When you purchase Goods or Services via our Website, we process your Data to manage your order, arrange delivery, handle payments and provide related service (e.g., order confirmation, updates, returns, or refunds).

Identification and contact details: full name, delivery address, email address, phone number.

Payment details: price, currency, credit card brand, type, BIN number, and issuing country.

Technical information: IP address, language, device type.

GDPR Art. 6(1)(b) - Contract:

• to complete and deliver your purchase.

Order and payment records are retained for 10 years in line with legal, tax and accounting obligations.

• Shipping and logistic providers (Worldwide);

• Payment service providers and banks (EEA and non-EEA);

• Intra-Group companies (EEA).

In order to use Enence Translator (“Device”), you are required to download and install the Enence App (translator Enence) (“App”) to connect your smartphone with the Device.

The App does not require registration or account creation and does not process your Personal data. However, to enable functionality, you will be asked to grant permissions for Bluetooth, microphone, and speech recognition, which are required to provide Device features.

Technical data: from Bluetooth pairing (non-personal data) and other technical data.

GDPR Art. 6(1)(b) - Contract:

• to provide Services.

No Personal data is stored by us.

• App developers (EEA);

• Intra-Group companies (EEA).

After successful Device and App pairing, you can start using Device. When you speak into the Device, your voice is securely transmitted via Wi-Fi or mobile data to Google Translate/Google Cloud services. Google converts your speech into text, translates it into the selected language, and returns the translated output as spoken text.

Note! Your voice or text inputs are processed directly by Google’s services and are not collected, accessed, or stored by us in the Device or the App.

Inputs: include voice, words, phrases, or sentences you speak;

Technical data: Bluetooth and Device pairing data (we only store technical information that is not related with your Personal data).

GDPR Art. 6(1)(b) - Contract:

• to provide translation Services.

We do not store or retain any Personal data from your use of the translation services.

• Google Cloud / Google Translate API (Independent Controller) (Non-EEA) - performs speech recognition, translation, and speech synthesis. Google processes translation inputs in accordance with its own Privacy Policy (https://policies.google.com/privacy).

To use the Travel Buddy Service, you must install the App to enable functionality.

We use artificial intelligence Google’s Gemini AI to provide you with Travel buddy personalized travel recommendations, including flights, accommodation, and destination suggestions etc. This Service works by processing your inputs (such as your travel preferences, dates, budget, or other details you share in natural language) and generating tailored options using Google’s real-time data sources (e.g., Google Flights and Google Hotels).

Note! We do not collect or store your voice, text, or other inputs, and we do not receive additional Personal data from your use of Gemini AI. All inputs are processed in real time by Google and we do not control how Google processes your Data. Please consult Google's privacy policies to understand your rights and obligations in relation to their services.

Inputs: text, voice and all others inputs you choose to provide to Travel Buddy processed directly by Google Gemini AI.

GDPR Art. 6(1)(b) - Contract:

• to provide Travel Buddy Services.

We do not store or retain any Personal data from your use of the Travel Buddy service.

• Google Gemini AI (Independent Controller) (Non-EEA) performs full Travel Buddy service in accordance with its own Privacy Policy: https://support.google.com/gemini/answer/13594961?hl=en;

• Intra-Group companies (EEA).

To use the Smart Tag Service, you must install a third-party mobile application, such as Apple’s Find My or Google’s Find My Device, to enable functionality. After installing the application, you must follow the third-party Terms of Service and Privacy Policy to set up and use the service.

Note! We do not have access to, collect, or process any Personal data generated through your use of the Smart Tag Service. All Data is handled directly by the third-party App providers.

Location data and related personal data are processed directly by the third-party App providers under their own privacy policies. Both providers normally use end-to-end encryption, meaning location data cannot be accessed by Apple or Google in identifiable form.

GDPR Art. 6(1)(b) - Contract:

• to provide Services.

We do not store or retain any Personal data from your use of the Smart Tag Service.

• Third-party App providers Google or Apple (Independent Controllers) (Non-EEA): performs full Smart tag service in accordance with their own Privacy Policy Apple Privacy – Find My; Google Find My Device: Google Privacy Policy.

We process your Personal data when handling payments related to your orders, subscriptions, discounts, returns, or refunds.

We also use this Data to comply with legal, financial, and tax obligations, including invoicing and bookkeeping.

Payment Information: payment method (card type, few last card numbers), payment token, transaction amount, transaction date and time, refund reasons.

Billing & Legal Data: name, email, phone, billing address, IBAN/account number, payment records, invoices, and other required accounting documentation.

GDPR Art. 6(1)(b) - Contract:

• to receive and manage payments.

GDPR Art. 6(1)(c) - Legal obligation:

• to fulfill statutory accounting requirement.

We retain accounting-related data for 10 years, as required by financial and tax regulations.

• Payment processors (EU and Non-EEA);

• Accountings processors (EEA);

• Intra-Group companies (EEA);

• Auditors (EEA).

If you contact us by phone and/or in writing (via Live Chat, customer support, email, social media or otherwise), we will keep a record of the fact of your contact and the information you have provided to us, including your Personal data, to properly process your request and respond to your question, request or complaint.

We use artificial intelligence (AI)-based tools (fully or semi-automated) to assist our customer support team. These tools are used to: suggesting draft responses, guiding or answering calls before transfer to a human agent, transcribing and summarizing conversations, and providing automated replies to frequently asked and trained questions.

Note! All AI-generated outputs are reviewed and validated by human staff where decisions could affect your rights. We do not rely solely on automated decision-making that produces legal or similarly significant effects. We do not use your data for training AI models unless fully anonymized.

When contacted by call: name, surname, mobile phone number, email address, residential address, purchase details and other information required to verify your identity (if needed). Date and time of the call, duration of the call and a recording of the call.

Contact by email / or via Livechat, Customer Support: name, surname, mobile phone number, email address, residential address. Purchase details and other information required to verify your identity (if needed). Other information related to the written request, attached documents or other visual content, all correspondence history.

GDPR Art. 6(1)(b) - Contract:

• provide Customer support service.

GDPR Art. 6(1)(f) - Legitimate interest:

• respond, advise, provide and administer inquiries when any person initiates the first conversation.

Recordings of conversations - 6 months from the moment of creation.

Written communication - 3 years after your inquiry was closed.

We may retain some information longer if we are required to do so to comply with applicable laws or based on justified interests.

• Customer support platform providers (Non-EEA);

• AI support tools and chatbots (Non-EEA);

• Customer support agents (some outside EEA);

• Intra-Group companies (EEA).

We have the right, in performing our rights and obligations under the Terms (“ToS”), to contact you at any time (e.g., provide transactional communication). We may send you important notifications and information by e-mail, SMS or via phone call.

Note! This important communication is not considered marketing, and you cannot opt out of it.

Identification and contact details: name, surname, mobile phone number, e-mail address, residential address.

Call details: date and time, duration, the call recording.

Technical data: copies of electronic messages/SMS, delivery status and date, message opening (reading) status and date, links opened from the message content.

GDPR Art. 6(1)(b) - Contract:

• administration of the ToS and provision of important notifications.

Recordings of conversations are kept for 6 months from the moment of creation.

Electronic communications history logs are kept for 1 month, unless longer retention is required for legal purposes.

• Communication service providers - e-mail/SMS/telephony platforms (EEA and Non-EEA);

• Intra-Group companies (EEA).

We process your Personal Data to inform you about our Goods, Services, promotions, new features, or to request your feedback. This includes sending general or personalized marketing content (e.g., newsletters, promotional messages, surveys) via email, SMS, or phone calls.

Marketing content may be customized based on the Data we already hold about you (e.g., previous purchases, browsing history, selected preferences), in order to provide you with relevant offers or content.

If you are an existing customer, we may contact you with marketing messages about the same or similar products or services, even if you haven’t given explicit consent — unless you objected and OPT-OUT during your order (e.g., via “Thank You“ page”), it’s not allowed by law, or you objected later.

Remember! you have the right to object to the use of your Personal data for direct marketing at any time. You may simply withdraw your consent or opt-out at any time by using the unsubscribe link provided in our newsletters, replying to SMS required word or by contacting us via email.

Contact details: full name, e-mail, telephone number, country;

Logs: consent collection logs (date, method, preferences).

GDPR Art. 6(1)(a) - Consent:

• to process consent via preferred communication method.

GDPR Art. 6(1)(f) - Legitimate interest:

• if you are an existing customer and have not objected, we may send limited marketing about similar products or services to maintain our customer relationship (soft opt-in).

3 years from consent given date, unless you opt-out earlier.

• Social media service providers (Non-EEA);

• Marketing service providers (Non-EEA);

• Intra-Group companies (EEA).

We manage our business profiles and accounts on various social networks. If you are interested in our Services and follow our profiles on social networks, participate in our games, promotions, share your photo with us or tag us in your photo, public post, etc., we collect and use your Data, which we receive directly from you, when you are active in our accounts.

Please note that our accounts are integrated into social networking platforms (e.g. Facebook, Instagram, Linkedin, etc.) and therefore all social platform providers as independent data controllers have full access to collect your Personal data. You can find detailed information on the data processing, purposes and scope of data use by each social networking platform in the privacy policy of the respective social network. Also if you want to exercise your rights in relation to data processed by social networks, it is more efficient to contact the controller of the social network directly.

Identifiers: name, surname, and profile photo;

Public interactions: likes, follows, comments, shares;

Participation: messages you send (content, time, attachments, history), active participation in games/events, any photos you send us or tag us in.

GDPR Art. 6(1)(a) - Consent:

• to process Personal data when you voluntarily take active steps on our social media accounts.

The provider of the social network concerned shall set the time limits for the retention of data.

We recommend that you check the privacy policy of the social network concerned. We normally retain and don’t delete them unless you withdraw consent, request deletion, or the platform enforces earlier deletion.

• Social media service providers e.g. Facebook, Linkedin, Instagram, Tiktok (Normally these providers are Independent Controllers, however in certain cases, we and the provider may act as joint controllers. You can read more in the privacy notice of each provider) (Non-EEA);

• Intra-Group companies (EEA);

• Affiliates (some outside EEA).

We may process your Personal data in case we become a party or concerned party in legal process which you are subject to, or we are statutorily required to collect and/or provide information about you in order to comply with the applicable law.

Also, in all cases where we suspect fraud, theft, account misuse, or other unlawful activities involving our Website, Company, brands and or services, we report such cases to the appropriate pre-trial investigation authorities (such as the police or prosecutor’s office).

All information that we uphold about you and that is a part of the legal process e.g. accounting and legal case files, legal documents, other information you provide us with, other information that we are statutorily required to collect and/or provide. Also, pleadings, claims, court decisions.

If the case arises - information about criminal offenses and convictions.

GDPR Art. 6(1)(f) - Legitimate interest:

• establishment, exercise, or defence of legal claims.

• to protect our rights and interests.

As long as the legal proceedings are going and 5 years from the date of entry into force of the court or authority's decision, or the date on which the legally binding decision is fully implemented.

• Legal parties e.g. Attorneys, Notaries, Bailiffs, Auditors, Consultants (EEA and Non-EEA);

• Courts (EEA);

• Consumer protection authorities and other institutions (EEA and Non-EEA).

When you visit and browse our Website, we process your personal data for statistical, analytical, and performance monitoring purposes, in order to improve the functionality, stability, and user experience of our Website. This includes processing data collected via cookies and similar tracking technologies, primarily through tools such as Google Analytics 4 or other analytics platforms.

Identifiers: IP address or other device identifiers;

Technical information: device type, browser type, language settings, hardware/software settings and configurations, referring URLs (websites visited before/after);

Use information: pages visited on our Website, interactions, clicks, or session behavior, visit timestamps, session duration, selected interface or account preferences (if applicable).

GDPR Art. 6(1)(a) - Consent:

• We process this data only if you have actively consented to the use of performance and analytics cookies (via our Cookie Banner).

For more information on the retention periods of cookies, please refer to our Cookie Policy.

• Google Ireland Limited (as provider of Google Analytics services). For more information about Google Analytics and the information collected by its tools, please visit: https://support.google.com/analytics/answer/9019185?hl=en&ref_topic=2919631#zippy=%252Cin-this-article.

We process your Personal data when you participate in our contests, competitions, games, or events. This is done to manage your participation, communicate with you, and (where applicable) publish or promote the outcome of the activity.

Identifiers: full name, email address, phone number;

Participation: social media engagement (comments, shares, “likes”, “follows”, reactions) contest entries, responses, evaluation/ratings, event attendance;

Media content: submitted or captured photos/videos, image/voice in recording.

GDPR Art. 6(1)(a) - Consent:

• for contest participation, contacting winners.

Contest participant data – retained for 1 year after the announcement of winners or as described in specific contest terms.

• Social media platform providers (Non-EEA);

• Contest partners and co-organizers (EEA and Non-EEA).

We process your Personal Data when you submit, create, or allow us to use content that features you for promotional purposes. This includes:

• User-generated content (UGC), such as testimonials, reviews, photos, or videos that you share with us directly or tag us in on social media.

• Participation in photo or video shoots organized by us, where your image, voice, or personal identifiers may be used for marketing or advertising campaigns.

Where applicable, a separate image-use or content-use agreement will be signed before publication or distribution, or consent will be collected via a dedicated form.

Identifiers: full name, username or profile name;

Media content: photo, video, or audio recordings;

Participation: testimonials, reviews, or other content you provide or permit us to use, social media identifiers (tags, mentions, handles), image-use or promotional content agreement (if applicable), consent logs.

GDPR Art. 6(1)(a) - Consent:

• when you voluntarily provide content or participate in promotional activities.

GDPR Art. 6(1)(b) - Contract:

• where the content is used under an affiliate, influencer, or advertising agreement.

UGC and campaign content: retained for up to 2 years from the date of collection or consent, unless a shorter or longer period is specified or consent is withdrawn.

Advertising campaign content: archived for up to 10 years for legal, contractual, or compliance purposes.

• Social media platforms (EEA and Non-EEA);

• Marketing and advertising agencies;

• Affiliate partners and campaign organizers;

• Intra-Group companies (EEA).

When you participate in our Affiliate Program (e.g., promoting our Goods or Services via links, campaigns, or other agreed methods), we process your Personal data to manage your participation, track referrals, calculate commissions, and make payments. We may also use your Data to communicate with you about affiliate program updates, compliance checks, complaints or performance reporting.

Identifiers: name, surname, and contact details (e-mail address, phone number), Affiliate account/login details;

Payment and billing details: bank account, or other payment identifiers, invoices;

Performance and tracking data: referral codes, campaign statistics, generated leads/sales, IP address, cookies where applicable;

Cookies: tracking data where applicable (subject to Cookie Policy and local regulations).

GDPR Art. 6(1)(b) - Contract:

• necessary for managing participation in the Affiliate Program, tracking referrals, and making payments.

GDPR Art. 6(1)(f) - Legitimate interest:

• fraud prevention, program integrity, and communication with affiliates.

Affiliate program data – retained for the duration of your participation in the program and up to 5 years after termination (for accounting, legal, and fraud-prevention purposes).

Payment records – retained for 10 years to comply with financial/accounting laws.

Affiliate photos and videos - as agreed in specific affiliate program, or mutual agreement.

• Affiliate platform providers and tracking technology providers (some may be outside the EEA);

• Intra-Group companies (EEA);

• Tax authorities, auditors, or regulators (where required by law).