Privacy Policy

Version 05/01/2022

Wota Travel Co., Ltd is dedicated to providing the best luxury travel escapes. Wota Travel Co., Ltd is 100% owned by Wota, Inc.. Therefore, Wota Travel Co., Ltd., its parent company Wota, Inc., and its subsidiaries (together, “we”, “Wota” or “the Company”) are included in the Privacy Policy. We value the protection of your personal data, so we created this Privacy Policy based on EU General Data Protection Regulation (“GDPR”) to outline how we collect and use different types of personal and behavioral information, and the reasons for doing so. You have the right to access, change or delete your personal information at any time and you can find out more about this and your rights in “Your Rights” section of this Privacy Policy or get in touch directly with us in our Contact Us section.

This Privacy Policy applies to “users” (hereinafter referred to as “you”) of Wota, which means anyone who visits the website, registers, or interacts with any service or products (generally, “Service(s)”) from Wota. For California residents, the section of the California Consumer Privacy Act explains the additional disclosures required by California law.

We may change this Privacy Policy in relation to changes in the law, best practices or changes in our Services. The changes will be published on our website, and if the change is material to your right, we will notify you via email or other agreed methods. If you do not accept the change, you can choose to delete your Wota Lifestyle customer account by contacting us through the means provided in our Contact Us section.

You may read this Privacy Policy in conjunction with our Terms of Use to totally understand how we collect and use data before you decide whether to accept this Privacy Policy or not. You acknowledge that your continued use of our Service after we publish or send a notice about this Privacy Policy or any subsequent changes means that the collection, use and sharing of your personal data is subject to the updated Privacy Policy, as of its effective date (the publishment date of this Privacy Policy on our website).

Sections in this policy:

  1. Information We Collect
  2. How We Use Your Information
  3. How We Work with Third Parties
  4. Retaining and Storing Your Information
  5. Your Rights
  6. California Consumer Privacy Act
  7. Contact Us

1. Information We Collect

When you use our Services, we will collect necessary personal data for a specific purpose.

(1) Registration of Wota Lifestyle customer account (“Wota Account”)

You can create a Wota Account to use the Service of Wota, e.g., to make orders. To create an account, you must provide the personal information below:

  • Surname / first name on passport
  • Mobile phone number
  • Email address
  • Residential address
  • Passwords

As another option, you can choose to link your Facebook, Google, or Apple account to create your user account. If you do so, we will receive the personal information below from Facebook, Google, or Apple:

  • Username
  • Email address
  • Photo (Facebook only)
  • Authentication token

Registering a Wota Account is not mandatory, however, if you choose not to register a Wota Account and provide necessary personal information to us, you would not be able to access most of our Services.

(2) Service Use

While using our Services, we may also collect and process some information, which may be directly or indirectly identifiable to you.

A. Bookings

When you book an order, we collect the information required to carry out the order, which usually includes:

  • First and last name
  • Billing address
  • Email address
  • Telephone number
  • Number of participants
  • Date and time

Further information may be required for the order, such as your flight number, location data or the age of the participants.

B. Payments

If you use the Service we provided, you may pay through our website, and necessary information, such as credit card number, billing information and your personal information will be required and be processed by a contractually affiliated third-party service provider stated in Section 2 of this Privacy Policy.

C. Customer support

If you send us inquiries through our customer support, e.g., LINE and Typeform, we will process and store the inquiry and your personal information you have provided to deal with the inquiry and to contact you.

(3) Device

When you visit our website, your device will automatically transmit the information below:

  • URL of the page accessed
  • Latency of the network connection
  • Date and time

When you visit our App, your device will automatically transmit the information below:

  • IP address
  • Location data

The personal information above will be stored separately from other information that you may transmit to us.

(4) Cookies

We use Cookies to recognize you and your device(s) for providing a better experience on our website, and certain information such as device ID and IP address will be collected through the Cookies we use, unless other Cookies are specified elsewhere in this Privacy Policy, the following Cookies:

  • Session Cookies: These Cookies are temporarily saved on our website and will be deleted when you leave the page (e.g., Cookies for finding out whether you have logged in).
  • Persistent Cookies: These Cookies are used for data storage on our website beyond a browser session (e.g., Cookies for the account to log in).

You can choose to delete existing Cookies and allow or block all Cookies in your browser settings.

(5) Social media

We operate pages or profiles on various social media platforms e.g., Twitter, Vimeo, Facebook and LINE.

If you interact with us via our social media sites or our posts, for example, if you mark a post with “Like”, share or “retweet”, comment or provide other content, we will collect and process the information you provide in connection with this, including your username and any profile photo (if any). The data processing in this regard is regularly carried out on the basis of our legitimate interest in providing the corresponding functions on our social media pages and, if applicable, on the basis of your consent vis-à-vis the operator of the respective network or your contractual relationship with the operator. Please also note that this content is published on our relevant social media sites according to your account settings and can be accessed by anyone worldwide.

We use the analytics function of the social media platform to analyze the use of our account or interactions with our social media pages and get anonymous information analysis. We also record if we are tagged on social media, and we will process information about the people who tag us to improve our social media activities.

Occasionally, we also run campaigns via our social media. To participate, you must, for example, comment on certain content, “like” us or tag us. We will collect your data once you choose to participate in the campaign and the information you provide will be processed for completing the campaign and notifying the winners.

Please note that the social media we use will also process your data based on their own privacy policies and may be different from our Privacy Policy. We are not responsible for their privacy policies, and you are suggested to read and understand all privacy policies which are applicable before making a decision.

2. How We Use Your Information

We primarily use your information for the purpose of providing the Service you ordered and giving personalized recommendations on things we think you may be interested in.

(1) To provide products and service

  • To successfully fulfill your orders and contracts with us (Art. 6 para. 1 lit. b GDPR).
  • To manage the inquiries and complaints from you (Art. 6 para. 1 lit. b GDPR).
  • To manage your privacy preferences and ensure you only receive communications that you have requested (Art. 6 para. 1 lit. d GDPR).
  • To send you administrative emails about the updates, changes and notifications that are necessary for the service you have chosen (Art. 6 para. 1 lit. b GDPR).

(2) To provide customer support

  • To manage our customer relationships, we store your personal data in our CRM system to answer any inquiries in a targeted manner and to send you contextual advertising within the permissible framework. The processing required within this context serves our legitimate interest in the management of our customer relationships (Art. 6 para. 1 lit. f GDPR).
  • To serve customers in a different language, we translate incoming requests (including the personal information you provide) into a specific language. The processing of personal data protects our legitimate interest in providing international customer service (Art. 6 para. 1 lit. f GDPR).
  • To continuously improve our customer service, we analyze inquiries sent to us based on certain parameters and keywords.

We basically analyze anonymous information based on specific parameters and keywords. Although, as a matter of principle, no analysis is carried out on the basis of personal data, it cannot be ruled out that, in individual cases, personal data may also be processed within this context. Telephone calls will only be analyzed and stored if we get your prior consent, and the record will be deleted after one year. The processing required within this context serves our legitimate interest as well as that of our customers in the continuous improvement of our customer service (Art. 6 para. 1 lit. f GDPR).

(3) To deliver marketing and advertising

We need your consent to use your information for marketing and advertising purposes. If you consent, further details of the way we will use your data are provided below:

A. Newsletter

You have the option on our website to register for our newsletter, and we would send you information on tours, activities or special promotions that is as personalized as possible. By registering for our newsletter, you, therefore, consent to us processing your email address for the purpose of sending the newsletter. You can revoke your consent at any time by clicking the “unsubscribe” link contained in every email or sending us a message through our customer support. To verify your email address, you will first receive a registration email, which you must confirm via a link (double opt-in). When you register for the newsletter, we store the IP address and the date and time of registration. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis results from our legal obligation to prove your consent (Art. 6 para. 1 lit. c in conjunction with Art. 7 para. 1 GDPR).

If you have booked a tour via our website or created a Wota Account, we will also send you our newsletter based on our legitimate interest in promoting similar services to your bookings or account (Art. 6 para. 1 lit. f GDPR) unless you have objected to this use. If Cookies are used for personalization, we will obtain your separate consent.

You can object to this at any time – even during registration – by deselecting the corresponding checkbox or clicking the unsubscribe link in the respective newsletter emails.

B. Advertising and Marketing

We need your consent to use your information for some specific purposes such as marketing and personalized advertising. Ways in which we will use your information if you consent are as follows:

We may send marketing communications via a range of channels including email and push notifications and you can opt out of these at any time. If you give us marketing permission, you may receive updates about special offers and related or similar products or services. If you accept and reply to the invitation we sent to you regarding the event held by a specially selected third party, we may pass your information to the third party who may provide you with their own products and services such as other events of hotels or restaurants. Those parties are responsible for their use of your data, and you are suggested to read their privacy policies carefully. The legal basis results from our legal obligation to prove your consent (Art. 6 para. 1 lit. a GDPR).

C. Evaluation

With your consent, we place advertisements, widgets, paid links, etc. on third-party sites on the web and social media platforms. In order to measure the effectiveness of our advertisements, Cookies are set when you are redirected from the relevant third-party site to our website. The use of the Cookies and the analysis of your click behavior is based on your consent, which we obtain before the respective cookie is set (Art. 6 para. 1 lit. a GDPR).

D. Other remarketing service

If you consent, we also use the remarketing service (Art. 6 para. 1 lit. a GDPR). In each case, your usage behavior on our website is analyzed using Cookies. The providers will use this information for precision marketing on third-party sites.

(4) To ensure the operation of website and IT systems

  • To balance the loading into our website to offer you the fastest possible loading time.
  • To ensure the security of our IT systems and defend against attacks on our systems.
  • To maintain the operation of our IT systems and prevent errors.
  • To confirm our Services are compatible with the browsers and operating systems used by most of our visitors.

The processing is carried out to ensure the security of the processing based on our legitimate interest in maintaining the operation of our Services (Art. 6 para. 1 lit. f GDPR).

(5) To prevent fraud or crime

  • To enable criminal prosecution, averting of a danger or legal prosecution in the event of specific indications of criminal offenses.
  • To avoid fraudulent bookings, we evaluate the information provided by our customers during the booking process with the data automatically transmitted to us.
    The processing protects our legitimate interest and that of the activity providers in reliable bookings and prevents misuse of our Services (Art. 6 para. 1 lit. f GDPR).

(6) Other uses of your information

In addition to the conditions above, your personal data will only be processed without your prior consent in these conditions:

  • If it is necessary for the clarification of illegal use of our Services or for legal prosecution, personal data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties. However, this only happens if there are specific indications of unlawful or abusive behavior (Art. 6 para. 1 lit. c GDPR).
  • Upon request, we also have the legal obligation to provide data to specific authorities’ units, e.g., law enforcement agencies, authorities that prosecute administrative offenses subject to fines, and the tax authorities (Art. 6 para. 1 lit. c GDPR).
  • If it is necessary, we disclose personal data to auditors, accounting service providers, lawyers, banks, tax consultants, etc., for the purpose of proper operation of our business or legal obligation (Art. 6 para. 1 lit. c GDPR).
  • As part of the further development of our business, it may happen that the structure of Wota changes by changing the legal form, founding, buying, or selling subsidiaries, parts of the company or components. In such conditions, customer information is passed on together with the part of the company to be transferred. We have a legitimate interest in adapting our corporate form to the economic and legal circumstances as necessary (Art. 6 para. 1 lit. f GDPR).

3. How We Work with Third Parties

We disclose personal information to third parties when it is necessary to deliver a service or product or to help us improve your experience with us, or when we are required to do so by contract or law. We will make sure the disclosure follows this Privacy Policy and relevant laws.

We have in place contracts to ensure the information remains secure and limited in use, and if we do not have a legitimate business reason to pass on your information, we will ask you to give consent first. The conditions that we disclose data to them if it is necessary are provided below:

(1) Payment:

The data provided during your payment will be forwarded by the third-party company to the financial institutions to fulfill the payment stage. In the case of payments by credit card, we only receive the information that payment has or has not been made. We, therefore, have no knowledge of your credit card number. For the processing of payments by credit card, we use the service provider Cherri Tech, Inc., based in Taiwan. If you are using a credit card or debit card issued in the United States, you can also process your payment via Stripe.

(2) Email:

We send you an email through third-party service providers. For sending emails, we use the Sendgrid service of Twilio, based in the USA.

(3) Inquiry:

  • For your inquiries to us, we use Typeform services operated by Typeform SL, based in Spain.
  • For the processing of inquiries, we use systems provided by Amazon Web Services, Inc., based in the USA.
  • For the processing of telephone inquiries, we use systems provided by Eason Sourcing International Co. Ltd, based in Taiwan.
  • For the evaluation of inquiries, we use the systems of the providers HubSpot Inc., Intercom, Inc., and Google, Inc., all based in the USA.

(4) Booking:

To book any travel, we use the API and GDS services of Travelport, LP, based in the USA. We transfer your data to the body responsible for the travel or activity.

(5) Hosting of our website:

For the hosting of our website, we use the services of Amazon Web Services EMEA S.a.r.l., based in Luxembourg.

(6) Newsletter:

For the dispatch of our newsletter and the personalization of content, we use the services of the provider NewsLeopard, Inc., based in Taiwan.

(7) Prevention of fraud:

For the prevention of fraud, we use the services of the provider Stripe, Inc., based in the USA, and Cherri Tech, Inc., based in Taiwan. To protect ourselves from bots and similar technologies, we use the Google reCAPTCHA service provided by Google, Inc., based in the USA.

(8) Advertising:

For advertising activity, we use the services of TikTok, Inc., Pinterest, Inc., Twitter, Inc., Facebook Ireland Limited and Google, Inc., based in the USA., they use Cookies and pixel to record your usage behavior on our website in order to display interest-based advertising for our products on other pages.

(9) Storage:

For data storage, we use the services of, Hubspot, Inc, Intercom, Inc, and Google, Inc, based in the USA.

(10) Integrated third-party content:

We have also integrated third-party content on our website. This content is loaded from the servers of the respective providers so that your end device transmits certain technically necessary data to the third-party provider. In particular, it can’t be ruled out that these providers may take note of the IP address assigned to you. Insofar as personal data is processed, this is done based on the privacy policies of the respective third-party providers. The integration by us is based on our legitimate interests in being able to provide our users with the corresponding content and functionalities and be able to operate our website economically, Art. 6 para. 1 lit. f GDPR.

Please note that the above contractually affiliated third-party companies and service providers might be changed from time to time based on our business cooperation. They will use and disclose your data based on their own privacy policies and may be different from our Privacy Policy. We are not responsible for their privacy policies, and you are suggested to read and understand all privacy policies which are applicable before making a decision.

4. Retaining and Storing Your Information

If you delete your Wota Account, your profile and other personal information will be deleted completely and permanently. However, we will retain backup copies of your data to the extent and for as long as this data is required for legal reasons or for criminal prosecution or to secure, assert or enforce legal claims.

If data must be retained for legal reasons, processing will be restricted, and the data is then no longer available for further use.

Storage beyond the contractual relationship is based on our aforementioned legitimate interests according to Art. 6 para. 1 lit. f GDPR.

Further details of keeping and storing your information that need your prior consent are provided below:

(1) Storing and transferring information internationally

Wota is a global business. The data that we collect from you, as described in this Privacy Policy, could be made accessible from, transferred to, or stored in countries which may not have the same data protection laws as the country in which you initially provided the information. We will put appropriate safeguards in place to make sure that these transfers comply with GDPR.

When your data is transferred internationally, we establish and implement appropriate contractual, organizational, and technical measures with them. This is done by putting in place Standard Contractual Clauses as approved by the European Commission, by examining the countries to which the data may be transferred, and by imposing specific technical and organizational security measures.

These clauses are contractual commitments between companies transferring personal data, binding them to protect the privacy and security of the data. Wota companies adopted Standard Contractual Clauses so that the data flows necessary to provide, maintain, and develop our Services take place legally.

(2) Users under:

We may only collect and process the personal information of individuals who can lawfully use the Service without parental consent. When necessary, users under the age of 16 will be told not to submit any personal details. We will make every effort to delete any details of such users where a parent or guardian has informed us that these details have been collected.

5. Your Rights

You have some rights for the processing of your personal data. Further details of the rights are provided below. If you want to exercise your rights, you can make a request by the means provided in the Contact Us section.

Moreover, please note that sometimes complete erasure or restriction to processing your data is not possible because of operational and legal reasons, such as you remain a customer for whom we need to provide Services, but you wish us to no longer contact you for marketing purposes. In this case, we may need to retain some of your details securely in order to facilitate this request by, for example, keeping you on a “do not contact” or suppression list.

(1) Right of access to information

You have the right to request us for what and how your personal data be collected and processed by us.

(2) Right to correct incorrect data

You have the right to request us to correct incorrect personal data about you. We will correct it immediately according to any proof provided by you.

(3) Right to erasure

You have the right to ask us to erase your personal data. When personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, and users withdraw consent on the subject that needs prior consent, if there is no other legal ground for the processing or the personal data have been unlawfully processed, we will erase personal data without delay upon request.

(4) Right to restriction of processing

You have the right to ask us to restrict processing. Wota will restrict the processing of personal data without delay upon request under circumstances as:

  1. when the accuracy of the personal data is suspected by you and Wota is enabled to verify the accuracy of the personal data for a reasonable period of time;
  2. the processing is unlawful and you request to restrict Wota’s use rather than to erase the data;
  3. Wota no longer needs the personal data for the purposes of the processing, but are required by you for the establishment, exercise or defense of legal claims;
  4. you have objected to processing pending the verification whether the legitimate grounds of Wota override your interests, rights and freedoms.

(5) Right of data portability

You have the right to receive the personal data concerning you, which you have provided to Wota, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

(6) Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. If you exercise this right, we will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

(7) Non-Discrimination

You have the right not to receive discriminatory treatment for exercising any of the rights described above.

6. California Consumer Privacy Act (CCPA)

In addition to the rights mentioned above, if you are a California resident, you have some additional rights under the CCPA, which include being informed if any of your personal data has been “sold”.

(1) Note about “Sales”

We do process personal data of users to certain contractually affiliated third-party companies and service providers for purposes documented in this Privacy Policy, which is defined as a “sale” of data under the CCPA. However, we do not “sell” personal data as most people would typically understand that term

(2) Right to opt-in and opt-out

You also have the right to opt out of the future sale of your personal data to third parties.
For information about the personal data we collect, how we use your personal data and how we work with the third party, please refer to the relevant sections in this Privacy Policy. If you have any questions or want to exercise your rights, please send an email to

7. Contact Us

If you have any questions or suggestions regarding data protection or would like to exercise your rights, please send an email to

If you have any questions or requests in connection with California Consumer Privacy Act, please send an email to

If you are a California resident and you want to exercise your right to know and/or right to deletion, please submit a request by emailing with the subject line “California Rights Request”.