Privacy Policy

1. Data controller and contact

The data controller responsible for personal data processed in connection with the Services is WORLD TRAVEL & TOURISM MARKET LTD.

Privacy enquiries: [email protected]. General support: [email protected]. If you are in the UK/EU and have unresolved concerns, you may lodge a complaint with your local supervisory authority.

2. Personal data we collect

We may collect: identity and contact data (name, email, phone, company, job title); account credentials and security signals; billing details and transaction metadata; communications you send us; marketing preferences; technical data (IP address, device identifiers, browser type, operating system); usage data (pages viewed, actions taken, referral URLs); event and travel-related details you choose to provide; documents uploaded for verification; and audio/video or chat transcripts where features exist and you participate.

We do not intentionally collect special-category data unless a feature requires it and we provide an appropriate lawful basis and notice.

3. How we use personal data (purposes and lawful bases)

We process personal data to: provide, operate, and improve the Services (contractual necessity and legitimate interests); process payments and prevent fraud (contractual necessity, legal obligation, legitimate interests); authenticate users and secure accounts (legitimate interests); provide customer support (contractual necessity); send service messages (contractual necessity); comply with law and regulatory requests (legal obligation); enforce terms and defend legal claims (legitimate interests); analyse product usage in aggregated or pseudonymised form (legitimate interests); and send marketing where permitted (consent or soft opt-in where lawful).

Where consent is required for cookies or direct marketing, you may withdraw consent at any time without affecting prior processing.

4. Payments: Stripe, card networks (Visa, Mastercard), and Ipak Yuli Bank

WTTM uses authorised payment partners to collect and process payments. Stripe Technology Europe Ltd and/or Stripe, Inc. (collectively, “Stripe”) may process card payments on our behalf using tokenisation and hosted payment fields designed so that WTTM does not receive your full card number or CVV.

Visa and Mastercard (and other networks as applicable) operate payment networks and authentication rules between issuers and acquirers. Your issuer may share fraud and authentication signals with acquirers and merchants’ processors under network rules.

For certain bank-transfer or regional settlement flows, we may provide instructions involving JSC Ipak Yuli Bank (“Ipak Yuli Bank”, Uzbekistan). In those cases, payment data you share with the bank is processed under the bank’s privacy notices and banking secrecy rules, while WTTM may receive limited confirmation metadata (for example payment reference, amount, currency, timestamp, and payer name) to reconcile your order.

5. Disclosures to processors and third parties

We may share personal data with: Stripe and other payment processors; cloud hosting and database providers; email and communications vendors; analytics providers; customer support tools; CRM systems; KYC/AML and sanctions screening providers; professional advisers (lawyers, accountants); and courts/regulators where required.

We impose contractual obligations on processors requiring them to protect personal data and process it only on our instructions, except where law requires otherwise.

6. International transfers

WTTM operates globally. Your personal data may be transferred to and processed in the United Kingdom, the European Economic Area, the United States, Uzbekistan (where Ipak Yuli Bank processing occurs), and other countries where we or our suppliers operate.

Where transfers are not covered by an adequacy decision, we use appropriate safeguards such as Standard Contractual Clauses, the UK IDTA Addendum, and supplementary measures where required by regulatory guidance.

7. Retention

We retain personal data only as long as necessary for the purposes described, including statutory retention periods for accounting, tax, anti-money laundering, dispute resolution, and fraud monitoring.

Marketing data is retained in line with consent records and legitimate interest balancing tests. Backup copies may persist for a limited technical period after deletion.

8. Security

We implement administrative, technical, and organisational measures including access controls, encryption in transit, encryption at rest where appropriate, logging, vulnerability management, vendor reviews, and staff training.

No method of transmission or storage is 100% secure; please use strong passwords and protect your devices.

9. Your rights (UK/EU-style rights, where applicable)

Depending on jurisdiction, you may have rights to: access; rectification; erasure; restriction; portability; objection to certain processing; and withdrawal of consent. You may also have rights related to automated decision-making where such processing has legal or similarly significant effects.

To exercise rights, contact [email protected]. We may need to verify your identity. You may also have the right to complain to a supervisory authority.

10. Children

The Services are not directed to children under 16 (or a higher age where required by local law). If you believe we collected data from a child, contact us and we will take appropriate steps to delete it.

11. Changes to this Policy

We may update this Policy to reflect operational, legal, or regulatory changes. We will post the updated version with a revised effective date and, where required, provide additional notice (including email or in-app notice for material changes).

12. Account deletion (WTTM app and website)

You may request deletion of your WTTM account and associated personal data for the Android app (info.wttm.app) and wttm.info.

Steps: (1) sign in if you still have access; (2) email [email protected] or [email protected] from your registered address with subject “Account deletion request — WTTM”, including your full name and account email; (3) complete any identity verification we request; (4) we aim to complete verified deletion within 30 days.

Deleted where feasible: profile, credentials, preferences, support history (unless a dispute is open), and user-linked usage data. Retained where required by law: payment/transaction records (typically up to 7 years), limited security logs, and encrypted backups (up to 90 days). Card data is handled by Stripe; WTTM does not store full card numbers.

Full instructions: https://wttm.info/account-deletion/

Uzbekistan Legal Entity (LLC UTTM)

Registered Address: 22-24 Small Ring Road, Yunusabad District, Tashkent, Uzbekistan

Bank: Ipak Yuli Bank, Mirzo Ulugbek Branch

MFO (Bank Code): 00421

OKED / Company Code: 07437461

TIN (INN): 312924418

Settlement Accounts:

UZS: 20208000307437461001

USD: 20208840607437461001

EUR: 20208978007437461001

Director: Ernest Akhmadulin (Akhmadulin Ernest Timurovich)