This English version is provided for information only. Voyino is operated by KATALUXE SARL U, a company incorporated in Togo: in case of any discrepancy, the French version of this document prevails.

Privacy policy

In accordance with Regulation (EU) 2016/679 (GDPR), Togolese law no. 2019-014 of 29 October 2019 on the protection of personal data, and the applicable national laws of the countries where Voyino operates.

Last updated: 05/05/2026 — Version 1.0 (MVP)

1. Data controller

The controller of your personal data is:

KATALUXE SARL U Single-member limited liability company under Togolese law Registered office: Zone Portuaire, Lomé, Togo Lomé business registry (RCCM): TG-LFW-01-2025-B13-01323 Legal representative: KATALA MABEBA, sole manager Email: contact@voyino.com

For any question about the protection of your data, contact us at contact@voyino.com with the subject "GDPR — [subject of your request]".

2. Personal data collected

In operating the Voyino Platform, we collect the following categories of data:

2.1 Identification and account data

• Email address (main account identifier)
• Surname and first name
• Phone number (optional, provided by the User)
• Password (stored hashed and salted — never in clear text)

2.2 Profile data

• Profile picture (avatar), if uploaded
• Country of residence and preferred language
• Payment provider identifier (customer reference, contains no banking data)
• Role on the Platform (traveler, host, administrator)

2.3 Transaction and booking data

• Booking history (dates, accommodation, amounts, statuses)
• Messages exchanged with Hosts or Travelers in connection with bookings
• Payment information processed by our third-party payment provider (KATALUXE SARL U stores no raw banking data)
• Cancellation reasons and refund amounts where applicable

2.4 Communication data

• Messages sent and received on the Platform between Users
• Exchanges with Voyino customer service

2.5 Technical data

• IP address
• Browser type and version (user agent)
• Technical session and authentication cookies
• Access and activity logs on the Platform (for security purposes)

3. Purposes of processing

Your personal data is processed for the following purposes:

4. Legal bases for processing (GDPR Art. 6)

• Performance of the contract (Art. 6.1.b): most processing is necessary to perform the Terms of Use and Terms of Sale you have accepted.
• Legitimate interest (Art. 6.1.f): Platform security, fraud prevention, service improvement.
• Legal obligation (Art. 6.1.c): retention of invoices and accounting data for 10 years in accordance with legal obligations.
• Consent (Art. 6.1.a): where applicable, for marketing communications or non-essential cookies (currently not used by Voyino).

5. Data retention periods

Once the retention periods expire, data is permanently deleted or irreversibly anonymised.

6. Data recipients

Your data may be shared with the following recipients, strictly for their stated purpose:

• Authorised staff of KATALUXE SARL U: strictly as necessary to carry out their duties.
• Third-party payment provider (payment processing): data required to process transactions. The precise identity of the provider will be communicated when online payments are activated.
• Vercel Inc. (frontend hosting): technical data related to providing the application hosting service.
• Supabase Inc. (database hosting): all data stored in the database, hosted in the EU.
• Competent public authorities: on judicial requisition or legal obligation.

None of your data is sold, transferred or rented to third parties for commercial purposes.

7. Data transfers outside the European Union

Some of our processors are established outside the European Union. These transfers are covered by the following safeguards:

8. Your rights over your personal data

Under the GDPR (Articles 15 to 22), you have the following rights:

• Right of access (GDPR Art. 15): obtain a copy of the personal data concerning you that we process.
• Right to rectification (GDPR Art. 16): have inaccurate or incomplete data corrected.
• Right to erasure (GDPR Art. 17): request deletion of your data under the conditions provided by law — Account deletion form.
• Right to restriction of processing (GDPR Art. 18): request temporary suspension of the processing of your data.
• Right to portability (GDPR Art. 20): receive your data in a structured, machine-readable format.
• Right to object (GDPR Art. 21): object to certain processing based on our legitimate interest.
• Right to withdraw consent: withdraw consent previously given at any time, without affecting the lawfulness of prior processing.

How to exercise your rights:

Send your request to contact@voyino.com with the subject "GDPR — [right exercised]" and attach a copy of proof of identity. We will reply within a maximum of 30 days (extendable to 90 days in complex cases, with prior notice).

Right to lodge a complaint with a supervisory authority:

If you consider that the processing of your data infringes your rights, you have the right to lodge a complaint with the competent data protection authority in your country of residence:

• 🇹🇬 Togo: Instance de Protection des Données à Caractère Personnel (IPDCP) — ipdcp.tg
• 🇨🇮 Côte d'Ivoire: Autorité de Régulation des Télécommunications/TIC (ARTCI) — artci.ci
• 🇧🇯 Benin: Autorité de Protection des Données Personnelles (APDP) — apdp.bj
• 🇸🇳 Senegal: Commission de Protection des Données Personnelles (CDP) — cdp.sn
• 🇲🇦 Morocco: Commission Nationale de Contrôle de la Protection des Données (CNDP) — cndp.ma
• France: Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr
• Belgium: Autorité de protection des données (APD) — autoriteprotectiondonnees.be
• Other EU countries: the national data protection authority of your country of residence

9. Data security

KATALUXE SARL U implements the following technical and organisational measures to protect your data:

• HTTPS encryption (TLS) of all communication between your browser and our servers.
• Secure password hashing (no password is stored in clear text).
• Row Level Security (RLS) on the Supabase database: each User can only access their own data.
• Restricted access to data: only authorised staff of KATALUXE SARL U have access, within the scope of their duties.
• Secure authentication through Supabase authentication services.
• Security monitoring and logs to detect unauthorised access.

Despite these measures, no system is infallible. In the event of a data breach likely to affect your rights and freedoms, we will inform you within the timeframes set by the GDPR (72 hours for notification to the authorities, a reasonable time for the individuals concerned).

10. Minors

The Voyino Platform is strictly reserved for people aged at least 18. We do not knowingly collect personal data from minors. If you become aware that a minor has created an account on our Platform, please report it immediately to contact@voyino.com. We will delete the account and the associated data as soon as possible.

11. Changes to this policy

KATALUXE SARL U reserves the right to change this Privacy policy at any time to adapt to legal, technical or operational developments.

Significant changes will be notified by email to all active Users with reasonable notice. The date of the last update is shown at the top of the document. We encourage you to consult this page regularly.

12. Contact — data protection questions

For any question, request or complaint about the protection of your personal data:

KATALUXE SARL U — Data protection contact Email: contact@voyino.com Subject line to use: "GDPR — [subject of your request]"

As no data protection officer (DPO) has been formally appointed at this stage, all data protection requests are handled directly by the manager of KATALUXE SARL U.

---

Last updated: 05/05/2026 Version: 1.0 (MVP)