Privacy policy

This Privacy Policy explains how Simple Travel (Simple Travel LLC) collects your personal data, what we use it for, how long we keep it and how we protect it.

We operate in accordance with Mongolia’s Law on the Protection of Personal Data and other applicable legislation.

By using the Platform you agree to your data being processed as described here. You can withdraw that agreement at any time (section 12).

The controller of your personal data is Simple Travel LLC (registration number 123456, Suite 804, Block A, Union Building, UNESCO Street, Narny Zam-62, 1st Khoroo, Sukhbaatar District, Ulaanbaatar, Mongolia).

Any question or request about personal data can be sent to info@simpletravel.mn or raised by telephone on +976 8010 0906.

Account data: your name, email address, telephone number, an encrypted form of your password, and a profile picture if you upload one.

Booking data: each traveller’s name, date of birth, passport number and expiry, nationality, emergency contact details, and your booking history.

Payment data: the payment method used, the transaction reference, the amount and its status. We do NOT store full card numbers or CVV codes — those are handled only by the licensed payment providers, in their own environment.

Sensitive data: health conditions, reduced mobility and food allergies are processed only with your explicit consent, and only so far as a particular trip requires it.

Technical data: IP address, browser type, basic device information, your chosen language, and server logs — needed to run the Platform and keep it secure.

Correspondence: what you send us by email, telephone or web form, together with any review or rating you post.

Most of it comes from you: when you create an account, place a booking, or contact us.

Some is generated automatically (technical data and server logs), and payment providers send us confirmation of a transaction’s status.

If you book on behalf of other travellers, it is your responsibility to have their permission and to have shown them this policy.

To perform our contract with you: registering and confirming bookings, arranging flights, accommodation and transport, sending trip information, taking payment and issuing refunds.

To meet legal obligations: accounting and tax reporting, anti-money-laundering requirements, and lawful requests from competent authorities.

For our legitimate interests: keeping the Platform secure, detecting fraud, improving our services, handling complaints, and defending legal claims.

With your consent: marketing messages, push notifications, and the processing of sensitive data. You can withdraw any of these at any time.

To the extent a trip requires it: airlines, hotels, local ground operators, transport companies, guides, insurers and visa-processing agents.

Payment providers: QPay, the Golomt card gateway, and our bank in the case of transfers. They receive the amount and reference needed to process the transaction.

Technology suppliers: hosting, database, file storage and email delivery, plus Google’s Firebase Cloud Messaging for push notifications where you have opted in.

Professional advisers — auditors, lawyers and accountants — only so far as their work requires.

Public authorities, where the law requires it.

We do NOT sell your personal data, and we do not pass it to third parties for advertising.

Arranging a trip abroad unavoidably means sending traveller names and passport details to airlines, hotels and consular authorities in the destination country.

Some of our technology suppliers host data outside Mongolia. Where that happens we require contractual confidentiality safeguards and send no more than is necessary.

We use the cookies the Platform needs to work: keeping you signed in, remembering where to return you after login, and holding your language choice.

At present the Platform carries no third-party analytics or advertising trackers.

Trip locations are shown through a Google Maps embed, so viewing them may let Google set its own cookies. That is governed by Google’s privacy policy.

You can restrict or delete cookies in your browser settings, but blocking the essential ones will stop core functions such as signing in and booking from working.

We send news of new trips and offers only if you have opted in. Service messages — booking confirmations, payment notices, changes to your trip — are not marketing and are sent regardless.

Push notifications arrive only after you accept the browser permission prompt, and can be turned off again in your browser or account settings at any time.

Every marketing email carries an unsubscribe link.

Account data is kept while your account is active and for one year after it is closed.

Booking and payment records are kept for the period required by accounting and tax law — generally ten years.

Sensitive data is deleted as soon as the trip is over or the purpose has been served.

Marketing consent is kept until you withdraw it; server logs are kept for twelve months.

Data travels over encrypted connections (HTTPS), and passwords are stored in a form that cannot be reversed.

Access is limited to what a person’s role requires and is logged. Our staff are bound by confidentiality obligations.

No transmission over the internet can be guaranteed completely secure, so please choose a strong password and keep it to yourself.

You have the right to know what data we hold about you, to see it, and to obtain a copy.

You may have inaccurate or incomplete data corrected. Most account details you can edit yourself in your profile settings.

You may withdraw a consent you have given. Doing so does not affect processing that took place before the withdrawal.

You may ask us to delete your data or to restrict how we process it. We cannot delete what a legal obligation (tax and accounting records, for instance) or a live contract requires us to keep, and we will explain when that is the case.

To exercise any of these, write to info@simpletravel.mn. We respond within 14 working days, and may ask you to verify your identity first.

If our response does not satisfy you, you may complain to the National Human Rights Commission of Mongolia or another competent authority.

The Platform is not directed at people under 18, and we do not collect data directly from children.

On a family trip a parent or guardian provides a child’s name and date of birth as part of the booking, and we use it only to arrange that trip.

If personal data is lost or accessed without authorisation, we will contain the incident immediately and investigate.

Where a breach poses a risk to you, we will notify the people affected and the competent authority within the time the law allows.

We may update this policy from time to time. The current version is always on this page, with the “last updated” date above.

If the purposes or scope of our processing change materially, we will tell registered users by email in advance.

Questions, requests and complaints about this policy: Simple Travel LLC, Suite 804, Block A, Union Building, UNESCO Street, Narny Zam-62, 1st Khoroo, Sukhbaatar District, Ulaanbaatar, Mongolia. Telephone +976 8010 0906. Email info@simpletravel.mn.

The Mongolian text of this policy is the governing version; where a translation differs from it, the Mongolian prevails.