Privacy Policy

Waygo Inc. ("Waygo", "we", "us") provides an interactive mapping and reservation platform for events and venues. This Privacy Policy explains how we handle personal data in the situations where we decide why and how it is used — when we are what privacy law calls a controller. It covers our website, our contact and sales channels, and the accounts that our customers' staff use to operate the Waygo platform.

It does not cover the content our customers place on their maps, or the personal data of people who attend or exhibit at their events. For that data our customer is the controller, and Section 2 explains what that means for you.

1. Who we are and how to reach us

• Company: Waygo Inc., 41 Windhaven Terrace, Thornhill, Ontario, Canada L4J 7N8.
• Privacy contact: legal@waygomaps.com. Use this address for any question, request or complaint about personal data.
• Privacy Representative: Matthew Isen, CEO, who is accountable for our compliance with privacy law and can be reached at the address above.

2. When this policy applies — and when it does not

2.1 When we are the controller: this policy applies

We are the controller of your personal data, and this policy applies, if you are:

• a visitor to waygomaps.com or another site we operate;
• someone who contacts us, requests a demo, books a meeting or otherwise communicates with us;
• an account user — a person at one of our customers who logs in to the Waygo dashboard, holds an API key, or otherwise operates the platform on the customer's behalf;
• a business contact or someone who has agreed to receive marketing from us.

2.2 When we are a processor: our customer's policy applies

Our customers — event organisers, venues and their partners — use the Waygo platform to build maps and to manage the information on them. That information can include personal data: the names and contact details of exhibitors, speakers and staff; booth and session assignments; reservations; and, where a customer connects a registration or ticketing system, data about attendees and registrants.

For all of that data, the customer is the controller and we are a processor. We process it only on the customer's instructions and under the terms of our Data Processing Addendum. The customer's own privacy notice governs how it is collected and used. If you are an exhibitor, speaker, attendee or registrant and want to exercise your rights over that data, please contact the organiser of the event. If you contact us instead, we will pass your request to the organiser and let you know we have done so.

2.3 If you use a Waygo map at an event or venue

When you open a map that one of our customers has published — on your phone, on a website, or on a kiosk — the platform records a small amount of interaction data so that the map works and so that the organiser can understand how it is used: the search terms entered, the locations viewed, and the routes requested. This data is not linked to you. We do not collect or store your IP address, device identifier, cookie identifier, name or account in connection with it, and we do not combine it with any other data about you. The organiser is the controller of this interaction data; we hold it on their behalf.

3. What we collect, why, and on what legal basis

The categories below are the categories of personal data we have collected in the twelve months before the effective date of this policy and expect to collect going forward. Where a legal basis is noted, it refers to the GDPR and UK GDPR; other laws impose equivalent purpose limitations, which we apply.

3.1 Website visitors

• What: IP address, browser and device type, operating system, referring page, pages visited and time spent, and the cookie data described in Section 4. Our website hosting provider records IP addresses and request details in server logs.
• Why: to deliver the website, keep it secure, diagnose problems, and understand how it is used so we can improve it.
• Legal basis: our legitimate interests in operating and securing the website; your consent for any non-essential cookies.

3.2 People who contact us or book a meeting

• What: your name, email address, organisation, role, telephone number, the content of your message, and the details of any meeting you book through Calendly.
• Why: to respond to you, arrange demonstrations, evaluate whether the platform suits your organisation, and manage our relationship with you.
• Legal basis: steps taken at your request before entering into a contract; our legitimate interests in responding to enquiries and developing our business.

3.3 Account users

• What: your name, business email address, organisation, role and permissions within the platform; your password (stored only as a salted hash — we never see or store it in readable form); any API keys issued to you (also stored only as a hash); the date, time and IP address of logins and of significant actions you take in the platform; support correspondence; and a record of the policies you accepted, when, and which version.
• Why: to provide the platform to your organisation, authenticate you, secure accounts and detect misuse, provide support, enforce our Acceptable Use Policy, keep records we are required to keep, and send you service notices (for example, about security, downtime or changes to these policies).
• Legal basis: performance of our contract with your organisation; our legitimate interests in securing the platform and its users; compliance with legal obligations.
• Note: administrators at your organisation can see the users on their account and their roles. Your organisation is responsible for deciding who has access.

3.4 Marketing

• What: your name, email address, organisation, and your communication preferences.
• Why: to send you news about the platform, features and events that we think will interest you.
• Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in any message or by emailing us. Because we are a Canadian company, we also comply with Canada's Anti-Spam Legislation: we send commercial electronic messages only with your express or implied consent, every message identifies us and includes a working unsubscribe mechanism, and we act on unsubscribe requests within ten business days. Service notices about your account are not marketing and are sent regardless of marketing preferences.

3.5 Data we create from personal data

We may aggregate or de-identify data so that it no longer identifies any person, organisation or event, and use the result to understand and improve the platform. We maintain technical and organisational measures to prevent re-identification, we publicly commit not to attempt to re-identify such data, and we require the same of anyone we share it with.

3.6 What we do not collect

We do not intentionally collect special categories of personal data (such as health, biometric or genetic data, or data about racial or ethnic origin, religion, political opinions, sexual orientation or trade-union membership), government identification numbers, payment-card numbers, or the precise geolocation of any individual. We do not sell personal data, and we do not share it for cross-context behavioural or targeted advertising.

4. Cookies and similar technologies

• Essential cookies. The Waygo dashboard uses cookies and similar storage to keep you signed in, protect your session and secure the platform. These are necessary for the service to work and cannot be switched off while you use it.
• Your choices. Where the law requires consent for non-essential cookies — including in the European Economic Area and the United Kingdom — we ask for it before setting them and you can change your choice at any time. You can also control cookies through your browser settings. We honour browser-level opt-out signals such as Global Privacy Control where they apply.

5. How we share personal data

We share personal data only as described here. We do not sell it.

• Service providers acting on our instructions. Website hosting (Webflow, Inc.); cloud infrastructure and storage (Google LLC); database hosting (MongoDB, Inc.); transactional email delivery (Resend, Inc.); map tileset hosting + processing (Inc. Each is bound by contract to protect personal data and to use it only to provide its service to us. The providers that process our customers' platform data are also listed, with more detail, at waygomaps.com/legal/subprocessors.‍
• Your organisation. If you are an account user, the administrators of your organisation's account can see your name, email, role and activity within the platform.‍
• Professional advisers. Lawyers, accountants, auditors and insurers, under confidentiality obligations, where necessary.‍
• Legal and safety. Where required by law, regulation, court order or lawful request by a public authority; to enforce our agreements; or to protect the rights, property or safety of Waygo, our customers or others. Where a request comes from an authority outside Canada and disclosure would not be permitted under Canadian privacy law, we will not comply unless required to by a Canadian court.‍
• Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction. We will notify you and any successor will be bound by this policy.

6. International transfers

We are based in Canada. Our platform is hosted in Canada, and the service providers listed in Section 5 process data in the United States, Canada, and, in some cases, other countries. When personal data moves across borders we use the following safeguards:

• From the European Economic Area: the European Commission has recognised Canada (for organisations subject to PIPEDA) as providing adequate protection. For onward transfers to providers in the United States and elsewhere, we rely on the European Commission's Standard Contractual Clauses, or on the provider's certification under the EU–US Data Privacy Framework where applicable.
• From the United Kingdom: the UK recognises Canada as adequate. For onward transfers we rely on the UK International Data Transfer Addendum to the Standard Contractual Clauses.
• From Switzerland: the Standard Contractual Clauses, adapted as required by the Swiss Federal Act on Data Protection.
• From the Republic of Korea: where we receive personal data of individuals in Korea, the recipient is Waygo Inc. (Canada), hosted in Canada (region northamerica-northeast2); the purpose is to provide the services described in Section 3; the items transferred are those described in Section 3; the retention period is as described in Section 7; the transfer takes place over an encrypted network connection at the time the data is provided; and questions may be directed to legal@waygomaps.com. Where the law requires your separate consent to this transfer, we or the organisation that collected your data will ask for it.

You can ask us for a copy of the safeguards we rely on by emailing legal@waygomaps.com.

7. How long we keep personal data

We keep personal data only as long as needed for the purposes in Section 3, and then delete or de-identify it. Our standard periods are:

• Website server logs: [90 days].
• Enquiries and sales contacts: [24 months] after our last interaction with you, unless you become a customer.
• Account user data: for as long as your organisation's account is active, then deleted within 30 days after the end of the retrieval period that follows termination, with backup copies removed within a further [90 days]. Records of policy acceptance and security logs are kept for [7 years / 12 months respectively] to meet legal and audit obligations.
• Marketing: until you unsubscribe, after which we keep only the minimum needed to honour your preference.
• Legal, tax and accounting records: for the period required by applicable law.

Where we cannot state a fixed period, we determine it by reference to the purpose of the processing, our legal obligations, and the resolution of any dispute.

8. Security

We protect personal data with measures appropriate to its sensitivity, including encryption in transit and at rest, salted hashing of credentials, role-based access control, the principle of least privilege for our own staff, and contractual security obligations on our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or data may have been compromised, contact us immediately at legal@waygomaps.com.

9. Your rights

9.1 Rights everyone has

Wherever you are, you can ask us to tell you what personal data we hold about you, to correct it if it is inaccurate, and to delete it where we no longer need it. Account users can view and update most of their own details directly in the platform.

9.2 European Economic Area, United Kingdom and Switzerland

You have the right to access your personal data; to have it rectified or erased; to restrict or object to its processing, including processing based on our legitimate interests; to receive it in a portable format; and, where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. You also have the right to lodge a complaint with your national supervisory authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner.

9.3 California and other United States states

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we have collected about you, the sources, purposes and recipients; to access it in a portable format; to correct inaccurate information; to delete it, subject to legal exceptions; and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the preceding twelve months, so there is no need to opt out. We do not collect sensitive personal information as defined under California law. You may authorise an agent to make a request on your behalf; we will ask the agent for proof of authorisation and may ask you to verify your identity directly. We respond to verifiable requests within forty-five days, extendable once by a further forty-five days with notice. California residents may also request, under Civil Code section 1798.83, information about disclosures to third parties for their direct-marketing purposes; we do not make such disclosures.

9.4 Canada

Under PIPEDA and substantially similar provincial laws, you have the right to access the personal information we hold about you, to challenge its accuracy and completeness and have it amended, and to withdraw consent to its use, subject to legal or contractual restrictions and reasonable notice. Residents of Quebec additionally have rights under the Act respecting the protection of personal information in the private sector, including the right to request that their personal information be de-indexed or that a computerised copy be provided in a structured format. You may complain to our Privacy Representative, and if you are not satisfied with our response, to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

9.5 Republic of Korea

Under the Personal Information Protection Act, you have the right to request access to your personal information; to request its correction or deletion; to request suspension of its processing; and to withdraw consent. You may exercise these rights through the contact in Section 1, and you may lodge a complaint with the Personal Information Protection Commission or the Korea Internet & Security Agency's privacy report centre.

9.6 How to exercise your rights

• Email legal@waygomaps.com. Tell us which right you are exercising and, where relevant, which jurisdiction you are in.
• We may need to verify your identity before acting. For account users, a request from the email address on the account is usually sufficient.
• We respond within thirty days, or sooner where the law requires, and will tell you if we need longer and why.
• Exercising your rights is free. We may decline or charge a reasonable fee for requests that are manifestly unfounded or excessive, and we will explain why.
• If your request concerns data on a customer's map or about a customer's event, see Section 2.2 — we will forward it to the organiser.

10. Children

Our website and platform are directed at organisations and their staff, not at children. We do not knowingly collect personal data from anyone under sixteen (or under the higher age at which parental consent is required in your jurisdiction). If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The version number and effective date at the top of the page identify the current version, and previous versions remain available at the address below. If a change materially affects how we handle personal data about account users, we will notify the designated contact at each customer by email at least thirty days before it takes effect. We encourage you to review this page periodically.

12. Complaints

We would like the chance to resolve any concern directly — please contact us first at legal@waygomaps.com. You also have the right to complain to a supervisory authority: the Office of the Privacy Commissioner of Canada (priv.gc.ca); the Commission d'accès à l'information du Québec (cai.gouv.qc.ca); your national data protection authority in the European Economic Area (a list is maintained by the European Data Protection Board at edpb.europa.eu); the UK Information Commissioner's Office (ico.org.uk); the California Privacy Protection Agency (cppa.ca.gov) or California Attorney General; and the Personal Information Protection Commission of Korea (pipc.go.kr).

13. Contact

Waygo Inc., 41 Windhaven Terrace, Thornhill, Ontario, Canada L4J 7N8 · legal@waygomaps.com

Previous versions: none. This is the first published version.

Related: Acceptable Use Policy  ·  Data Processing Addendum  ·  Sub-processors

‍