Privacy Policy

PRIVACY AND PERSONAL DATA PROCESSING POLICY

This Privacy Policy (the “Policy”) explains what personal data we collect, why we process it, whom we share it with, how long we keep it, and what rights you have in relation to your data.

The Policy forms an integral part of the Tour Operator Public Offer and the Service Provider Public Offer, and applies together with the Booking Rules.

Please read it before submitting a request, making a booking or paying for services.

I. Who processes your data

1.1. The controllers of personal data within the meaning of the Law of Ukraine “On Personal Data Protection” are:

• Pro Karpaty Tourist Company LLC (the Tour Operator), EDRPOU code 38267505, 3-5 Korzo St., Uzhhorod, Zakarpattia region, 88000, Ukraine, tour operator licence series AE No. 185601 of 06.12.2012 - in relation to the tourism product formed by the tour operator;
• Sole Trader Ivan Anatoliyovych Kharchuk (the Service Provider), taxpayer number 2317604091, correspondence address: 12/48 Bestuzheva St., Uzhhorod, Zakarpattia region, 88000 - in relation to excursion, organisational, informational and consulting services provided in his own name.

1.2. Which controller processes your data depends on the service you ordered; this is stated in the booking confirmation. Both controllers apply the same processing rules set out in this Policy.

1.3. Contacts for any question about personal data: telephone +38 (099) 776 77 29, e-mail prokarpaty@gmail.com.

II. Legal grounds for processing

2.1. We process personal data on the basis of:

• the Law of Ukraine “On Personal Data Protection”;
• the Civil Code of Ukraine;
• the Law of Ukraine “On Tourism”;
• the Law of Ukraine “On Electronic Commerce”;
• the Law of Ukraine “On Consumer Protection”;
• other regulatory acts of Ukraine.

2.2. The specific grounds for processing are:

• performance of a contract to which you are a party, or steps taken at your request before entering into a contract (handling your request, booking, providing services);
• your consent, given by taking the actions defined in the public offer (submitting a request, confirming an intention to book, making a payment);
• compliance with a legal obligation (tax and accounting records, responses to requests from authorised bodies);
• our legitimate interest - operating the website, protection against abuse, keeping internal records of enquiries, and being able to evidence the consent given.

III. What data we collect

3.1. Identification and contact data: surname and given name, contact telephone number, e-mail address (if you provided one), preferred communication channel (Viber, Telegram, Messenger).

3.2. Booking data: the tour or excursion selected, the date of travel, the number of participants, the pick-up city, the composition of the group, preferences regarding accommodation and meals, and any other details you provide so that the service can be arranged.

3.3. Data required for particular services: for trips abroad - details from an identity document, limited to the minimum needed to arrange insurance and to book with foreign suppliers; for school groups - participant lists provided by the school or the responsible person.

3.4. Payment data: the fact and amount of payment, the date, the payment method, and the details needed to process a refund. We do not collect or store full bank card numbers, CVV codes or payment service passwords - payments are processed by the bank or the payment service.

3.5. Technical website data: IP address, browser and device data (User-Agent), the address of the page from which the request was sent, the interface language, advertising campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and advertising click identifiers (for example, fbclid, gclid) if you arrived via an advertising link.

3.6. Consent log data. When you press a form submit button, we record: the fact that consent was given, the date and time in Coordinated Universal Time, the IP address, browser data, the page address, the language, and also the exact wording of the consent shown to you and the version of the public offer in force at that moment. This data exists solely so that both you and we can confirm precisely which terms you agreed to.

3.7. The content of your enquiries: the text of your messages, questions and complaints sent through the site forms, messengers or e-mail.

3.8. Photographs and video taken during tours and excursions - as described in section XIV of this Policy.

3.9. We do not deliberately collect data on racial or ethnic origin, political, religious or philosophical beliefs, party or trade union membership, health, sex life, or biometric data. If you yourself tell us about your health (for example, dietary restrictions, allergies or a need for special arrangements), we process it solely to arrange your trip and use it for no other purpose.

IV. Where we obtain data from

4.1. Directly from you - through the website forms, by telephone, e-mail, messengers, or in person at the office.

4.2. From a Customer booking for a group or for another person. In that case the Customer confirms that they have those persons’ consent to pass on their data and have informed them of the terms of the offer and of this Policy.

4.3. From a school or a responsible person - for school and children’s groups.

4.4. Automatically when you use the website - the technical data described in clauses 3.5 and 3.6, and cookies (section VIII).

V. Why we process data

• to consider your request and confirm whether the services can be provided;
• to book a tour, an excursion or individual services;
• to book services with third parties - carriers, hotels, insurance companies, excursion sites;
• to issue documents: the booking confirmation, invoice, programme, voucher, information sheet;
• to contact you about trip details, programme changes and organisational matters;
• to arrange insurance where it forms part of the service;
• to receive and record payments, and to process refunds;
• to handle enquiries, applications and complaints;
• to keep accounting and tax records;
• to evidence the fact and scope of the consent you gave;
• to improve the website and analyse which pages and routes interest visitors;
• to inform you about our offers - only if you have separately agreed to this;
• to protect our rights and interests in the event of a dispute.

VI. Whom we share data with

6.1. We do not sell personal data and do not pass it to third parties for their own marketing.

6.2. Data is shared only to the extent necessary to perform the contract, with the following categories of recipients:

• tourism service suppliers - carriers, hotels and other accommodation providers, insurance companies, excursion sites, museums, catering establishments, guides, tour guides and group leaders;
• the enquiry management system (CRM) - the amoCRM service, in which we keep the history of your request;
• the hosting provider on whose servers the website runs;
• e-mail services and messengers through which we correspond with you;
• banks and payment services - for processing payments;
• web analytics services - in anonymised form (section VIII);
• public authorities - solely in the cases and in the manner prescribed by the legislation of Ukraine.

6.3. Each supplier receives only the data it actually needs: a hotel receives the name and the dates of stay, a carrier the group list, an insurance company the details required for the policy.

VII. Cross-border transfer of data

7.1. If you book a tour abroad, your data is passed to foreign service suppliers - hotels, carriers and insurance companies in the countries on the route (in particular Hungary, Slovakia, Poland, Romania and Austria). Without this it is impossible to book accommodation or arrange insurance.

7.2. Some services we use (CRM, web analytics, e-mail) may process data on servers outside Ukraine.

7.3. In all such cases we transfer the minimum necessary amount of data and act within the limits permitted by the legislation of Ukraine.

VIII. Cookies and web analytics

8.1. The website uses the following cookies:

• pll_language - remembers the interface language you selected. Technically necessary; without it the site would open in the default language every time;
• _ga and _ga_Y2L5NMVCGN - Google Analytics 4 cookies (property ID G-Y2L5NMVCGN). They provide anonymised visit statistics: how many people visited, which pages they viewed, and which sources they came from.

8.2. Google Analytics does not receive your name, telephone number or the content of your request from us. It works with anonymised identifiers.

8.3. You can delete cookies or block them in your browser settings. Declining analytics cookies does not affect your ability to use the site or make bookings; declining technical cookies may break the language switcher.

8.4. The list in clause 8.1 is current as at the last review date of this Policy. If we add other analytics or advertising tools, we will update this section.

IX. How long we keep data

• Data from a request that did not become a booking - up to 12 months from the last contact, after which it is deleted or anonymised;
• Data from a completed booking - for the limitation period established by the legislation of Ukraine, so that both parties can confirm the terms and the fact that the service was provided;
• Accounting and tax documents - for the period prescribed by the legislation of Ukraine for the relevant type of document;
• The consent log - for as long as the data of the corresponding booking: without it, it is impossible to prove what exactly you agreed to;
• Mailing list data - until you unsubscribe.

Once the retention period expires, data is deleted or anonymised so that it can no longer be linked to a specific person.

X. Your rights

10.1. Under Article 8 of the Law of Ukraine “On Personal Data Protection” you have the right:

• to know the sources of collection and the location of your personal data, the purpose of processing, and the location of the controller, and to receive this information;
• to receive information about the conditions for granting access to personal data, in particular about third parties to whom it is transferred;
• to access your personal data;
• to receive, no later than thirty calendar days from the date of the request, an answer as to whether your data is processed and what it contains;
• to make a reasoned demand that your personal data be changed or destroyed if it is processed unlawfully or is inaccurate;
• to have your data protected against unlawful processing and accidental loss, destruction or damage;
• to lodge complaints about the processing of your personal data with the Ukrainian Parliament Commissioner for Human Rights or with a court;
• to apply legal remedies in the event of a breach of personal data protection legislation;
• to make reservations restricting the right to process your data when giving consent;
• to withdraw consent to the processing of personal data;
• to know the mechanism of automatic processing of personal data;
• to be protected against an automated decision having legal consequences for you.

10.2. Withdrawing consent. You may withdraw consent at any time using the contacts in clause 1.3. Withdrawal does not affect the lawfulness of processing carried out before it and does not release us from the obligation to retain documents whose retention period is prescribed by law.

10.3. If you withdraw consent before the services begin, we will most likely be unable to fulfil the booking: without your data it is impossible to reserve a place, accommodation or insurance.

XI. How to exercise your rights

11.1. Send a request to prokarpaty@gmail.com or call +38 (099) 776 77 29.

11.2. So that we can be sure the request comes from you, we will ask you to provide details that allow us to locate your enquiry or booking (for example, the telephone number given in the request, the date and the name of the tour).

11.3. We reply within the period prescribed by the legislation of Ukraine - no later than thirty calendar days from the date the request is received.

11.4. Handling a request is free of charge.

XII. Data security

12.1. The website runs over a secure connection (HTTPS): the data you send through the forms is transmitted in encrypted form.

12.2. Access to requests and personal data is limited to those employees and authorised persons who need it for their work.

12.3. We apply organisational and technical measures to protect data against unauthorised access, alteration, destruction or disclosure.

12.4. At the same time, no method of transmitting information over the internet is completely secure, so we cannot guarantee absolute security of data transmitted over open communication channels.

XIII. Children’s data

13.1. We do not collect children’s personal data directly from them.

13.2. We receive the data of minor participants in tours and excursions from parents, legal representatives, accompanying persons, or the school organising the trip.

13.3. The person providing us with a minor’s data confirms that they have the right and authority to do so.

13.4. Responsibility for the conduct and safety of minor participants rests with their parents, legal representatives or accompanying persons.

XIV. Photography and filming

14.1. During tours and excursions, we or persons authorised by us may take photographs and film in order to publicise our activities, promote routes, build an archive and prepare informational and advertising materials.

14.2. Such materials are used in compliance with the legislation of Ukraine on personal data protection and the right of a natural person to their own image.

14.3. If you do not wish your image to be used, tell us before the activity begins or at any time during it - we will take that wish into account in any further use of the materials.

XV. Automated decision-making

15.1. We do not take decisions about you solely by automated means that would have legal consequences for you. Every request is reviewed by a manager.

15.2. We do not carry out profiling to evaluate your personality.

XVI. Links to third-party resources

16.1. The website may contain links to third-party resources - maps, review pages, partner sites and social networks.

16.2. This Policy does not apply to those resources. When you follow a link, please read the privacy policy of the resource concerned.

XVII. Changes to this Policy

17.1. We may update this Policy: legislation changes, as do our services and the tools we use.

17.2. The current version is always published on this page; the last review date is stated at the top of the document.

17.3. A new version takes effect upon publication on the website.

XVIII. Contacts

For any question about the processing of personal data, please contact us:

• telephone: +38 (099) 776 77 29;
• e-mail: prokarpaty@gmail.com;
• postal address: 3-5 Korzo St., Uzhhorod, Zakarpattia region, 88000, Ukraine.

You also have the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights.