Wayby Privacy Policy

This Privacy Policy describes how Digital Labs Oy (“Wayby”, “we”, “us”, or “our”) processes personal data in connection with the Wayby personalization and A/B testing service, customer relationships, business development, and direct marketing.

Wayby is operated by:

Digital Labs Oy
Business ID: 3001169-1
Heikkiläntie 103
42560 Pohjoisjärvi
Finland
Email: support(at)wayby.io

1. Scope of This Policy

This Privacy Policy applies to:

• Personal data relating to our customers and their representatives.
• Personal data relating to prospective customers, partners, suppliers, and other professional contacts.
• Personal data processed through the Wayby personalization service on behalf of our customers.

When processing customer account data, prospective business contact data, and direct marketing data, Digital Labs Oy acts as the data controller.

When providing the Wayby service, Digital Labs Oy acts as a data processor on behalf of its customers, who act as data controllers with respect to visitor data collected on their websites.

2. Categories of Personal Data

2.1 Customer Account Data — Controller Role

When organizations register for and use Wayby, we may process:

• Company name
• Contact person name
• Email address
• Telephone number
• Job title and professional responsibilities
• Billing information
• Website ID
• Contractual and service usage information
• Communication records

We act as the data controller for this data.

2.2 Business Contact and Direct Marketing Data — Controller Role

For business development and direct marketing purposes, we may process professional contact information relating to existing and prospective customers, partners, suppliers, and other persons whose professional responsibilities may reasonably be connected with the Wayby service.

The personal data processed for these purposes may include:

• Name
• Professional email address and telephone number
• Employer or represented organization
• Job title, department, and professional responsibilities
• Company website and other publicly available professional information
• The source from which the contact information was obtained
• Records of business communications and interactions
• Marketing preferences, consent records, unsubscribe requests, and objections to direct marketing

We do not intentionally collect private contact information that is unrelated to the person’s professional role, or special categories of personal data under Article 9 GDPR, for business-to-business marketing purposes.

2.3 Sources of Business Contact Data

Business contact data may be collected:

• Directly from the individual or their organization
• From the organization’s website or other publicly available business sources
• From professional networking services and business directories
• From business events, conferences, webinars, and professional meetings
• Through referrals, enquiries, demonstrations, trials, or other business interactions
• From service providers or business-information providers that are lawfully permitted to provide the information

Where personal data is obtained from a source other than the individual, we provide the information required under Article 14 GDPR within the applicable period and, where the data is used to contact the individual, no later than the first communication.

This includes information about the source of the data, the purposes of processing, and the reason the person was selected as a relevant business contact.

2.4 Website Visitor Data — Processor Role

When Wayby is implemented on a customer’s website, we process limited visitor-related data strictly on behalf of the customer.

This may include:

• Website ID
• Page URL
• Campaign identifier
• Variant assignment, such as an A/B test group
• Interaction events, such as impressions and clicks
• Truncated IP address, where used for security or approximate geolocation
• Browser and device metadata, such as the user agent

Wayby:

• Does not store full IP addresses
• Does not assign persistent visitor identifiers
• Does not track users across sessions
• Does not track users across campaigns
• Does not link visitor behavior between different websites
• Does not process special categories of personal data under Article 9 GDPR

All campaign tracking is isolated per campaign and per session.

3. Purposes of Processing

3.1 Customer Account Data

We process customer account data to:

• Provide and maintain the Wayby service
• Manage customer accounts
• Provide customer support
• Invoice customers and manage billing
• Communicate service, contractual, and security updates
• Manage the customer relationship
• Ensure service and account security
• Comply with legal and accounting obligations

3.2 Business Contact and Direct Marketing Data

We process business contact data to:

• Identify organizations and professional contacts that may reasonably be interested in Wayby
• Establish, maintain, and develop business relationships
• Communicate about Wayby’s services, demonstrations, trials, features, events, and relevant content
• Respond to enquiries and follow up on previous business interactions
• Manage sales, partnership, and customer-development activities
• Maintain records of marketing permissions, unsubscribe requests, and objections
• Measure and improve the relevance and effectiveness of our business communications
• Prevent marketing messages from being sent to individuals who have objected or unsubscribed

3.3 Visitor Data Processed on Behalf of Customers

We process visitor data solely to:

• Deliver personalization experiences
• Conduct A/B testing
• Measure campaign performance
• Provide anonymized or aggregated performance metrics
• Maintain technical security and service integrity

We do not use visitor data for advertising networks, cross-site tracking, or resale.

4. Legal Basis for Processing

4.1 Customer Account Data

Processing of customer account data may be based on:

• Performance of a contract or steps taken before entering into a contract under Article 6(1)(b) GDPR
• Our legitimate interests under Article 6(1)(f) GDPR, including managing customer relationships, improving the service, ensuring security, and conducting relevant business communication
• Compliance with legal obligations under Article 6(1)(c) GDPR, including accounting and tax requirements
• Consent under Article 6(1)(a) GDPR where consent is requested and appropriate

4.2 Business Contact and Direct Marketing Data

Where permitted by applicable law, the processing of business contact data is based on our legitimate interests under Article 6(1)(f) GDPR.

Our legitimate interests include:

• Promoting and developing our services
• Identifying prospective business customers and partners
• Establishing and maintaining business relationships
• Communicating with persons whose professional responsibilities are relevant to Wayby
• Maintaining accurate records of marketing preferences and objections

Before relying on legitimate interest, we assess whether:

• The intended processing serves a specific and lawful business interest
• The processing is necessary and proportionate for that interest
• The individual could reasonably expect the processing in their professional capacity
• The communication is relevant to the individual’s organization, position, or professional responsibilities
• The individual’s interests, fundamental rights, or freedoms override our interests

We may instead rely on consent under Article 6(1)(a) GDPR where consent is required or is otherwise the appropriate legal basis.

4.3 Visitor Data

Website operators using Wayby determine the legal basis for processing visitor data on their websites.

Wayby processes visitor data strictly under a data processing agreement with the customer, in accordance with Article 28 GDPR.

Depending on the customer’s implementation and jurisdiction, the legal basis determined by the customer may include:

• Legitimate interest
• Consent
• Another legal basis available under applicable law

Customers are responsible for ensuring that their use of Wayby complies with applicable data protection, electronic communications, and ePrivacy laws.

5. Electronic Direct Marketing

The inclusion of a person’s professional contact information in our business contact database does not automatically mean that we may send electronic direct marketing to that person.

We send electronic direct marketing only where permitted under applicable data protection and electronic communications laws.

This may include situations where:

• The recipient has given prior consent
• The message is sent to a general company or organizational contact address rather than an address assigned to a specific natural person
• The recipient’s professional role is essentially connected with the products or services being marketed and the communication is relevant to that role
• An existing customer relationship permits marketing of our own similar products or services, subject to the applicable legal requirements

Before sending electronic direct marketing to a named professional contact without consent, we assess and document why the person’s role is materially connected with the Wayby service and why the communication is relevant to that role.

We do not send electronic direct marketing merely because a person’s contact information is publicly available or because we generally believe that the person or their organization might be interested in our business.

Every electronic marketing message:

• Clearly identifies Digital Labs Oy or Wayby as the sender
• Does not conceal the commercial nature of the communication
• Provides an easy and free method of objecting to or unsubscribing from further marketing

We honor unsubscribe requests and objections without undue delay.

6. Cookies and Tracking Technologies

Wayby:

• Does not use cookies for personalization
• Does not assign persistent identifiers
• Does not perform cross-session tracking
• Does not perform cross-campaign tracking
• Does not perform cross-site tracking

Wayby does not store or access information on a visitor’s device for tracking purposes beyond what is technically necessary to deliver a campaign experience.

Website operators are responsible for determining whether consent mechanisms are required under applicable law.

7. Data Retention

7.1 Customer Account Data

Customer account data is retained:

• For the duration of the customer relationship
• As required by accounting, tax, and other legal obligations
• For a reasonable period after termination where necessary for contractual, legal, or dispute-resolution purposes

7.2 Business Contact and Direct Marketing Data

We retain prospective business contact data only for as long as it remains relevant and necessary for the purposes described in this Privacy Policy.

Prospective business contact records are reviewed periodically and are generally deleted or anonymized no later than 24 months after the most recent meaningful business interaction, unless:

• A customer, contractual, partnership, or other business relationship has commenced
• The individual has requested or consented to continued communications
• A longer retention period is necessary for legal claims, compliance obligations, or the establishment, exercise, or defense of legal rights
• Limited information must be retained to respect an objection or unsubscribe request

Inaccurate, outdated, or no longer relevant contact information is corrected or deleted without undue delay.

After an individual objects to direct marketing or unsubscribes, we may retain limited information, such as the email address and the date of the request, on a suppression list. This information is retained only to ensure that the individual is not contacted again for direct marketing purposes.

7.3 Visitor Data

Visitor-level campaign data is retained only for the period necessary to:

• Measure campaign performance
• Generate aggregated metrics
• Maintain service integrity
• Meet the documented instructions of the relevant customer

Aggregated and anonymized statistical data may be retained for longer periods for analytical purposes.

We do not retain persistent visitor profiles.

8. Data Transfers

Wayby is hosted in Finland. Personal data processed by Wayby is stored within the European Union.

We do not transfer personal data outside the EU or EEA unless required by law or necessary for essential service infrastructure under appropriate safeguards in accordance with GDPR.

Where an international transfer takes place, we use an applicable transfer mechanism and supplementary safeguards where required.

9. Subprocessors and Service Providers

Where necessary, we may use carefully selected service providers for:

• Hosting infrastructure
• Cloud storage
• Security monitoring
• Email delivery
• Customer relationship management
• Business communications
• Payment processing

Where a service provider processes visitor data on our behalf in connection with the Wayby service, it acts as a subprocessor.

Where a service provider processes personal data on our behalf in connection with customer relationships or business development, it acts as our processor.

All such providers are bound by appropriate data processing, confidentiality, and security obligations.

An up-to-date list of subprocessors used in connection with the Wayby service is available upon request.

10. Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit using TLS
• Access control and authentication mechanisms
• Role-based access restrictions
• Secure hosting within the EU
• Monitoring and logging of system access
• Data minimization principles
• Regular review of access permissions

Access to personal data is restricted to personnel whose job duties require it.

11. Data Subject Rights

Under the GDPR, individuals may have the right to:

• Access their personal data
• Rectify inaccurate or incomplete personal data
• Request erasure of their personal data
• Restrict processing
• Object to processing based on legitimate interests
• Receive their personal data in a portable format where applicable
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with a competent supervisory authority

These rights may be subject to conditions and limitations under applicable law.

11.1 Right to Object to Direct Marketing

Individuals have the right to object at any time to the processing of their personal data for direct marketing purposes. No justification is required.

After receiving an objection, we stop using the person’s personal data for direct marketing without undue delay.

An objection or unsubscribe request may be submitted:

• Using the unsubscribe mechanism included in a marketing message
• By contacting support@wayby.io

We may retain limited information on a suppression list where necessary to ensure that the person is not contacted again.

11.2 Visitor Data Requests

Because Wayby acts as a data processor for visitor data:

• Visitors should primarily contact the website operator that determines the purposes and means of processing.
• Wayby will assist its customers in fulfilling data subject requests where required by law and the applicable data processing agreement.

11.3 Customer Account and Business Contact Data Requests

Requests concerning customer account data, prospective business contact data, or direct marketing data may be directed to:

[support@wayby.io](mailto:support@wayby.io)

We may request information necessary to verify the identity of the person making the request before fulfilling it.

12. Automated Decision-Making

Wayby provides campaign-based personalization and A/B testing functionality.

Wayby does not perform automated decision-making that produces legal effects or similarly significant effects within the meaning of Article 22 GDPR.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, service functionality, or our processing activities.

The latest version will always be available at:

Wayby – Privacy Policy

Where required by law, we will provide notice of material changes through an appropriate communication channel.

14. Contact

If you have questions about this Privacy Policy, wish to exercise your rights, or have questions about our data processing practices, please contact:

Digital Labs Oy
Email: support(at)wayby.io