Privacy Policy

VIAZUNO is committed to protecting your privacy and complying with the highest international data protection standards, including the European Union General Data Protection Regulation (GDPR), the ePrivacy Directive, United States federal and state privacy statutes (including the California Consumer Privacy Act CCPA/CPRA, Virginia VCDPA, and Colorado CPA), and the Children's Online Privacy Protection Act (COPPA).

1. Scope & Data Controller

This Privacy Policy applies to all public digital properties, web applications, and services operating on viazuno.com and its official subdomains. VIAZUNO acts as the Data Controller under GDPR Article 4(7) for personal information collected directly through your interactions with our website.

2. Categories of Information We Process

We adhere to the core principle of data minimization (GDPR Art. 5(1)(c)). We collect and process only the minimal data strictly necessary to deliver high-quality travel planning tools:

• Essential Preference Data: We store your chosen language, display mode (light, dark, high contrast), currency preference, and text size in your local browser storage. These values are never transmitted to third parties.
• Optional Usage & Telemetry Data: When you explicitly grant analytics consent, we collect aggregated, non-personally identifiable telemetry such as page route, locale, search result counts, and load performance. IP addresses are anonymized prior to any storage.
• Affiliate Attribution Metrics: When you click an outbound partner search link, an attribution signal may record the partner identifier, referring page path, language code, and timestamp to reconcile commercial partnerships.
• Authenticated Planning Workspace: If you register an optional authenticated planning account, we store your secure session credentials, saved trip itineraries, and user-generated expense notes. Account data is private and never indexed publicly.

3. European Union (GDPR) Lawful Bases

We process personal data strictly in accordance with lawful bases defined in GDPR Article 6:

• Consent (Art. 6(1)(a)): Applied to optional analytical telemetry, marketing cookies, and cross-context functional tracking. You may withdraw consent at any time with immediate effect.
• Legitimate Interests (Art. 6(1)(f)): Applied to maintaining server security, detecting automated scraping and DDoS attacks, debugging code errors, and ensuring platform resilience.
• Contractual Performance (Art. 6(1)(b)): Applied when managing authenticated user workspaces and synchronizing saved trip plans.

4. Your European Privacy Rights (GDPR Articles 15–22)

If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, you possess enforceable statutory rights:

• Right of Access (Art. 15): Obtain confirmation whether your personal data is processed and receive a copy thereof.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal records.
• Right to Erasure / Right to be Forgotten (Art. 17): Request permanent deletion of your personal data where retention is no longer justified.
• Right to Restriction of Processing (Art. 18): Restrict data processing under specific dispute circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local EU Data Protection Supervisory Authority (such as CNIL, BfDI, or the Irish DPC).

5. United States State Privacy Rights (CCPA / CPRA & State Laws)

For residents of California, Virginia, Colorado, Connecticut, and Utah, we provide specific disclosures and protections:

• Notice at Collection: We do not sell personal information for monetary compensation, nor do we share personal information for cross-context behavioral advertising without affirmative consent.
• Do Not Sell or Share My Personal Information: You have the permanent right to opt out of any commercial data disclosure. Because VIAZUNO does not sell personal data, no opt-out penalty exists.
• Right to Non-Discrimination: We will never deny services, charge varying prices, or degrade quality if you exercise your statutory privacy rights.
• Submitting Verifiable Consumer Requests: Submit consumer requests by contacting [email protected]. We respond to verified requests within statutory timeframes (45 days under CCPA).

6. Strict Children's Privacy Policy (COPPA & EU Protections)

VIAZUNO is strictly a general-audience travel planning platform designed for adult travelers, trip organizers, and families. We enforce rigorous child protection standards in full compliance with the U.S. Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code, and EU child safety regulations:

• No Collection from Children: We do not knowingly solicit, collect, maintain, or disclose personal information from children under 13 years of age (or under 16 years of age in applicable EU member states).
• No Behavioral Advertising to Minors: We strictly prohibit any behavioral profiling, audience segmentation, or targeted advertising directed at children or minors.
• Parental Rights & Inadvertent Collection: If a parent or legal guardian discovers that their child has provided personal information to VIAZUNO without verified parental consent, contact our Data Protection Officer immediately at [email protected]. We will delete such data from our databases without delay.

7. International Data Transfers & Standard Contractual Clauses

When technical data is processed across borders, VIAZUNO relies on European Commission Standard Contractual Clauses (SCCs) and robust technical safeguards to ensure that personal data transferred outside the EEA receives an equivalent standard of protection.

8. Data Retention, Security & Minimization

Personal data is retained only for as long as necessary to fulfill the specific operational purpose for which it was gathered. We implement TLS 1.3 encryption in transit, strict database least-privilege credentials, MariaDB encrypted connections, and automated vulnerability scanning.

9. Third-Party Booking Origins & External Links

Flight and car searches open on separate VIAZUNO origins, where the partner's search code and privacy rules apply. Accommodation search opens through KKday. Information you provide while booking is handled under the booking provider's privacy policy. We strongly encourage travelers to review the privacy terms of external providers before completing purchases.

10. Google AdSense & Third-Party Advertising Cookies

Third-party vendors, including Google (Google AdSense, publisher ID ca-pub-3958695326520792), use cookies to serve ads based on a user's prior visits to this website or other websites on the Internet. Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to VIAZUNO and/or other sites on the Internet. Users may opt out of personalized advertising by visiting Google Ads Settings (https://www.google.com/settings/ads or https://myadcenter.google.com/) or https://www.aboutads.info, or by revoking advertising consent at any time in VIAZUNO's Privacy choices panel. For details on how Google processes data when you use partner sites, visit https://policies.google.com/technologies/partner-sites.