Privacy Policy

TourFixer is a travel services intermediary operating at tourfixer.uz. We facilitate bookings for private car transfers, guided tours, and day trips in Uzbekistan. References to "we," "us," or "our" mean TourFixer.

We take your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it.

We collect only what is necessary to process and fulfil your booking:

• Full name • Phone number (required for driver coordination and booking confirmation) • Email address (optional — used for sending confirmations if provided) • Travel details: route, date, number of passengers, vehicle preference • Pickup and drop-off addresses • Flight number (if relevant to your service) • Language preference • Any notes or special requests you provide voluntarily • IP address (collected automatically for security and fraud prevention)

We do not collect payment card numbers. Deposit payments are processed through third-party transfer services (Xoom, Remitly, Western Union, etc.) independently — we never see or store your card details.

We use your personal data exclusively to:

• Confirm and manage your booking • Coordinate your service with the assigned driver or guide • Send you booking confirmation, reminders, and relevant updates via WhatsApp or email • Respond to your enquiries and support requests • Prevent fraud and ensure platform security • Comply with applicable legal obligations

We do not use your data for advertising, marketing campaigns, or profiling. We do not sell, rent, or trade your personal information to any third party for commercial purposes.

Your booking data is shared only with:

• The assigned driver or guide — they receive your name, phone number, pickup location, and booking reference so they can contact you on the day of service. They do not receive your email address. • Our platform infrastructure provider (Supabase) — your data is stored on Supabase's hosted database, which is located in the EU (Frankfurt region). Supabase processes data in accordance with GDPR. • Our internal team — only the TourFixer operator (you contacted us directly) has access to your booking details.

We do not share your data with other tourists, partner agencies, mailing list providers, or any advertising networks.

We retain your booking data for a maximum of 24 months from the date of your service. This allows us to:

• Respond to any post-service queries or disputes • Maintain financial records as required by Uzbek tax law • Improve service quality based on historical booking patterns

After 24 months, personal identifiers (name, phone, email) are deleted or anonymised. Aggregate statistical data (route, date, vehicle category) may be retained indefinitely in anonymised form.

If you request deletion of your data before this period, we will comply within 30 days except where retention is required by law (e.g. financial records).

The primary channel through which we communicate with you is WhatsApp. When you message TourFixer on WhatsApp, your messages are subject to WhatsApp's own privacy policy (Meta Platforms Inc.). We do not control WhatsApp's data processing.

We store copies of relevant booking-related messages in our internal system for the purpose of dispute resolution and service coordination. We do not share your WhatsApp messages with third parties.

Our website uses minimal cookies:

• Essential cookies: Required for the website to function (e.g. language preference, form state). These cannot be disabled. • No advertising cookies: We do not use Google Ads, Facebook Pixel, or any advertising tracking cookies. • Analytics: If we use website analytics in future, we will update this policy to describe what tool is used and what data is collected. At the time of writing, no third-party analytics service is active on tourfixer.uz.

You can clear cookies at any time through your browser settings. This will not affect your ability to use the website.

We implement the following security measures to protect your data:

• All data is transmitted over HTTPS (TLS encryption) • Our database (Supabase) uses row-level security — booking data is only accessible to authorised server-side processes • The admin panel is protected by a signed authentication token and rate-limited login endpoint • We do not store payment card numbers under any circumstances

Despite these measures, no system is completely secure. In the event of a data breach that affects your personal data, we will notify you as required by applicable law.

You have the following rights regarding your personal data:

• Access: You can request a copy of the personal data we hold about you. • Correction: You can ask us to correct inaccurate or incomplete data. • Deletion: You can ask us to delete your personal data, subject to legal retention requirements. • Portability: You can request your data in a structured, machine-readable format. • Objection: You can object to any processing that is not strictly necessary for fulfilling your booking.

To exercise any of these rights, contact us at the email address below. We will respond within 30 days. We do not charge a fee for these requests.

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

TourFixer operates in Uzbekistan. If you are booking from outside Uzbekistan, your data will be transferred to and processed in Uzbekistan and/or the EU (where our database infrastructure is hosted). By submitting a booking, you consent to this transfer.

We take reasonable steps to ensure your data receives an adequate level of protection wherever it is processed.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The current version is always published at tourfixer.uz/privacy with the date it was last updated. Material changes will be communicated via our website.

For any privacy-related questions, data requests, or complaints, contact us at:

Email: [email protected] WhatsApp: Available via the contact button on our website

We will acknowledge your message within 3 business days and aim to resolve all requests within 30 days.