Privacy Policy

Summary of Key Points

Table of Contents

1. Data Controller and Contact Details
2. What Information Do We Collect?
3. How Do We Process Your Information?
4. Legal Bases for Processing
5. Bookings and Expressions of Interest: Data Shared With Hosts
6. When and With Whom Do We Share Your Information?
7. Communications, Emails, and Notifications
8. Cookies and Tracking Technologies
9. Google Sign-In and Social Logins
10. International Data Transfers
11. How Long Do We Keep Your Information?
12. How We Protect Your Information and Data Breaches
13. Minors
14. Your Privacy Rights
15. No Automated Decision-Making
16. Third-Party Websites and Do-Not-Track Features
17. Updates to This Policy
18. How to Contact Us and How to Complain

1. Data Controller and Contact Details

The data controller for personal data collected via the Platform is Wanderer.

We have not appointed a Data Protection Officer (DPO), as the conditions in Article 37 GDPR are not met. Requests may be addressed to the contacts above.

2. What Information Do We Collect?

2.1 Standard Personal Data

• Full legal name, email address, and city (required for account creation)
• Age declaration made at registration, with date and time
• Profile photo, biography, 'About You' text, and personal website (optional)
• Social and messaging handles you choose to add: WhatsApp, Telegram, Instagram, Facebook, X
• Spoken languages

2.2 Interests You Add to Your Profile

If you choose to add interests to your profile, we process them as ordinary personal data, on the basis of the consent you give when you enter them. They are never shown to Hosts or other users — they are used solely to personalise the event recommendations shown to you. You can change or delete them at any time from your profile settings. We do not ask you to disclose religious or philosophical beliefs, health data, or any other special category data, and we ask you not to enter such information in these fields.

2.3 Automatically Collected Information

Device type, browser, IP address, pages visited, and aggregated usage statistics, collected via cookies and similar technologies (see Section 8) and via the technical logs of our infrastructure providers, necessary for service security and diagnostics.

2.4 Event Data From Hosts

Hosts provide event details: title, description, city and (optionally) venue address, images, date and time, language, and any price or donation amount they wish to state. In External Payment and Expression of Interest modes, Wanderer does not collect, process, or store any payment made in connection with an event: the price stated by the Host is settled directly between Host and Participant, and we do not know whether, when, or to what extent it was paid. In Online Payment mode, Sections 2.11 and 5.2 apply.

2.5 Location Data

We use the city associated with your profile and with events to power map-based discovery and to select nearby events in periodic communications. We do not track your precise real-time location and do not access device GPS.

To the city selected by the User or by a subscriber we associate the approximate geographic coordinates returned by our geocoding provider, which identify the centre of that locality and not the person's own position. We use them solely to select events within a predefined radius for our periodic communications.

2.6 Language Data

Your selected interface language is stored in a cookie to serve the Platform in your preferred language.

2.7 Invite Programme Data

If you use the invite programme, we process your personal invite code, the link between the inviter and the invited person, and the symbolic points accrued. A person who registers via an invite link is associated with the inviter; the inviter sees the name and progress status of people they have invited, but not their contact details.

2.8 Reviews

If you publish a review of a Host, we process the rating, text, date, and the link to the author's profile, which is displayed publicly alongside the review.

2.9 Google Sign-In

If you register via Google, we receive from Google your name, email address, and profile photo, in accordance with the permissions you grant during sign-in.

2.10 Subscribing to Updates Without an Account

Anyone may subscribe to event updates without creating an account, using the dedicated box on the site. In that case we process the name given, the email address, the selected city and its approximate geographic coordinates, the browsing language, the page the subscription came from, as well as the date, time and IP address of the consent given, as evidence of that consent.

The legal basis is consent, given by explicitly ticking a dedicated box that is not pre-selected. This data is used solely to send the periodic event summary and the optional communications described in Section 7. It is not linked to any public profile and is never disclosed to Hosts.

Every email contains an immediate unsubscribe link. Withdrawing consent stops all sending. If the person later creates an account with the same email address, the subscription is linked to that account and communications are from then on governed by the preferences set in the profile.

2.11 Online Payment Data

When a Host turns on Online Payment mode for a listing, we process an additional set of data, which differs by role.

We receive confirmation of payment through a notification from the provider, which we re-verify before recording it. We do not store payment instrument data.

3. How Do We Process Your Information?

• Operating and maintaining the Platform, including your account and event listings
• Letting you discover events and express interest in attending one
• Recording your booking: counting places, issuing the registration record, handling the Host's approval where enabled, and the related communications
• Sharing your contact details with a Host when you book a place or express interest in their event, and vice versa
• Handling online payments when a Host turns that mode on: setting up the Host's space with the payment provider, processing the Participant's purchase, recording the payment confirmation, handling refunds and disputes
• Sending transactional emails and in-app notifications (e.g. interest confirmations, host notifications, reminders, review requests, security alerts)
• Sending, with your consent, the periodic event digest and other optional communications, always with immediate opt-out available
• Personalising event recommendations based on your stated interests
• Managing the invite programme and preventing related abuse
• Automatically translating listing content to make it accessible in supported languages
• Handling reports, moderating content, and enforcing our Terms and Community Standards
• Improving and securing the Platform, including fraud and abuse prevention
• Complying with legal obligations and establishing, exercising, or defending legal claims

4. Legal Bases for Processing

5. Bookings and Expressions of Interest: Data Shared With Hosts

BOOKING A PLACE AND EXPRESSING INTEREST ARE TWO DISTINCT ACTIONS. A BOOKING REGISTERS A PLACE FOR YOU AND SHARES YOUR DATA WITH THE HOST SO THAT BOOKING CAN BE HONOURED; IT INVOLVES NO PAYMENT THROUGH THE PLATFORM. EXPRESSING INTEREST IS NOT A BOOKING, AN ATTENDANCE CONFIRMATION, OR A PAYMENT: IT IS A CONSENT-BASED ACTION THAT SHARES A SPECIFIC, LIMITED SET OF YOUR CONTACT DETAILS WITH THE HOST SO THEY CAN CONTACT YOU DIRECTLY.

When you book a place for an event, we share with the Host of that specific event your full name and email address, the date of the booking, the number of places, and — where the Host has enabled participant approval — any answer you gave to their question. This sharing is necessary to perform the booking (Art. 6.1.b GDPR): without it the Host could not welcome you at the event. Any social or messaging handles on your profile are shared on the same terms as for an expression of interest. In External Payment mode we process no payment data at all, because no payment passes through the Platform: the stated price is repeated on your booking confirmation for the sole purpose of reminding you what you will need to settle directly with the Host. We do not know whether that amount was paid, to what extent, or by what means, nor whether you actually attended the event: we process no payment, collection, or attendance data for those listings.

When you click to express interest in an event, we ask you to confirm your consent before any data is shared. Once confirmed, the following fields — to the extent you have provided them on your profile — are shared with the Host of that specific event: full name, email address, WhatsApp, Telegram, Instagram, Facebook, and X. No other profile data (including the interests on your profile) is shared as part of this action.

• This sharing happens once, at the moment you express interest, for that specific event only.
• The Host becomes an independent data controller for any further use they make of this data, and is contractually bound (under Section 4.6 of our Terms and the Community Standards) to use it only for purposes related to that event.
• You may withdraw your Expression of Interest at any time by contacting support@wanderer.live; this does not retroactively undo contact already made by the Host, but stops any further platform-side association with that event.
• Because the Host is an independent controller, to obtain erasure of data already in their possession you must also approach the Host directly. On request we will forward the request to the Host and remind them of their obligations.
• Please review Section 14 (Your Privacy Rights) if you wish to object to or restrict this specific processing.

5.1 Circle Management Tools for Hosts

In the 'Circle' area of their dashboard, Hosts have additional tools for organising contacts relating to their events:

• Private notes: the Host may record private notes on each person who has booked or expressed interest (e.g. to track contacts made). Such notes are visible only to the Host and are never shown to the person they refer to; however, that person may request a copy and deletion by exercising their rights.
• Data export: the Host may export in CSV/XLSX format the list of contact details of persons who booked or expressed interest in their events and — for listings in Online Payment mode — of those who bought a ticket for them. The same list of purchases with the related contact details is also viewable and exportable from the "Online payments" page of the dashboard. The export is for use in their own management tools outside the Platform; once exported, this data leaves our technical control and remains under the Host's sole responsibility.
• Host communications: the Host may send communications about their events to persons in their Circle. Each communication identifies the Host and contains an opt-out mechanism. Wanderer acts solely as the technical delivery provider and does not determine the content or recipients of such communications.
• Ticket buyers: for listings in Online Payment mode, the Circle and the "Online payments" page also show the Host who bought a ticket for their events or sessions, with the name and email address given at checkout, the number of tickets, the amount, and the payment status. This includes buyers who completed the purchase as guests, without creating a Wanderer account: their data comes from the Gomry checkout. We process this data so the Host can manage attendance and communicate with their paying participants (performance of the purchase contract and the Host's legitimate interest in organising their event). The buyer may object or request restriction under Section 14, except for data we are required to retain for tax and accounting obligations.

Anyone who receives an unwanted communication from a Host, or believes their data has been added to a Host's Circle without a legal basis, may write to support@wanderer.live: we will intervene with the Host and, where necessary, remove the data and suspend the functionality.

5.2 Online Payments: Roles and Data

When a listing is in Online Payment mode, the Participant buys their place on the listing page through the checkout provided by Gomry Europe B.V., a company incorporated in the Netherlands, and the other companies of the Gomry group (together "Gomry"), acting as Merchant of Record. In relation to those payments, the roles are as follows:

• Wanderer processes the Host's payout data (Section 2.11) to set up their space with Gomry, and the Participant's purchase data to record the payment confirmation and link it, where possible, to their account. Wanderer neither collects nor holds the funds. The Host is paid by Gomry, not by Wanderer.
• Gomry and its payment processors process the Participant's payment data (including card details) as independent controllers for the purposes of processing the payment, fraud prevention, and their own compliance obligations, under their respective privacy policies. Wanderer has no access to full payment instrument data.
• The Host is the seller of the experience (Seller of Record). The receipt or equivalent document for the payment is issued by Gomry as Merchant of Record, in Gomry's name and carrying the Host's heading and tax details; in relation to the Host's data contained in them and to any documentation specific to the performance, the Host is an independent controller.
• In the event of a refund or a dispute (chargeback), Wanderer and Gomry process the minimum data needed to handle the operation and update its status. A refund may be initiated by the Host and is then executed with Gomry; for that purpose we process the buyer's name and email address, the amount, and the status of the request, and we notify the buyer, the Host, and authorised Wanderer staff.
• The Host may view and export the contact and purchase data of their paying participants through the Circle and the "Online payments" page (Section 5.1). Buyers who register or purchase through the checkout receive the purchase confirmation and event reminders; those with a Wanderer account also receive a review request after the event. These are transactional communications tied to that single purchase: we do not subscribe the buyer to any periodic or marketing communication. Buyers with an account manage these emails from their profile's notification preferences; buyers who purchased as guests, without an account, may ask us to stop them by writing to support@wanderer.live, an address stated in each email.

Buyers who purchase without creating a Wanderer account are shown, next to the checkout on the listing page, a short notice referring them to this Policy and to the Terms, before entering any data. Turning off Online Payment mode for a listing does not delete the data of transactions that have already taken place, which remain subject to the retention periods in Section 11. For requests concerning data processed by Gomry as an independent controller, you may also contact Gomry; on request we will forward the application.

6. When and With Whom Do We Share Your Information?

6.1 Service Providers (Data Processors)

We use the following providers, who process data exclusively on our behalf under agreements compliant with Article 28 GDPR:

For online payments, Gomry acts partly as a processor on our behalf (setting up the Host's space, payment notifications) and partly as an independent controller — as Merchant of Record and together with its own payment processors (including Stripe) — for concluding the transaction and issuing the receipt in its own name, processing payment instrument data, fraud prevention, and its own compliance obligations; those activities are governed by the privacy policies of Gomry and its processors. Wanderer has no access to full card data.

We encourage Hosts not to include personal data of third parties in event descriptions, as such text may be sent to the automatic translation service. We do not use user data to train artificial intelligence models, and our providers are not authorised to do so.

6.2 Other Users

Certain profile fields (photo, city, biography, website) are visible to other users as described in our Terms. Contact details are shared with a Host only when you express interest in their event, as described in Section 5. Participants cannot view the profiles or data of other Participants who have expressed interest in the same event.

6.3 Business Transfers

If Wanderer is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction, subject to equivalent confidentiality commitments. You will be informed in advance and may terminate your account.

6.4 Legal Requirements

We may disclose data where required by law, regulation, a competent authority, or a valid legal process, and where necessary to establish, exercise, or defend legal claims.

6.5 No Sale of Data

We do not sell, rent, or transfer users' personal data to third parties for marketing purposes, and we do not engage in behavioural advertising.

7. Communications, Emails, and Notifications

Opting out of optional communications is immediate, free of charge, and does not affect your use of the Platform in any way.

8. Cookies and Tracking Technologies

Analytics and performance measurement tools are not loaded or executed until you have given your consent via the banner. For the detailed list, durations, and management of your choices, see our Cookie Policy.

9. Google Sign-In and Social Logins

When you sign in via Google, that provider's own privacy policy also applies to their processing of your data. We receive from Google only the data necessary for authentication and do not have access to your password.

10. International Data Transfers

Some of the providers listed in Section 6.1 are based in the United States or may process data outside the European Economic Area. In such cases the transfer takes place on the basis of a European Commission adequacy decision (including the EU–U.S. Data Privacy Framework, where the provider participates) or Standard Contractual Clauses adopted by the Commission, supplemented where necessary by additional safeguards. A copy of the applicable guarantees may be requested at support@wanderer.live. For online payments, the provider with whom the transaction is concluded is Gomry Europe B.V., established in the Netherlands, so the processing connected with collection takes place within the European Economic Area; any disclosure to other Gomry group companies established outside the EEA takes place on the basis of the safeguards stated above.

11. How Long Do We Keep Your Information?

At the end of the applicable period, data is deleted or irreversibly anonymised. We may retain for longer periods data strictly necessary to establish, exercise, or defend a legal claim, or to comply with a statutory obligation.

12. How We Protect Your Information and Data Breaches

We apply appropriate technical and organisational measures, including encryption in transit and at rest, provider authentication, the principle of least privilege in access controls, environment separation, and periodic security reviews of our infrastructure providers, to protect your data against unauthorised access, loss, or misuse. No system can guarantee absolute security.

In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours of becoming aware, where the conditions of Article 33 GDPR are met, and will inform affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, pursuant to Article 34 GDPR. Security vulnerabilities may be responsibly reported to safety@wanderer.live.

13. Minors

The Platform is not directed at, and may not be used by, anyone under 18 years of age. We do not knowingly collect data from minors. At registration we require an express age declaration. If we become aware that an account belongs to a minor, we will terminate it and delete the associated data without delay. Parents and guardians may report such situations to us at support@wanderer.live.

14. Your Privacy Rights

To exercise any of these rights, write to support@wanderer.live. We respond without undue delay and in any event within one month of the request, extendable by a further two months for particularly complex requests, with prior notice to you. Exercising your rights is free of charge; we may ask for information to verify the identity of the requester.

Online payment data that we are required to retain under tax, accounting, or reporting obligations cannot be erased on request before the relevant statutory period expires; for data processed by Gomry as an independent controller, you may also contact Gomry.

15. No Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. Event recommendations and the selection of events in periodic communications are personalised based on city and stated interests, but do not produce effects of this kind and can be disabled by withdrawing the relevant consent.

16. Third-Party Websites and Do-Not-Track Features

The Platform may contain links to third-party websites (including Hosts' social profiles and messaging channels used for direct contact). We are not responsible for the privacy practices of those third parties, and we encourage you to review their respective policies. Our Platform does not currently respond to browser "Do Not Track" signals, as no uniform standard for such signals has been adopted; preferences expressed via the cookie banner are always respected.

17. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email at least 14 days before they take effect. The date of last update is always shown at the top of the document.

18. How to Contact Us and How to Complain

For any request relating to this Policy or to the exercise of your rights, write to support@wanderer.live. If you believe that our processing of your data violates applicable law, you have the right to lodge a complaint with the competent supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it) — or with the authority of the EU member state in which you habitually reside, work, or where the alleged violation occurred. This is without prejudice to your right to seek judicial redress.