Legal
Privacy Policy
Effective date: 1 June 2025 · Last updated: 27 May 2026
This Privacy Policy describes how Nawigo Srl (“Nawigo”, “we”, “us”) collects, uses and protects your personal data when you visit nawigo.com or interact with our early access programme. We are committed to complying with Regulation (EU) 2016/679 (GDPR), the Italian Personal Data Protection Code (D.Lgs. 196/2003 as amended by D.Lgs. 101/2018), and the Garante per la Protezione dei Dati Personali guidelines, including the Cookie Guidelines of 10 June 2021.
01Data Controller
The data controller for personal data collected through this website is:
Nawigo Srl (Startup Innovativa)
Via Senorbì 89/A · 00148 Roma (RM) · Italy
Partita IVA / C.F.: IT18173191000
REA: RM-1766527
Registro Imprese: RI/PRA/2025/426530/800
PEC: nawigo@pec.it
Email privacy: privacy@nawigo.com
A Data Protection Officer (DPO) has not been appointed at this stage, as Nawigo does not carry out large-scale systematic monitoring of individuals nor process special categories of data on a large scale (Art. 37 GDPR). This assessment will be reviewed as the platform scales.
02Data We Collect
We collect only what we actually need — no more. Depending on how you use our site, this may include:
Email address — collected when you sign up for early traveler access or submit an application as a hotel/stay or creator.
First name — collected voluntarily during traveler registration.
Property details — for hotels and stays: property name, type, location, your name and professional role.
Professional profile — for creators: role, link to published work and territory or topic covered.
Referral code — a unique code generated when you join the early access list, used to manage the referral programme.
Technical data — IP address (anonymised), browser type, device type, pages visited, time and duration of visit, collected automatically via cookies and analytics tools.
We do not collect special categories of data (Art. 9 GDPR), biometric data, financial data or data from minors.
03Purposes & Legal Basis
We process your personal data only for specific, explicit and legitimate purposes. For each purpose we identify the applicable legal basis under Art. 6 GDPR:
| Purpose | Data used | Legal basis |
|---|---|---|
| Managing early access registration and communicating your position in the list | Email, name, referral code | Art. 6.1.b — Performance of a contract / pre-contractual steps |
| Reviewing hotel, stay and creator applications and contacting you regarding the outcome | Email, name, property or professional details | Art. 6.1.b — Pre-contractual steps at the request of the data subject |
| Sending updates about the Nawigo beta launch, access confirmations and platform news | Email, name | Art. 6.1.a — Consent (given at registration; withdrawable at any time) |
| Managing the referral programme and attributing invitations correctly | Email, referral code | Art. 6.1.b — Performance of a contract |
| Analysing website usage to improve our services (anonymised analytics) | Anonymised technical data | Art. 6.1.f — Legitimate interest (improvement of services); requires cookie consent |
| Preventing fraud and ensuring website security | IP address, technical data | Art. 6.1.f — Legitimate interest (security) |
| Complying with legal obligations (tax, accounting, regulatory) | As required by law | Art. 6.1.c — Legal obligation |
Regarding legitimate interest: where we rely on legitimate interest, we have carried out a balancing test and concluded that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interest at any time (see Section 8).
04Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected, applying the principle of storage limitation (Art. 5.1.e GDPR):
| Data type | Retention period | Reason |
|---|---|---|
| Early access registrations (travelers) | 36 months from registration, or until you request deletion | Pre-launch and early beta period |
| Hotel and stay applications | 24 months from submission | Review period and potential onboarding |
| Creator applications | 24 months from submission | Review period and potential onboarding |
| Marketing communications consent | Until consent is withdrawn | Consent-based processing |
| Anonymised analytics data | 26 months | Standard analytics retention |
| Legal and accounting records | 10 years | Italian civil and tax law obligation |
At the end of the retention period, data is securely deleted or irreversibly anonymised. You may request early deletion at any time (see Section 8).
05Data Sharing
We do not sell, rent or trade your personal data. We share data only in the following limited circumstances, appointing third parties as data processors under Art. 28 GDPR agreements where required:
Email delivery provider — to send transactional and marketing emails. Operates under a Data Processing Agreement.
Web analytics provider — to analyse anonymised website traffic. IP addresses are anonymised before processing.
Hosting and infrastructure provider — to operate and maintain the website securely.
Referral management system — to track and attribute referral codes correctly.
Legal and regulatory authorities — where required by Italian or EU law, court order or regulatory investigation.
Business successors — in the event of a merger, acquisition or sale of assets, your data may be transferred under the same privacy protections, with prior notice to you.
All data processors are selected for GDPR compliance and are contractually bound to process data only on our documented instructions.
06International Transfers
Some of our data processors are located outside the European Economic Area (EEA), primarily in the United States. We ensure all international transfers are protected by one or more of the following mechanisms:
EU-US Data Privacy Framework (DPF) — adopted by the European Commission on 10 July 2023 (Decision 2023/1795). We use US providers certified under the DPF where available, as this provides an adequate level of protection equivalent to EU standards.
Standard Contractual Clauses (SCCs) — the 2021 EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) for transfers not covered by the DPF.
Adequacy decisions — for transfers to countries recognised by the European Commission as providing adequate protection.
You may request specific information about the transfer mechanisms applicable to each processor by writing to privacy@nawigo.com.
07Referral Programme
When you join the Nawigo early access list, you receive a unique personal referral code. This section explains how data is processed in connection with this programme.
Your referral code is generated automatically and linked to your email address. It is stored to track referrals and calculate your position in the access list.
When someone uses your code, we record the relationship between your code and the new registrant’s email for the sole purpose of managing the referral programme. We do not share either party’s personal data with the other.
Data of invited persons who have not yet registered is not collected or stored. The referral link simply directs them to our registration page.
Referral data is retained for the same period as your early access registration (36 months) and deleted when your data is deleted.
The legal basis for processing referral data is Art. 6.1.b GDPR — performance of the early access programme in which you have enrolled.
08Your Rights
Your data is yours. Here is what you can ask us to do — and we will respond within one calendar month, extendable by two more months if a request is particularly complex (we will let you know within the first month):
Right of access (Art. 15)
Obtain a copy of your personal data and information about how it is processed.
Right to rectification (Art. 16)
Request correction of inaccurate or completion of incomplete data.
Right to erasure (Art. 17)
Request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful.
Right to restriction (Art. 18)
Request we limit processing in specific circumstances (e.g. while accuracy is contested).
Right to portability (Art. 20)
Receive your data in a structured, machine-readable format where processing is based on consent or contract.
Right to object (Art. 21)
Object to processing based on legitimate interest, including profiling. We will cease unless we demonstrate compelling legitimate grounds.
Right to withdraw consent
Withdraw consent for marketing communications at any time via the unsubscribe link in emails or by writing to us. Withdrawal does not affect prior lawful processing.
Right to lodge a complaint
File a complaint with the Garante per la Protezione dei Dati Personali at garanteprivacy.it or by post: Piazza Venezia 11, 00187 Roma.
How to exercise your rights: write to privacy@nawigo.com with subject line “Privacy Request — [your right]”. We may ask you to verify your identity before processing the request. We will not charge a fee unless requests are manifestly unfounded or excessive, in which case we will notify you in advance.
09Travel Personality Quiz
Nawigo may offer an optional Travel Personality Quiz to help you understand your travel style and improve the relevance of your experience on the platform.
Voluntary — the quiz is entirely optional. You can use Nawigo without completing it.
Purpose — responses are used to provide generalised travel-style insights and to help us improve future Nawigo experiences. They are not used to make automated decisions with legal or similarly significant effects.
No profiling with legal effects — the quiz is exploratory. Results influence the suggestions you see, but do not produce automated decisions as defined under Art. 22 GDPR.
Data used — quiz responses are linked to your account and retained for the same period as your registration data. You may request deletion at any time.
Legal basis — Art. 6.1.a GDPR (consent), given when you choose to start the quiz.
A note on AI and personalisation: Nawigo uses your quiz responses and usage data to personalise your travel recommendations. This is not automated decision-making under Art. 22 GDPR — a human-reviewed system is involved. We will update this section as the platform develops.
10Cookies
We use cookies in accordance with the Garante per la Protezione dei Dati Personali Cookie Guidelines of 10 June 2021 and the ePrivacy Directive (2002/58/EC). Our full Cookie Policy is available at nawigo.com/cookie-policy. In summary, we use the following categories of cookies:
Technical / essential cookies — strictly necessary for the website to function (e.g. session management, security, referral code storage). No consent required under Art. 122 D.Lgs. 196/2003.
Analytics cookies (first party) — anonymised measurement of website usage to improve our services. Require consent.
Analytics cookies (third party) — where third-party analytics tools are used with appropriate anonymisation and Data Processing Agreements. Require consent.
Functional cookies — remember preferences to improve your experience. Require consent.
We do not use profiling cookies, advertising cookies or behavioural tracking at this stage.
Cookie consent: when you first visit nawigo.com, a cookie banner will appear. Non-essential cookies are activated only upon your explicit, affirmative action (not by scrolling, continuing to browse, or via pre-ticked boxes). You may change your preferences at any time via the cookie settings link in the footer.
11Children
Our services are not directed at persons under the age of 16 years, in accordance with Art. 2-quinquies of the Italian Personal Data Protection Code (D.Lgs. 196/2003). We do not knowingly collect personal data from minors. Note that the minimum age may differ in other EU Member States (ranging from 13 to 16 years); where applicable, we apply the age set by the relevant national law.
If you believe we have inadvertently collected data from a person under 16, please contact us immediately at privacy@nawigo.com. We will delete such data without delay.
12Policy Changes
We may update this Privacy Policy to reflect changes in our data processing activities, applicable law or Garante guidelines. The "Last updated" date at the top of this page will be revised accordingly.
For material changes — meaning changes that affect your rights or the purposes for which we process your data — we will notify registered users by email at least 30 days before the change takes effect, and, where required, request fresh consent. Continued use of our services after the effective date constitutes acceptance of non-material changes.
13Contact
For any questions, requests or complaints regarding the processing of your personal data, please contact our privacy team:
Nawigo Srl — Privacy Team
Via Senorbì 89/A · 00148 Roma (RM) · Italy
P.IVA: IT18173191000 · REA: RM-1766527
Email: privacy@nawigo.com
PEC: nawigo@pec.it
If your request is not resolved to your satisfaction, you may contact the Italian Data Protection Authority:
Garante per la Protezione dei Dati Personali
Piazza Venezia 11, 00187 Roma · garanteprivacy.it