Privacy Policy

Policy of the Tripman mobile application's information service on the processing and security of customers' personal data

This is an English translation of the published Russian-language Tripman Privacy Policy (page identifier: police). The source section numbering is preserved; the contact address is updated to info@tripman.online for this integration. The Instagram integration disclosure following section 8 is an additional explanation of the web integration.

1. General provisions

1.1. The Personal Data Protection Policy of the Tripman information service (the “Policy”) aims to preserve the confidentiality of the personal data of customers who use the www.Tripman information service (the “Service”) to find a suitable place to stay (the “Customers”), and to protect human and civil rights and freedoms when personal data are processed, including the rights to privacy and personal and family confidentiality.

1.3. The Operator protects the personal data it processes against unauthorized access and disclosure, unlawful use or loss in accordance with Federal Law No. 152-FZ of 27 July 2006, “On Personal Data” (the “Personal Data Law”), and Order No. 21 of the Federal Service for Technical and Export Control of Russia of 18 February 2013, “On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data When Processed in Personal Data Information Systems.”

1.4. This Policy establishes the categories of Customers' personal data processed, the basic principles, purposes, methods and conditions of processing, and the functions and actions of the Service and its employees relating to the processing of Customers' personal data.

1.5. The Service may process the following personal data: surname, first name, home or mobile telephone number, personal email address, year of birth, bank card details, cookies and other personal data that must be provided to use the Service.

1.6. The Operator does not collect or process Customers' personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, or private life.

1.7. Customers' personal data constitute confidential information with restricted access.

1.8. Confidentiality is not required for anonymized personal data or publicly available personal data.

1.9. The Operator may amend this Policy. A new version takes effect when posted on the website, unless otherwise provided in that version. If the terms of this Agreement change materially, the Operator notifies Customers by posting a corresponding notice on the Website.

1.10. If you disagree with this privacy document, please refrain from using our services. By continuing to use the Service, the Customer consents, under Federal Law No. 152-FZ of 27 July 2006, “On Personal Data,” to the Operator performing the following actions:

• Processing personal data: surname, first name, date and place of birth, passport details, registered and residential addresses, citizenship, bank card details, contact information, home or mobile telephone number, personal email address and other personal data, including cookies collected and used by the Service under this Policy.
• Transferring personal data to third parties, including across borders, in written or electronic form, including to foreign countries that do not provide adequate protection of personal data subjects' rights, in accordance with subparagraph 4 of paragraph 4 of Article 12 of Federal Law No. 152-FZ of 27 July 2006, “On Personal Data.”

These actions are performed for the following purposes:

• Publishing information about places to stay.
• Providing other tourism services.
• Other purposes related to providing the services ordered by the Customer.
• The Operator delegating personal data processing to another person under part 3 of Article 6 of the Personal Data Law.

The Customer gives this consent until the Operator's obligations are fully performed and/or the retention period established by Russian law expires. Consent may be withdrawn by submitting a written request to the Operator. The Customer also consents to the transfer of personal data to third parties for further processing in compliance with all principles and rules of Federal Law No. 152-FZ, “On Personal Data.” The decision to provide personal data and consent to processing is made voluntarily and in the Customer's own interest. Refusal to provide personal data makes it impossible for the Operator to provide services.

2. Terms and definitions

2.1. Personal data: any information relating to a directly or indirectly identified or identifiable individual (personal data subject).

2.3. Personal data processing: any action or set of actions performed on personal data, including collection, recording, organization, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (dissemination, provision or access), anonymization, blocking, deletion and destruction.

2.4. Automated personal data processing: processing using computing equipment.

2.5. Personal data information system: personal data contained in databases, together with the information technologies and technical equipment used to process them.

2.6. Destruction of personal data: actions that make it impossible to restore personal data in a personal data information system and/or destroy the physical media containing personal data.

2.7. Other terms used in this Policy are interpreted in accordance with the Personal Data Law.

3. Purposes of processing Customers' personal data

The Service processes Customers' personal data for the following purposes:

a) Bookings. Personal data are used to create and manage hotel room bookings made online and/or through Tripman customer service, including transferring booking information to accommodation providers and ordering other tourism services available through the Service.

b) Improving service quality. The Service continually improves its services and develops convenient new booking tools.

c) Marketing. Customers' personal data may be used to send news about travel products and services, personalized offers, information about promotions and competitions held through the Service, and invitations to participate in research. Customers can unsubscribe from these communications at any time.

d) Service reliability and security. The Operator may use data for testing, troubleshooting and improving the functionality and quality of its online travel services.

4. Procedure and conditions for processing Customers' personal data

4.1. Customers' personal data are processed exclusively using automated means.

4.2. The Service processes personal data with the Customer's consent, both from the time a booking is made and immediately after registration with the Service.

4.3. Obtaining consent to personal data processing is a prerequisite for making a preliminary booking or registering with the Service. Customers may read the “Consent to Personal Data Processing” document at any time, including when making a booking.

4.4. All personal data should be obtained from the data subject. If personal data can only be obtained from a third party, the data subject must be notified and their consent obtained, as this is the Customer's personal responsibility.

4.5. Some data may be collected automatically without the Customer's involvement, such as the IP address, dates and times of Service use, hardware and software information, and the internet browser used.

4.6. Personal data may be transferred to the following third parties:

• Accommodation providers and other tourism service suppliers and providers. Booking information, including Customers' personal data, is transferred to the accommodation provider with which the Customer has booked. This may include the Customer's name, contact details, the names of accompanying guests and preferences specified during booking. If a booking dispute arises, we may provide the accommodation management with information about the booking process where necessary. This may include a copy of the booking confirmation as evidence that the booking was made.
• Competent public authorities. Where required by Russian law, the Service reserves the right to disclose Customers' personal data to the relevant authorized state and municipal authorities.

When transferring personal data to the above parties, the Service accepts no further responsibility for the lawfulness of subsequent processing carried out by those parties.

4.7. The Service collects, records, organizes, accumulates, stores, clarifies (updates or modifies), retrieves, uses, transfers, including across borders (disseminates, provides or grants access to), anonymizes, blocks, deletes and destroys personal data.

4.8. Data in a form that identifies the Customer are retained no longer than necessary for the processing purposes and must be destroyed when those purposes have been achieved or are no longer necessary.

6. Cookies

6.1. The Operator may use cookies and other tracking technologies to support the Service, analyze traffic or advertise. Cookies used by the Service are treated as anonymized information that does not identify the Customer and does not constitute personal data.

By using the Service, the Customer confirms consent to the use of the cookies described in this Policy.

6.2. The Operator uses the following types of cookies:

• Account management. Cookies are generated automatically when a Customer visits the Website, allowing the Service to recognize when the session starts and ends. The Service uses these cookies to identify the account used to sign in and the options available to it.
• Essential cookies. These allow the Customer to navigate the Service and use its features effectively.
• Analytics cookies. These are set by analytics systems that collect information about how the Customer uses the Service. They are used exclusively for statistical purposes.
• Advertising cookies, including third-party cookies. These collect information about websites and individual pages visited by Customers, to display advertising relevant to their interests and conduct marketing communications. Partners' advertising cookies may be placed on the Service.

6.3. Customers can configure their mobile devices to accept cookies, notify them when cookies are received, or disable cookies.

7. Rights of personal data subjects

7.1. A personal data subject has the right to obtain information about the processing of their personal data, including:

• Confirmation that the Operator processes personal data.
• The legal grounds and purposes of processing.
• The purposes and methods of processing used by the Operator.
• The Operator's name and location, and information about persons other than its employees who have access to personal data or to whom personal data may be disclosed under a contract with the Operator or federal law.
• The personal data processed concerning that subject and their source, unless federal law provides a different procedure for supplying such data.
• Processing periods, including retention periods.
• The procedure for exercising data subject rights.
• Information about completed or planned cross-border data transfers.
• The name, or surname, first name and patronymic, and address of a person processing personal data on the Operator's behalf, where processing has been or will be delegated.
• Other information provided for by Russian law.

7.2. The information specified in clause 7.1 is provided upon a request sent to info@tripman.online. The subject must provide the Operator with evidence that the personal data concerned belong to them. The information must be supplied in an accessible form and must not include other data subjects' personal data unless there are lawful grounds for disclosure.

7.3. A personal data subject has the right to withdraw consent to processing and to request deletion. To exercise these rights, send a request to info@tripman.online. The subject must provide evidence that the personal data concerned belong to them. The Service reviews the request, ensures processing ceases, and deletes the subject's personal data within 5 (five) working days after receiving the request.

7.5. Data on electronic media are destroyed by erasing or formatting the media. Destruction is documented by a media destruction certificate.

8. Monitoring compliance with personal data protection requirements

8.1. Internal monitoring of the Operator's departments' compliance with Russian law and internal personal data regulations is performed by the person responsible for organizing personal data processing and ensuring security.

8.2. The Operator reserves the right to exclude a Customer by deleting their Service profile if the Customer violates Service rules or behaves improperly.

8.3. All employees of the Operator who process personal data must keep personal data confidential in accordance with this Policy and Russian law.

8.4. Persons responsible for violations of this Policy are liable as provided by Russian law.

Instagram integration disclosure

When a property owner connects a professional Instagram account, Tripman processes the authorized account's identifiers and username to associate the correct account with the owner's dashboard. Authorization is completed on Meta's website.

For an enabled Instagram channel, Tripman processes incoming guest messages, conversation identifiers and related messaging information to handle property enquiries. The property owner can view conversations in Tripman. Replies are sent to Instagram using the connected account's authorization. Automatic replies require the owner's explicit consent and are subject to the supported messaging window.

The assistant uses the guest's enquiry and the owner's property information to prepare replies. Depending on the configured model routing, the supported AI processing providers are OpenAI, Anthropic and Yandex. The provider selected for the request processes the information needed to generate the reply. Information needed to deliver a reply is sent to Meta's Instagram services. Instagram message content is used for handling enquiries, rather than for advertising.

The owner can stop a channel or disconnect saved Instagram access in the Instagram connection section of the Tripman dashboard. Disconnection removes saved authorization access. Instagram conversation content is retained while the connection is active, subject to the general retention rule in clause 4.8, and is scheduled for erasure 30 days after disconnection. Owners can request earlier erasure by selecting the history erasure option when disconnecting. Erasure waits for any in-flight or ambiguous delivery to be reconciled. Technical delivery receipts are retained to prevent duplicate sends.

For personal data access, withdrawal of consent or deletion requests, use info@tripman.online. This is the contact for the Instagram integration. See the English and Russian data deletion instructions. Instagram conversations are stored in the Tripman assistant service's PostgreSQL database; credentials and pending webhook payloads are encrypted. The integration does not collect media posts for this messaging use case.