Last updated: 2025 · Framework: Law of the Republic of Azerbaijan «On Personal Data» (No. 998-IIIQ).
1. Data controller
Data controller: Mubah Travel LLC, AZ1033, 83A Heydar Aliyev Avenue, Baku, Azerbaijan Contact: [email protected].
2. What we collect
- Account: first name, last name, e-mail, phone, date of birth.
- Travel (PII): passport / ID number, visa data — stored encrypted.
- Payment: card details are NOT stored on our servers — only tokens and transaction IDs held by PCI DSS-certified payment providers.
- Technical: IP, browser, device, cookies, log files.
3. Purposes
- Processing reservations and payments.
- Customer support and complaint handling.
- Fraud prevention.
- Marketing communications — only with consent.
- Statutory reporting.
4. Sharing with third parties
- hotels, airlines, transfer and visa providers — minimum necessary scope;
- payment providers (Pasha Bank, Kapital Bank, Azericard, EPoint, etc.);
- competent state authorities — when required by law.
5. Retention
Account data is retained while active + 5 years (statutory). PII is archived for 3 years after reservation completion.
6. Your rights
- Request access to your data.
- Request correction or deletion.
- Withdraw marketing consent.
- File a complaint with the competent data protection authority.
Requests: [email protected].
7. Security measures
Encryption (AES-256 at rest, TLS 1.3 in transit), least-privilege access, audit logs, regular penetration tests.