Privacy policy

1. Who is responsible for your data?

JSC Waavo (Waavo), Ukmergės 283B, LT-06313 Vilnius, Lithuania, is the controller of personal data described in this policy. For privacy questions or to exercise your rights, email [email protected] or write to this address.

This policy covers the waavo.com promotional website, contact and business enquiry forms, and enquiries submitted to Waavo through LinkedIn Lead Gen Forms. Our booking products and travel agencies using those products may provide separate privacy notices for their services and traveller data.

2. What information do we collect?

• Contact and business enquiries: your name, email, company, phone number if supplied, preferred call time, topic, message, and answers about your business, market, products and needs. We also record the submission time and language. The website forms ask for your permission to be contacted about the request.
• LinkedIn Lead Gen Forms: the contact and professional details you submit, such as your name, business email, phone number, company and job title, together with your answers to the questions shown on the form. The fields depend on the particular form; we receive the details you choose to submit from LinkedIn.
• Correspondence: the information you provide when discussing your request with us.
• Website use and security: technical information such as IP address, browser and device information, requested URLs, timestamps and error information. If analytics is enabled, Google Analytics also processes information about page visits and interactions as described below.

Please do not include passport details, payment card information, health information or other sensitive personal data in an enquiry. The information requested as required on a form is needed to handle it; optional fields may be left blank.

3. Why do we use your information?

• To answer your enquiry, arrange a call or demonstration and discuss suitable products. For website forms, we rely on your consent to be contacted (GDPR Article 6(1)(a)). For business enquiries through LinkedIn or direct correspondence, we rely on our legitimate interest in responding to the request and communicating with your business (Article 6(1)(f)), or on consent where the form asks for it. Where you personally request steps towards a contract, Article 6(1)(b) applies.
• To operate and protect the website, prevent spam and investigate faults. We rely on our legitimate interest in keeping our website and communications secure and reliable (Article 6(1)(f)). This includes technical logs and anti-spam checks, including Cloudflare Turnstile when enabled on a form.
• To understand website use. Analytics cookies require your consent (Article 6(1)(a)). See the cookies section for the distinction between cookies and cookieless measurements.
• To meet legal obligations and handle legal claims. We process relevant records where required by law (Article 6(1)(c)) or where necessary for our legitimate interest in establishing, exercising or defending claims (Article 6(1)(f)).

Submitting an enquiry is not a subscription to a newsletter. If we ask for permission for separate marketing communications, you may refuse or withdraw that permission. You can also ask us to stop following up on your enquiry at any time by emailing [email protected].

4. LinkedIn enquiries

When you submit a Waavo Lead Gen Form on LinkedIn, we use the information to respond to the request described on that form, for example to contact you about our software or arrange a demonstration. Only submit a form if you want us to receive those details and follow up on that request.

LinkedIn also processes information for its own platform purposes under its Privacy Policy. This policy describes Waavo's use of the information we receive; it does not replace LinkedIn's policy.

5. Who receives your information?

Access is limited to people who need the information to deal with your request or operate our services. We use service providers for hosting and storage, email delivery, website security and error monitoring. These providers process information as needed to deliver their services. Google provides website analytics, and LinkedIn provides the platform on which its lead forms are submitted.

We may also disclose relevant information to professional advisers or competent authorities when necessary to meet legal obligations or handle legal claims.

Some providers, including Google and LinkedIn, process data outside the European Economic Area. Where we transfer personal data to a provider outside the EEA, applicable safeguards are required, such as an adequacy decision or the European Commission's standard contractual clauses. Contact us for information about the safeguards relevant to your data.

6. How long do we keep your information?

We retain enquiry details and correspondence for as long as needed to handle your request and any resulting business discussions. In deciding what remains necessary, we consider whether the enquiry is still active, the date and content of our last exchange, whether a customer relationship follows, and any applicable legal or claims requirements.

Technical and security records are kept for the period needed to operate the website and investigate incidents. Records required for legal obligations or a dispute may need to be retained longer. If you ask us to stop contacting you, we may retain the minimum information needed to respect that request. You can contact us to ask about retention or request deletion of your particular data.

7. Cookies, local storage and analytics

The website uses necessary session and security technologies for forms and administration. Your browser may also store your theme preference and, when analytics is enabled, your cookie choice in local storage (the waavo-consent key). Local storage remains until it is replaced or you clear it in your browser.

When Google Analytics is enabled, the _ga and _ga_* cookies are used only after you accept analytics. They distinguish visitors and sessions. You can decline or withdraw acceptance through Cookie settings in the footer; withdrawing also removes the Google Analytics cookies accessible to this site.

The site uses Google Consent Mode: before acceptance, or after refusal, Google may still receive cookieless measurements, such as page URLs, browser information and consent status. Declining analytics prevents analytics cookie storage; it does not prevent these network requests. We rely on our legitimate interest in obtaining limited website usage measurements for this processing. See Google's Privacy Policy for its processing and retention information. Your browser settings can clear stored data or block requests to third parties.

8. Your rights

Subject to the conditions in the GDPR, you can request access to your personal data, correction, deletion, restriction of processing or a portable copy of data processed by automated means on the basis of consent or contract.

You can object to processing based on legitimate interests on grounds relating to your situation, and object to direct marketing at any time. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Send requests to [email protected]. We may need information to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain it.

You can complain to Lithuania's State Data Protection Inspectorate or the supervisory authority where you live, work or believe an infringement occurred.

9. Automated decisions

We do not use website or lead-form enquiries to make solely automated decisions that have legal or similarly significant effects on you.

10. Changes to this policy

We may update this policy when our practices change. The date at the top identifies the latest version. For questions about this policy, contact [email protected].