Privacy Policy

Penta turistička agencija d.o.o. ("we", "us", "our") owns the website www.conwayo.ai and www.conwayo.io (the "Website"). We created this Privacy Policy to show that we care about the privacy of our users and to inform them how we collect and process personal data on this website. Please read this Policy carefully to understand how we collect, process, protect, or otherwise use your personal data.

Data collection

Personal data means any data relating to an individual whose identity is known or can be established. An identifiable individual is a person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural, or social identity.

We collect your personal data only when you voluntarily provide it to us. We collect data about you when you fill out a form on the website, register via WhatsApp, or subscribe to our newsletter.

You should be aware that non-personal information may be automatically collected through our internet servers or through the use of "cookies". Examples of information about your use of the site include: the most visited pages and links on our website, the number of completed forms, time spent on the site, the most popular keywords leading users to our site, your IP address, information collected via cookies, and your device data such as hardware settings, system activity, browser type, etc.

Data processing

We use the data obtained about you for one or more of the following purposes:

• To personalise your user experience (the information collected helps us better respond to your individual needs)
• To improve our website (we continuously strive to improve our website based on feedback from our visitors)
• To establish a primary channel of communication with you
• To occasionally send emails (regarding news, if you wish to receive them, updates, information about similar products or services, etc.)

This Privacy Policy applies to the processing of personal data through: the Conwayo.io website, WhatsApp communication, the voice AI agent (Voice Agent), and all related digital channels.

We process data based on:

• (a) Performance of a contract: registration and user accounts, ticket purchases, customer support
• (b) Legal obligation: accounting, taxes
• (c) Legitimate interest: system security, fraud prevention, analytics and service improvement
• (d) Consent: marketing, cookies, WhatsApp communication (where applicable)

Roles in data processing (Platform and Organisers)

Within the use of the Platform, the following roles are distinguished:

• Platform (Conwayo) — data controller for: user accounts, technical data, payment processing (as intermediary), communication
• Event Organiser — a separate data controller for: Participant data related to the Event, invoicing, marketing of its own events

The Platform may act as: a data processor on behalf of the Organiser, or as a separate data controller, depending on the specific processing activity.

What data we collect

• Data you provide directly: first and last name / company name, VAT/tax ID (for business users), email address, phone number, account data (login, hashed password)
• Payment-related data: We do not store card details; processing is carried out by our payment service provider (e.g. Stripe)
• Data collected automatically: IP address, device and browser data, on-site behaviour, cookies
• Data received from the Organiser: event registration data, participation status, event-specific data (if requested by the Organiser)

Automated processing and AI (WhatsApp)

Communication via the WhatsApp channel may be automated using AI systems. This includes: answering enquiries, guiding users through registration, generating payment instructions.

This processing: does not produce legal effects, does not involve automated decisions that significantly affect the user. The user may always request to communicate with a human operator.

Voice channel (Voice Agent)

Conwayo offers optional registration via a voice AI agent. By using this channel:

• The conversation is processed by the AI system of Retell AI Inc. (service provider: Retell AI, USA)
• We collect exclusively: call metadata, name, email address, and ticket selection — audio recordings and transcripts are NOT stored (setting: Basic Attributes Only)
• Processing is based on your explicit consent given at the start of the call (Art. 6(1)(a) GDPR)
• Call metadata is retained by Retell AI for 30 days, after which it is automatically deleted
• A record of consent (date, call ID, notice text version) is retained permanently for evidentiary purposes under Art. 7(1) GDPR
• If you decline to give consent at the start of the call, all data collected up to that point is immediately deleted
• Transfer of data to the USA is governed by Standard Contractual Clauses (SCC) and a signed DPA with Retell AI

Data recipients

We share data only when necessary: IT infrastructure providers (hosting, databases), payment processors (e.g. Stripe), communication tools (WhatsApp / Meta), analytics tools (e.g. Google Analytics), AI tools, Event Organisers. All processors are contractually bound to protect data.

Use of cookies

We use: necessary, analytics, marketing, and functional cookies.

Protecting your data

To protect the personal data you submit through this website, we use physical, technical, and organisational security measures. We continuously upgrade and test our security technology. We limit access to your personal data to employees who need to know that information in order to provide you with certain benefits or services. In addition, we train our staff on the importance of data confidentiality and the protection of your privacy and data.

Data transfers outside the EU/EEA

Some partners (e.g. Meta, Google, Stripe, OpenAI) may process data outside the EU. In such cases we use: Standard Contractual Clauses (SCC) and other GDPR safeguard mechanisms.

Data security

We apply: SSL/TLS encryption, access control, authentication, security checks.

Retention periods

• Transactional data: 11 years
• User accounts: while the account is active + max. 3 years of inactivity
• Marketing data: until consent is withdrawn
• Analytics: up to 24 months

Individual rights

If you would like to know whether we hold and process your personal data, or if you wish to access the personal data we hold about you, please contact us at registration@conwayo.ai — we respond within 30 days.

You may also request information about: the purpose of processing, the categories of personal data processed, who outside our company has received your personal data from us, the source of the personal data (if not provided directly by you), and how long we will retain the data. You have the right to correct personal data we hold if it is inaccurate. You may also, subject to certain exceptions, request that we erase your data or stop processing it. You may request that we stop using your personal data for direct marketing purposes. In many jurisdictions you have the right to lodge a complaint with the competent data protection authority if you are not satisfied with how we handle your personal data.

If you submit a request for us to send you your personal data to registration@conwayo.ai, we will fulfil that request free of charge. If we are unable to fulfil your request within a reasonable time, we will notify you of the date by which we will fulfil it.

Personal data breach notification

In the event of a personal data breach, we will notify you and the competent supervisory authority by email within 72 hours regarding the scope of the breach, the data involved, any potential impact on our services, and our planned measures to secure the data and limit any adverse effects on individuals.

We will not send you a breach notification if: appropriate technical and organisational protection measures (such as encryption) were applied to the personal data affected by the breach, rendering it unintelligible to any unauthorised person; we have taken subsequent measures ensuring that the high risk to individuals' rights and freedoms is no longer likely to materialise; or doing so would require disproportionate effort (in which case we will notify you via public communication or a similarly effective measure).

Your consent

By using this website, you consent to this Privacy Policy. The service is not intended for individuals under the age of 16.

Changes to our Privacy Policy

If we make changes to our Privacy Policy, we will notify you on this page and update the revision date below accordingly.

Cookies

Cookies are small text files that the website you visit stores on your computer. Cookies usually remember your personal or website settings, such as your preferred language or address. When you revisit the same website, your browser returns these text files to that site.

Cookies can store various information, including personal data. However, this information can only be stored if you allow it — websites cannot access information you have not provided, nor can they access other files on your computer.

By disabling cookies, you decide that they will not be stored on your computer. You can manage cookie settings in your browser (Chrome, Firefox, Safari, Edge). Note that even if you block cookies, you will still be able to browse this website, but some of its functionality may not be available.

To opt out of Google Analytics tracking across all websites, visit: tools.google.com/dlpage/gaoptout