1. Data controller
The data controller is lev.travel, city of Lviv, Ukraine. For data processing questions, write to privacy@lev.travel.
2. What data we process
We process only the data needed to run the service:
- identity and contact data: name, email address, phone number;
- account data: sign-in method, hashed password, social sign-in identifiers;
- booking data: the chosen tour, number and details of travellers, support messages;
- technical data: IP address, device and browser type, on-site activity, cookies;
- correspondence with us by email, chat or phone.
3. Purposes of processing
We use the data to:
- create and maintain your account;
- process booking requests and pass them to tour operators;
- provide support before, during and after your trip;
- send service messages (confirmations, status changes, password resets);
- with your consent, send news and offers; consent can be withdrawn at any time;
- ensure security, prevent fraud and comply with legal requirements.
4. Legal bases
We process data to perform our contract with you (providing the service and bookings), on the basis of your consent (marketing, optional cookies), our legitimate interest (security, service improvement) and compliance with legal obligations (accounting and tax records).
5. Who we share data with
We share data only to the extent needed to provide the service:
- tour operators you choose for a booking;
- payment providers to process payment;
- SMS and email delivery providers for service messages;
- hosting, file storage and analytics providers;
- public authorities where legally required.
6. International transfers
Tour operators and some technical partners may be located outside Ukraine. In that case we take reasonable measures to ensure the transfer is carried out with an adequate level of data protection.
7. Cookies
We use necessary cookies for the site to work (session, saved language and currency choice) and, with your consent, analytics cookies to understand how the site is used.
You can manage cookies in your browser settings. Disabling necessary cookies may break some features.
8. Retention
Account data is kept while the account is active. Booking and payment data is kept for the periods required by law. After the period ends, data is deleted or anonymised.
9. Your rights
Regarding your personal data, you have the right to:
- access it and obtain a copy;
- request correction of inaccurate data;
- request erasure or restriction of processing;
- object to processing and withdraw consent previously given;
- lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights.
10. Security
We apply organisational and technical safeguards: encrypted connections, password hashing, restricted access to data. No method of transmission or storage is completely secure, but we review our practices regularly.
11. Children
The service is intended for adults. We process children’s data only as part of a booking made by an accompanying adult travelling with them.
12. Changes to the Policy
We may update this Policy. The current version with the update date is always available on this page. We will give additional notice of material changes.
13. Contact
For any privacy questions, write to privacy@lev.travel.