Privacy Policy

PRIVACY POLICY 1. Data controller. The data controller of the personal data is ALARA AS, a company incorporated under the laws of Norway, with company registration number 937 674 686 and registered office at Enerhauggata 7, 0651 Oslo, Norway, owner of the VOYARA platform. Contact email: support@voyara.city. For the purposes of this Privacy Policy, references to “VOYARA”, “we”, “our” or “the platform” shall be understood as references to ALARA AS and to the services offered under the VOYARA brand. 2. Scope of application. This Privacy Policy applies to the processing of personal data carried out through VOYARA’s website, digital platform, e-book, digital products, forms, electronic communications, validation systems, promotions, benefits and other services. This Policy is addressed to users, customers, potential customers, website visitors and any person who interacts with VOYARA. 3. Applicable regulations. ALARA AS shall process personal data in accordance with the General Data Protection Regulation, as applicable in the European Economic Area, and with the applicable Norwegian data protection legislation. Where appropriate by reason of users, activity, commercial communications, electronic contracting or services directed at Spain or other countries of the European Economic Area, VOYARA shall take into account the applicable rules on digital services, consumers and electronic communications. 4. Personal data we may process. VOYARA may process the following categories of personal data: a) Identification data: name, surname, country of residence and similar data. b) Contact data: email address, telephone number and communications maintained with VOYARA. c) Account data: username, password, registration date, account status, membership, edition purchased or type of access. d) Purchase and payment data: product purchased, purchase date, amount, currency, payment method, transaction reference and data necessary to manage payments, invoicing or refunds. Full card details or other payment method data may be processed directly by external payment service providers. e) Platform usage data: benefits consulted, establishments viewed, interactions with the e- book, validations, redemptions, codes used, incidents, preferences and activity within the platform. f) Technical data: IP address, device identifiers, browser, operating system, language, date and time of access, pages visited, cookies, online identifiers and analytics data. g) Approximate or precise location data, where the user allows it or where it is necessary to show nearby benefits, establishments or location-based functionalities. h) Data voluntarily provided by the user in forms, emails, support requests, surveys, reviews, comments or communications. 5. Purposes of processing. VOYARA may process personal data for the following purposes: a) To manage the user’s registration, account, access, membership or purchase. b) To allow access to and use of VOYARA’s e-book, platform, digital products, benefits, promotions and functionalities. c) To manage payments, invoicing, purchase confirmations, refunds, incidents and support. d) To verify the user’s right to enjoy certain benefits through validation systems, QR codes, digital identifiers or other mechanisms. e) To communicate operational information to the user regarding their account, purchase, access, benefits, relevant changes or operation of the service. f) To respond to enquiries, requests, claims or incidents. g) To improve the platform, analyse its use, develop new functionalities, measure performance and optimise the user experience. h) To personalise content, recommendations, establishments or benefits shown to the user, where there is a sufficient legal basis. i) To send commercial communications, newsletters, promotions or VOYARA updates, where there is consent or another applicable legal basis. j) To prevent fraud, misuse, code duplication, unauthorised access, security issues or breaches of the Terms and Conditions. k) To comply with legal, regulatory, tax, accounting or administrative obligations. 6. Legal basis for processing. The legal bases for processing shall be, as applicable: a) Performance of a contract or application of pre-contractual measures: to manage purchases, access, accounts, memberships, digital products, benefits, validations, support and incidents. b) User consent: for certain commercial communications, non-essential cookies, precise geolocation, voluntary forms or other processing activities that require consent. c) VOYARA’s legitimate interest: to improve the platform, prevent fraud, protect the security of the service, manage incidents, analyse basic use of the service, protect VOYARA’s rights and maintain communications with existing users, provided that the user’s rights and interests do not prevail. d) Compliance with legal obligations: to meet tax, accounting, regulatory, administrative obligations or requests from competent authorities. 7. Recipients of the data. VOYARA may disclose personal data to the following categories of recipients where necessary: a) Collaborating establishments, where necessary to manage benefits, reservations, validations, promotions, incidents or services requested by the user. b) Technology providers, hosting providers, maintenance providers, web developers, analytics providers, email marketing providers, customer service providers, validation providers, security providers, communication tools or user management tools. c) Payment service providers, banks, card issuers or payment platforms necessary to process purchases, payments or refunds. d) Legal, tax, accounting advisers, auditors or other professionals where necessary for the management of VOYARA or the defence of its rights. e) Public, administrative, judicial or regulatory authorities where there is a legal obligation or valid request. VOYARA does not sell users’ personal data to third parties. 8. Collaborating establishments. When the user uses a benefit, promotion, reservation, validation or functionality linked to a collaborating establishment, VOYARA may share with such establishment the personal data strictly necessary to manage that benefit or service. In such cases, the collaborating establishment may act as an independent data controller in respect of the personal data it processes to provide its own services, comply with legal obligations, manage reservations, carry out access controls, provide customer service or handle claims. VOYARA shall not be responsible for the privacy practices of collaborating establishments when they process personal data as independent data controllers. 9. International transfers. VOYARA may use providers located inside or outside the European Economic Area. Where international transfers of personal data outside the European Economic Area take place, VOYARA shall adopt the safeguards required by applicable law, including adequacy decisions, standard contractual clauses or other legally recognised mechanisms. 10. Data retention. VOYARA shall retain personal data for as long as necessary to fulfil the purposes for which it was collected. In particular: a) Account data shall be retained for as long as the account remains active and for the period necessary to address potential liabilities. b) Purchase, payment and invoicing data shall be retained for the periods required by applicable tax, accounting or legal regulations. c) Data processed on the basis of consent shall be retained until the user withdraws such consent, unless there is another legal basis for retaining it. d) Data necessary to prevent fraud, manage claims or defend rights shall be retained for the applicable limitation periods. e) Technical data and cookies shall be retained in accordance with the periods indicated in the Cookie Policy or the relevant consent management tool. 11. User rights. The user may exercise, under the terms provided by applicable law, the following rights: a) Right of access: to obtain confirmation as to whether VOYARA processes their data and to access such data. b) Right to rectification: to request correction of inaccurate or incomplete data. c) Right to erasure: to request deletion of their data where applicable. d) Right to object: to object to certain processing based on legitimate interest or direct marketing. e) Right to restriction: to request restriction of processing in certain cases. f) Right to data portability: to receive the data provided in a structured, commonly used and machine-readable format, where applicable. g) Right to withdraw consent: to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. The user may exercise their rights by writing to support@voyara.city. VOYARA may request additional reasonable information to verify the identity of the applicant before responding to the request. 12. Complaints before a supervisory authority. The user may lodge a complaint with the competent supervisory authority. As ALARA AS is established in Norway, the main reference authority shall be the Norwegian data protection authority, Datatilsynet, without prejudice to any other authority that may be competent under applicable law. 13. Security. VOYARA shall apply appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access, improper disclosure, accidental destruction or unlawful processing. However, no digital system can guarantee absolute security. The user must adopt reasonable measures to protect their credentials, devices and account access. 14. Minors. VOYARA is not directed at minors who do not have sufficient legal capacity to contract or use its services under applicable law. Certain benefits, establishments or experiences may be subject to minimum age requirements, identification or legal restrictions. Verification of such requirements may correspond to the collaborating establishment. 15. Commercial communications. VOYARA may send commercial communications, newsletters, promotions, updates or recommendations where there is user consent or another applicable legal basis. The user may object to or unsubscribe from commercial communications at any time through the link included in the communication or by writing to support@voyara.city. 16. Cookies and similar technologies. VOYARA may use cookies, pixels, online identifiers and similar technologies to enable the functioning of the website, remember preferences, measure use of the platform, improve the user experience and, where applicable, carry out analytics or personalised communications. The user may obtain detailed information about the use of cookies, purposes, third parties and settings in the relevant Cookie Policy. 17. Automated decisions. As a general rule, VOYARA shall not make decisions based solely on automated processing that produce legal effects concerning the user or similarly significantly affect them. If VOYARA implements personalisation, recommendation or segmentation functionalities, these shall mainly be used to improve the user experience, show relevant content or prevent misuse. 18. Changes to the Privacy Policy. VOYARA may update this Privacy Policy where necessary for legal, technical, operational or commercial reasons. The updated version shall be available on the VOYARA website or platform. Where the changes are substantial, VOYARA may inform the user by reasonable means. 19. Contact. For any questions relating to this Privacy Policy or to the processing of personal data, the user may contact VOYARA at support@voyara.city. © 2026 VOYARA. All rights reserved.