Privacy Policy

1. What we process

When you make a booking:

• the name that should appear on the voucher,
• the e-mail address we send the voucher to,
• a phone number, so the guide can agree the meeting point and time with you — these services have no fixed meeting point, so without it we cannot deliver them,
• the service, date, time and number of people,
• the code of the hotel or receptionist you came through, if you came through one,
• the language you are reading the site in, so the voucher arrives in the same one.

2. What we do not process

We hold no payment details — nothing is paid on this site. We hold no address and no date of birth. The phone number is there so the guide can tell you where to meet; we use it for nothing else and we will not send you offers on it. We run no advertising pixels and no profiling, and we sell data to nobody. Visits are counted anonymously with Vercel Web Analytics — no cookie and no identifier; the cookies page has the details.

3. Why, and on what basis

• The booking and the voucher — performance of the contract you entered into by booking.
• Keeping a record of bookings and settling commission with the hotel and the provider — our legitimate interest in knowing what happened and who is owed what.
• Protecting the site from abuse (rate limiting) — our legitimate interest in the service staying up.
• Answers from the chat assistant — our legitimate interest in answering a question you asked.
• Accounting records — compliance with a legal obligation.

4. Who sees it

The provider receives your name, your phone number, the date and the number of people — they need to know who is coming and when, and they have to agree a meeting point with you.

The hotel you came through sees neither your name, nor your e-mail, nor your phone number. Its statement shows only that a booking happened, what it was for, when, and for how much, so it can check its own share.

We also use processors who run the technology for us: Vercel (hosting and anonymous visit counting), Supabase (the bookings database), Resend (sending the voucher e-mail) and OpenAI (answers from the chat assistant — it receives only the text you type into the chat, so please do not type personal details there). Some of them are based outside the European Union; where that is the case, the transfer relies on the standard contractual clauses approved by the European Commission.

5. How long we keep it

A booking is kept for three years from the date it was for. That is the window in which a dispute about a service or a commission can still arise. After that the record is anonymised (name, e-mail, phone). Accounting documents are kept for as long as the law requires. Enquiries (leads) are kept for two years from the last contact, then deleted. Outreach records are kept until the campaign ends; refusals are recorded and never contacted again.

6. Places to stay that we approach

This section is not about guests. It is about the hotels, guesthouses and hostels we send a first e-mail to. They did not give us their address — we took it from OpenStreetMap and from their own websites, where they published it. Article 14 GDPR requires us to say so, which is why a link to this page sits in the footer of that e-mail.

What we keep about them: name, address, the public e-mail and phone number, the website, the company number and the director's name from the public register, the Google Maps rating, and notes on how the conversation is going. None of it is sensitive and none of it comes from a private source.

The legal basis is legitimate interest — approaching a business with an offer that concerns its own trade. We keep the record until the campaign ends; if someone tells us they are not interested, we write that down and stop writing.

Reply to the e-mail or write to hello@waygo.cz and we delete the record.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to portability, and to object to processing based on legitimate interest. Write to hello@waygo.cz — we answer within a month.

If you think we are handling your data badly, you can complain to the Czech Data Protection Authority.