PRIVACY POLICY
https://stage.billetsorsay.com
Hereinafter, the "Controller".
BeTraveller OÜ is responsible for the processing of personal data collected through the Website.
Data processing is carried out in accordance with:
3.1 Booking and purchase management
Includes: Order management, Payment processing, Ticket issuance and delivery, After-sales service, Communication with tourist suppliers.
Legal basis: Performance of a contract (Art. 6.1.b GDPR)
3.2 Customer care and inquiries
Management of requests sent through forms or email.
Legal basis: Consent (Art. 6.1.a GDPR) or pre-contractual measures.
3.3 Fraud prevention and security
Data processing for: Detection of fraudulent transactions, Prevention of misuse, System protection.
Legal basis: Legitimate interest (Art. 6.1.f GDPR)
3.4 Sending own commercial communications
Information about similar products or services.
Legal basis: Consent (Art. 6.1.a GDPR), or Legitimate interest in the case of existing customers (Art. 6.1.f GDPR). The User may object at any time using the unsubscribe link included in each communication.
3.5 Statistical analysis and Website improvement
Use of analytical tools to improve user experience.
Legal basis: Consent (when required) or legitimate interest.
The following categories may be processed:
Special categories of data are not processed (Art. 9 GDPR).
The data requested to formalize a purchase are mandatory. Refusal to provide them will prevent the provision of the service.
Data will be retained for:
Subsequently, they will be blocked and deleted in accordance with current regulations.
Data may be communicated to:
7.1 Essential service providers: Tourist suppliers, Payment gateways, Technology providers, Web hosting services. They act as data processors under contract pursuant to Art. 28 GDPR.
7.2 Public authorities: When there is a legal obligation.
Personal data is not sold to third parties.
Some technology providers may be located outside the European Economic Area. In such cases, Standard Contractual Clauses approved by the European Commission will apply, and additional security measures will be adopted where appropriate.
BeTraveller OÜ may use automated systems for fraud detection and statistical analysis. No automated decisions are made that produce significant legal effects for the User under the terms of Article 22 GDPR.
The Website is not directed at minors under 18 years of age. We do not knowingly collect data from minors without authorization from their legal representatives.
The User may exercise the following rights: Access, Rectification, Erasure, Restriction of processing, Portability, Objection, Withdrawal of consent.
To exercise them, you can write to: [email protected]
If you consider that your rights have not been respected, you can file a complaint with the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate): https://www.aki.ee
You may also appeal to the data protection authority of your country of residence within the European Union.
BeTraveller OÜ applies appropriate technical and organizational measures to guarantee: SSL encryption in communications, Use of secure payment gateways, Restricted access control, Protection against unauthorized access.
The Website uses its own and third-party cookies. For more information on the use of cookies, configuration, and withdrawal of consent, please consult our Cookies Policy.
BeTraveller OÜ may update this Policy to adapt it to regulatory or technical changes. The current version will always be available on the Website.
BeTraveller OÜ maintains a Record of Processing Activities in accordance with Article 30 of the GDPR, documenting the categories of data processed, purposes, recipients, international transfers, and applied security measures.
For each processing purpose described in section 3, BeTraveller OÜ has identified and documented the applicable legal basis pursuant to Article 6 of the GDPR, as detailed in said section.
When deletion is appropriate, data will be blocked and kept exclusively at the disposal of competent authorities during the applicable statutory limitation periods, after which they will be permanently deleted.
BeTraveller OÜ does not engage in invasive commercial profiling or automated decision-making with legal effects based on the User's personal preferences.
The automated systems used are limited to:
Requests must be sent to: [email protected]
The request must include:
The Controller will respond within a maximum period of one month, in accordance with Art. 12 GDPR.
Without prejudice to the right to appeal to the competent supervisory authority, the User may use alternative dispute resolution mechanisms available in the European Union when applicable.
This Policy shall be governed by the legislation of the Republic of Estonia and by Regulation (EU) 2016/679 (GDPR).
When data processing is based on the legitimate interest of BeTraveller OÜ (for example, fraud prevention, system security, or sending communications to existing clients), the corresponding balancing analysis has been carried out, ensuring that such interests do not override the fundamental rights and freedoms of the User.
The User may object at any time to processing based on legitimate interest by sending a request to [email protected].
BeTraveller OÜ is not obliged to designate a Data Protection Officer in accordance with Article 37 of the GDPR, as it does not carry out processing operations that require it due to their nature, scope, or purpose.
The User guarantees that the personal data provided are true, accurate, and up to date. The User undertakes to communicate any modification thereof.
BeTraveller OÜ will not be liable for damages resulting from the inaccuracy or lack of updating of the data provided.
Regardless of the ordinary retention periods indicated above, BeTraveller OÜ may retain certain personal data duly blocked when necessary for:
These data will remain blocked during the applicable statutory limitation periods and will be permanently deleted once those periods have elapsed.
In the event of a merger, acquisition, corporate restructuring, asset transfer, or any corporate operation involving the transfer of the business or part of it, personal data may be communicated to the resulting or acquiring entity, always guaranteeing:
The User will be informed when such communication significantly affects their rights.
BeTraveller OÜ adopts appropriate technical and organizational measures to protect personal data. However, it cannot guarantee the absolute invulnerability of technological systems against illegal access, cyberattacks, or other acts carried out by third parties outside its reasonable control.
In the event of a security breach involving a risk to the User's rights and freedoms, action will be taken in accordance with the provisions of Articles 33 and 34 of the GDPR.
This Privacy Policy must be interpreted jointly with the Terms and Conditions of the Website. BeTraveller OÜ acts as an intermediary in the commercialization of tourist activities, without prejudice to its status as Data Controller regarding the personal data collected through the Website.
In certain cases, BeTraveller OÜ may receive personal data from third-party suppliers linked to the provision of the contracted service (for example, tourist suppliers or payment platforms).
In such cases, said data will be processed exclusively for the correct execution of the contract and in accordance with this Privacy Policy.
The tourist suppliers who ultimately provide the contracted activity may process certain personal data of the User as independent data controllers, in accordance with their own privacy policies.
BeTraveller OÜ will not be responsible for the processing carried out directly by said suppliers once the data have been communicated for the correct provision of the service.
Certain communications related to the management of the purchase, confirmations, modifications, incidents, or relevant information about the contracted activity are mandatory and cannot be cancelled as long as an active contractual relationship exists.