Payment Security Policy

1. Roles and responsibilities (WTTM vs payment partners)

WTTM operates a digital marketplace and related services. Payment acceptance is performed by regulated payment partners (including Stripe) and/or approved banking partners (including JSC Oktobank for certain bank-based flows). WTTM is not a bank and does not issue payment credentials.

Card scheme rules (Visa, Mastercard, and other networks as applicable) impose security obligations on participants in the payment chain. Your card issuer may apply additional authentication controls beyond WTTM’s environment.

2. Stripe: tokenisation, encryption, and hosted fields

Where Stripe is used, sensitive card data is typically collected through Stripe-hosted components or tokenisation flows designed to reduce PCI DSS scope for merchants. WTTM aims to avoid receiving, logging, or storing full Primary Account Numbers (PAN), CVV/CVC, or full magnetic-stripe equivalent data.

Stripe’s security posture, certifications, subprocessors, and regional terms are described in Stripe’s documentation and legal notices. WTTM may receive limited non-sensitive references (such as payment intent IDs, last4 brand fingerprint where permitted, and status metadata) to reconcile orders.

3. Visa and Mastercard: network authentication and issuer controls

Visa and Mastercard operate global payment networks with rules for secure acceptance, dispute handling, and fraud monitoring. Authentication experiences (including 3-D Secure / SCA workflows) may be presented by issuers or delegated authentication providers.

WTTM cannot guarantee issuer approval of a transaction. A declined authorisation does not necessarily indicate a WTTM system error; it may reflect issuer risk policy, spending limits, cross-border restrictions, or regulatory controls.

4a. Merchant obligation: no card data on WTTM servers

WTTM does not request, accept, store, or process full card numbers (PAN), CVV/CVC, magnetic-stripe data, or PIN blocks on its own websites or application servers. Card credentials are entered only on secure pages operated by licensed payment partners (Stripe hosted checkout; Uzbekistan licensed acquirer hosted pages upon activation).

Customers must never send card details by email, chat, or social media. If you receive such a request purporting to be from WTTM, report it immediately to [email protected].

4b. Bank transfer and Uzbekistan partner bank flows

Where payments are completed via bank transfer instructions involving licensed Uzbekistan partner banks or other approved banking partners, customers must follow exact beneficiary details provided through official WTTM channels. WTTM will never ask you to send funds to unrelated personal accounts via unsolicited messages.

Bank transfers may be subject to sanctions screening, AML monitoring, correspondent banking delays, and intermediary fees. Always retain proof of transfer and share it only through verified support channels when requested.

5. PCI DSS scope and assessments

WTTM seeks to maintain PCI DSS compliance aligned to its actual cardholder data environment (CDE) scope. Controls may include segmentation, access control, vulnerability management, secure SDLC practices, logging and monitoring, and vendor due diligence.

Because architectures evolve, specific PCI reports (for example AOC/ROC) may be available to enterprise customers under NDA where applicable.

6. Fraud prevention, velocity checks, and manual review

We may use automated and manual fraud controls including device fingerprinting (where lawful), IP reputation, velocity limits, behavioural signals, and payment anomaly detection. Transactions may be delayed, cancelled, or referred for enhanced due diligence where risk indicators are present.

7. Customer security hygiene

You should protect account credentials, enable multi-factor authentication where offered, avoid public Wi‑Fi for payments, verify domain names and TLS certificates, and report suspicious messages (phishing/smishing) to [email protected].

WTTM will not request your full card number by email.

8. Incident response (high-level)

If WTTM becomes aware of a material security incident affecting personal data, we will follow applicable breach notification laws and contractual obligations, including notifying regulators and/or affected individuals where required.

This section is a high-level summary and does not create third-party beneficiary rights.

WTTM - United Kingdom

WORLD TRAVEL & TOURISM MARKET LTD.

Company Registration Number: 16672223

Registered Office:
167–169 Great Portland Street
London, England, W1W 5PF
United Kingdom

Director: Bakhish Ismayil

Tel: +44 7432 200554

Banking Details

Bank: Lloyds Bank (via AT Smart Solutions Ltd)

Account Name: AT Smart Solutions Ltd

Account Number: 66204662

Sort Code (Bank Code): 30-99-50

IBAN: GB44 LOYD 3099 5066 2046 62

SWIFT / BIC: LOYDGB21287

UTTM Uzbekistan

LLC UTTM

Registered Address: 22-24 Small Ring Road, Yunusabad District, Tashkent, Uzbekistan

Company Registration Number: State Registration No: 07437461

Bank: JSC Oktobank, Mirzo Ulugbek Branch

MFO (Bank Code): 00421

OKED / Company Code: 07437461

TIN (INN): 312924418

Settlement Accounts:

UZS: 20208000307437461001

USD: 20208840607437461001

EUR: 20208978007437461001

Director: Ernest Akhmadulin (Akhmadulin Ernest Timurovich)