Effective date: January 1, 2026
1. General Provisions
This Privacy Policy describes how the BusEx.pro platform (hereinafter — the "Platform"), owned and operated by FOP "BusEx" (hereinafter — the "Operator"), collects, uses, stores, and protects the personal data of its users. By using the Platform, you confirm your agreement with the terms of this Policy.
The Operator is committed to complying with the requirements of the Law of Ukraine "On Personal Data Protection" dated June 1, 2010 No. 2297-VI, Regulation (EU) 2016/679 (GDPR) insofar as it applies to processing data of EU citizens, and other applicable regulations.
2. What Data We Collect
In the course of using the Platform, we may collect the following categories of personal data:
- Identification data: first name, last name, date of birth, gender — required for ticket processing and passenger identification at boarding.
- Contact data: email address, phone number — for booking confirmations, ticket delivery, and support communication.
- Travel data: selected routes, dates, number of passengers, booking history — for service delivery and improving recommendations.
- Payment data: last 4 digits of the card, payment system type — solely for transaction identification. Full card details are stored by a certified payment provider (PCI DSS compliant).
- Technical data: IP address, browser type, operating system, screen resolution, interface language, cookies — to ensure service functionality and security.
- Account data: email for authorization, login history — to maintain account security.
3. Purpose of Data Processing
We process your data exclusively for the following purposes:
- Processing, confirming, and managing ticket bookings.
- Processing payments and refunds.
- Communicating about order status, schedule changes, or route cancellations.
- Providing technical support and handling user inquiries.
- Improving service quality and Platform usage analytics.
- Fulfilling legal obligations (storing fiscal documents, responding to requests from competent authorities).
- Ensuring security — fraud detection and prevention.
4. Legal Basis for Processing
Personal data processing is carried out on the following legal grounds:
- Contract performance — processing is necessary to provide booking and transportation services.
- Data subject consent — for marketing communications and analytical cookies.
- Legitimate interest — for service improvement, fraud prevention, and security.
- Legal obligation — to comply with financial document retention requirements.
5. Data Sharing with Third Parties
We may share your personal data with the following categories of recipients:
- Carriers: passenger name, contact details, and booking information — to ensure boarding and route execution.
- Payment providers: data necessary for payment processing (handled in accordance with PCI DSS standards).
- Hosting providers: technical data is stored on servers in EU data centers.
- Analytics services: anonymized data for user behavior analysis (Google Analytics or similar).
- Government authorities: in cases provided by applicable law, upon official request.
We do not sell or share personal data with third parties for marketing purposes without your explicit consent.
6. Cookies and Tracking Technologies
The Platform uses cookies and similar technologies to ensure functionality, personalize content, and perform analytics. We use the following types of cookies:
- Essential cookies: provide basic functionality (authorization, language settings, cart).
- Analytical cookies: help us understand how users interact with the Platform.
- Functional cookies: remember your preferences (recent searches, favorites).
You can manage cookie settings through your browser. Disabling essential cookies may limit Platform functionality.
7. Data Retention Periods
Personal data is retained for the period necessary to achieve the processing purposes:
- Booking and ticket data — 3 years from the date of travel.
- Financial documents — 7 years in accordance with tax legislation requirements.
- Account data — until the user deletes their account.
- Cookies and technical data — from 30 days to 12 months depending on the type.
After the retention period expires, data is destroyed or anonymized.
8. User Rights
In accordance with applicable legislation, you have the right to:
- Access — obtain information about what personal data we process.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure — request deletion of your data (subject to legitimate grounds for retention).
- Restriction of processing — request temporary suspension of data processing.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdrawal of consent — withdraw previously given consent to data processing.
To exercise these rights, contact us at privacy@busex.pro. We will process your request within 30 calendar days.
9. Data Security
We implement comprehensive technical and organizational measures to protect your data:
- Data encryption in transit (TLS/SSL) and at rest.
- Regular software updates and vulnerability monitoring.
- Access to personal data restricted on a need-to-know basis.
- Regular backups and incident recovery plan.
- Staff training on data protection.
10. Children's Data Protection
The Platform is not intended for independent use by persons under 16 years of age. We do not knowingly collect personal data from children without the consent of parents or legal guardians. If you believe we have inadvertently collected data from a minor, please contact us for its removal.
11. Changes to the Policy
The Operator reserves the right to modify this Privacy Policy. In case of significant changes, we will notify you through the Platform or via email. We recommend periodically reviewing this page to familiarize yourself with the current version.
12. Contact Information
For questions regarding personal data processing, you can contact us:
- Email: privacy@busex.pro
- Postal address: Kyiv, Ukraine
- Hotline: +380 (XX) XXXX-XXXX