Privacy Policy
Last updated: 4 October 2026
1. Who is responsible for your data
Tour & Car (tourecar.com) is the controller of the personal data described here. It is operated by an individual entrepreneur registered in the Republic of Azerbaijan.
- Taxpayer ID (VÖEN): 2003143332
- Contact for all privacy questions: info@tourecar.com
We process personal data in line with the following, where they apply:
- the Law of the Republic of Azerbaijan "On Personal Data";
- the EU General Data Protection Regulation (GDPR);
- the UK GDPR;
- other applicable data-protection laws.
2. What data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | name, email, password (stored only as a secure hash), role | you |
| Profile and listing data | photos, bio, languages, country and city, prices, vehicle, property details, availability calendar | Service Providers |
| Identity and tax data | ID / licence number, issuing country, document type (guides and drivers); taxpayer ID (hosts); licence images if uploaded | Service Providers |
| Booking data | service, dates, prices, deposit, status, the Booking Contract with acceptance time and IP address | you and the system |
| Payment data | transaction ID and status, last digits of the card (shown by the payment provider) | payment provider |
| Messages and reviews | messages between Tourists and Service Providers, ratings and reviews | you |
| Technical data | IP address, browser and device type, log and error data, security cookies | your device |
We do not collect special categories of data (such as health, religion or ethnicity) unless you choose to write them in a message, for example a health limitation relevant to a tour. Please share only what is needed.
3. Why we use your data and the legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account; making, managing and documenting bookings and Booking Contracts | performance of a contract |
| Processing deposits, refunds and payouts | performance of a contract |
| Showing provider profiles and listings to travelers | performance of a contract |
| Identifying Service Providers, checking ID / tax numbers, preventing fraud and keeping the platform safe | legitimate interest; legal obligation (e.g. trader traceability under the EU Digital Services Act) |
| Booking, reminder, cancellation and account emails | performance of a contract |
| Answering questions and complaints | legitimate interest / contract |
| Error monitoring and security logs | legitimate interest |
| Keeping accounting and tax records | legal obligation |
| Newsletters or partnership emails (only if offered) | consent, which you can withdraw at any time |
We do not sell personal data, do not use it for third-party advertising, and do not make decisions with legal effects about you based solely on automated processing. Automatic completeness checks only decide whether a listing is shown, and a person can always review the result.
4. Who receives your data
- The other party to your booking. After a booking, the Tourist and the Service Provider see each other's names, booking details and contact details, so that the service can be performed. They may use this data only for that booking.
- Visitors to the site. Provider profiles and listings, without ID or tax numbers, are public. Reviews show the reviewer's name.
- Processors acting on our instructions:
- payment providers (Epoint; Stripe where used);
- server hosting (Hetzner, EU);
- email delivery (Brevo) and incoming email forwarding (Forward Email);
- image storage (Cloudinary, where used);
- error monitoring (Sentry).
- Authorities, when the law requires it or to protect the safety of people.
ID and taxpayer numbers are visible only to Platform administrators. In Booking Contracts they appear masked, showing only the last 4 characters.
5. International transfers
Our servers are in the European Union. Some processors may process data in other countries, including the United States, and the Platform is operated from Azerbaijan. When data leaves the EEA/UK, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
6. How long we keep data
- Account and profile data: while your account is active. We delete or anonymise it within 30 days after you close it, except where we must keep it longer.
- Bookings, Booking Contracts and payment records: 5 years after the booking, as required by tax and accounting law and for legal claims.
- Messages: up to 2 years after the last booking between the parties.
- Technical and security logs: up to 90 days.
7. Cookies
We use only necessary cookies: the login session, security (CSRF) protection and remembered settings. We do not use advertising or cross-site tracking cookies. If we ever add analytics or marketing cookies, we will ask for your consent first.
8. Security
We protect data with:
- encrypted connections (HTTPS);
- hashed passwords;
- restricted administrator access;
- private storage of identity documents;
- regular updates.
No system is completely secure. If a breach is likely to put you at risk, we will inform you and the competent authority as the law requires (under the GDPR, within 72 hours).
9. Your rights
Depending on the law that applies to you, you have the right to:
- access your data and receive a copy;
- correct inaccurate data;
- delete your data ("right to be forgotten"), unless we must keep it;
- restrict or object to processing based on legitimate interest;
- data portability, to receive your data in a machine-readable format;
- withdraw consent at any time, where processing is based on consent;
- complain to a data-protection authority: in Azerbaijan, the competent state authority; in the EU/UK, the supervisory authority of your country (for example the ICO in the UK).
To use these rights, write to info@tourecar.com from your account email. We reply within one month.
10. Children
The Service is for adults (18+). We do not knowingly collect data from children. If a parent books for a family, they are responsible for the data they give about children travelling with them.
11. Changes
We may update this Privacy Policy. Important changes are announced on the website or by email. The date at the top shows the latest version.
12. Contact
Tour & Car, tourecar.com
Individual entrepreneur, Republic of Azerbaijan
Taxpayer ID (VÖEN): 2003143332
Email: info@tourecar.com