. WEROAD may contact the interested party again within this period.

SOFT-SPAM: The email address could be processed to send interested parties emails relating to the promotion of WEROAD services similar to the services already purchased. The legal basis is the legitimate interest of the Data Controller to promote its services to existing customers. The interested party can object to the use of their e-mail address at any time by clicking on the "unsubscribe" link in the e-mail received or by sending an e-mail to privacy@weroad.com. WEROAD will no longer use the e-mail address after 36 months from the date of the last commercial contact with the data subject.

It is possible to revoke the consent given for marketing and commercial purposes at any time, without prejudice to the lawfulness of the processing carried out before the revocation based on the consent.

USER SEGMENTATION: for sending personalized commercial communications based on age and type of trip purchased. The legal basis is the legitimate interest of the Data Controller (art. 6, par. 1, letter f) GDPR) to improve its commercial offer. The interest of the Owner has been balanced with that of the user in being able to receive commercial communications in line with their interests. The provision is optional. There will be no negative repercussions on the user in case of opposition to the treatment. The data will be kept for 5 years from collection.

CONDUCTING SATISFACTION SURVEYS: Users who have completed a trip will receive an email communication regarding a satisfaction survey. The legal basis is the legitimate interest of the Data Controller (art. 6, par. 1, letter f) GDPR) to evaluate and improve the quality and satisfaction with the services offered. The provision is optional. Failure to provide the Data, however, will not allow us to evaluate customer expectations and satisfaction with the services offered by the Owner. The Data will be stored for 36 months from the time of collection and will subsequently be anonymized and aggregated.

PUBLICATION OF IMAGES OF INTERESTED PARTIES ON THE SITE OR SOCIAL CHANNELS OF WEROAD: the images/videos collected during the trip made with WEROAD may be published by the Owner on the Site or on social channels and/or in travel diaries. The basis of the processing is the legitimate interest of the Data Controller to promote its business (art. 6, par. 1, letter f) GDPR). The travel participant is informed of the taking of photographs/videos both in the contractual context and during the trip and has the possibility to abstain and request not to be photographed during the trip. The interested party can object at any time either by asking not to participate in the shots/filming, or by requesting the removal of the published contents by writing to privacy@weroad.com. The interest of the Owner has been balanced with that of the user in being part of the filming of group. The provision is optional. There will be no negative repercussions on the user in case of opposition to the treatment. The data will be kept for 5 years from the publication of the images unless an objection is made and the images are removed.

REPORTS RELATING TO FACTS/ACCIDENTS AND/OR NON-COMPLIANT BEHAVIOURS: the Data Controller may collect and process data relating to facts, incidents, behaviors referable to the Traveling User, which do not comply with the legislation or the WeRoader Manifesto. The legal basis is the legitimate interest of the Data Controller (art. 6, par. 1, letter f) GDPR) to verify that the travel experience complies with the company's standards and monitor/report non-compliant facts and/or behaviors with the WeRoader Manifesto or the law. The report can be made through the trip group leader, travel companions and local partners. The travel participant is informed of this possibility as soon as the travel contract is signed. Furthermore, the participant is notified in the event that there is a report from the group leader that concerns him and he has the possibility to object and lodge a complaint. The data will be kept for 36 months from the collection of the report.

MANAGEMENT OF ANY CLAIMS AND DEFENSE IN COURT: the legal basis is the execution of pre-contractual and contractual obligations of which the interested party is a party (art. 6, par. 1, letter b) GDPR) as well as the legitimate interest of the Data Controller (art. 6, par. 1, letter f). The provision is necessary both to allow the Data Controller to respond to requests made by interested parties and to defend their rights against the interested party or third parties before the competent authorities. The Data is stored for the duration of the claim and in any case within the limitation periods indicated by the law (usually 3 years without prejudice to a possible longer period, if related to personal injury).

CORPORATE OPERATIONS: Sharing personal data in connection with, or during negotiations of extraordinary operations of all or a portion of WEROAD's business. The legal basis is the legitimate interest of the Data Controller (art. 6, par. 1, letter f) GDPR). Data processing is necessary for WEROAD's legitimate interest in following up on the negotiation and execution of corporate transactions. The data stored for this purpose will be deleted at the end of the operation.

Furthermore and without prejudice to the above, the Data Controller undertakes to base the processing of Personal Data on the principles of minimization, verifying on an annual basis the need for their conservation for a period of time not exceeding that required by the purposes for which the data were collected and processed. The Data Controller may retain Personal Data to comply with the law or to exercise or defend any rights or claims in legal proceedings. Once the purposes for which the Personal Data were collected and processed have been achieved, the Data Controller will implement appropriate measures to make them anonymous, so that the interested party cannot be identified.

RECIPIENTS OF THE DATA

The Data will be processed by employees and collaborators of the Data Controller expressly authorized to process the Data on the basis of the instructions and after adopting suitable measures to protect the Data in relation to all the purposes indicated above.

The following subjects may become aware of the Data in relation to the processing purposes envisaged by this privacy policy and may process the Data both as independent data controllers and as data processors duly appointed by the Data Controller (the list of such managers and independent data controllers are available upon request via e-mail to be sent to privacy@weroad.com):

• subjects that carry out activities functional to achieving the aforementioned purposes, i.e. companies that provide IT infrastructures and IT support and consultancy services, companies that provide data analysis and development services, as well as law, accounting and auditing firms;

• other companies that belong to the Group to which WEROAD is part and which provide services to WEROAD;

• hotels and other accommodation facilities, car rentals, airlines, companies that provide travel insurance policies and other third parties who provide the services necessary for the realization of the booked trip;

• group leader;

• local tourism partners, for example, local travel agencies, tourist guides;

• companies offering payment and booking services;

• insurance companies.

DATA TRANSFER TO A NON-EU COUNTRY

Personal data may be transferred to non-EU countries, for example if the travel destination is a non-EU country.

The Data Controller undertakes to transfer personal data to third countries if necessary:

• ensuring that the country to which the personal data will be sent guarantees an adequate level of protection, as required by Article 45 of the GDPR; or

• complying with the standard contractual clauses approved by the European Commission for the transfer of personal information outside the EEA (these are clauses approved pursuant to Article 46 (2) of the GDPR).

DATA PROCESSING METHODS

The Data will be processed in compliance with the principles of correctness, lawfulness and transparency, through manual and automated methods and through the use of paper and electronic means, in any case within the limits of the purposes of the data processing(s) established by this information and, in any case, always guaranteeing the security and confidentiality of the Data.

RIGHTS OF INTERESTED PARTIES

The interested party may at any time exercise the following rights under the conditions and within the limits established by Articles 12-22 of the GDPR by sending an email to privacy@weroad.com:

• Right of access: the interested party has the right to obtain confirmation from the data controller as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to the personal data (Article 15 GDPR) ;

• Right to rectify inaccurate personal data and to obtain integration of incomplete personal data (Article 16 GDPR);

• Right to erasure of personal data: the interested party may request that their data be erased if they are no longer necessary for the aforementioned purposes, in the event of revocation of consent or opposition to the processing, in the event of unlawful processing, or there is an obligation legal cancellation (Article 17 GDPR);

• Right to limit processing: the interested party has the right to obtain the limitation of processing when one of the following hypotheses occurs: the interested party contests the accuracy of the personal data, for the period necessary for the Data Controller to verify the accuracy of such data personal; the processing is unlawful and the interested party opposes the deletion of the personal data and requests instead that their use be limited; although the Data Controller no longer needs them for the purposes of the processing, the personal data are necessary for the interested party to ascertain, exercise or defend a right in court; the interested party has objected to the processing, pending verification of the possible prevalence of the legitimate reasons of the Data Controller over those of the interested party (Article 18 GDPR);

• Right to object to processing: the interested party may object at any time to the processing of their data, unless the Data Controller demonstrates the existence of compelling legitimate reasons to proceed with the processing which prevail over the interests, rights and freedoms of the interested party or for the establishment, exercise or defense of a right in court, pursuant to Article 6(1), letters (e) or (f), of the GDPR, including profiling (Article 21 GDPR);

• Right to portability: the interested party has the right to receive the personal data concerning him or her provided to a data controller in a structured, commonly used and machine-readable format and has the right to transmit such data to another data controller processing without impediments by the data controller to whom it was provided if: the processing is based on consent, or on a contract (article 20 GDPR);

• Right to lodge a complaint with the supervisory authority (Article 77 GDPR).

In the event that you believe that the processing of personal data carried out by the Data Controller occurs in violation of the provisions of Regulation (EU) 2016/679, the interested party has the right to lodge a complaint with the Supervisory Authority, in particular in the Member State in which where he habitually resides or works or in the place where the alleged violation of the regulation occurred (in Italy the Privacy Guarantor https://www.garanteprivacy.it/), or to take action in the appropriate judicial offices.

Where the legal basis of the processing is express consent, the interested party has the right to withdraw consent at any time. The revocation of consent does not affect the lawfulness of the processing based on consent before the revocation.

Purpose/ActivityType of dataLawful basis for processing including basis of legitimate interestTo register you as a new customer.(a) Identity; (b) Contact.Performance of a contract with you.To process and deliver your booking including: (a) Manage payments, fees and charges; (b) Collect and recover money owed to us.(a) Identity; (b) Contact; (c) Financial; (d) Transaction; (e) Marketing and Communications.(a) Performance of a contract with you; (b) Necessary for our legitimate interests (to recover debts due to us).To manage our relationship with you which will include: (a) Notifying you about changes to our terms or Privacy Policy; (b) Asking you to leave a review or take a survey.(a) Identity; (b) Contact; (c) Profile; (d) Marketing and Communications.(a) Performance of a contract with you; (b) Necessary to comply with a legal obligation; (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services).To enable you to partake in a prize draw, competition or complete a survey.(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications(a) Performance of a contract with you; (b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business).To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).(a) Identity (b) Contact (c) Technical(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise); (b) Necessary to comply with a legal obligation.To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) TechnicalNecessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)To use data analytics to improve our website, products/services, marketing, customer relationships and experiences(a) Technical (b) UsageNecessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)To make suggestions and recommendations to you about goods or services that may be of interest to you(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and CommunicationsNecessary for our legitimate interests (to develop our products/services and grow our business)To monitor our communications with you in order to check any instructions given to us, for training purposes, for crime prevention, to improve the quality of our customer service and to defend legal claims(a) Identity (b) Contact (c) Technical(a) Necessary for our legitimate interests (to assist us in training our employees and defend our business in the event of a claim). (b) Necessary to comply with a legal obligation;

Change of purpose.

The Owner shall only use the User’s Personal Data for the purposes for which it was collected, unless the Owner reasonably considers that it needs to be used for another reason and that reason is compatible with the original purpose. The User can request an explanation as to how the processing for the new purpose is compatible with the original purpose. The User will be notified if the Owner intends to use their Personal Data for an unrelated purpose and an explanation will be given as to the lawful basis. The Owner may process Personal Data without the User’s knowledge or consent in compliance with the above rules, where this is required or permitted by law.

The rights of Users

Users may exercise certain rights regarding their Personal Data processed by the Owner.

In particular, Users have the right to do the following:

• Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.

• Object to processing of their Personal Data. Users have the right to object to the processing of their Personal Data if the Owner is relying on a legitimate interest (or those of a third party), Users may object to such processing by providing a ground related to their particular situation to justify the objection.. Users must know that, however, their Personal Data should be processed for direct marketing purposes, they can object to that processing at any time without providing any justification. To learn, whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

• Access their Data. Users have the right to learn if Personal Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Personal Data undergoing processing.

• Verify and seek rectification. Users have the right to verify the accuracy of their Personal Data and ask for it to be updated or corrected. The Owner may have to verify the accuracy of any new Personal Data provided by the user.

• Restrict the processing of their Personal Data. Users have the right, under certain circumstances, to restrict the processing of their Personal Data. In this case, the Owner will not process their Personal Data for any purpose other than storing it. Certain circumstances include establishing the accuracy of the Personal Data, where the use of the Personal Data in unlawful but the User does not want it erased, where the User needs the Owner to hold the Personal Data longer than they need to in order to establish, exercise or defend legal claims or where the User has object to their use of Personal Data but the Owner needs to verify whether there are any overriding legitimate interests to allow the Owner to use it.

• Have their Personal Data deleted or otherwise removed. Users have the right, under certain circumstances, to obtain the erasure of their Personal Data from the Owner. Users can do this where there is no good reason for the continuation of the processing or where the User has successfully exercised their right to object to processing, where the Owner has processed the Personal Data unlawfully or where the Owner is required to erase the Personal Data to comply with a local law. There may be specific legal reasons that prevents the Owner from erasing the Personal Data, the User will be notified where this is the case.

• Receive their Personal Data and have it transferred to another controller. Users have the right to receive their Personal Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to controller third party without any hindrance. This provision is applicable provided that the Personal Data is processed by automated means and that the processing is based on the User's consent, on a contract which the User is part of or on pre-contractual obligations thereof.

• Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

How to exercise these rights

Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.

The Owner may need to request specific information from the User to help confirm identity and ensure the Users right to access their Personal Data (or to exercise any other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. The Owner may also contact the User to ask for further information in relation to the request to speed up response times.

Cookies

This Website uses Trackers. To learn more, the User may consult the Cookie Policy.

Additional information about Data collection and processing

Legal action

The User's Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Website or the related Services.

The User declares to be aware that the Owner may be required to reveal Personal Data upon request of public authorities.

Additional information about User's Personal Data

In addition to the information contained in this privacy policy, this Website may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, this Website and any third-party services may collect files that record interaction with this Website (System logs) use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Website and/or - as far as technically and legally feasible - sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

Should the changes affect processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.

Glossary

Lawful basis

Legitimate interest. the interest of the Owner in conducting and managing their business to enable the Owner to provide the best service/product and the best and most secure experience. The Owner will consider and balance any potential impact on the User (both positive and negative) and the rights of the User before processing any Personal Data for legitimate interests. The Owner will not use Personal Data for activities where the interests are overridden by the impact on the User (unless consent has been provided by the User or are otherwise required or permitted to by law). The User can obtain further information about the assessment of legitimate interests against any potential impact on the User in respect of specific activities.

Performance of contract. Processing of Personal Data where it is necessary for the performance of a contract between the Owner and the User to take steps at the Users request before entering into a contract.

Comply with a legal obligation. Processing of Personal Data where it is necessary for compliance with a legal obligation that the Owner is subject to.

Date of update: march 2026