PRIVACY POLICY - WeMeet by WeRoad App
Information document pursuant to and for the purposes of articles 13/14 Regulation (EU) 2016/679 (GDPR)
This information applies to the "WeMeet by WeRoad" App and its users, both visitors and registered users ("Users").
DATA CONTROLLER
WeRoad S.p.A., a company belonging to the OneDay Group, with its registered office in Milan, Viale Cassala, 30, 20143, Tax Code and VAT No. 12474100968, Milan Companies Register 05/07/2022 No. 12474100968 | R.E.A. No.: MI-2664339; PEC for traveler complaints: [email protected]; PEC for administration: [email protected].
(hereinafter referred to as “WEROAD” or the “Data Controller”).
Contacts:
Email: [email protected]
Postal mail: Viale Cassala n. 30 – 20143 Milan
The Data Controller has appointed a Data Protection Officer (DPO) pursuant to Article 37 of EU Regulation 2016/679 (GDPR). The DPO can be contacted at the following email address: [email protected]
TYPE OF DATA PROCESSED
We may process the following personal data:
Personal data: Name, surname, place and date of birth, sex (gender), tax identification number or fiscal code
Contact details (email and/or telephone)
other personal data transmitted voluntarily: In some areas of the App it is possible to contact the Owner to ask for information or clarifications regarding the Events.
Data relating to the preferences of Users collected following registration and relating to the interests of Users.
Payment details such as credit card / IBAN ("Bank Details")
Data relating to the Event booked by the user
Image
Data contained in surveys
Generic location (not precise)
Data relating to facts/incidents that occurred during the event, including any behavior that violates the law, the WeRoader Manifesto, the Community Regulations (part of the agreement with each User participating in an event)
App usage data
Cookies For all information on cookies active on the App and on the related processing of personal data, we invite you to read the relevant information in the "Cookie policy" section.
In some cases we may also process some particular data:
allergies and intolerances.
("Personal Data")
PURPOSE AND LEGAL BASIS OF THE PROCESSING
The following processing takes place within the App:
CREATING AN ACCOUNT FOR THE APP: To allow the User to register for the App and use the services within it. The personal data processed are name, surname, date of birth, sex (gender). In the event that the user has a "MyWeRoad" profile, they can use the credentials of that profile to access the App. The MyWeRoad account data will therefore be shared by WeRoad s.p.a. (part of the WeRoad Group) with the Data Controller. The legal basis is the execution of pre-contractual and contractual obligations to which the Data Subject is party (art. 6, par. 1, lett. b) GDPR). The provision is necessary to follow up on the request. In the event of failure to provide the Data, the user will not be able to register for the App. The Personal Data is kept until the cancellation of their account by the Data Subject. The Data Controller reserves the right to verify the user's interest in maintaining the account in the event of prolonged inactivity. The Data Controller may, upon notification, delete inactive accounts. The data subject can update their data at any time.
REGISTER FOR A "WEMEET" EVENT ("Event"): in order to allow participation in the Event by booking within the App. The legal basis is the execution of pre-contractual and contractual obligations to which the Data Subject is party (art. 6, par. 1, lett. b) GDPR). The provision is necessary to follow up on the request and, with reference to particular data, will not be able to follow up on the specific needs requested. Personal Data is kept until the execution of the event and will subsequently be kept for the following 12 months, except for the need to keep it for a subsequent term where required by applicable law.
WITHDRAW PARTICIPATION IN AN EVENT: in order to allow the User to cancel the reservation for an Event. The legal basis is the execution of contractual obligations to which the Data Subject is party (art. 6, par. 1, lett. b) GDPR). For data eventually provided in the form to indicate the reason for withdrawal, the legal basis of the processing is the consent of the data subject (art. 6, par. 1, lett. a) GDPR). The conferment is necessary to follow up on the request, while the conferment of data within the form is optional. Personal Data is kept until the execution of the withdrawal request and for the following 12 months, except for the need to keep it for a subsequent period if required by applicable law.
PURCHASE OF MEMBERSHIP SERVICES ("Membership"): to finalize and manage the payment of the Membership through the App. The legal basis is the execution of pre-contractual and contractual obligations to which the Data Subject is party (art. 6, par. 1, lett. b) GDPR). The provision is necessary to follow up on the request. In case of failure to provide the Data, WEROAD will not be able to follow up on the request and finalize the purchase. The Personal Data is kept until the execution of the purchase contract and, in any case, not beyond the limitation periods provided for by law and except in cases of defense in court.
CREATION OF A PUBLIC PROFILE: to allow the registered User to create a public profile and enter personal data such as image, description and interests, make known and visible to other users the events in which they participate. The legal basis is the consent of the data subject (art. 6, par. 1, lett. a) GDPR). The provision is optional. In case of failure to provide the Data, WEROAD will not be able to publish this information and make the profile public. The data subject can revoke the consent given at any time within their personal area or by sending an e-mail to [email protected]. Personal Data is kept until the withdrawal of consent or until the cancellation of the account by the Data Subject.
SHARING ON YOUR PUBLIC PROFILE THE DATA OF THE TRIPS IN WHICH THE USER HAS PARTICIPATED/BOOKED: to allow the User to share on their public profile within the App information regarding the trips in which they have participated and/or booked through the site
INFORM THE USER OF A NEARBY EVENT: to inform the User via email, push notifications (if activated) or in the "Events near you" section of the App, of a nearby Event based on the generic location entered. The legal basis is the consent of the data subject (art. 6, par. 1, lett. a) GDPR). The provision is optional. In case of failure to provide Personal Data, WEROAD will not be able to regularly update the interested party regarding bookable Events nearby. The interested party can revoke the consent given at any time within their personal area or by sending an e-mail to [email protected]. The Personal Data processed for this purpose will be kept until the user revokes consent, revokes the generic location entered or until the cancellation of their account by the Data Subject.
BE INSERTED INTO THE WHATSAPP GROUP OF THE EVENT IN WHICH YOU PARTICIPATE: Users who participate in an Event can be inserted into a WhatsApp group formed by the other participants and the organizer of the Event ("Event Creator") to efficiently communicate the related organizational matters and/or requests of the participants in the Event. The legal basis of the processing is the consent of the data subject (art. 6, par. 1, lett. a) GDPR). With reference to any particular data provided (any allergies, food preferences), the legal basis is the express consent of the Data Subject (art. 9, par. 2, lett. a) GDPR). The interested party can revoke the consent given at any time by sending an e-mail to [email protected] or leaving the WhatsApp group. The data will be kept for the time necessary to pursue the aforementioned purpose and the WhatsApp Group will be deleted within 3 months from the end of the Event, without prejudice to the revocation of consent by the Data Subject. It is specified that in the event that the Event is not organized directly by the Owner, but by a different subject, the data will be communicated to that subject for the purpose of creating and managing the WhatsApp group of the related event.
INFORM USERS OF THE SERVICES THROUGH PUSH NOTIFICATIONS OF THE APP: the push notifications of the App are notifications that can be displayed on the mobile device, on the lock screen or on the home screen, even when the user is not actively using the 'App, which are sent to inform Users of WEROAD's services, news, offers and promotions. The legal basis is the consent of the data subject (art. 6, par. 1, lett. a) GDPR). The provision is optional. In case of failure to provide the Data, WEROAD will not be able to regularly update the interested party on its services, news, offers and promotions via push notifications. The interested party can revoke the consent given at any time through the settings of the mobile device. The Data processed for this purpose will be kept for as long as push notifications are active.
REVIEWS: Users who have concluded an Event will receive a communication via the App requesting an evaluation of the Event with the possibility of leaving a review that will be published in the App. The legal basis is the legitimate interest of the Owner (art. 6, par. 1, lett. f) GDPR) to evaluate and improve the quality and satisfaction with respect to the services offered and for the publication of the review the consent of the data subject (art. 6, par. 1, lett. A) GDPR) who is free to write nothing. The provision is optional. Failure to provide Personal Data, however, will not allow to evaluate the expectations and satisfaction of Users with respect to the services offered by the Owner. The Data will be kept for 24 months from the moment of collection and will subsequently be anonymized and aggregated.
ANALYSIS OF BEHAVIORS TO IMPROVE SERVICES: Within the app we collect information relating to the use and interaction with the features (for example, tapping on buttons, using filters, RSVPs to events, check-in), in order to analyze and improve the user experience. This data can be processed in aggregate form or, if associated with the account, in individual form, proposing content and services more suited to the preferences of Users within the App. The legal basis is the legitimate interest of the Owner (art. 6, par. 1, lett. f) GDPR) to optimize and improve the experience of Users within the App. The provision of data is optional. The interested party can object at any time by writing to [email protected]. There will be no negative repercussions on the User in case of opposition to the processing. The data will be kept for 24 months, after which they will be processed anonymously and aggregated for internal reporting purposes.
RESPOND TO CONTACT REQUESTS: it is possible to contact the Owner through the App, to ask for information or clarifications regarding the Events and in general in relation to the services offered. The legal basis is the execution of pre-contractual obligations to which the Data Subject is a party (art. 6, par. 1, lett. b) GDPR). The provision is necessary to follow up on the request. In case of failure to provide Personal Data, WEROAD will not be able to respond to the request. WEROAD will delete the Personal Data processed to respond to requests within 1 year from the date of closure of the request management. WeRoad may keep tickets anonymous and aggregated for internal reporting purposes (by tickets we mean the requests we receive).
SENDING COMMUNICATIONS OF A COMMERCIAL/PROMOTIONAL NATURE: for direct marketing purposes in relation to Events and App news, offers and promotions relating to the App's services, via newsletter, email or telephone, including automated means (SMS, social media). The legal basis is the consent of the data subject (art. 6, par. 1, lett. a) GDPR). The provision is optional. In case of failure to provide the Data, WEROAD will not be able to regularly update the interested party on its offers and promotions. The interested party can revoke the consent given at any time by clicking on the "unsubscribe" link included in the marketing email received or by sending an email to [email protected]. The Data processed for this purpose will be kept and processed for 2 years, without prejudice to the revocation of consent by the Interested Party. The Data Controller reserves the right to verify the user's interest in receiving communications in the event of prolonged inactivity.
SOFT-SPAM: The email address may be processed to send emails to interested parties relating to the promotion of Events similar to the services already purchased. The legal basis is the legitimate interest of the Data Controller to promote its services to existing customers. The interested party can object to the use of their email address at any time by clicking on the "unsubscribe" link in the email received or by sending an email to [email protected]. WEROAD will no longer use the email address after 24 months from the date of the last commercial contact with the interested party.
REPORTS RELATING TO FACTS/INCIDENTS AND/OR NON-COMPLIANT BEHAVIOR: the Data Controller may collect and process data relating to facts, incidents, behavior attributable to the User who participated in the Event, not compliant with the regulations or the Community Regulations. The legal basis is the legitimate interest of the Owner (art. 6, par. 1, lett. f) GDPR) to verify that the Event experience complies with the company standard and to monitor/report facts and/or behaviors that do not comply with the Community Regulations or the law. The report can be made through the Event Creator. The participant in the Event is informed of this possibility from the moment of booking the Event. Furthermore, the participant is notified in the event that there is a report from the Event Creator concerning him and the same has the possibility to object and lodge a complaint. The data will be kept for 36 months from the collection of the report.
MANAGEMENT OF ANY CLAIMS AND DEFENSE IN COURT: the legal basis is the execution of pre-contractual and contractual obligations to which the Interested Party is a party (art. 6, par. 1, lett. b) GDPR) as well as the legitimate interest of the Owner (art. 6, par. 1, lett. f). The provision is necessary both to allow the Owner to respond to requests made by the Interested Parties and to defend their rights against the interested party or third parties before the competent authorities. The Data are kept for the duration of the claim and in any case within the limitation periods indicated by the law (generally 3 years except for a longer period, if related to damage to the person).
CORPORATE TRANSACTIONS: share personal data in relation to, or during, negotiations of extraordinary transactions of all or part of WEROAD's business. The legal basis is the legitimate interest of the Owner (art. 6, par. 1, lett. f) GDPR). The processing of data is necessary for the legitimate interest of WEROAD to follow up on the negotiation and execution of corporate transactions. The data stored for this purpose will be deleted at the end of the transaction.
Furthermore, and without prejudice to the foregoing, the Data Controller undertakes to base the processing of Personal Data on the principles of minimization, verifying on an annual basis the need for their storage for a period of time not exceeding that required by the purposes for which the data were collected and processed. The Data Controller may retain Personal Data to comply with the law or to exercise or defend any right or claim in legal proceedings. Once the purposes for which the Personal Data have been collected and processed have been achieved, the Data Controller will implement appropriate measures to make them anonymous, so that the data subject cannot be identified.
ACCOUNT AND DATA SHARING
The WeRoad Group, in order to allow a better use of the services and user experience, has configured a single account that can be used both to access the personal MyWeRoad area of the WeRoad sites and in the personal area of the App.
The official WeRoad websites are managed, as independent data controllers, by the following companies:
www.weroad.it - WeRoad Italia S.r.l.
www.weroad.es - WeRoad Viajes S.A.
www.weroad.fr - WeRoad France SAS
www.weroad.de - WeRoad Germany GmbH
www.weroad.com - WeRoad S.p.a. and WeRoad UK Ltd.
If a user already has a MyWeRoad profile created on one of the sites listed above, they can access the App using the same credentials. In this case, the WeRoad Group company where the user originally created their account will share the user's data with the Data Controller, in order to allow access and use of the services via the App.
Conversely, if the user has created an account directly through the App and wishes to access the MyWeRoad personal area of one of the WeRoad Group sites (in the absence of an already existing profile), the Data Controller will share the data relating to the account with the competent Group company, for the sole purpose of enabling access.
The privacy policies of the WeRoad Group companies can be consulted directly on their respective official websites indicated above.
DATA RECIPIENTS
Your personal data are processed by employees and collaborators of the Data Controller who are expressly authorized to process them under our instructions, and protected by appropriate organizational and technical measures.
The following categories of external recipients may also access or process your data, either as independent controllers or as processors appointed by WeRoad (all bound by EU Standard Contractual Clauses where applicable). For details or a full list of processors, contact [email protected]:
Advertising & Analytics Providers
Meta Platforms, Inc. (Meta SDK, Pixel) – ad delivery, retargeting, social plug-ins
TikTok Inc. (TikTok SDK, Pixel) – ad delivery, retargeting, social plug-ins
Google LLC (Google Ads, Firebase SDK) – campaign measurement, analytics, crash reporting
Apple Inc. (SKAdNetwork, IDFA via ATT) – ad attribution on iOS
Firebase – app analytics and crash reports
In-App Purchase & Payment
RevenueCat, Inc. – in-app subscription and purchase management
Payment processors – e.g. credit card networks, banks, payment gateway providers
Event & Community Management
Event Creator – organization and communication for each WeMeet event (e.g. WhatsApp groups)
Insurance companies – where required for event coverage
IT, Development & Support
IT infrastructure, hosting and support vendors
Software development and data-analysis consultants
Law firms, auditors and accountants
WeRoad Group Companies
Sharing of account and profile data between WeRoad Spa and its country-specific subsidiaries (WeRoad Italia S.r.l., WeRoad Viajes S.A., WeRoad France SAS, WeRoad Germany GmbH, WeRoad UK Ltd.) solely to enable single-sign-on and service continuity across platforms.
COOKIE AND SIMILAR TECHNOLOGIES
WeMeet App uses cookies and similar tracking technologies to ensure the App’s basic functions, to analyze usage, and to deliver relevant advertising. We classify them as follows:
Strictly Necessary Cookies
Purpose: Enable core functionality (e.g. login, security, account management).
Data: Session identifiers, device type.
Legal basis: Art. 6(1)(b) GDPR (contractual necessity).
Analytics Cookies
Purpose: Measure and improve app performance and user experience.
Providers: Firebase Analytics.
Data: Screen views, button taps, crash reports.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Marketing / Profiling Cookies
Purpose: Build user segments, retargeting, ad attribution.
Providers: Meta Pixel, TikTok Pixel, Google Ads, Apple Search Ads.
Data: Device identifiers (IDFA, GAID), in-app events, referral URLs.
Legal basis: Art. 6(1)(a) GDPR (consent).
Consent management
On account creation, Users see a consent screen with options to accept or decline Marketing consent.
Users can change their preferences at any time via the “Tracking Preferences” screen in the App.
Retention
Analytics data: 24 months
Marketing/profiling data: 12 months
At end of each period, data are anonymized or deleted.
IOS TRACKING TRANSPARENCY (ATT)
When you open the App on an iOS device, we will request your permission to access your Identifier for Advertisers (IDFA).
If you grant permission, we may share your IDFA with advertising partners to:
Measure ad campaign performance
Deliver personalized ads
If you decline, we will not access or share your IDFA, but the App will continue to work normally.
You can change your ATT preference anytime in your device’s Profile > Tracking Preferences.
DIRECT MARKETING AND ADVERTISING CAMPAIGNS
We run advertising campaigns on Google Ads, Apple Search Ads, Meta and TikTok to promote our services. With your consent, we collect and process:
Search terms you use to find us
Device identifiers (IDFA, GAID)
In-app events (e.g., installs, purchases)
This data helps us:
Measure campaign effectiveness
Optimize ad delivery
Retarget users with relevant offers
Retention: Campaign data are stored for up to 24 months, then aggregated or anonymized.
CONSENT MANAGEMENT PLATFORM
We use a centralized Consent Management Platform hosted at WeRoad to manage all cookie, analytics and marketing consents.
Access & Control: Users can review or modify their preferences at any time by visiting our consent portal:
https://my.weroad.com/account/consents Scope: all in-app and on-site tracking technologies (analytics, profiling, advertising) are governed by the choices made in this portal.
Audit Trail: all consent events are logged for compliance purposes.
TRANSFER OF DATA TO A NON-EU COUNTRY
Personal data will be processed in the EU.
The Data Controller undertakes to transfer personal data to third countries if necessary:
ensuring that the country to which the personal data will be sent guarantees an adequate level of protection, as required by Article 45 of the GDPR; or
complying with the standard contractual clauses approved by the European Commission for the transfer of personal data outside the EEA (these are clauses approved pursuant to Article 46(2) of the GDPR).
METHODS OF DATA PROCESSING
The Data will be processed in compliance with the principles of correctness, lawfulness and transparency, through manual and automated methods and through the use of paper and electronic means, in any case within the limits of the purposes of the data processing established by this information and, in any case, always guaranteeing the security and confidentiality of the Data.
RIGHTS OF THE INTERESTED PARTIES
The interested party may at any time exercise the following rights under the conditions and within the limits set forth in Articles 12-22 of the GDPR by sending an email to [email protected]:
Right of access: the interested party has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, to obtain access to the personal data (Article 15 GDPR);
Right to rectification of inaccurate personal data and to have incomplete personal data completed (Article 16 GDPR);
Right to erasure of personal data: the data subject may request that his or her data be erased, if they are no longer necessary for the aforementioned purposes, in the event of withdrawal of consent or his or her opposition to the processing, in the event of unlawful processing, or if there is a legal obligation to erase (Article 17 GDPR);
Right to restriction of processing: the data subject has the right to obtain restriction of processing where one of the following applies: the data subject contests the accuracy of the personal data, for the period necessary for the Controller to verify the accuracy of such personal data; the processing is unlawful and the data subject opposes erasure of the personal data and requests instead that its use be restricted; although the Controller no longer needs it for the purposes of processing, the personal data are necessary for the data subject to ascertain, exercise or defend a right in court; the data subject has opposed the processing, pending verification as to whether the Controller's legitimate grounds override those of the data subject (Article 18 GDPR);
Right to object to processing: the data subject may object at any time to the processing of his or her data, unless the Controller demonstrates the existence of compelling legitimate grounds for proceeding with the processing that override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of a legal claim, pursuant to Article 6(1), letters (e) or (f), of the GDPR, including profiling (Article 21 GDPR);
Right to portability: the data subject has the right to receive in a structured, commonly used and machine-readable format personal data concerning him or her which he or she has provided to a controller and has the right to transmit those data to another controller without hindrance from the controller to whom he or she has provided them where: the processing is based on consent, or on a contract (Article 20 GDPR);
Right to lodge a complaint with the supervisory authority (Article 77 GDPR).
In the event that the data subject considers that the processing of personal data carried out by the Controller is in violation of the provisions of Regulation (EU) 2016/679, the data subject has the right to lodge a complaint with the Supervisory Authority, in particular in the Member State in which he/she habitually resides or works or in the place where the alleged violation of the regulation occurred (in Italy the Privacy Guarantor
Where the legal basis for processing is express consent, the data subject has the right to revoke consent at any time. Revocation of consent does not affect the lawfulness of processing based on consent before revocation.
Update date: September 2025