PRIVACY POLICY

1. General Information

1.1. “Gezoba Discovery” MMC (hereinafter referred to as “Gezoba”) obtains and processes personal data of persons who access or use the Gezoba website, mobile application and related services, create an account, make a booking or are included as guests in a booking (hereinafter collectively referred to as “Users”). This Privacy Policy (hereinafter referred to as the “Policy”) sets out the categories of personal data processed by Gezoba, the purposes and principles of processing, transmission of personal data, Users’ rights and other matters relating to personal data protection.

1.2. “Personal data” means any information that directly or indirectly identifies an individual.

1.3. “Processing of personal data” means any operation performed in relation to personal data, including collection, recording, systematization, updating, alteration, use, storage, transmission, disclosure, anonymization, blocking, deletion and destruction.

1.4. For the purposes of the Law of the Republic of Azerbaijan “On Personal Data”, Gezoba is the owner of the personal data information resources and information systems used by it and, where it directly carries out processing operations, the operator of such personal data.

1.5. Users may exercise their rights concerning personal data, including requesting information, access, correction, suspension of processing, deletion or destruction, in accordance with the legislation of the Republic of Azerbaijan.

2. About Gezoba

2.1. Gezoba operates an online intermediary platform through which Users may search for, compare and book hotel accommodation and other travel-related services made available by independent third-party suppliers (“Suppliers”).

2.2. The Platform includes the Gezoba website, mobile application and related digital interfaces and provides functions for searching, booking, payment facilitation, booking administration and customer support.

2.3. In order to facilitate and administer a booking, Gezoba may need to process personal data of the booking User and other Guests and transmit the necessary information to Suppliers, payment service providers and other parties involved in arranging or providing the booked service.

3. Principles of Personal Data Processing and Acceptance of the Policy

3.1. Gezoba processes personal data lawfully, fairly and transparently; for specific, legitimate and predetermined purposes; only to the extent necessary for those purposes; for no longer than necessary or legally required; and with appropriate confidentiality and security.

3.2. When registering on the Platform, Users accept this Privacy Policy through electronic confirmation and consent to the collection and processing by Gezoba of the personal data necessary to register the User, provide the requested services, process and administer bookings and perform the related operations described in this Policy. Where Azerbaijani law requires a specific form or additional content of consent for a particular processing or transmission activity, Gezoba shall obtain and retain such consent in the legally required form.

3.3. Where processing is based on consent, the User may withdraw consent using the contact details in Section 12. Withdrawal does not affect processing lawfully carried out before receipt of the withdrawal. Withdrawal may prevent Gezoba from processing or administering a booking where the relevant data are necessary for that purpose.

3.4. Where a User provides personal data relating to another Guest, the User confirms that the User is authorized to provide the information, has made this Policy available to that Guest and has obtained any consent required by law. Gezoba may request evidence of such authority or consent.

3.5. Where a Guest is a minor or otherwise legally unable to provide valid consent, the required consent must be provided by the Guest’s parent, guardian or other lawful representative.

4. Purposes of Personal Data Processing

4.1. Gezoba may process personal data for the following purposes:

• creating and managing User accounts and ensuring account security;
• processing, confirming, modifying, cancelling and administering bookings;
• transmitting booking information to Suppliers and other parties involved in arranging or providing the booked service;
• processing or facilitating payments, refunds and related transactions;
• providing customer support and responding to requests, complaints and special booking requirements;
• sending service communications concerning accounts, bookings, payments, refunds, cancellations and security;
• preventing fraud, unauthorized transactions, misuse and other unlawful activity;
• maintaining and improving the security, functionality and quality of the Platform;
• preparing anonymized or aggregated statistics, research and analysis;
• maintaining accounting, tax, transaction and other legally required records;
• establishing, exercising or defending Gezoba’s legal rights; and
• complying with binding legal obligations and lawful requests from courts and competent state authorities.

4.2. Marketing and promotional communications shall be sent in accordance with applicable legislation and any required consent. Users may unsubscribe from marketing without affecting essential booking and service communications.

4.3. The User is responsible for ensuring that personal data provided to Gezoba are accurate and current. Incorrect contact, Guest or booking information may prevent communication or affect the processing or fulfilment of a booking.

5. Scope of the Privacy Policy

5.1. Gezoba may collect and process the following categories of personal data:

• Personal information – name, surname, date of birth, gender, nationality and other identification details necessary for an account or booking;
• Contact information – e-mail address, telephone number, postal address and other contact information provided by the User;
• Account information – User ID, registration date, authentication information, account preferences and account activity;
• Booking information – booked service, destination, check-in and check-out dates, room category, number and names of Guests, number and ages of children, booking reference, special requests, cancellations, modifications and booking history;
• Travel-document information – passport or other identification-document details and copies only where strictly necessary for a booking or required by law;
• Payment and transaction information – payment amount, currency, payment status, transaction reference, refund and billing information. Full card details are normally processed by authorized banks or payment service providers and are not stored by Gezoba unless Users are expressly informed otherwise;
• Correspondence with Gezoba – information contained in e-mails, customer-support requests, complaints and other communications. Calls shall be recorded only after appropriate notice and where legally permitted;
• Electronic information – IP address, device and browser type, operating system, device identifiers, application version, access dates and times, Platform activity and security logs;
• Location information – approximate location derived from an IP address and, where expressly enabled by the User, device location required for a requested Platform function; and
• Consent and preference information – records of privacy choices, marketing preferences, consent and withdrawal of consent.

5.2. Nationality, health information, family-life information, religious dietary requirements and other information included in special requests may constitute specially protected personal data. Gezoba shall process such information only where necessary and after obtaining the legally required consent or where another express legal ground applies.

6. Cookies and Electronic Technologies

6.1. Gezoba may use cookies, software development kits and similar technologies for session management, preferences, authentication, security, fraud prevention, analytics, performance measurement and Platform functionality.

6.2. Where such technologies collect personal data or legally require consent, Gezoba shall provide the relevant notice and obtain consent before activation, except for technologies that are strictly necessary for a requested function or Platform security where legally permitted.

6.3. Users may manage available choices through the Platform, browser or device settings. Restricting certain technologies may affect Platform functionality.

7. Transmission of Personal Data

7.1. Subject to applicable legal requirements and data minimization, Gezoba may transmit necessary personal data to:

• Suppliers and other parties involved in arranging or providing the booked service;
• banks, acquiring institutions, payment processors and payment gateways;
• hosting, cloud, IT, cybersecurity, communications, authentication and analytics service providers;
• lawyers, auditors, accountants and other professional advisers subject to confidentiality obligations; and
• courts, law-enforcement bodies and other competent state authorities where disclosure is required or expressly permitted by law.

7.2. Except where Azerbaijani law expressly permits transmission without consent, confidential personal data shall be transmitted to third parties only after Gezoba has obtained the data subject’s legally valid consent. Personal data transmitted to a Supplier shall be limited, where reasonably possible, to the information necessary to process, confirm, administer or fulfil the relevant booking.

7.3. Gezoba shall require service providers processing personal data on its behalf to maintain confidentiality, apply appropriate security measures, process data only for lawful and documented purposes and delete or return the data when their services end, unless retention is legally required.

8. Cross-Border Transmission

8.1. Gezoba uses hosting, cloud and other technology infrastructure located outside the Republic of Azerbaijan. Personal data collected through the Platform may be transmitted to, stored and processed on such infrastructure. Such hosting, storage and processing constitute cross-border transmission of personal data and shall be conducted in accordance with Article 14 of the Law of the Republic of Azerbaijan “On Personal Data”.

8.2. Cross-border transmission shall be carried out in accordance with Article 14 of the Law “On Personal Data”. Gezoba shall not carry out a transfer that threatens the national security of the Republic of Azerbaijan.

8.3. Where a foreign recipient does not ensure legal protection of personal data equivalent to that required by Azerbaijani law, the transfer shall be carried out on the basis of the data subject’s consent or where another express statutory exception applies. Gezoba shall take the necessary organizational and technical measures to protect personal data during transmission, storage and processing abroad and shall limit access to persons who require the data for a lawful and stated purpose.

8.4. Where the recipient country does not ensure legal protection equivalent to that required by Azerbaijani law, the transfer shall be carried out only with the data subject’s consent to the cross-border transfer or where another express statutory exception applies. Gezoba shall take the necessary measures to protect personal data during transmission.

9. Storage and Destruction of Collected Data

9.1. Gezoba stores personal data only for a limited period in connection with the use of the Platform and Gezoba’s services and only for as long as necessary to achieve the purposes for which the data were collected. Upon expiry of the applicable periods, if there is no lawful reason or requirement to retain the personal data, Gezoba shall delete or destroy the personal data in accordance with Article 9.4 of the Law of the Republic of Azerbaijan “On Personal Data”.

9.2. When the processing purpose has been achieved, the consent or applicable retention period has expired and there is no lawful basis for continued retention, Gezoba shall delete or destroy the personal data or anonymize them so that the individual can no longer be identified.

9.3. A User may request deletion or destruction using the contact details in Section 12. Certain information may continue to be retained where its retention is required or expressly permitted by law. Any retained information shall be restricted to the relevant lawful purpose.

9.4. Gezoba shall implement the organizational and technical measures required by Azerbaijani law and appropriate to the applicable protection level of its personal data information systems to prevent unauthorized or accidental access, alteration, blocking, disclosure, copying, provision, deletion, loss or destruction.

9.5. Gezoba shall ensure that its personal data information systems are registered, examined or certified where required by Azerbaijani law. Information concerning the applicable protection level and any legally required registration or conformity certificate may be requested using the contact details in Section 12.

10. Users’ Rights

10.1. Subject to the requirements and limitations of Azerbaijani law, Users have the right to:

• receive information concerning the collection and processing of their personal data;
• obtain access to their personal data and information concerning recipients;
• request correction or completion of inaccurate or incomplete personal data;
• request suspension or termination of processing, deletion or destruction where the legal grounds exist;
• withdraw consent where processing or transmission is based on consent;
• object in writing to processing carried out contrary to law or the stated purposes; and
• apply to a competent state authority or court and claim compensation where their rights have been violated.

10.2. Gezoba may request the identification information or documentation required by law to verify the requester and prevent unauthorized disclosure.

10.3. Gezoba shall normally respond to a valid request no later than 7 working days after receipt. Where reference to a third party is necessary, the period may be extended by a further 7 working days. A lawful refusal shall be explained within 5 working days. Where required by law, relevant third-party recipients shall be notified of measures taken within 3 working days.

11. Amendments

11.1. Gezoba may amend this Policy to reflect changes in legislation, Platform functionality, processing activities, technology, security requirements or business operations. The updated Policy shall be published on the Platform and shall indicate its effective or last-updated date.

11.2. Where a change introduces a new or materially changed processing activity requiring consent, Gezoba shall provide the legally required notice and obtain new or additional consent. Continued use of the Platform shall not replace consent where specific consent is required by law.

12. How to Contact Gezoba

12.1. Users may contact Gezoba for questions, complaints, withdrawals of consent or requests concerning personal data using the following details:

Legal Entity“Gezoba Discovery” MMC

TIN1507714321

Registered AddressAZ1008, Baku City, Narimanov District, 45 Aliashraf Alizade Street, Apt. 24

Websitewww.gezoba.com

E-mailinfo@gezoba.com

Telephone+994 10 265 00 66