Privacy Policy

1. Data controller

• Data controller/operator: NEOEAST SRL
• Registered office: Via Amerigo Vespucci 41, 19135 La Spezia (SP)
• Tax code / VAT number: C.F. e P.IVA 01597490117 · VAT UE IT01597490117
• Companies Register / REA: Registro Imprese di La Spezia · REA SP-247276
• Privacy contact: info@waveasy.it
• Certified email (PEC): neoeast.srl@legalmail.it

2. Personal data processed

• registration and profile data: first name, last name, email address, role and protected credentials;
• for Operators: declared professional status, registered name, tax code, VAT number, registered address, certified email or recipient code, and data collected by Stripe for identification and payments;
• for Travelers: private or business billing name, tax code, any VAT number, registered address, certified email or recipient code; these details are disclosed to the booking Operator so they can issue the tax document;
• data relating to boats, availability, requests, bookings, reviews and communications between users;
• photographs and other content uploaded by owners;
• payment transaction identifiers and status; full card details are processed by Stripe and are not stored by Waveasy;
• Google account data when you choose to sign in with Google;
• external calendar addresses and the related occupied periods, if you voluntarily connect a calendar;
• technical and security data, such as IP address, logs, session identifiers and information needed to prevent abuse.

3. Purposes and legal bases

• account creation and management, publication of listings, requests, bookings, payments and support: performance of a contract or pre-contractual measures;
• tax, accounting and administrative compliance and responses to public authorities: legal obligation;
• security, fraud prevention, protection of rights, moderation and dispute management: legitimate interests of the controller and users;
• promotional communications and non-technical tracking tools: consent, where required and obtained separately.

4. Recipients and service providers

Data may be disclosed, where necessary, to hosting, maintenance, email, consulting, security, and support providers, and to authorities where required by law. The Operator receives the Traveler’s declared tax details in the booking copy solely for contractual, accounting, and tax compliance; users otherwise receive only the information needed to manage the experience.

For authentication and payments, the following may act as independent controllers or processors: Google and Stripe.

5. International transfers

When a provider processes data outside the European Economic Area, the transfer takes place on the basis of an adequacy decision or safeguards provided for by the GDPR, such as standard contractual clauses.

6. Retention

• account data is retained while the account remains active and, after closure, for as long as necessary to meet legal obligations or handle disputes;
• contractual, tax and payment data is retained for the periods required by applicable law;
• booking-related conversations are normally retained for 24 months after completion, unless disputes or administrative cases remain open;
• technical logs, security data and uncompleted requests are retained for periods proportionate to their purpose.

7. Cookies and similar technologies

The website uses cookies and technical identifiers necessary for security, session management, access and operation. Any non-technical analytics, advertising or profiling tools must remain disabled until valid, revocable consent has been obtained.

8. Data subject rights

You may request access, rectification, erasure, restriction, portability and objection, and you may withdraw consent without affecting prior processing. You may also lodge a complaint with the Italian Data Protection Authority.

To exercise your rights, write to info@waveasy.it.

9. AI-generated images and content

Promotional images generated or manipulated using artificial intelligence systems are visibly identified. Related technical provenance signals are retained where available. Photographs uploaded by users remain subject to the representations concerning rights and releases set out in the Terms.