Privacy Policy

Volward is the data controller for personal data collected through the use of the service, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679).

We collect the following data, strictly necessary for the operation of the service:

• Passenger identity : gender, first name, last name
• Contact : email address
• Flight data : departure/arrival airports, travel dates
• Payment data : processed directly by our PCI-certified payment processor (we do not store card numbers)
• Technical data : IP address, browser (for security purposes only)

In accordance with Article 6 of the GDPR, each processing activity relies on a legal basis:

• Creating and managing your temporary flight booking
  Performance of a contract (Art. 6.1.b)
• Sending your ticket by email and order-related notifications
  Performance of a contract (Art. 6.1.b)
• Processing payment and managing refunds
  Performance of a contract (Art. 6.1.b)
• Audience measurement and service improvement (self-hosted analytics)
  Legitimate interest (Art. 6.1.f)
• Compliance with our legal and accounting obligations
  Legal obligation (Art. 6.1.c)

We never sell your data to third parties. We do not use it for advertising or profiling purposes.

Your data is hosted on servers located in Europe, in compliance with GDPR requirements. Our database is hosted on a European server.

The following sub-processors access certain data as part of the service:

• Payment processor (payments): payment data, PCI-certified. Transfer to the United States governed by Standard Contractual Clauses (SCCs)
• Booking platform (flight booking): passenger names, flight data. Transfer to India governed by SCCs
• Email service (transactional emails): email address. Transfer to the United States governed by SCCs
• CDN network (content delivery and security): technical data. Transfer to the United States governed by SCCs
• Analytics (audience measurement): anonymized browsing data. Self-hosted in France on our own servers, no transfer outside the EU

• Active booking (PNR): 48 hours (automatic expiration)
• Order data: 13 months (accounting obligations)
• Affiliate attribution cookie: 30 days
• Analytics data: 90 days maximum
• Technical logs: 12 months maximum

Under GDPR, you have the following rights:

• Right of access : obtain a copy of your personal data
• Right to rectification : correct inaccurate data
• Right to erasure : request deletion of your data
• Right to data portability : receive your data in a structured format
• Right to object : object to the processing of your data

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

Under your right to erasure (GDPR Article 17), you may request the deletion of all personal data associated with your email address. This action is irreversible.

To delete your data, send an email to [email protected] with the subject line 'Delete my data'. We will process your request within 30 days.

Volward uses strictly necessary cookies for the operation of the service. No advertising or profiling cookies are used.

• Session cookie: required for service operation (session duration)
• Affiliate attribution cookie: encrypted first-party cookie (HMAC), 30 days, used to attribute commissions to affiliates. HttpOnly, not accessible by JavaScript
• Self-hosted analytics: audience measurement via a solution hosted on our own servers in France. No data is transmitted to third parties

For any questions: [email protected]. You may also file a complaint with your local data protection authority.

"Volward Social Pipeline" is an internal application operated by Volward to automate content publication on Volward's official TikTok and Instagram accounts.

Data accessed via TikTok API:

• user.info.basic — to authenticate the connected TikTok creator account via OAuth 2.0 (open ID, display name)
• video.publish — to directly post content to Volward's TikTok profile
• video.upload — to upload content as a draft for further editing and publication

No personal data of TikTok end users is collected, stored, or processed by this application. The application only acts on behalf of Volward's own brand account.

Token storage: Access tokens are stored securely and used exclusively for publishing content on Volward's own brand accounts. No TikTok user data is retained beyond what is strictly necessary for the publishing operation.

Access revocation: You may revoke this application's access to your TikTok account at any time via TikTok settings at tiktok.com/setting. For any questions regarding data processed by Volward Social Pipeline, contact: [email protected].

If you participate in the Volward Affiliate Program, the following additional data is collected:

• Identity : name, email address, custom profile identifier
• Payment : PayPal email address (for commission payouts)
• Statistics : number of clicks, conversions and commissions generated through your affiliate link

Legal basis: consent (Art. 6.1.a GDPR). You may withdraw your consent and request deletion of your affiliate account at any time by contacting [email protected].

Retention period: your affiliate data is retained as long as your account is active. Upon deletion, data is erased within 30 days, except for accounting data retained for 13 months.