Privacy policy

In force as from 13-08-2026

We are RYO, a simplified joint-stock company (société par actions simplifiée) with a share capital of EUR 271,753.58, whose registered office is located at 15 Quai Jean Moulin, 69002 Lyon (France), registered with the Lyon Trade and Companies Register under number 902 055 904 (hereinafter “RYO” or “we”).

We publish the “RYO” application, a travel application which allows users to visit cities independently by means of immersive routes and audio guides, as well as to plan and customise road trips and journeys (hereinafter the “Application”).

In the course of providing the Application, we collect and process personal data concerning you.

We attach great importance to the protection of your personal data and pay close attention to compliance with all applicable regulations in this area, in particular the General Data Protection Regulation (EU) no. 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”), French Act no. 78-17 of 6 January 1978 on information technology, data files and civil liberties, known as the “Loi Informatique et Libertés”, as amended, the French Digital Republic Act no. 2016-1321 of 7 October 2016 and the implementing decrees adopted thereunder (hereinafter the “Applicable Personal Data Protection Regulations”).

In accordance with the Applicable Personal Data Protection Regulations, this Policy informs you about the processing of personal data that we carry out when you use the Application.

In particular, it informs you about:

The personal data we collect

The reasons why we use it (purposes and legal bases);

How long we keep it (retention periods);

The recipients of this data and any data transfers carried out;

Your rights over your Data;

We may amend this Policy at any time if we change the way we process your data. In such a case, we will inform you by the means most appropriate to our relationship with you (sending an email, displaying a notification on the Application).

1. Definitions

“Subscriber” means any User who has taken out a RyoPlus Subscription.

“RyoPlus Subscription” means the annual subscription which any User may take out in order to benefit from additional advantages and services (in particular access to all the content of the Application).

“Application” means our “RYO” application as described in the preamble.

“Legal basis” : means the basis on which a processing operation is founded. Processing is lawful only if, and to the extent that, it relies on one of the six bases provided for by the GDPR (art. 6).

“Data” means the personal data concerning you which we process, whether such data identifies you directly or indirectly.

“Processing purposes” means the various objectives justifying the collection and processing of your Data by RYO, as defined in this Policy.

“Privacy Policy” or “Policy” means this document explaining in detail the processing of Data that we carry out in the course of providing the Application.

“Data Controller” means the entity which determines the purposes and means of a personal data processing operation.

RYO acts as Data Controller in respect of the Data processing operations explained in this Policy.

“RYO” or “we” means our company as identified in the section “Who are we?” below.

“Processor” means an entity which processes personal data on behalf of a Data Controller, that is to say on the latter’s instructions and for the purposes determined by the latter.

We use processors which process some of your Data for the purposes explained to you in this Policy.

“Processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, disclosure by transmission, dissemination, extraction or consultation of personal data, as defined by Regulation (EU) 2016/679 of 27 April 2016 and any subsequent equivalent regulation.

“User” or “you” means any natural person holding an account on the Application and using the services offered by it.

2. Who are we?

We carry on a business of software and application design and publishing, in particular in the tourism sector. It is in the course of this business that we developed the Application.

We carry out the Data processing operations explained in this Policy as Data Controller within the meaning of the Personal Data Protection Regulations.

3. How to contact us?

For any question concerning this Policy or to exercise your rights regarding your Data, you can contact us by one of the following means:

By email: hi@ryo.co

By post: RYO, 15 Quai Jean Moulin, 69002 Lyon, France

4. What data do we collect about you?

We collect the personal Data listed below on or through the Application when you use it.

Concerning all Users

This data is collected whether you use the Application in free mode or in paid mode (RyoPlus Subscription)

Identity

Data collected: Surname, first name, title.

Account

Data collected: Username, email address associated with the account.

Records of our relationship with you

Data collected: Requests for information about RYO’s products and/or services, correspondence, exchanges with the sales department, any complaints, etc.

Geolocation

Data collected: Location data obtained via your smartphone’s geolocation system (your exact GPS position: latitude, longitude), altitude, horizontal and vertical accuracy).

Route history: routes completed, number of steps, kilometres covered, duration of the route.

Movement and activity data

Data collected: Number of steps, estimated distance covered, activity status (stationary, walking, running, in a vehicle), flights of stairs climbed, flights of stairs descended, estimated movement speeds, date/time of start/end of movement, etc.

This data is provided by your phone’s operating system. The exact content of the data processed depends on the operating system used (iOS, Android). We access it solely in order to optimise the operation of the Application and the use of your phone’s battery.

Connection data / Metadata

Data collected: Connection IP address, session identifier, page or screen visited, referring page (where applicable), dates and times of connection and of events, actions carried out on the Application (for example: features used, clicks, screen views, purchases, sign-ups and other configured events).

Configuration information of your device

Data collected: The operating system, device model, device identifier, time zone, device language, connection type, application version, screen resolution.

Concerning Subscribers

This data is collected only if you take out a RyoPlus Subscription

Payment and subscription information

Data collected: Date and time of payment, unique identifier assigned to the subscriber, subscription date, subscription duration, renewal date, termination date, use of a promo code

Information concerning the Data processed by the download platforms (App Store and Google Play):

The Application is distributed via Apple’s App Store and the Google Play Store. When you download the Application, take out, renew or terminate a subscription, or make an in-app purchase via one of these platforms, certain personal data is processed directly by Apple or Google in accordance with their own privacy policies.

This data may include, in particular, information relating to your platform user account, purchase and subscription data, billing information, transaction history, the technical identifiers of your device, your IP address and the data necessary to secure payments and prevent fraud.

For these processing operations, Apple and Google act as independent data controllers and determine autonomously the purposes and means of the processing they carry out. We do not have access to your complete payment information, such as bank card numbers or the authentication data associated with payment methods.

We receive only the information strictly necessary to manage access to the service and the subscriptions taken out via the platforms concerned, such as the subscription status, transaction identifiers or the information enabling the validity of a subscription to be verified.

5. Why do we use your data and for how long?

We process your personal Data solely for the purposes described in the table below.

We may process it on the basis of various grounds which authorise us to do so (legal bases):

to perform a contractual obligation (Legal basis: performance of a contract)

to comply with a legal obligation (Legal basis: legal obligation)

because we have a legitimate interest in processing it (Legal basis: legitimate interest)

because you have given us your consent (Legal basis: consent).

Data is kept for as long as is necessary to achieve the purposes pursued, in accordance with the retention periods specified in the table below.

These are defined in line with the recommendations of the French data protection authority (Commission Nationale de l’Informatique et des Libertés, CNIL).

Concerning all Users

These processing operations are carried out whether you use the Application in free mode or in paid mode (RyoPlus Subscription)

Management of the Application and provision of the associated services

User registration, account management, support and maintenance management, complaints handling.

Legal basis: Performance of a contract

Retention period: For the entire duration of the contractual relationship

Geolocation of Users

Offering relevant routes/tours according to the User’s position, locating and guiding the User in real time along the routes, automatically triggering contextualised content (audio guides, information, points of interest, etc.) according to the User’s position

Legal basis: Performance of the contract

Retention period: For the period strictly necessary to perform the service concerned (suggesting a nearby route, completion of the journey, route, etc.)

Route history

Allowing users to keep a record of their routes.

Legal basis: Performance of the contract

Retention period: For the entire duration of the contractual relationship

Management of the security of the Application / log recording

Legal basis: RYO’s legitimate interest in ensuring traceability of the accesses and actions carried out on the Application, in particular in order to detect malicious behaviour and to preserve the security of the Application and of the Data

Retention period: 1 year

Marketing to consumers

Marketing relating to products or services similar to those already supplied

Legal basis: RYO’s legitimate interest in offering Users deals relating to the Application

Retention period: Up to 3 years from the last contact with the Data Subject

You have the right to object to receiving our marketing communications

Management of the marketing opt-out list

Legal basis: RYO’s legitimate interest in knowing which people it is no longer authorised to send marketing to

Retention period: For 3 years from the exercise of the right to object

Sending of the newsletter (news and guides)

Legal basis: Consent

Retention period: Up to 3 years from the last contact with the Data Subject or until consent is withdrawn

You may withdraw your consent at any time

Management of the newsletter opt-out list

Legal basis: RYO’s legitimate interest in knowing which people it is no longer authorised to send the newsletter to

Retention period: For 3 years from the exercise of the right to object

Production of anonymised statistics

Legal basis: RYO’s legitimate interest in having statistics on its customer base as part of the management of its business

Retention period: Without any time limit, in aggregated (anonymised) form

Handling of requests to exercise GDPR rights

Legal basis: Legal obligation

Retention period: For 5 years from the request to exercise the right

Handling of complaints and disputes

Legal basis: RYO’s legitimate interest in establishing proof of a right or of the proper performance of its contractual obligations where applicable

Retention period: For the entire applicable limitation period relating to the relationship (e.g. up to 5 years for civil limitation)

Concerning Subscribers

This data is collected only if you take out a RyoPlus Subscription

Management of subscriptions and provision of the associated services

Legal basis: Performance of a contract

Retention period: For the entire duration of the contractual relationship

Management of legal, accounting and tax obligations in the context of the contractual relationship with Subscribers

Legal basis: Compliance with legal obligations

Retention period: Storage in the form of an intermediate archive for the statutory retention period to which RYO is subject (e.g. up to 10 years for our accounting obligations)

* Where “Consent” is stated in the “legal basis” column of the table, this means that we may carry out processing for the purpose concerned only if you consent to it, in particular by ticking a box inviting you to do so on the Application, and that you may withdraw your consent at any time by contacting us.

6. Who may your data be passed on to?

In the course of the processing operations we carry out on or through the Application, and in order to provide you with our services, we pass on some of your Data to various recipients.

To our teams

Your Data may be communicated to all our teams that need it to carry out their tasks in the context of managing and making the Application available.

Example: our technical team to improve our tool and ensure its maintenance, our support team to handle your questions, etc.

To our technical processors

We use various technical service providers for various reasons:

AMAZON WEB SERVICES (AWS)

Purposes of the subcontracting: Hosting of the Application

ZOL

Purposes of the subcontracting: Development and maintenance of the Application

ALGOLIA

Purposes of the subcontracting: Search for and suggestion of routes near the user

ADJUST

Purposes of the subcontracting: Audience measurement, marketing analysis and reporting; fraud detection

ONESIGNAL

Purposes of the subcontracting: Management of mailing and marketing campaigns

GOOGLE (Google Workspace)

Purposes of the subcontracting: Use of office productivity and email tools

ZENDESK

Purposes of the subcontracting: Management of support requests

REVENUECAT

Purposes of the subcontracting: Management of subscription sign-ups via the stores

To administrative or judicial authorities

We may be required to communicate some of your Information to administrative or judicial authorities when we receive a court order.

7. Where do we store your Data?

We endeavour to store your data on servers located in the European Union whenever this is possible and consistent with the level of service we intend to provide you with.

However, some of our technical processors may process certain Data outside the European Union. Where this is the case, we ensure beforehand that the processors in question provide adequate safeguards in accordance with the GDPR.

List of possible data transfers outside the European Union and the adequate safeguards taken:

AMAZON WEB SERVICES (AWS)

Adequate safeguards: Adequacy decision: EU-US DATA PRIVACY FRAMEWORK

European Commission standard contractual clauses