Personal Data Processing Policy

1. Operator

The personal data operator (the company responsible for your data) is Sanya Yulong International Travel Agency Co., Ltd (三亚裕隆国际旅行社有限公司), operating under the Mango Tour brand.

Unified Social Credit Code (USCC), the company’s registration number in China: 91460000MA5TYLCM12. The company was registered on 26 April 2021 by the Hainan Provincial Administration for Market Regulation (PRC).

Registered address: Office 916–917, 9th floor, CITIC Southern Airlines Building, Fenghuang Rd & Yingbin Rd, Jiyang District, Sanya, Hainan, China.

Website: https://mango-tour.com. E-mail for enquiries concerning personal data: info@mango-tour.com.

We are located outside the Russian Federation. Law No. 152-FZ applies to the processing of personal data of citizens of the Russian Federation (Part 1 of Article 1).

2. Whose data we process and which data

We process the data of visitors to the website, of people who have submitted a request through the form on the website, and of people who have contacted our managers directly. The data come from you (the request form, correspondence, a phone call) and from your browser when you visit the website.

From the request form: your name; a contact for us to reach you — phone number, WhatsApp or e-mail, as you choose; the subject of your request (tour, excursions, treatment and wellness, partnership, other); the text of your message (optional); the address of the website page from which the request was sent; the time it was sent; a record that you gave consent to the processing of personal data, and the version of that consent.

When you visit the website, through the Yandex Metrica service, including Webvisor (see Section 9 for details): cookies; information about your actions on the page, including scrolling, clicks and cursor movements.

When you contact us directly — via WhatsApp, Telegram, by phone or by e-mail: the contact details from which you reached us and the information you share with us.

Information about your health belongs to a special category of personal data and may be processed only with your written consent (Clause 1 of Part 2 of Article 10 of Law No. 152-FZ). Please do not include diagnoses, health complaints or any other health information in the request form, including in the message text — it is enough to tell us which programme you are interested in.

3. Purposes and legal grounds for processing

1) Responding to your request or message. Data: data from the request form, including the page address and the time of submission; information from correspondence or conversation. Legal basis: your consent (Clause 1 of Part 1 of Article 6 of Law No. 152-FZ).

2) Selecting and arranging trips, excursions, accommodation and medical programmes; communicating with you about your booking. Data: name, contact details, the subject and text of your request, information from correspondence or conversation. Legal bases: your consent; the conclusion of a contract at your initiative and the performance of that contract (Clause 5 of Part 1 of Article 6 of Law No. 152-FZ).

3) Improving the website (web analytics). Data: cookies, information about your actions on the page. Legal basis: our legitimate interest in understanding how visitors use the website and making it more convenient, provided this does not violate your rights and freedoms (Clause 7 of Part 1 of Article 6 of Law No. 152-FZ).

We do not use data for purposes not specified in this section. We do not sell personal data, do not send promotional mailings, and do not make decisions about you by means of software without human involvement (that is, solely on the basis of automated data processing).

Consent to the processing of personal data is given separately from this Policy: its text is published at https://mango-tour.com/en/consent, and you give it by ticking the box in the request form.

4. How we process data

Processing is mixed: it is carried out both with the use of automation tools (for example, a request submitted on the website is automatically forwarded to Telegram) and without them.

Actions performed with data: collection, recording, systematisation, accumulation, storage, rectification (updating, modification), retrieval, use, transfer (provision, access), including outside the Russian Federation, blocking, deletion, destruction.

5. Who has access to the data

Access to the data is limited to the company’s employees and management who handle requests and arrange trips.

A request submitted on the website is automatically forwarded to the Telegram messenger, into the company’s private work chats.

The website is hosted on the servers of Vercel Inc. (hosting provider), through which a submitted request passes. If a request cannot be delivered, its data are kept for a short time in technical logs (service records of the website’s operation) so that the request is not lost.

Information about visits to the website is processed by Yandex LLC in the Yandex Metrica service (Section 9).

E-mails sent to info@mango-tour.com are stored on the mail server of the Russian hosting provider Beget.

When you decide to book a trip, excursion, accommodation or medical programme, we share with the service providers — hotels, guides, carriers, medical organisations — only the data without which the booking is impossible.

If you write to our managers directly on WhatsApp or Telegram, the correspondence passes through those services under their own rules. We process data received in this way in accordance with this Policy.

We do not sell personal data or share it for advertising.

6. Transfer of data outside Russia

We are located in China, and the website’s main audience is citizens of Russia; your personal data are therefore transferred outside the Russian Federation (the law refers to such a transfer as cross-border):

— to us as the operator in the PRC: the data listed in Section 2, including Yandex Metrica data, for the purposes set out in Section 3;

— to the Telegram messenger: request form data, in order to deliver requests to our managers, and, if you write to our managers on Telegram directly, your correspondence as well;

— to the hosting provider Vercel Inc.: request form data when the request is sent, for the operation of the website;

— to service providers in the PRC (hotels, guides, carriers, medical organisations): only the data needed for a booking, once you decide to use a service.

Data are transferred outside Russia on the same legal grounds on which they are processed (Section 3).

7. Processing periods and destruction of data

We process data from requests and correspondence until the purposes set out in Section 3 have been achieved, or until you withdraw your consent, if we have no other lawful grounds for processing.

If a request cannot be delivered, its data are kept for a short time in the technical logs of the hosting provider Vercel Inc. Cookies are stored in your browser, and you can delete them at any time.

Once the purpose of processing has been achieved, we stop processing and destroy the data, including by deleting requests and correspondence from our work chats, within a period not exceeding 30 days from the date on which the purpose was achieved (Part 4 of Article 21 of Law No. 152-FZ). After consent is withdrawn, we do so within a period not exceeding 30 days from the date on which the withdrawal is received (Part 5 of Article 21).

If unlawful processing is identified, we stop it within a period not exceeding 3 working days from the date of identification. If it is impossible to ensure that the processing is lawful, we destroy the data within a period not exceeding 10 working days from the date of identification and notify you accordingly (Part 3 of Article 21).

If it is impossible to destroy the data within the periods specified above, we block the data and destroy them within a period not exceeding 6 months, unless a different period is established by federal laws (Part 6 of Article 21). Destruction is confirmed in accordance with the procedure established by Roskomnadzor.

8. Your rights and response times

You have the right to:

— obtain the information about the processing of your personal data listed in Part 7 of Article 14 of Law No. 152-FZ;

— demand that we rectify, block or destroy your data if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;

— withdraw your consent to the processing of personal data;

— demand that we stop processing your data;

— appeal against our actions or inaction to Roskomnadzor (the state authority that protects citizens’ rights in the field of personal data) or in court.

Please send requests, demands and withdrawals of consent by e-mail to info@mango-tour.com.

A request must contain: the number of the main identity document of you or your representative, its date of issue and the issuing authority; information confirming that you contacted us (for example, the contact details given in your request and the date the request was sent), or other information confirming that we process your data; your signature or the signature of your representative. A request may be sent in the form of an electronic document signed with an electronic signature (Part 3 of Article 14 of Law No. 152-FZ).

We provide information about the processing of data within 10 working days from the date of receipt of the request, in the same form in which the request was sent, unless the request specifies otherwise. This period may be extended by no more than 5 working days; in that case, we will send you a reasoned notice stating the reasons for the extension (Part 3 of Article 14, Part 1 of Article 20). A reasoned refusal is sent within the same periods (Part 2 of Article 20).

We rectify data that are incomplete, inaccurate or out of date, and destroy data that were unlawfully obtained or are not necessary for the stated purpose, within 7 working days from the date of receipt of the supporting information, and notify you accordingly (Part 3 of Article 20).

We comply with a demand to stop processing within 10 working days from the date of its receipt; this period may be extended by no more than 5 working days, with a reasoned notice sent to you (Part 5.1 of Article 21).

After you withdraw your consent, we stop processing and destroy the data within 30 days, unless we have other lawful grounds for processing (Part 2 of Article 9, Part 5 of Article 21).

9. Cookies and Yandex Metrica

The Yandex Metrica web analytics service (Yandex LLC), including Webvisor, is installed on the website. Webvisor records your actions on the page, including scrolling, clicks and cursor movements.

The website uses cookies — small files that are saved in your browser; Yandex Metrica uses them to compile visit statistics.

This information helps us improve the website (see Section 3 for the legal basis). You can disable or delete cookies in your browser settings — this does not prevent you from using the website or sending requests.

10. Data protection

The website operates over the secure HTTPS protocol: the data you enter in the form are transmitted over an encrypted connection.

Requests are delivered only to the company’s private work chats in Telegram.

If you write to us directly on WhatsApp or Telegram, the correspondence passes through those services under their own rules.

11. Changes to this Policy

We may update this Policy. The current version is published on the website https://mango-tour.com, and the date of the version is shown at the beginning of the document.

If the changes concern new purposes of processing or a new scope of data, we will ask you for new consent.