1. General provisions
1.1. This Privacy Policy (the "Policy") sets out how Asuu Tseg App LLC ("we") collects, uses, stores, transfers and protects personal data through the Asuu.Travel platform (the asuu.travel website, user accounts and service provider panels, the "Platform").
1.2. The controller of your personal data is Asuu Tseg App LLC, registered in Mongolia under registration no. 4291263. We process data under the Law of Mongolia on the Protection of Personal Data and other applicable laws.
1.3. The Policy applies to everyone who visits or registers on the Platform, including visitors, travellers, service providers, Counterparties and their representatives, and to people registered on the Platform through data provided by others.
1.4. Terms used in the Policy have the meaning given in section 2 of the Terms of Service (the "Terms"). "Personal data", "sensitive data" and "processing" have the meaning given in the Law on the Protection of Personal Data.
2. Data we collect
2.1. When you visit the Platform: IP address, browser and device information, the chosen language, the sign-in session.
2.2. Traveller account:
- name (in Latin letters, as in the passport), email address, password (stored only as a one-way hash);
- site language, country of residence, phone number and country code, profile photo (if provided);
- the date the email was verified, the date the Terms and the Policy were accepted and their version numbers.
2.3. Bookings: the service provider or scheduled departure booked, dates, number of travellers (for a scheduled departure, by age category), unit type and count, booking message, price, status, cancellation reason, the date the end of the trip was confirmed, the description of a problem if one was reported, and the operator's decision and explanation.
2.4. Payments and refunds: payment number, amount, method, the payment institution's invoice and response, the IP address when a payment is checked, and the bank, account number and account holder's name for receiving a refund.
2.5. Reviews: stars, comment, the month of travel, the service provider's reply.
2.6. Guides:
- public profile: name, photo, guide number, introduction, biography, nationality, home aimag, experience, languages and levels, specialities, regions served, price, calendar and its notes, driving licence, vehicle details, social media links;
- verification data: registration number, passport number, gender, year of birth, phone, address, copies of the national ID card, passport, guide licence and other certificates;
- name and phone of an emergency contact.
2.7. Places to stay and tour companies: the registration number of the owner or company (for an individual, their registration number), name, address, location on the map, phone, email, website, social media links, photos, logo, the name of the director or owner, and copies of documents such as their ID card, state registration certificate, special permits and references. Staff invitations: the invited email address, role (manager, staff), the status and dates of the invitation and membership; an address without an account is kept for the life of the invitation. Guide–company links: the numbers of both sides, status, dates.
2.8. Counterparties: registration number, name, whether VAT-registered, phone, email, address, the representative's name, position and phone, bank, account number, account holder's name, the history of account changes, and copies of the ID card, certificate and power of attorney.
2.9. We do not collect:
- bank card numbers, expiry dates or security codes (these are entered only on the bank's page);
- the names or passport details of fellow travellers;
- biometric data;
- data that tracks you for advertising or analytics.
2.10. News comments: the text of the comment, whether you chose to show your name, the IP address it was sent from, the link to your account. The IP address is seen by the operator only and never shown on the site; it serves to deal with abuse.
2.11. Gallery: photo, caption, the photo's subject (guide, place to stay, tour company, package, news), aimag, whether you chose to show your name, the IP address it was sent from (operator only). Camera and location (EXIF) data is removed from the converted images shown on the site; the original file is kept as it is, so we advise removing location data from a photo yourself before uploading it.
2.12. Package interest: the preferred window for the start date, number of travellers, notes, the scheduled departure on which seats were held and its status.
2.13. Contact and trip request forms: name, email address, phone, destination, dates, number of travellers, message. These are delivered only by email to info@asuu.travel and are not stored in the database; the email sending record is kept as set out in 12.5.
3. Sources of data
3.1. We obtain data from the following sources:
- you: when you register, fill in a profile, book, pay, write a review or fill in a form;
- other users: when a guide registers an emergency contact, a tour company its director, or a service provider a person it invites as a Counterparty;
- payment institutions and banks: the status of payments and refunds; the statements of our bank accounts (8.2);
- the Platform automatically: IP address, cookies, system logs.
4. Purposes of use
4.1. We use your data to:
- create accounts, sign you in, protect accounts and verify email addresses;
- receive bookings, pass them to service providers and see them performed;
- receive and confirm payments and make refunds;
- check and verify service providers and prevent duplicate and banned registrations;
- pay service providers' earnings to their Counterparties;
- confirm the end of trips and settle reported problems;
- match the statements of our bank accounts against payments, refunds and transfers;
- publish reviews and send booking, payment and security notices;
- handle complaints and disputes;
- protect the Platform against fraud, unlawful acts and automated programs;
- meet our accounting, tax and other legal obligations;
- run the Platform and fix faults.
4.2. We use data only for the purpose it was collected for and only as much as that purpose needs. To use it for a new purpose we will change this Policy as set out in section 18.
4.3. We do not sell your data or pass it to others for advertising. We send marketing only with your consent (Terms 19.5).
5. Legal basis and consent
5.1. By ticking "I accept the Terms of Service and the Privacy Policy" when you register, you consent to your data being processed for the purposes in this Policy, including transfer outside Mongolia as set out in section 10. We keep the date of your consent and the version number of the Policy.
5.2. Data needed to perform a contract (the Terms, a booking) or to meet a legal obligation (accounting, tax, lawful requests from competent authorities) is processed on the grounds provided by law.
5.3. When a service provider or Counterparty submits documents, a registration number or bank details for verification, they consent to their processing for the purposes in section 4.
5.4. You may withdraw your consent at any time (section 15). Withdrawal does not affect the lawfulness of processing before it. If you withdraw consent for data the Platform cannot work without, the account is closed as set out in section 16.
6. Specially protected data
6.1. We treat registration numbers, passport numbers, copies of ID cards, passports, licences and certificates, and bank account details as specially protected data.
6.2. Document copies are kept in a separate, non-public store. Only staff authorised to carry out verification open them, through a signed temporary link valid for 2 minutes. Documents are never published on the Platform (Terms 5.7).
6.3. Registration numbers, passport numbers and bank account numbers are stored in a database with restricted access. Only authorised staff and the person the data belongs to see them; they are not shown on public pages or to other users (other than in the masked form set out in 7.4).
6.4. Photos on documents are checked by eye by staff only. We do not use biometric methods to identify people.
6.5. We do not collect health or other sensitive data. If it matters for safety (an allergy, an illness), we advise writing only what is necessary in the booking message or discussing it with the service provider by phone (Terms 14.5).
7. Who sees what
7.1. The public: a guide's public profile (the public profile data in 2.6), calendar and its notes; the public page of a place to stay or tour company (name, photos, logo, description, location, prices, contact details); packages and scheduled departures; reviews; the gallery; news comments. Guides write calendar notes for travellers to read.
7.2. A review shows your full account name, the month of travel, the stars and the comment. A review cannot be published anonymously. In the gallery and in news comments you choose whether to show your name; if you hide it, "Traveller" is shown instead.
7.3. Service providers: when a booking is sent they see the traveller's name, the number of travellers and the booking message. After payment they see the traveller's email address and phone number (if provided). After payment the traveller sees the service provider's phone number (Terms 18.2). The service provider's owner and the managers and staff they have invited see this data alike.
7.4. A service provider linked to a Counterparty sees the Counterparty's name, bank name and the last 4 digits of its registration number. They do not see the account number. When a service provider searches for a Counterparty by registration number, the name and registration number of the Counterparty found are shown in masked form.
7.5. Asuu Tseg App LLC staff see data only as far as their duties require, within the limits of their permissions.
7.6. Profile photos, service provider photos and logos are kept in a public store (CDN), so anyone who knows a file's link can view it.
8. Transfers to third parties
8.1. Services that process data on our behalf:
- DigitalOcean, LLC (a United States company): servers, database, file storage, CDN. Data is stored in its data centre in Singapore;
- the email server we operate (steppe.asuu.app): the recipient, subject and content of emails the Platform sends.
8.2. Services that receive data under their own terms:
- Google LLC (United States): reCAPTCHA (on the registration and contact forms: IP address, browser information, cookies), Google Fonts (on every page load: IP address, browser information), Google Maps (when the public page of a place to stay loads its map from Google: IP address, browser information; the "Open in maps" link takes you to Google Maps; the map for choosing a location in the panel);
- jsDelivr: country flag icons (on every page load: IP address, browser information);
- ui-avatars.com: generating an icon from the name of a user without a photo in the panel (name);
- QPay: payment invoices (booking and payment numbers, amount). Your name, email and phone are not sent;
- Trade and Development Bank: when paying by card you enter your card details directly on the bank's page. We also fetch the balances and statements of our bank accounts from the bank's system every 20 minutes, use each statement line (date, amount, the name and account of the other party to the transaction, description) to match payments and transfers, and keep it for the period in 12.3. Requests to transfer money to service providers and travellers (the recipient's name and account, the amount, a description carrying the booking number) are sent to the bank through this channel;
- banks: the recipient's name, account number and amount when refunds and service provider payouts are transferred. As the booking number is written in the transaction description, it appears on the recipient's bank statement.
8.3. Service providers: the data in 7.3, to perform the booking.
8.4. Competent state authorities: on a request made on the grounds and by the procedure set out in law.
8.5. In a reorganisation or succession, the successor processes the data within this Policy (Terms 26.4).
8.6. These services process data under their own privacy policies and terms. We pass on only the data the service needs.
9. Payment data
9.1. Bank card details are entered only on the bank's page. We do not receive or store card numbers, expiry dates or security codes.
9.2. For QPay payments we keep the invoice number, the payment status and the response from the payment institution.
9.3. Bank details entered in the refund form are used only to transfer the refund and keep financial records.
9.4. Every change to a Counterparty's account is kept with its history, to protect against fraud and for financial control.
9.5. Payments transferred to service providers, refunds made to travellers and the lines of our bank account statements count as financial records and are kept for the period in 12.3.
10. Transfers outside Mongolia
10.1. Platform data and files are stored in DigitalOcean's data centre in Singapore. Public files are distributed through a worldwide CDN. Google's services are located in the United States.
10.2. We transfer data over encrypted connections (HTTPS). Each recipient has its own data protection measures.
10.3. By registering you consent, as set out in 5.1, to your data being transferred outside Mongolia.
11. Cookies and browser storage
11.1. We use only the cookies the Platform needs to work:
- session cookie: keeps your sign-in, chosen language and form data. It expires after 120 minutes of inactivity;
- XSRF-TOKEN: protects forms against forged requests;
- remember-me cookie: created only when you tick "Remember me", kept until you sign out;
- Google reCAPTCHA cookies: on the registration and contact pages only.
11.2. The service provider panel keeps display settings (colour, menu state) in browser storage.
11.3. We do not use advertising or analytics cookies. If you block cookies in your browser, you will not be able to sign in or send forms.
12. Retention
12.1. Account data is kept while the account is active.
12.2. Data a user enters (profile, photos, reviews, gallery photos, comments, calendar notes and the like) is kept until that user deletes it or Asuu Tseg App LLC decides to delete it.
12.3. Financial data such as bookings, payments, refunds, payouts to service providers, Counterparties and account history, and the lines of our bank account statements is kept for 5 years from the transaction.
12.4. A service provider's verification documents are kept while the account is active. Documents of rejected or unfinished applications are deleted by decision of Asuu Tseg App LLC. A deactivated service provider's record is permanently deleted, with its documents and photos, after 90 days. Data of banned service providers is kept to prevent them registering again (Terms 20.3).
12.5. Technical data:
- session: expires after 120 minutes of inactivity;
- system logs: 30 days;
- password reset link: valid for 60 minutes;
- email sending records: 30 days; emails that could not be sent: 7 days.
12.6. When the retention period ends, data is deleted or anonymised so that it can no longer identify anyone.
13. Security
13.1. To protect data we:
- encrypt all connections (HTTPS);
- store passwords only as one-way hashes;
- limit staff access by role and permissions, and give each service provider panel separate access;
- keep documents in a separate store behind temporary links (6.2) and specially protected numbers under restricted access (6.3);
- hide a traveller's contact details from the service provider until payment;
- limit the number of requests and protect registration forms with reCAPTCHA.
13.2. No system is completely secure. Do not share your password. If you suspect unauthorised access to your account, change your password and tell us at once at info@asuu.travel.
14. Data breaches
14.1. If personal data is leaked or accessed without authorisation, we take immediate steps to stop and reduce the harm.
14.2. We notify the people concerned and the authorities designated by law within the period set by law.
15. Your rights
15.1. Under the law you have the right to:
- know what data we process about you and how we use it, and receive a copy;
- have wrong or incomplete data corrected (you can correct most of it yourself under "My account");
- have your data deleted;
- withdraw your consent;
- complain to the National Human Rights Commission of Mongolia or a court if you believe your rights were breached, and claim compensation.
15.2. Send your request from your registered email address to info@asuu.travel. We reply within the period set by law after confirming who you are.
15.3. Data the law requires us to keep (12.3) is not deleted before that period ends, but is not used for any other purpose.
16. Closing your account
16.1. To close your account, fill in the form behind the "Close account" button under "My account", or send a request from your registered email address to info@asuu.travel.
16.2. While a booking, refund or service provider settlement is still open, the account is not closed until it is finished (Terms 20.5).
16.3. When the account is closed, data such as your name, email, phone and photo is deleted. Financial data is kept in anonymised form for the period in 12.3. Your reviews become anonymous ("Traveller"), or are deleted if you wish.
17. Minors and other people's data
17.1. Only people aged 18 or over may register on the Platform (Terms 4.1). If someone under 18 is found to have registered, the account is closed.
17.2. A minor taking part in a trip is included in the booking only in the number of travellers. We do not collect their name or other data.
17.3. Someone booking on behalf of others makes this Policy known to them (Terms 4.7).
17.4. Before entering the data of an emergency contact, a representative, a director or a person invited as a Counterparty, inform that person and obtain their consent.
17.5. A service provider uses a traveller's data only to provide the booked service. If they keep it outside the Platform, they are responsible for protecting it (Terms 6.6).
18. Changes and versions
18.1. Each version of the Policy is numbered. The number of the version in force and the date it took effect are shown on this page.
18.2. We may change the Policy when the law, the Platform's services or the recipients of data change. Significant changes are announced on the Platform and to your registered email address at least 14 days before they take effect.
18.3. By continuing to use the Platform after a new version takes effect you are deemed to accept it. If you do not accept it, you may close your account as set out in section 16.
18.4. The Policy may be published in several languages. If they differ, the Mongolian text prevails.
19. Contact
19.1. Send questions, requests and complaints about personal data to:
- Asuu Tseg App LLC, registration no. 4291263;
- address: Asuu Tseg App LLC building, Khiimori Garden, 24th khoroolol, 10th bag, Darkhan sum, Darkhan-Uul aimag, Mongolia;
- phone: +976 86085522;
- email: info@asuu.travel.