Information on the Personal Data Protection Measures in Place

1. Legal measures

The Personal Data Processing Policy is published. A link to it appears at the bottom of every page and under the request form, in all three language versions.

Consent to the processing of personal data is a separate document: https://mango-tour.com/en/consent. The form carries its own required checkbox, unticked by default: consent is never inferred from the fact that you pressed a button.

Every request message records which version of the consent text you accepted.

A legal basis is stated for every purpose of processing described in the Policy.

We collect the minimum: the form has two required fields — your name and a way to reach you. It asks for no passport, payment or medical details, and we specifically ask you not to put health information in it.

We follow an internal rule: before a new recipient of data or a new form field appears, the Policy and the Consent text are changed first. A new channel cannot appear before you have been told about it.

2. Organisational measures

Access to requests is separated: a request reaches only the work chat whose staff need it for the subject of your enquiry. The excursions manager does not see travel-agency enquiries, and the partnerships manager does not see retail requests.

Requests are delivered only to the company’s private work chats in Telegram. We do not export requests to external mailboxes, a CRM or any other third-party system. If a request cannot be delivered, it does not count as accepted: you see an error and an invitation to write to us directly.

Staff are forbidden to forward requests and correspondence to personal chats or outside groups, to export them to third-party services, or to use them for personal purposes.

Access to the data ends on the same working day on which an employee stops working with it.

Passwords and access keys are never sent in plain text in correspondence and are not stored in the website’s source code.

The retention period is 30 calendar days after the purpose of your enquiry has been achieved. After that the request and the correspondence are deleted.

3. Technical measures

The website runs over the secure HTTPS protocol: the data you enter in the form are transmitted over an encrypted connection.

The “name”, “contact” and “message” fields carry two special Yandex Metrica classes: the first switches off the recording of what you type, the second hides their contents in recordings.

Webvisor, which records actions on the page, is off by default and starts only after you press “Allow” in the cookie notice.

The Telegram bot token and the work chat addresses are kept in the protected settings of the hosting platform, not in the website’s source code.

The text you enter is processed so that it cannot alter the markup of the internal message about your request.

The form contains a hidden trap field for automated mailings: a form filled in by a robot is not processed and its data go nowhere.

When a request is delivered successfully, the service records of the website’s operation contain only the subject of the enquiry and the page address — no name, contact details or message text.

4. What we say plainly

We do not use information protection tools that have gone through a conformity assessment procedure. Apart from the hosting platform’s standard HTTPS, no cryptographic tools are used.

If you write to us directly on WhatsApp or Telegram, the correspondence passes through those services under their own rules — we cannot influence their protection measures.

If a request cannot be delivered to a work chat, its text goes into the service records of the hosting provider Vercel Inc., so that the request can be recovered by hand and your enquiry is not lost. We do not configure how long those records are kept.

5. If you have a question or a demand

Write to info@mango-tour.com. We will reply within the periods set by Law No. 152-FZ. The procedure and your rights are described in Section 8 of the Policy: https://mango-tour.com/en/privacy.

We may update this document. The current version is always on this page, and its date is shown at the beginning.