OKS Tours App Privacy Policy

This policy explains what the OKS Tours mobile app for iOS and Android collects, why, who we share it with, how long we keep it and how you can control it.

In short

We take only what we need for tickets, your account and support.
We don't keep passport photos used for auto-fill: we read them on our own server and delete them straight away.
You enter card details on the page of the OCTO payment service — they never reach us.
The app has no ads, third-party analytics or tracking.
Our server with your data is in Germany (European Union) — see section 8.
You can delete your account in the app or at okstours.com/en/account/delete.

1. Who we are

The personal data operator is OKS TOURS Limited Liability Company (TIN 310326925). Registered address: Republic of Karakalpakstan, Nukus, Hawa Joly makhalla, A. Dosnazarov St., 141/2 ("we", "us").

This policy follows the Law of the Republic of Uzbekistan "On Personal Data" No. ZRU-547 of 2 July 2019 (the "Law") and covers the app only. The okstours.com website has its own policy: okstours.com/en/privacy.

Questions about your data: support@okstours.com or the support chat in the app.

2. What we receive

Account. First name, last name, email and password. If you sign in with Google or Apple, they give us your name, email and the ID of your account with them. We never get your Google or Apple password. If you chose to hide your email with Apple, we get a relay address instead. To sign in with a password, you confirm your email through a one-time link we send — it works for 24 hours. For partner travel agents, the account also holds the agency name and phone number.

Booking details. You need an account to book. For each passenger: category (adult, child, infant), last and first name in Latin letters, gender, date of birth, citizenship, document type, number and expiry date; if you scanned a passport, also the country that issued it. For contact about the order: email and phone. Without these, the airline can't issue a ticket.

Saved passengers. A passenger is saved to your account only if you choose so: by ticking the option to save them for future trips when booking, or by adding them in your account on okstours.com. Next time, their details fill in by themselves. You can delete a saved passenger on the booking screen or in your account on the website. Passengers used to be saved automatically when booking; those entries stay until you delete them.

Passport photo for auto-fill. If you tap "Scan passport", the app — with your permission — opens the camera or takes the photo you pick and sends it to our server. There an antivirus checks it, and recognition software (Tesseract) reads the document data. The photo exists only in server memory and in a temporary file while it's being read, then it's deleted. We don't keep it or share it with anyone. The recognised details go into the form — check them before booking. You can turn off camera and photo access in your device settings.

Orders and payment. Route, dates, fare, booking reference and airline booking references, tickets, amount, currency and payment status. You enter the card number, expiry date and CVV on the page of the OCTO payment service (octo.uz) — they never reach us. From OCTO we receive and keep the payment ID, its status, the amount, the masked card number, the card type (such as Visa or Uzcard), the bank transaction number (RRN) and the payment date. We don't store the PDF ticket: each time you open it, we fetch it from the booking system, and after ticketing it's emailed to you once.

Support chat. Your messages. If you write without an account, also a name and one contact, if you give them. If you wrote to the chat without an account and then sign in on the same device, the guest conversation is linked to your account — if the account doesn't have a conversation of its own yet.

Notifications. If you allow notifications, the app sends us the device's push token and the app language. We link the token to your account, or without an account to the guest chat, to tell you about bookings, payments and support replies. After you sign out, the token is no longer linked to your account. If you turn notifications off in device settings, the token is deleted from our server the next time you open the app.

Location. If you allow location access, the app finds your approximate location to suggest the nearest departure airport. The coordinates are used on the device only — they're not sent to us or stored. You can turn access off in device settings.

Technical data. Like any web server, ours receives your device's IP address, the app language and standard request details: the app and operating system version (user agent).

From the IP address we work out your approximate city to suggest the nearest airport, using the DB-IP database installed on our server (IP Geolocation by DB-IP, db-ip.com). The address itself isn't sent to DB-IP.
At payment, the IP address sets the currency: from a network in Uzbekistan — Uzbek soum, from other countries — US dollars. The IP address isn't stored with the payment.
The IP address is stored only in the request log — see section 8.
The app has no crash-reporting tools of its own. We can get crash reports only through the App Store and Google Play — if you allowed your device to share diagnostics with developers.

3. What we don't collect

device coordinates — they stay on the device;
contacts, calendar, photos and files — except the passport photo you pick yourself;
advertising identifiers.

The app has no third-party analytics, advertising or tracking tools.

4. What stays on your device

Sign-in keys, the account ID and the guest chat key — in the system's secure storage (Keychain on iOS, Keystore on Android). Sign-in keys are valid for 30 days. When you sign out, the app deletes them from the device. Lost your phone or noticed someone else signed in? Write to support@okstours.com.
The app language, the selected country and a note that the welcome screen has been shown.
A temporary cache of up to 24 hours: flight searches, reference data and the approximate city from your IP — without passenger, order, payment or chat data.
The PDF ticket, if you opened it — in the app's temporary folder until the system clears the cache or you delete the app.

5. Why we use data, and on what basis

The bases come from Article 18 of the Law.

Booking and issuing tickets, contacting you about the order, refunds and changes — performance of the contract (the public offer).
Payment and payment records — performance of the contract and legal requirements.
Your account — performance of the contract (the Terms of Use). Saved passengers — your consent: you decide to save them.
Replies in the support chat — your request (consent) and, if it's about an order, performance of the contract.
Push notifications — the consent you give in the system prompt.
Passport-photo auto-fill and the nearest airport by location — your consent: you start the feature and grant access.
Protecting the service and preventing fraud (request log, request rate limits) — our legitimate interests.
Accounting and tax records, answering lawful requests from public authorities — legal requirements.
Transfers abroad — see section 7.

Automated decisions. The system picks the payment currency automatically from your IP address; you see the amount and currency before paying and can decline. We make no other automated decisions that have legal effects for you.

We don't sell personal data and don't show ads in the app. If you receive our promotional emails, you can unsubscribe through the link in any of them — order and ticket emails will keep coming.

6. Who we share data with

Each recipient gets only what its task needs.

The ETS flight booking system (new.etm-system.com) and airlines — to book and issue tickets: last and first names, gender, dates of birth, citizenship, document details, phone and email of the passengers and the buyer. If a flight is booked through another booking system, it receives the same data.
The OCTO payment service (octo.uz) — to process payments and refunds: the buyer's phone and email, the amount, currency, language and order description (for example, "OKS Tours - flight ‹booking reference›, booking ‹order number›").
Eskiz (eskiz.uz) — to send SMS: the phone number and message text (the ticket with the booking reference and route, payment confirmation).
Jino (jino.ru) — to send email: email address, name, links and the PDF ticket.
Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) — to deliver push notifications: the device token and the notification text.
netcup GmbH (Germany) — our hosting provider: our service runs, and the data is stored, on its server (see section 8).
Public authorities — only on a lawful request.

When you sign in with Google or Apple, they send us a sign-in confirmation; we send them nothing.

The app fetches exchange rates directly from the open service open.er-api.com. None of your data is sent to it — only the request itself, which, like any internet request, shows your device's IP address.

Payment opens on the OCTO page in an in-app browser. After you pay, a page of okstours.com opens there — the website's policy and cookie settings apply to it.

Contact buttons (phone, email, WhatsApp, Telegram, Instagram) open third-party apps, which have their own rules.

Contractors who process data on our behalf (the hosting provider and the email and SMS services) get only what their task needs and are required by law to keep the data confidential and protect it. Once airlines, the booking system and the payment service receive data, they are also responsible for it under their own rules.

7. Transfers outside Uzbekistan

Some data goes abroad:

our server, which receives and stores the app's data, is in Germany (section 8);
for an international flight, the booking system and airlines in the countries of departure, destination and transit receive passenger data — including countries that are not on the List of foreign states providing adequate protection of personal data. Without this, a ticket can't be issued;
push notifications are delivered by Google and Apple, companies based in the USA;
emails are sent through Jino, a Russian service.

We transfer data abroad under Article 15 of the Law. Transfers to countries on the List of foreign states providing adequate protection of personal data (Cabinet of Ministers Resolution No. 415 of 29 July 2026) need no separate consent. The List includes, for example, Germany and Russia, and the USA only for companies that take part in the EU-U.S. Data Privacy Framework (Google is one of them). We transfer data to other countries with your consent. You give this consent when you accept the public offer while booking (for passenger data) and when you allow notifications (for the device token). Without transferring data abroad, a ticket for an international flight can't be issued.

8. Where and how long we keep data

Where. Our server with the database is in Germany (European Union), with the hosting provider netcup GmbH. Germany is on the List of foreign states providing adequate protection of personal data (Cabinet of Ministers Resolution No. 415 of 29 July 2026), so Article 27¹ of the Law allows us to keep the data we receive through the app there. The law requires only biometric and genetic data and telecom operators' records about their subscribers to be kept in Uzbekistan — we don't store such data from the app.

How long.

Account — as long as it exists.
Saved passengers — until you delete them or your account.
Orders and payments — as long as the account exists. After the account is deleted, order and payment records are kept without your name, contacts or passport details for as long as accounting law requires: at least five years after the end of the reporting year they belong to (Article 29 of the Law "On Accounting" No. ZRU-404).
Passport photo for auto-fill — not stored: deleted right after recognition.
Support conversation — deleted a year after the last message, or together with your account. A guest conversation is deleted together with the name and contact.
Push token — while notifications are on. Deleted if you turn them off, and together with your account.
Request log (IP address, user agent, request address, account ID) — 90 days, then deleted automatically. What you type (passenger details, messages, passwords) is not written to the log.
PDF ticket — not stored on our server.
Backups — deleted data may stay for a while in server backups, until those backups are deleted or overwritten.

9. How we protect data

The connection between the app and our server is encrypted (HTTPS).
We store passwords only as a BCrypt hash — not even we know your password.
Passengers' passport details in orders and in saved passengers are stored encrypted.
A password reset link works for one hour and only once. If there's no account with the email you entered, we send nothing and don't say whether such an account exists.
In our server log, records of ticket bookings contain no names, document numbers or contacts, and in records of sent SMS only the last two digits of the phone number are visible.
Staff may use data only for their work and must not disclose it (Article 12 of the Law).

10. Your rights

Under Articles 11, 22 and 30 of the Law, you can:

find out whether we hold your data, which data, where it came from, why and how we process it, who we share it with (including abroad) and how long we keep it;
correct or complete your data — we do this no later than three days after your request (Article 11 of the Law);
ask us to pause processing if the data is incomplete, out of date, inaccurate, unlawfully obtained or no longer needed for its purpose;
withdraw your consent — the same way you gave it, or in writing (Article 21 of the Law), for example by writing to support@okstours.com. This doesn't affect processing needed for orders already placed or required by law;
delete your account — see section 11;
complain to the authorised state body for personal data or go to court.

How to contact us:

the support chat in the app;
support@okstours.com — ideally from your account email;
a letter to our registered address (section 1).

So that we don't hand your data to someone else, we may ask you to confirm that the request is yours. If we refuse to provide information, we'll send you a written notice of refusal within 10 days (Article 22 of the Law). You can appeal a refusal to the authorised body or a court.

11. Deleting your account

In the app: Profile → "Delete account" → confirm. The support chat opens with a ready request — send it. We'll delete the account and reply within 15 days.

Without the app: at okstours.com/en/account/delete — through a link we email you.

That page explains in detail what's deleted at once and what's kept, and for how long. In short: your profile, saved passengers, support conversation, notification devices and logs are deleted; unpaid bookings are cancelled; order and payment records are kept without your name, contacts or passport details for as long as the law requires. You can't delete your account while a paid trip hasn't finished.

12. Children

Only people aged 18 or over can create an account. Children's details are entered by a parent or another legal representative when booking. If you book a ticket for a child but aren't their legal representative, you confirm that you have the legal representative's consent.

14. Changes

We may update this policy. The current version is in the app (Profile → Privacy Policy) and at okstours.com/en/app/privacy; the date is at the top. If we want to use data for a new purpose, we'll ask for your consent first (Article 19 of the Law).

The policy is written in Russian. If a translation differs from the Russian text, the Russian text prevails.

15. Contacts

support@okstours.com — personal data questions;
the support chat in the app;
OKS TOURS LLC, TIN 310326925, Republic of Karakalpakstan, Nukus, Hawa Joly makhalla, A. Dosnazarov St., 141/2.

Questions about this document: support@okstours.com