Dies ist ein rechtliches Dokument. Die angezeigte Übersetzung dient ausschließlich Ihrer Bequemlichkeit — allein die englische Fassung ist der maßgebliche und rechtlich verbindliche Text. Für die garantiert korrekte und beabsichtigte Fassung sehen Sie sich diese Seite bitte auf Englisch an.

Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how URVALON International Holdings Ltd. ("ViaLoka", "we", "us") collects, uses, and protects personal data when you use the ViaLoka platform and websites (the "Platform"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Maltese data-protection law.

1. Controller

URVALON International Holdings Ltd. Office 82, 9 Triq L-Gharb, Gharb GRB 1102, Gozo, Malta Email: legal@vialoka.com

For privacy and data-protection requests: legal@vialoka.com

2. What Data We Process

Depending on how you use the Platform, we may process:

Account data — name, email address, password (hashed), and profile details you provide when registering as a user or vendor.
Vendor / listing data — business name, address, contact details, opening hours, products, services, prices, and images. For unclaimed profiles, this data is compiled from publicly available sources (see Section 4).
Transaction data — bookings, orders, and related communications where the Platform facilitates them.
Usage & technical data — IP address, device and browser information, pages viewed, and interactions, collected via server logs and cookies/similar technologies.
Communications — messages you send us or exchange through the Platform.

3. How and Why We Use Data (Legal Bases)

Purpose	Legal basis (GDPR Art. 6)
Providing and operating the Platform, accounts, and transactions	Performance of a contract (Art. 6(1)(b))
Building and maintaining the local vendor catalogue, including aggregated profiles	Legitimate interests (Art. 6(1)(f))
Security, fraud prevention, and stability	Legitimate interests (Art. 6(1)(f))
Marketing / newsletters (where applicable)	Consent (Art. 6(1)(a))
Compliance with legal obligations	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, you have the right to object (see Section 8).

4. Aggregated & Unclaimed Vendor Profiles

To build a useful local catalogue, ViaLoka compiles vendor information from publicly available sources and enhances it using automated systems, including artificial intelligence. Our aim is to surface local businesses with the best possible intent and usefulness.

Because this information is drawn from third-party sources and processed by automated technology, it may be incomplete, out of date, or contain errors. We rely on our legitimate interest in operating a local-discovery service (GDPR Art. 6(1)(f)).

If you are a vendor (or the person responsible for a listed business), you can at any time and free of charge:

claim your profile and take control of it,
correct or complete the information shown,
request removal of your profile, or
register and then delete your profile and data yourself.

To do so, register on the Platform or contact us at legal@vialoka.com.

5. Automated Processing & AI

We use automated systems, including AI, to organize, enrich, format, and surface content (such as generating descriptions or categorizing vendors). This processing supports discovery and does not make legally significant automated decisions about you within the meaning of GDPR Art. 22. AI-processed content may contain inaccuracies (see Section 4).

6. Cookies & Tracking

We use only strictly necessary and functional cookies and local storage to operate the Platform. We do not currently use advertising or third-party analytics / tracking cookies. If this changes, we will update this policy and request your consent via the cookie banner before any non-essential cookies are set.

Name	Category	Purpose	Duration
`staffToken`	Essential	Authenticates staff / preview access during the pre-launch phase	24 hours
`vialoka_guest`	Essential	Links a shopping cart to your browser before you sign in	30 days
`userToken` / `adminToken`	Essential	Keeps you signed in to your account	Until logout (local storage)
`cookie-consent`	Essential	Remembers your cookie choice	Persistent (local storage)
`vialoka_lang`	Functional	Remembers your selected language	Persistent (local storage)
`vialoka_theme`	Functional	Remembers your light / dark theme preference	Persistent (local storage)

You can clear cookies and local storage at any time via your browser settings, and manage your choice through the cookie banner.

We may share personal data with:

Service providers / processors acting on our behalf (e.g. hosting, email, analytics, payment processing), under data-processing agreements;
AI and translation infrastructure providers that we use to generate, enrich, format, categorize, and translate content. Some of these providers are established outside the EU/EEA, in particular in the United States;
Vendors and users, where necessary to facilitate a booking or transaction you initiate;
Authorities, where required by law.

Our hosting is provided within the EU/EEA where possible. Where personal data is transferred outside the EU/EEA — including to AI and cloud providers in the United States — we rely on appropriate safeguards, namely the EU–US Data Privacy Framework (for certified recipients) and/or the EU Standard Contractual Clauses (SCCs), together with supplementary measures where required.

8. Your Rights

Under the GDPR, you have the right to:

access your personal data,
rectification of inaccurate data,
erasure ("right to be forgotten"),
restriction of processing,
data portability,
object to processing based on legitimate interests, and
withdraw consent at any time (without affecting prior processing).

To exercise these rights, contact legal@vialoka.com. You also have the right to lodge a complaint with a supervisory authority — in Malta, the Office of the Information and Data Protection Commissioner (IDPC).

9. Data Retention

We keep personal data only as long as necessary for the purposes described above or as required by law. In particular:

Account data is retained while your account is active and deleted or anonymized thereafter, subject to statutory retention obligations.
Unclaimed / aggregated vendor profiles are retained until a deletion request is received, until the vendor claims and deletes the profile, or until we determine that the business is permanently closed or that the information is no longer accurate or useful.
Transaction and invoicing data is retained for the periods required by applicable tax and commercial law.

Once data is no longer needed for these purposes, it is deleted or anonymized.

10. Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse. No system is completely secure, but we work to protect your data on an ongoing basis.

11. Children

The Platform is not directed to children under 16 (or the applicable age of digital consent). We do not knowingly collect their personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on the Platform, with the "Last updated" date above.

13. Contact