dAirect Privacy Policy
Version 1.0 — Last modified: 17 March 2026
This Privacy Policy describes how Takyon S.r.l., with its registered office at Via Crema no. 15, 20135 Milan, Tax Code and VAT no. 12424180961, certified email (PEC) dairect@pec.it (hereinafter, the “Company”, “dAirect” or the “Controller”), processes the personal data of users who visit, browse, register with or use the dAirect digital platform (hereinafter, the “Platform”), as well as individuals whose data is processed in connection with related features and services. The Company processes personal data in accordance with Regulation (EU) 2016/679 (“GDPR”), applicable national data protection legislation and the principles of lawfulness, fairness, transparency, data minimisation, purpose limitation, accuracy, storage limitation, integrity and confidentiality.
Data Controller
The Data Controller is:
Takyon S.r.l.
Via Crema n. 15, 20135 Milano
Tax Code / VAT no. 12424180961
Certified email (PEC): dairect@pec.it
Email: privacy@dairect.io
For any request concerning the processing of personal data or the exercise of rights under applicable law, data subjects may contact the Company using the contact details provided on the Platform.
Scope of application
This Privacy Policy applies to the processing of personal data carried out by the Company in the following contexts:
visiting the website and the Platform
registering and creating an Account
using the Platform as a B2C user
using the management system as a B2B user
purchasing, selling, viewing or managing Bookings
processing data relating to the End User benefiting from the Booking
requests for information, contact, support or demos
managing payments through third-party providers
IT security, technical logs, maintenance and abuse prevention
complying with legal obligations or protecting the Company’s rights
This Privacy Policy governs the processing of personal data carried out by the Company as a data controller.
Separate contractual agreements or additional privacy arrangements between the Company and the business customer may apply to specific data flows connected with the contracted dAirect Connect and dAirect Resell services.
Categories of data subjects
The Company may process personal data relating to the following categories of data subjects:
visitors to the website and the Platform
registered B2C users
registered B2B users
contacts, employees, contractors or authorised representatives of business customers
buyers or sellers of Bookings
End Users benefiting from Bookings
individuals who contact the Company or request a demo
suppliers, partners or other individuals who interact with the Company
end users of the website of an accommodation provider using dAirect Connect
Categories of data processed
Depending on the circumstances, the Company may process the following categories of personal data:
identification and personal details, such as first and last names
contact details, such as email address and telephone number
Account-related data, such as credentials, internal identifiers, login history and sessions
Booking-related data, including status, history, operations performed and associated data
End User data necessary to use the service
administrative, tax and accounting data, where necessary
payment-related data, to the extent processed by the Company
technical and browsing data, such as IP address, browser and device information, logs, timestamps, and technical and security events
data and content uploaded or transmitted through the Platform or management system, including URLs, instructions, materials, content, outputs and requests
data relating to support requests, contacts, demos or communications
data relating to onboarding with Payment Providers, to the extent disclosed or made visible to the Company in connection with the Platform’s operational flows
technical and interaction data relating to end users of the accommodation provider’s website, such as page views, URLs, referrers, outbound link clicks, any UTM parameters, configured events, device type, browser, operating system, country of origin and a daily pseudonymised identifier
Purposes of processing and legal bases
The Company processes personal data for the purposes and on the legal bases set out below.
5.1 Browsing and technical operation of the Platform
The Company processes technical and browsing data to enable the operation of the website, use of the Platform, session management, security, stability and business continuity.
Legal basis: taking pre-contractual steps at the data subject’s request; the Controller’s legitimate interest in the security, maintenance and proper operation of the Platform.
5.2 Registration, authentication and Account management
When a user creates an Account or accesses the Platform, the Company processes the data necessary to:
create and manage the Account
authenticate the user
enable access to restricted areas
keep track of sessions and logins
handle technical, operational and security requests
Legal basis: performance of a contract or taking pre-contractual steps at the data subject’s request; the Controller’s legitimate interest in protecting the Platform and preventing unauthorised access.
5.3 B2C use of the Platform and Booking management
When a user registers with and uses the Platform as a B2C user, the Company processes the data necessary to:
create and manage the Account
display any Bookings associated with the user
enable Bookings to be listed for sale, where available
enable the purchase of Bookings listed for sale by other users, where available
associate the purchased Booking with the buyer’s user profile
manage transaction statuses and related communications
provide support for the resale, transfer or technical management of the Booking
If a user purchases a Booking listed for sale by another user, the Company may process the data necessary to manage the operational flow and correctly update the systems, while payment may be handled primarily by the Payment Provider.
Legal basis: performance of a contract or taking pre-contractual steps at the data subject’s request; the Controller’s legitimate interest in the technical management, security and traceability of operations carried out through the Platform.
5.4 B2B use of the management system
When a B2B user accesses the management system, the Company processes the data necessary to enable access to the features available under the existing contractual relationship.
If the B2B customer has activated dAirect Connect, the management system may display results, analyses, activities performed, content, insights, technical data and other outputs connected with the service.
If the B2B customer has activated dAirect Resell, the management system may display Booking data, statuses, operational repurchase features and other elements provided for in the separate contract.
This Privacy Policy governs the processing of personal data carried out by the Company through the management system as a controller, without prejudice to any additional privacy agreements relating to the contracted services.
Legal basis: performance of the contractual relationship or taking pre-contractual steps; the Controller’s legitimate interest in the proper technical, administrative and security management of the management system.
In general, the dAirect Connect service is aimed at business customers and is not designed to process personal data of end users of the accommodation provider’s website through its content optimisation component. The Analytics component may, however, process technical data and a pseudonymised identifier relating to interactions by end users of the accommodation provider’s website, as described below.
The Content Optimisation component makes technical requests to an endpoint managed by dAirect solely to retrieve and load onto the website content previously processed offline, such as meta tags, JSON-LD structured data and content in conversational format. These requests are not used to identify, profile or track end users, and any data contained in the request or its technical metadata is not retained by dAirect for its own purposes.
Processing through the dAirect Connect script on accommodation providers’ websites
Where the business customer activates the Analytics component of dAirect Connect, the script installed on the accommodation provider’s website collects technical data relating to end users’ interactions with its pages, such as page views, URLs, referrers, outbound link clicks, any UTM parameters and events configured on the website, as well as information on device, browser, operating system and country of origin. Processing is carried out through a cookieless analytics solution, self-hosted on the infrastructure used by dAirect in the European Union.
No cookies, localStorage, sessionStorage or other persistent identifiers are used on the device of the end user of the accommodation provider’s website. The technical identifier used to associate events within the same day is a pseudonymised hash generated by combining the IP address, user agent, project or website identifier and a cryptographic salt rotated daily. The IP address is not retained.
This processing is not used to identify end users of the accommodation provider’s website by name, carry out advertising profiling, remarketing or personal assessments. For this processing, Takyon S.r.l. acts as an independent controller under Article 4(7) GDPR. The legal basis is Takyon S.r.l.’s legitimate interest in measuring service performance and traffic from AI assistants, under Article 6(1)(f) GDPR. The data is not transferred to third parties for their own purposes.
5.5 Contacts, demos, commercial enquiries and follow-up
When a user or prospective customer contacts the Company or requests a demo, support or information, the Company processes the data necessary to:
respond to the request
arrange any appointments or demonstrations
manage commercial or technical follow-up
document communications exchanged
manage any onboarding activities or preliminary service assessments
Legal basis: taking pre-contractual steps at the data subject’s request; the Controller’s legitimate interest in managing commercial and organisational relationships; consent, where required by applicable law for specific promotional communications.
5.6 Data received from partner accommodation providers
In some cases, the Company may receive personal data from partner accommodation providers relating to users who have purchased Bookings eligible for use on the Platform, including any subsequent resale or technical management of the Booking.
The Company may process this data to:
associate the Booking with the user
send initial communications enabling access to the Platform
enable user registration and subsequent Booking management through an Account
make Booking-related features available
If the user registers with the Platform, the Company will process their data as a controller for further purposes connected with the Account, Booking management and available features.
Legal basis: taking pre-contractual steps at the data subject’s request or otherwise enabling use of the Platform; the Controller’s legitimate interest in correctly activating the requested features and technically managing the service.
5.7 End User data
Users may provide the Company with data relating to the End User who will actually benefit from the Booking. This data is processed only to the extent necessary to enable proper management of the Booking and its fulfilment by the third-party provider.
Users who provide third-party data warrant that they are entitled to do so and, where required by applicable law, have provided data subjects with the necessary information about the processing.
Legal basis: performance of the service requested by the user; the Controller’s legitimate interest in the proper technical and operational management of the Booking.
5.8 Payments and Payment Providers
When users make or receive payments through the Platform, the Company may process the data necessary to:
manage the transaction’s operational flow
verify its successful completion
record the transaction status
comply with administrative, accounting and tax obligations
interact with the Payment Provider
enable collection or payout features, where necessary
Users’ financial data may be collected and processed primarily by the Payment Provider in accordance with its own terms and privacy policy.
Legal basis: performance of a contract or taking pre-contractual steps; compliance with legal obligations; the Controller’s legitimate interest in the operational, accounting and security management of payment flows.
5.9 Support, assistance and communications management
The Company processes data contained in communications sent by users to handle support requests, technical assistance, reports, disputes or other operational communications.
Legal basis: performance of a contract or taking pre-contractual steps; the Controller’s legitimate interest in handling requests, ensuring service quality and protecting its rights.
5.10 Security, logs, maintenance and abuse prevention
The Company processes technical data and system logs to:
ensure the Platform operates correctly
monitor its availability, performance and security
prevent fraud, unauthorised access or anomalous behaviour
identify and correct bugs or malfunctions
carry out maintenance and technical assistance
Legal basis: the Controller’s legitimate interest in Platform security, abuse prevention and business continuity; compliance with legal obligations, where applicable.
5.11 Service improvement, internal analysis and product development
The Company may process personal data, operational data, Booking data and technical data in a manner compatible with the purpose pursued for internal analysis, monitoring Platform use, improving features, optimising workflows, developing the product, technically generating tokens or identifiers associated with Bookings and generally improving the services offered.
Such processing will comply with the principles of data minimisation and proportionality and, where possible, use aggregated or pseudonymised data or other appropriate measures to reduce the impact on data subjects.
Legal basis: the Controller’s legitimate interest in improving the Platform, services and technical and organisational processes.
5.12 Compliance with legal obligations and defence of rights
The Company may process personal data to comply with obligations laid down by law, regulations or requests from competent authorities, or to establish, exercise or defend its rights in judicial or out-of-court proceedings.
Legal basis: compliance with legal obligations; the Controller’s legitimate interest in protecting its rights.
Nature of the provision of data
Providing the data required for registration, authentication, Account management, use of the Platform, execution of requested operations, operation of the management system, Booking management or compliance with legal obligations is necessary.
Failure to provide the necessary data may make it impossible to:
create or use the Account
access the management system
purchase or sell Bookings
receive support
complete financial transactions
use the requested features
Providing data for purposes beyond those strictly necessary may be optional and, where required by law, subject to the data subject’s consent.
Data and content uploaded by users
The Company may process data, content, URLs, texts, instructions, files, configurations or other materials entered or transmitted by users through the Platform or management system.
Users remain solely responsible for the lawfulness, accuracy, relevance and lawful availability of such data and content. The Company processes them only to the extent necessary to make the requested feature available, provide assistance, maintenance and security, ensure the proper operation of the Platform and protect its rights.
Recipients of personal data
Personal data may be disclosed or made accessible, within the limits of their respective responsibilities and needs, to:
the Controller’s authorised personnel
providers of IT, hosting, cloud, authentication, maintenance, support, CRM and assistance services
Payment Providers
providers of communication, scheduling or support services
accommodation providers or other suppliers connected with the Booking
business customers or their authorised contacts, to the extent necessary to provide features connected with the contracted services
consultants, professionals and parties assisting the Controller in legal, tax, technical or organisational matters
public authorities, bodies or parties entitled to receive the data under the law
Parties processing data on behalf of the Controller are appointed as processors under Article 28 GDPR, where necessary.
Transfers of data to third countries
Where data is processed through suppliers or infrastructure located outside the EEA — including, for example, payment service providers and analytics tools — the Company adopts the measures required by law, including, where necessary, the Standard Contractual Clauses (SCCs) adopted by the European Commission or other appropriate safeguards provided for by the GDPR.
Data retention period
Personal data is retained only for as long as strictly necessary to fulfil the purposes for which it was collected and processed and, where necessary, for the period required by legal obligations or to protect the Controller’s rights.
In particular, data may be retained in accordance with the following general criteria:
Account-related data: for the lifetime of the Account and subsequently for the time necessary to handle any disputes, requests or legal obligations (generally no longer than 5 years after closure)
data relating to Bookings and operations carried out through the Platform: for the time necessary to manage the Booking, related operations and any subsequent disputes or checks (generally no longer than 10 years for tax/accounting purposes)
data relating to contact, support or demo requests: for the time necessary to handle the request and related follow-up, and for a subsequent period consistent with organisational, evidentiary or commercial purposes (generally no longer than 24 months)
administrative, accounting and tax data: for the periods prescribed by applicable law
technical logs and security data: for the time necessary for abuse prevention, security, maintenance and technical documentation of activities performed (generally no longer than 12 months)
data relating to analytics events collected through dAirect Connect: for the period necessary to generate and consult historical analytics, determined on the basis of service measurement needs, the principles of data minimisation and storage limitation, and documented internal criteria that are periodically reviewed. At the end of the identified period, data is deleted, anonymised or retained further only where a specific documented need or legal obligation exists.
data processed for marketing or promotional communications, where applicable: until consent is withdrawn or the data subject objects, and in any event in accordance with criteria of proportionality and periodic review
Once the applicable retention period has expired, data will be deleted or anonymised, unless further retention is permitted or required by law.
Data subject rights
Within the limits and subject to the conditions laid down by applicable law, data subjects may exercise the rights recognised under Articles 15–22 GDPR, including:
the right of access to personal data
the right to rectification of inaccurate or incomplete data
the right to erasure of data, where the relevant conditions are met
the right to restriction of processing
the right to object to processing, in the cases provided for by law
the right to data portability, where applicable
the right to withdraw any consent given at any time, without affecting the lawfulness of processing carried out before withdrawal
the right to lodge a complaint with the competent supervisory authority
To exercise their rights, data subjects may contact the Controller using the contact details provided in this Privacy Policy or on the Platform.
Marketing and promotional communications
The Company may send promotional or commercial communications only to the extent permitted by applicable law and, where required, with the data subject’s prior consent.
If a user registers with the Platform, the Company may use their contact details for communications connected with the service, the Account, Bookings, operations carried out through the Platform or other administrative, technical or transactional messages.
Data subjects may object to receiving promotional communications or withdraw any consent given at any time, following the instructions in the communication received or by contacting the Controller.
Cookies and tracking tools
For information on the use of cookies and tracking tools through the Platform, please refer to the Cookie Policy available on the Platform.
Changes to this Privacy Policy
The Company reserves the right to amend, supplement or update this Privacy Policy at any time for legal, regulatory, technical or organisational reasons.
The updated version will be made available on the Platform, indicating the date of the latest update, and will take effect upon publication unless otherwise specified.
Any versions of this Privacy Policy translated into other languages are provided for information purposes only. In the event of a dispute or discrepancy, only the Italian version shall prevail. Translations are carried out automatically using artificial intelligence tools.
© 2026 Takyon S.r.l. — Privacy Policy.