Maunatrip Privacy Policy

The controller of personal data is individual entrepreneur Nataliia Hennadiivna Hazhala, taxpayer number (RNOKPP) 2809806282 (“Maunatrip”, “we”). Contacts for personal data matters: maunatrip.admin@gmail.com, Telegram @maunatrip, phone/WhatsApp +380 67 593 77 03.

We process data in accordance with the Law of Ukraine “On Personal Data Protection”. For travellers from the EU we also comply with the EU General Data Protection Regulation (GDPR).

• Requests and correspondence: name, phone, email, messenger username, chosen tour dates, your questions. You provide them through the form on the website, in Telegram, WhatsApp or by email.
• Booking data: surname and first name in Latin letters, date of birth, citizenship, passport details and a copy of the passport, photo for permits, insurance policy details, emergency contact.
• Health data (special category): chronic conditions, medication, allergies, dietary restrictions that you disclose in the participant form. We process them only with your separate explicit consent and only for your safety on the route.
• Payment data: amount, date and purpose of payment, payer’s name. We do not receive or store bank card details.
• Technical data: cookies, IP address, device and browser type, pages viewed. Analytics and marketing cookies only after your consent (section 6).
• Tour photos and video: images of participants in the team’s pictures (section 14 of the Public Offer).

• Replying to your request, consultation. Data: contact details, questions. Legal basis: your consent; steps taken at your request before entering into a contract. Retention period: 12 months after the last contact if no contract is concluded.
• Booking and running the tour: permits, flights, accommodation, transfers. Data: booking data. Legal basis: conclusion and performance of the contract. Retention period: 3 years after the tour ends.
• Passport copies and photos. Data: passport, photo. Legal basis: performance of the contract. Retention period: deleted within 30 days after the tour ends.
• Safety on the route. Data: health data, emergency contact. Legal basis: your separate explicit consent; protection of life and health. Retention period: until the tour ends, then deleted within 30 days.
• Payment records and tax reporting. Data: payment data. Legal basis: legal obligation. Retention period: periods set by tax law.
• Website analytics. Data: technical data. Legal basis: your consent in the cookie banner. Retention period: according to the service settings, no longer than 14 months.
• Measuring advertising performance (Meta Pixel and Conversions API). Data: technical data; name, phone, email in hashed form. Legal basis: your separate consent. Retention period: until consent is withdrawn.
• Handling complaints and disputes. Data: correspondence, contract data. Legal basis: legitimate interest. Retention period: up to 3 years after the tour ends.

We do not sell your data. We share it only to the extent needed for a specific purpose:

• The partner in the tour country — the receiving company (named in the booking confirmation). Purpose: permits required by the tour country, transfers, accommodation, local guides. Country: tour country.
• Hotels, domestic airlines, the helicopter company. Purpose: booking accommodation, domestic flights, helicopter flights. Country: tour country.
• Government authorities of the tour country. Purpose: issuing permits, immigration control. Country: tour country.
• Vercel Inc. — website hosting. Purpose: running the website, technical logs. Country: USA.
• Resend — email delivery service. Purpose: sending confirmation emails for requests. Country: USA.
• Meta Platforms (Pixel, Conversions API) — only with consent. Purpose: measuring advertising performance. Country: Ireland/USA.
• Google (Analytics 4, Tag Manager, Gmail), TikTok — only with consent, if connected. Purpose: analytics, advertising, correspondence. Country: USA/EU.
• Telegram, WhatsApp. Purpose: correspondence you start. Country: outside Ukraine.
• Request tracking service (CRM). Purpose: tracking requests. Country: where the service is located.
• Insurer (at your request). Purpose: taking out or settling insurance. Country: insurer’s country.
• Medical and rescue services. Purpose: in an emergency. Country: where the incident occurs.

Some recipients are located outside Ukraine. Some tour countries are not among the countries Ukraine recognises as providing an adequate level of data protection. Transferring data to partners in the tour country is necessary to perform the contract: permits and domestic flights cannot be arranged without passport details. Before the transfer we obtain your explicit consent in the participant form. We work with service providers in the USA under their standard data processing agreements.

• Necessary cookies store your cookie choice for up to 180 days. They do not require consent.
• Analytics (Google Analytics 4, Google Tag Manager) and marketing cookies (Meta Pixel, TikTok Pixel) are switched on only after your consent in the banner. Before consent, the website sends no requests to these services.
• Meta Conversions API. If you have accepted marketing cookies and submitted a request, we may pass your name, phone and email to Meta in hashed (one-way encrypted) form. The purpose is to measure which advertising brings requests. Hashed data remains personal data, so we do this only with your consent.

You can change your choice at any time via the “Cookie settings” link at the bottom of the website.

Only the tour coordinator and your group’s guides have access to the data. We use two-factor authentication on email and work accounts. We do not publish document copies or forward them in open group chats. If a data breach may harm you, we will notify you and the Ukrainian Parliament Commissioner for Human Rights.

You have the right to:

• know what data of yours we process and receive a copy of it;
• correct inaccurate data;
• request deletion of data if there are no lawful grounds to keep it;
• restrict processing or object to it;
• withdraw consent at any time — this does not affect the lawfulness of processing before withdrawal;
• receive your data in a structured format;
• complain to a data protection authority.

Write to maunatrip.admin@gmail.com — we will reply within 30 days. A complaint can be filed with the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua). EU residents may also contact the data protection authority of their country.

We do not accept requests from persons under 18 without the involvement of their parents or legal guardians. A minor participant’s data is provided and approved by their legal guardian.