Ochrana osobných údajov

Welcome to 1StepTrip.com, operated by SETTOUR Slovakia spol. s r. o. ("we," "us," or "our"). We respect your privacy and are committed to protecting the personal information you share with us through our website and mobile application.

This Privacy Policy explains how we collect, use, share, and safeguard your information when you use our travel services.

1. About us

• Company name: SETTOUR Slovakia spol. s r. o.
• Registered address: Lazaretská 29, 811 09 Bratislava, Slovakia
• VAT ID: SK2020057314
• Contact e-mail: [email protected]
• Phone: +421 2 5292 7917

2. Information we collect

We collect and process the following types of personal information when you interact with our services:

a) Personal identifiable information (PII)

• Full name
• E-mail address
• Phone number
• Address
• Payment details (e.g., credit/debit card information)
• Passport or ID details (for bookings, when required)

b) Booking and travel information

• Travel destinations, preferences, itineraries, and reservations
• Flight, hotel, car rental, and tour booking details

c) Device and usage data

• IP address
• Browser type and version
• Mobile device identifiers (e.g., device ID, operating system, app usage)
• Cookies and tracking data (see Section 8 for details)

d) Sign in with Google

If you choose to create an account or sign in with your Google account, Google shares with us, with your permission, only your name, your e-mail address (and whether Google has verified it) and your Google account identifier. We request only the basic scopes openid, email and profile. We do not receive your Google password and we do not access your contacts, Gmail, Google Drive, calendar or any other Google data.

We use this information only to create and sign you in to your 1StepTrip customer account, to link it with an existing account registered under the same e-mail address, and to send you booking confirmations. We store it in our customer database for as long as your account exists. We do not sell it, do not use it for advertising and do not share it with third parties, except with our hosting provider listed in Section 14 as part of operating the website.

You can stop using Google sign-in at any time by removing 1StepTrip's access in your Google account settings. To have your account and the data received from Google deleted, contact us at [email protected].

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

e) Protection of our forms against bots

Our contact, partner, newsletter, sign-in, registration and password reset forms are protected by Cloudflare Turnstile, a service of Cloudflare, Inc. When you use these forms, Turnstile checks in the background that the form is filled in by a person and not by an automated program. For this check Cloudflare processes your IP address and technical information about your browser and device. Turnstile does not set cookies for this purpose and the data is not used for advertising. We use it on the basis of our legitimate interest in protecting our website and our customers from spam and abuse. More information: Cloudflare Turnstile privacy addendum.

f) Other information

• Communication logs and customer service interactions
• Reviews, ratings, or feedback submitted to us

3. How we use your information

We use your data for the following purposes:

• To process bookings and payments: Managing reservations, confirmations, and customer payments.
• To improve our services: Analyzing user behavior, preferences, and feedback to enhance the platform.
• To provide customer support: Responding to inquiries, concerns, or disputes.
• For marketing purposes: Sending newsletters, offers, and updates (only if you have given consent).
• For legal compliance: Meeting regulatory obligations, such as tax reporting and fraud prevention.
• To personalize user experience: Recommending tailored travel plans and offers.

4. Legal basis for processing personal data

We process your personal data based on one or more of the following legal bases:

• Contractual necessity: To fulfill our obligations to provide you with travel services.
• Consent: When you opt-in to receive marketing or personalized services.
• Legal obligation: To comply with applicable laws and regulations.
• Legitimate interest: For fraud prevention, service improvement, and customer support.

5. How we share your information

We do not sell or rent your personal data. However, we may share it with trusted third parties, including:

• Service providers: Airlines, hotels, car rental companies, tour operators, and payment processors.
• Business partners: Partners who help us deliver complementary travel services.
• Legal authorities: When required by law or to protect our legal rights.
• IT and analytics providers: To analyze data, monitor usage, and improve platform functionality.

6. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy. After that, your data will be deleted or anonymized unless otherwise required by law.

• Booking records: Retained for up to 5 years for legal and audit purposes.
• Marketing data: Retained until you withdraw your consent.
• Customer service records: Retained for up to 2 years after resolution.

7. Your data protection rights

Under GDPR and applicable laws, you have the following rights:

• Right of access: Request a copy of your personal data.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data.
• Right to restrict processing: Request limited processing of your data.
• Right to data portability: Request transfer of your data to another provider.
• Right to object: Object to processing of your data for certain purposes (e.g., marketing).
• Right to withdraw consent: Opt-out of marketing communications at any time.

To exercise your rights, contact us at [email protected]. We will respond within 30 days.

8. Cookies and tracking technologies

We use cookies and similar technologies. Essential cookies are needed for the website to work and require no consent. Analytics and marketing cookies are used only with your consent given in the cookie bar, separately for each type.

Types of cookies we use:

• Essential cookies: Necessary for website functionality.
• Analytics cookies: Help us understand how the website is used.
• Marketing cookies: Enable personalized ads and promotions.

You can change or withdraw your consent at any time on the About cookies page, which also lists every cookie we use.

9. Security of your information

We implement appropriate technical and organizational measures to safeguard your personal data from unauthorized access, alteration, or loss. These include:

• Encrypted data transmission (SSL/TLS)
• Secure payment processing systems
• Restricted access to sensitive information

While we strive to protect your data, no system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

10. International transfers

If your data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards, such as:

• Contracts incorporating standard data protection clauses.
• Transfer to countries recognized as providing adequate data protection by the EU.

11. Third-party links

Our platform may contain links to third-party websites. We are not responsible for their privacy practices, and we encourage you to review their policies.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page, and we will notify you if significant updates occur.

Effective date: 1 March 2025

13. Contact us

If you have any questions, concerns, or requests about this Privacy Policy or your personal data, please contact us:

SETTOUR Slovakia spol. s r. o.

Address: Lazaretská 29, 811 09 Bratislava, Slovakia

E-mail: [email protected]

Phone: +421 2 5292 7917

ID-VAT: SK2020057314

14. List of authorized subprocessors

List of authorized subprocessors used by the data processor for the purposes of the DPA, the standard contractual clauses and applicable data protection laws.

• Faustagency s.r.o., Hraničná 30, 821 05 Bratislava-Ružinov, Slovakia
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland
• Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04 X2K5, Ireland
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (form protection, Cloudflare Turnstile)