Personal Data Processing Policy

1. Operator

The personal data operator (the company responsible for your data) is Sanya Yulong International Travel Agency Co., Ltd (三亚裕隆国际旅行社有限公司), operating under the Mango Tour brand.

Unified Social Credit Code (USCC), the company’s registration number in China: 91460000MA5TYLCM12. The company was registered on 26 April 2021 by the Hainan Provincial Administration for Market Regulation (PRC).

Registered address: Office 916–917, 9th floor, CITIC Southern Airlines Building, Fenghuang Rd & Yingbin Rd, Jiyang District, Sanya, Hainan, China.

Website: https://mango-tour.com. E-mail for enquiries concerning personal data: info@mango-tour.com.

We are located outside the Russian Federation. Law No. 152-FZ applies to the processing of personal data of Russian citizens carried out by foreign companies on the basis of a contract with a Russian citizen or of that citizen’s consent (Part 1.1 of Article 1, introduced by Federal Law No. 266-FZ of 14 July 2022). Those are exactly the grounds on which we process your data.

2. Whose data we process and which data

We process the data of visitors to the website, of people who have submitted a request through the form on the website, and of people who have contacted our managers directly. The data come from you (the request form, correspondence, a phone call) and from your browser when you visit the website.

From the request form: your name; a contact for us to reach you — phone number, WhatsApp or e-mail, as you choose; the subject of your request (tour, hotel, excursions, treatment and wellness, business visit, private hosting, partnership, other); the text of your message (optional); the address of the website page from which the request was sent; the service you chose on the site — the name of an excursion, hotel or tour format, if you came from its page; the time it was sent; a record that you gave consent to the processing of personal data, and the version of that consent.

When you visit the website, through the Yandex Metrica service (see Section 9 for details): cookies; visit statistics, including a click map and link clicks. Your actions on the page (scrolling, clicks, cursor movements) are recorded by Webvisor only after you consent in the cookie notice.

When a page is opened and when a request is sent, the hosting provider records the IP address and information about your browser in its technical logs — every web server works this way.

When you contact us directly — via WhatsApp, Telegram, by phone or by e-mail: the contact details from which you reached us and the information you share with us.

Information about your health belongs to a special category of personal data and may be processed only with your written consent (Clause 1 of Part 2 of Article 10 of Law No. 152-FZ). Please do not include diagnoses, health complaints or any other health information in the request form, including in the message text — it is enough to tell us which programme you are interested in.

3. Purposes and legal grounds for processing

1) Responding to your request or message. Data: data from the request form, including the page address and the time of submission; information from correspondence or conversation. Legal basis: your consent (Clause 1 of Part 1 of Article 6 of Law No. 152-FZ).

2) Selecting and arranging trips, excursions, accommodation and medical programmes; communicating with you about your booking. Data: name, contact details, the subject and text of your request, information from correspondence or conversation. Legal bases: your consent; the conclusion of a contract at your initiative and the performance of that contract (Clause 5 of Part 1 of Article 6 of Law No. 152-FZ).

3) Improving the website (web analytics). Data: cookies, information about your actions on the page. Legal bases: for visit statistics — our legitimate interest in understanding how visitors use the website and making it more convenient, provided this does not violate your rights and freedoms (Clause 7 of Part 1 of Article 6 of Law No. 152-FZ); for the recording of your actions on the page by Webvisor — your consent, given in the cookie notice (Clause 1 of Part 1 of Article 6 of Law No. 152-FZ).

4) Working with travel agencies and partners: replying to partnership enquiries and business correspondence. Data: the name and contact details of the agency’s representative, the subject and text of the enquiry, information from correspondence. Legal bases: our legitimate interest in conducting business correspondence (Clause 7 of Part 1 of Article 6 of Law No. 152-FZ) and, for enquiries sent through the website form, your consent (Clause 1 of Part 1 of Article 6).

We do not use data for purposes not specified in this section. We do not sell personal data, do not send promotional mailings, and do not make decisions about you by means of software without human involvement (that is, solely on the basis of automated data processing).

Consent to the processing of personal data is given separately from this Policy: its text is published at https://mango-tour.com/en/consent, and you give it by ticking the box in the request form.

4. How we process data

Processing is mixed: it is carried out both with the use of automation tools (for example, a request submitted on the website is automatically forwarded to Telegram) and without them.

Actions performed with data: collection, recording, systematisation, accumulation, storage, rectification (updating, modification), retrieval, use, transfer (provision, access), including outside the Russian Federation, blocking, deletion, destruction.

5. Who has access to the data

Access to the data is limited to the company’s employees and management who handle requests and arrange trips.

A request submitted on the website is automatically forwarded to the Telegram messenger, into the company’s private work chats.

The website is hosted on the servers of Vercel Inc. (hosting provider), through which a submitted request passes. If a request cannot be delivered, its data are kept in technical logs (service records of the website’s operation) so that the request is not lost. How long those logs are kept is set by the hosting provider.

Information about visits to the website is processed by Yandex LLC in the Yandex Metrica service (Section 9).

E-mails sent to info@mango-tour.com are stored on the mail server of the Russian hosting provider Beget.

When you decide to book a trip, excursion, accommodation or medical programme, we share with the service providers — hotels, guides, carriers, medical organisations — only the data without which the booking is impossible.

If you write to our managers directly on WhatsApp or Telegram, the correspondence passes through those services under their own rules. We process data received in this way in accordance with this Policy.

We do not sell personal data or share it for advertising.

6. Transfer of data outside Russia

We are located in China, and the website’s main audience is citizens of Russia; your personal data are therefore transferred outside the Russian Federation (the law refers to such a transfer as cross-border):

— to us as the operator in the PRC: the data listed in Section 2, including Yandex Metrica data, for the purposes set out in Section 3;

— to the Telegram messenger: request form data, in order to deliver requests to our managers, and, if you write to our managers on Telegram directly, your correspondence as well;

— to the hosting provider Vercel Inc.: request form data when the request is sent, for the operation of the website;

— to the WhatsApp messenger: your correspondence, if you write to our managers there;

— to service providers in the PRC (hotels, guides, carriers, medical organisations): only the data needed for a booking, once you decide to use a service.

Data are transferred outside Russia on the same legal grounds on which they are processed (Section 3).

7. Processing periods and destruction of data

We process data from requests and correspondence until the purposes set out in Section 3 have been achieved, or until you withdraw your consent, if we have no other lawful grounds for processing.

If the trip does not take place, the purpose is considered achieved 30 days after your last message. If the trip does take place, it is considered achieved once the trip is over and all payments are settled; documents and correspondence relating to a completed trip may be kept longer, within the periods that the law sets for confirming payments and handling claims.

If a request cannot be delivered, its data are kept in the technical logs of the hosting provider Vercel Inc. for the period that provider sets. Cookies are stored in your browser, and you can delete them at any time.

Once the purpose of processing has been achieved, we stop processing and destroy the data, including by deleting requests and correspondence from our work chats, within a period not exceeding 30 days from the date on which the purpose was achieved (Part 4 of Article 21 of Law No. 152-FZ). After consent is withdrawn, we do so within a period not exceeding 30 days from the date on which the withdrawal is received (Part 5 of Article 21).

If unlawful processing is identified, we stop it within a period not exceeding 3 working days from the date of identification. If it is impossible to ensure that the processing is lawful, we destroy the data within a period not exceeding 10 working days from the date of identification and notify you accordingly (Part 3 of Article 21).

If it is impossible to destroy the data within the periods specified above, we block the data and destroy them within a period not exceeding 6 months, unless a different period is established by federal laws (Part 6 of Article 21). Destruction is confirmed in accordance with the procedure established by Roskomnadzor.

8. Your rights and response times

You have the right to:

— obtain the information about the processing of your personal data listed in Part 7 of Article 14 of Law No. 152-FZ;

— demand that we rectify, block or destroy your data if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;

— withdraw your consent to the processing of personal data;

— demand that we stop processing your data;

— appeal against our actions or inaction to Roskomnadzor (the state authority that protects citizens’ rights in the field of personal data) or in court.

Please send requests, demands and withdrawals of consent by e-mail to info@mango-tour.com.

A request must contain: the number of the main identity document of you or your representative, its date of issue and the issuing authority; information confirming that you contacted us (for example, the contact details given in your request and the date the request was sent), or other information confirming that we process your data; your signature or the signature of your representative. A request may be sent in the form of an electronic document signed with an electronic signature (Part 3 of Article 14 of Law No. 152-FZ).

We provide information about the processing of data within 10 working days from the date of receipt of the request, in the same form in which the request was sent, unless the request specifies otherwise. This period may be extended by no more than 5 working days; in that case, we will send you a reasoned notice stating the reasons for the extension (Part 3 of Article 14, Part 1 of Article 20). A reasoned refusal is sent within the same periods (Part 2 of Article 20).

We rectify data that are incomplete, inaccurate or out of date, and destroy data that were unlawfully obtained or are not necessary for the stated purpose, within 7 working days from the date of receipt of the supporting information, and notify you accordingly (Part 3 of Article 20).

We comply with a demand to stop processing within 10 working days from the date of its receipt; this period may be extended by no more than 5 working days, with a reasoned notice sent to you (Part 5.1 of Article 21).

After you withdraw your consent, we stop processing and destroy the data within 30 days, unless we have other lawful grounds for processing (Part 2 of Article 9, Part 5 of Article 21).

9. Cookies and Yandex Metrica

The Yandex Metrica web analytics service (Yandex LLC) is installed on the website. It uses cookies — small files saved in your browser — and collects statistics: which pages are opened, where visitors come from, which devices they use, plus a click map and link clicks (taps on the phone number, WhatsApp, Telegram and external links).

Webvisor works separately: it records actions on the page — scrolling, clicks, cursor movements. It starts only after you press “Allow” in the cookie notice shown on your first visit. If you choose “No thanks”, nothing is recorded.

The request form fields carry two special Yandex Metrica classes: the first switches off the recording of what you type, the second hides their contents in recordings.

You can change your answer at any time through the “Cookie settings” link at the bottom of every page. The answer itself is kept in your own browser (in local storage, or in our own technical cookie when storage is unavailable) and is not sent to us. Cookies can also be disabled or deleted in your browser settings. Refusing recording or cookies does not prevent you from using the website or sending requests.

10. Data protection

The website operates over the secure HTTPS protocol: the data you enter in the form are transmitted over an encrypted connection.

Requests are delivered only to the company’s private work chats in Telegram.

If you write to us directly on WhatsApp or Telegram, the correspondence passes through those services under their own rules.

The full list of measures is published separately: https://mango-tour.com/en/protection.

11. Changes to this Policy

We may update this Policy. The current version is published on the website https://mango-tour.com, and the date of the version is shown at the beginning of the document.

If the changes concern new purposes of processing or a new scope of data, we will ask you for new consent.