Privacy policy

The homepage journey enquiry form requests information such as name, email address, WhatsApp number, country, travel dates, group composition, destinations, interests, travel pace, accommodation preference, contact preference, notes and consent. On submission, the form writes an enquiry record to the project’s Firebase Firestore collection named tripEnquiries. The exact Firebase project region, access configuration, retention, operator/processor terms and lawful basis must be verified and explained in this notice before production deployment.

Please do not send passport numbers, identity documents, payment-card details, medical information or other sensitive personal information through this website or through any unverified channel.

Like most websites, the service used to host, deliver and protect this website may process limited technical information, such as an IP address, browser and device details, requested page, approximate access time, error information and security logs. This may be necessary to deliver the website, diagnose faults, prevent misuse and protect its availability.

The final hosting provider, its location, the precise technical data collected, any cookies or similar technologies, retention periods and relevant service-provider terms have not yet been confirmed for the public deployment. These details must be checked and added to this notice before the website is placed on its production domain.

The current stylesheet requests the DM Sans and Playfair Display fonts through Google Fonts. A visitor’s browser may therefore connect to Google’s font services to retrieve those files. This external font request, the applicable provider terms and any related processing must be included in the final technical and privacy review. If the review requires it, the fonts should be self-hosted before production deployment.

For the present preview, the intended purposes of any limited technical processing are website delivery, security, troubleshooting and prevention of misuse. The responsible legal entity, the applicable legal basis for each processing purpose and the records required by Kyrgyz law must be confirmed before the full commercial launch.

When AIMSTOO introduces enquiry, booking, customer-support or marketing functionality, it must first identify the purpose and lawful basis for each activity and provide a complete notice before asking visitors to submit personal information.

The website hosting, content-delivery, security, domain and deployment providers may process technical information as part of operating the site. The exact providers, their locations, subprocessors and contractual roles must be identified before production publication.

This preview does not collect customer trip enquiries for sharing with hotels, drivers, guides, insurers or other travel suppliers. Any future sharing must be explained in the final notice and limited to what is necessary and lawful.

Before launch, AIMSTOO must confirm where the public website is hosted, where technical logs are stored, which service providers can access them and whether any personal data is transferred outside the Kyrgyz Republic. The applicable requirements for international transfers under the Kyrgyz Republic Digital Code must be assessed with local legal advice.

The existing project uses Firebase Firestore for the public journey enquiry workflow and private administration. The configured data location and applicable Google/Firebase processing terms, processor arrangements and permitted transfer safeguards must be verified before production deployment and documented here.

The enquiry form allows the visitor to enter the number of children travelling, but does not ask for a child’s name or direct identifying details. Do not enter sensitive information about children in the free-text notes. Any future collection of information identifying a child must be limited and handled under applicable rules.

Technical logs may be kept by the relevant hosting or security providers under their service terms and retention settings. The applicable retention periods and security controls have not yet been confirmed and must be documented before production deployment.

Before production deployment, AIMSTOO must approve a retention schedule, access policy, processor register, incident response process and appropriate technical and organisational safeguards for the active enquiry form.

Applicable law may provide rights relating to access, correction, deletion, objection, restriction or other aspects of personal-data processing. The final notice must explain how to exercise those rights and how requests will be verified and answered.

A dedicated privacy contact has not yet been published. It will be added after AIMSTOO’s legal operator details and support channels are established. This page is an interim draft and should not be treated as the final statutory privacy notice.

This interim notice must be replaced or updated before production deployment and before reservations, accounts, marketing subscriptions or payments are enabled. The final version will identify the operator, effective date, hosting and data processors, data locations, lawful grounds, retention periods, rights contact and any relevant international-transfer safeguards.