Privacy Policy

Version of November 4, 2026.

This policy explains what personal data we receive through enjoyers.org and when you book a tour, why we need it, where it is stored, who receives it and how you can control it. We follow the Law of the Republic of Kazakhstan No. 94-V of May 21, 2013 "On Personal Data and Their Protection" (the Law).

1. Who processes your data

Sole proprietor Garifulin (trade name Enjoyers Travel), owner and operator of the personal data database.
Legal address: Khaliullin St. 66, office 3, Almaty, Kazakhstan
BIN (IIN): 040303500027
Email for personal data requests: enjoyers.travel.almaty@gmail.com
Person responsible for organizing personal data processing: sole proprietor Garifulin

2. What data we receive and why

Request forms and the price calculator. Your name; the contact method you chose and the contact itself (phone number, Telegram username, WhatsApp number or email); a separate email if you entered one; your question or wishes; for the calculator: destination, group size and estimated price; the tour page the request was sent from.

Technical details the form adds to a request. The page address, the address of the site you came from (referrer), the time of sending, the language and form type, a random browser identifier (client_uuid), and Google Analytics and Yandex Metrica identifiers if analytics is on in your browser (section 7 explains when it is).

Messages and bookings. Data you give a manager in a messenger or by email to book a tour: names and contacts of participants, dates, wishes, and details needed for the contract and payment.

We use the data to:

• answer your request, calculate the price and choose a tour;
• conclude and perform the tour services contract (booking transport, accommodation, guides, entrance tickets);
• understand where requests come from and how visitors use the site.

We do not ask for health, religion or other special category data through the site. If you give such data for a tour yourself (for example, dietary restrictions), we use it only to organize that tour.

3. Legal basis: your consent

We collect and process data with your consent (Articles 7 and 8 of the Law). You give consent by ticking the consent box in a form before sending it, or by paying for services under the terms and conditions. Your consent covers the data and purposes in section 2, the transfers to third parties and abroad in section 5, and lasts until the purposes are achieved or until you withdraw it.

If you give us data of other travellers in your group, you confirm that they agree to its processing for organizing the tour.

4. Where the data is stored

In short, where the data is kept and for how long (details below and in section 6):

• main database of requests: a server in Kazakhstan, kept for 1 year;
• working copy of a request in the automation services: no longer than 14 days;
• conversations with managers: in our CRM, for as long as we need them to work with you;
• data on a booked tour: 3 years after the tour ends.

The main database of requests is on a server in Kazakhstan (hosting provider Hoster.KZ, Astana), as Article 12 of the Law requires. A request is first written to this database. After that we use working services to handle it: messengers, automation and a CRM. Some of these services and their backups are located outside Kazakhstan; section 5 lists which services and in which countries, and section 6 lists how long data is kept.

Before sending, the form saves a copy of your request in your browser storage (localStorage) and deletes it as soon as the request reaches us. If it does not reach us, the form sends it again the next time you open the site. A copy older than 30 days is sent one last time and deleted the next time you open the site. The random browser identifier is kept there until you clear the site data.

5. Who we share data with, including abroad

We do not sell personal data. We share only what is needed for the purpose:

• Hoster.KZ (Kazakhstan): the server that runs request intake and the main database;
• netcup GmbH (Germany): the n8n automation server and the CRM;
• Telegram (servers outside Kazakhstan): notifying managers about a new request;
• SendPulse (servers outside Kazakhstan): conversations with managers in messengers;
• Cloudflare (USA): site hosting, protection and delivery of traffic, storage of encrypted backups;
• Google (USA): Google Analytics and Google Tag Manager, when analytics is on (section 7);
• Yandex (Russia): Yandex Metrica, when analytics is on (section 7);
• carriers, hotels, guides, tour operators, parks and museums: as far as your tour requires.

Transfers to Germany, the USA, Russia and other countries are cross-border transfers (Article 16 of the Law). We make them with the consent you give in the form on the site. This does not apply to the analytics data described in section 7: it contains no names, IIN, facial images or biometric data and is not personal data under the Law.

6. How long we keep data

• requests from the site in the main database: 1 year from the request date, then deleted automatically; data on booked tours is kept longer, for the period in the next item;
• data on booked tours: 3 years after the tour ends, for accounting, tax and claims purposes;
• conversations with managers in the CRM: for as long as we need them to answer your questions and organize tours, then deleted;
• analytics data: per the settings of Google Analytics (14 months) and Yandex Metrica.

When the purpose is achieved or you withdraw consent, we delete or anonymize the data unless the law requires us to keep it longer.

7. Cookies and analytics

The site uses essential cookies and browser storage entries: your choice in the cookie banner, the browser identifier and the queue of unsent requests.

For visit statistics the site uses Google Analytics, Google Tag Manager and Yandex Metrica. They store a random identifier in your browser and receive information about the visit: pages opened, the site you came from, device and browser type, IP address, clicks and scrolling, and clicks on links to messengers and social networks. What you type into forms (name, contact, questions) is not sent to analytics: forms are hidden in Yandex Metrica session recordings.

On the English version, analytics loads only after you click "Accept" in the banner. On the Russian version analytics turns on at the first visit. Your choice is shared by both versions: if you choose "Only essential" here, analytics stays off on the Russian version too; if you open the Russian version before making a choice here, analytics turns on in both.

You can turn analytics off at any time: block cookies for enjoyers.org in your browser settings or use a tracker blocker.

8. Your rights and how to use them

Article 24 of the Law gives you rights over the data we hold about you. You may:

• know which of your data we hold, who else holds it, and receive it;
• ask us to correct or complete your data;
• ask us to block, delete or anonymize data collected or processed in breach of the law;
• withdraw consent to processing, transfer to third parties and cross-border transfer;
• appeal against our actions to the authorized personal data protection body or a court.

To use a right, write to enjoyers.travel.almaty@gmail.com from the email or messenger you gave in your request, or name that contact in your message. We reply within the time limit set by law. After you withdraw consent, we stop processing within 15 working days, unless the law requires us to keep the data or a contract with you is not yet performed (Article 8 of the Law).

9. How we protect data

Only staff who handle requests have access to requests and the CRM. The server is behind a firewall, administrators log in through a protected network, and backups are encrypted. If we detect a leak or another personal data security breach, we will notify the authorized body within one working day (Article 25 of the Law) and inform the affected people.

10. Changes to this policy

We update the policy when the data we collect, the services we use or the storage location change. The current version is always published on this page, with the version date at the top.