← TravelX

Privacy policy

Last updated 22 October 2026 · Hilal Biz LLC (TravelX), Tashkent, Uzbekistan · info@travelx.uz

1. Who we are

TravelX is a trading name of Hilal Biz LLC, taxpayer identification number (INN) 306861927, holding tour operator licence 623550, at 34 Buyuk Ipak Yo’li, Tashkent 100005, Uzbekistan. We offer tours, transfers and guided travel in Uzbekistan and Tajikistan, and we are the operator (controller) of the personal data described here.

The person responsible for personal data at TravelX is our Director, Rakhimjon Dadajonov. Write to info@travelx.uz or call +998 97 652 25 25 about anything in this policy.

2. What we collect

• Enquiries: your name, email or phone number, country, the trip you are interested in, dates, group size and your message.
• Tour bookings: your name, email, phone, country, tour, date, number of travellers, chosen extras, and anything you write in the notes.
• Health and dietary details, only if you choose to give them (for example an allergy or a mobility need), so that we can plan your trip safely. This is sensitive information: we use it only for your trip, share it only with the guide, driver or hotel who needs it, and you can ask us to delete it at any time.
• Transfer requests: pick-up and drop-off addresses, date and time, flight number, passengers, luggage, child-seat needs, your name, phone and email.
• Passport details, only for trips that need them: hotels, train and air tickets, and border-zone permits (for example the Pamir/GBAO permit in Tajikistan). We ask for the details as text: name, nationality, passport number, date of birth, issue and expiry dates. A photo or scan of the passport page is requested only when an authority insists on one; we forward it the same day and delete it within 7 days after your trip.
• Accounts (only if you create one): your email address, a password stored by our database provider in hashed form (we cannot read it), and the profile details you add.
• Reviews you write through your account. A published review is shown publicly with your first name, the initial of your surname and your country — never your email or phone.
• Payment records: the amount, currency, status and booking reference, and the confirmation details the payment provider returns (such as a masked card number, transaction reference and approval code). We never see or store full card numbers or security codes.
• Notifications (only if you turn them on, in the TravelX app or on the My trips page): the address Google Firebase gives your phone or browser, its language, the bookings it should tell you about, whether you also asked for offers and news, and — if you are signed in — which account it belongs to.
• Technical records: our hosting and database providers log the IP address, time, page requested and browser type to keep the site running. To stop abuse of our forms we keep a scrambled (hashed) form of the IP address for a short time, never the address itself.

We do not collect biometric data (fingerprints, face recognition) or genetic data.

3. What we do not do

• No advertising or analytics trackers: no Facebook pixel, no Google Analytics.
• No cookies. Your language choice lives in the page address.
• We count visits ourselves, without any outside company: which pages are opened, the language, whether you came from a search engine or a social network, and whether a WhatsApp link, an enquiry or a booking followed. Your network address and browser are turned into a one-way code with a secret that changes every day, so visits can be counted but you cannot be recognised, today or later. No name, e-mail, address or booking reference is stored with it. If your browser sends the Global Privacy Control signal, you are not counted at all.
• Your browser or phone keeps only what you switch on: a sign-in token if you have an account (signing out deletes it), and your notification settings if you turn notifications on. If you do neither, we store nothing on your device.
• No marketing unless you ask for it. Messages about your own trip, and offers and news, are two separate choices; offers are off unless you tick that box, and you can turn either off at any time on the My trips page or in your phone’s settings.
• We never sell, rent or trade your data, and no decision about you is made by a machine alone.

4. Why we use it, and on what grounds

What for	Legal ground
Answering your enquiry and preparing an offer	Your consent, and steps you asked for before a contract
Booking and running your trip, transfers, hotels, permits	Our contract with you
Health and dietary details you give us	Your explicit consent, given when you tick the box on the form
Taking payment and issuing refunds	Our contract with you
Accounting and tax records	Our legal obligations under the law of Uzbekistan
Booking confirmations, and a reminder the day before your trip	Our contract with you; by notification only if you turn notifications on
One email after your trip asking for a review	Our legitimate interest in hearing how the trip went; reply “stop” and we will not write again
Offers and news	Only your separate consent, which you can withdraw at any time
Keeping the site and your data secure, stopping abuse	Our legitimate interest, and our legal duty to protect your data

You can withdraw a consent at any time by writing to us or switching it off in your account. This does not affect what was done before, and we may still need to keep records the law requires.

5. Who receives it

We share only what each party needs to do its part:

Who	What for	What they receive
Supabase (database and accounts) — servers in Frankfurt, Germany	Storing enquiries, bookings, transfer requests, accounts and reviews	Everything listed in section 2 except passport photos and our host’s server logs
Netlify (website hosting) — USA	Delivering the website	Server logs (IP address, pages, browser)
Resend (email sending) — USA	Sending your confirmations and notifying our office	Your email address and the content of the message
Google Workspace (our mailbox) — USA	Our office receiving and answering your emails	Emails about your enquiry or booking
Google Firebase Cloud Messaging — USA, only if you turn on notifications	Delivering notifications to your phone or browser	Your device’s notification address and the text of each message (for example the tour, date and booking reference — not your name, email or phone)
Montra (card payments) — Uzbekistan	Taking a payment on their secure page	Booking reference, amount and your phone number; you enter card details on Montra’s page, not ours
WhatsApp (Meta) — USA, only if you choose to contact us there	Chatting with our team	The pre-filled message carries trip details only (route or tour, date, travellers, reference) — not your name, phone, email, addresses or flight. What you then write in WhatsApp is covered by WhatsApp’s own policy.
Amazon Web Services / Bókun (tour photos)	Showing tour images	Your browser requests the photos directly, so they see your IP address and browser type
Hotels, guides, drivers, railway and airline companies in Uzbekistan	Running your trip	The minimum needed — usually your name, dates, pick-up details, group size and, where required, passport details
Hotels, guides, drivers and permit offices in Tajikistan — only for trips that go there	Running that part of your trip, and border-zone permits	Your name, dates and, for permits, passport details
State authorities	Only where the law requires it	What the request lawfully asks for

6. Where your data is stored, and transfers abroad

The law of Uzbekistan allows personal data to be stored abroad in countries with adequate protection, listed by Cabinet of Ministers Resolution No. 415 of 29 July 2026. Our database is in Germany, which is on that list. Our US providers (Netlify, Resend, Google, Meta) take part in the EU–US Data Privacy Framework, which the same list accepts. We do not process the data that must stay in Uzbekistan (biometric and genetic data).

Tajikistan is not on that list. We send data there only for trips that go there, only what is needed for that part of the trip, on the basis of our contract with you and the consent you give on the booking form.

If you are in the European Union, the United Kingdom or South Korea: you give your data directly to us, a company in Uzbekistan. Uzbekistan has no adequacy decision from those countries, so we protect your data as this policy describes and through the data protection terms of each provider above. If you would rather not have your data handled this way, contact us by phone and we will arrange your trip directly.

7. How long we keep it

• Enquiries that do not become bookings: up to 24 months, then deleted.
• Bookings, transfer requests and payment records: five years, as Uzbek tax and accounting law currently requires.
• Passport photos or scans: deleted within 7 days after your trip. Passport details in text: deleted within 30 days after your trip.
• Health and dietary details: deleted within 30 days after your trip, or sooner if you ask.
• Accounts: until you delete yours (on the My trips page) or ask us to. Published reviews stay up until you ask us to remove them.
• Notification addresses: until you turn notifications off, remove the app or block them; the address is then deleted within 30 days.
• Server logs and the scrambled IP records: kept for short technical periods only.

8. Your rights

You can ask us to tell you what we hold about you and who received it; to correct it; to delete it; to stop or limit using it, or object to a use; to give you a copy in a common format; and you can withdraw any consent. Write to info@travelx.uz and we will reply within 30 days. We may ask you to confirm your identity first, so that we never hand your data to someone else.

You can also complain to the authorised state body for personal data in Uzbekistan, the Personalization Agency under the Ministry of Justice (pd.gov.uz); if you are in the EU or the UK, to your national data protection authority; and if you are in South Korea, to the Personal Information Protection Commission.

9. Children

Accounts are for people aged 16 and over. Children travel with us on bookings made by a parent or guardian, who gives the child’s details (name, age and anything needed for their safety) on the child’s behalf.

10. Security

The site is served over HTTPS only, with HSTS, a strict Content Security Policy and no third-party scripts. Card payments happen only on the payment provider’s page — we will never ask for card details by WhatsApp, Instagram, email or phone. Customer records are visible only to TravelX staff who need them, and staff sign in with a password and a code from a phone app (two-step sign-in). Passwords are stored only in hashed form. To report a security problem, see security.txt.

11. If something goes wrong

If your data is leaked or accessed without permission, we will report it to the authorised state body within 24 hours where the law requires, tell you without delay if it may affect you, and say what we are doing about it.

12. Changes

If this policy changes materially we will update the date above and, for active bookings, tell you by email. This policy is published in ten languages; if they ever differ, the English version prevails.