Last updated: April 2026

Privacy Policy.

How we handle your data — pursuant to GDPR.

1. Data Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Shadmon Kubanychbekov
Арча Бешик Арашан 47
Kyrgyzstan

Email: [email protected]
Phone: +996 702 555 014
Website: https://www.gotokirgistan.com

2. General Information on Data Processing

2.1 Scope of Processing

We only process personal data of our users where this is necessary to provide a functional website and our content and services (e.g. travel bookings, tours, visa support).

2.2 Legal Basis for Processing

2.3 Place of Processing and Transfer to Third Countries

The hosting of the website and the storage of booking and contact data takes place on servers within the European Union (EU) or the European Economic Area (EEA).

However, some of the third-party services we use (in particular Cloudflare, Google Analytics, and Formspree – see Section 7) may involve transfers of personal data to the United States. For the United States, there is currently an adequacy decision by the European Commission based on the EU-U.S. Data Privacy Framework (DPF). Where a provider is certified under the DPF, the level of data protection is deemed adequate within the meaning of Art. 45 GDPR. Where this is not the case, the transfer is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR or your explicit consent pursuant to Art. 49(1)(a) GDPR.

2.4 Data Erasure and Storage Duration

Personal data will be erased once the purpose for which it was stored ceases to apply or when statutory retention periods expire.

3. Hosting

Our website is hosted by a service provider with servers located within the European Union. The hosting provider processes the data on our behalf, on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Legal basis: Art. 6(1)(f) GDPR.

4. Provision of the Website and Creation of Log Files

Each time our website is accessed, the following data is automatically collected:

Legal basis: Art. 6(1)(f) GDPR.
Storage period: typically a maximum of 30 days.

5. Contact and Booking Inquiries

5.1 Contact via Email or Phone

Your details (name, contact data, content of the inquiry) will be stored to process your request.
Legal basis: Art. 6(1)(b) or Art. 6(1)(f) GDPR.

5.2 Booking and Travel Inquiries

For booking inquiries we collect the following data:

This data is used for contract execution and the organization of the booked services and may be passed on to local service providers (hotels, guides, transport companies, authorities for visa processing) where necessary for the performance of the contract. Transfers to local service providers in Kyrgyzstan are based on Art. 49(1)(b) GDPR (necessity for contract performance).

The technical transmission of the submitted form is handled via the service Formspree (see Section 7.3).

Legal basis: Art. 6(1)(b) GDPR.
Storage period: Until full execution of the contract; beyond that, only insofar as statutory retention obligations apply.

6. Cookies

Our website uses cookies. Cookies are small text files stored in the user's browser.

6.1 Strictly Necessary Cookies

We use technically necessary cookies to ensure the functionality of the website (e.g. Cloudflare's security cookie __cf_bm).
Legal basis: Art. 6(1)(f) GDPR or Section 25(2) TTDSG.

6.2 Optional Cookies (Analytics, Marketing)

Optional cookies — in particular Google Analytics cookies — are only set with your explicit consent (Art. 6(1)(a) GDPR, Section 25(1) TTDSG). You can revoke your consent at any time via our cookie banner.

7. Third-Party Services Used

7.1 Cloudflare (CDN, Security, Performance)

We use the service Cloudflare, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (represented in the EU by Cloudflare Germany GmbH).

Cloudflare is used as a Content Delivery Network (CDN), for protection against attacks (e.g. DDoS), and to improve loading speed. To this end, all data traffic between your browser and our website is routed via Cloudflare's servers. Cloudflare processes, in particular, your IP address, log data, and information about website activity. Cloudflare may also set the technically necessary cookie __cf_bm for bot detection.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and performant website).
Transfer to the USA: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. In addition, Standard Contractual Clauses under Art. 46 GDPR are in place.
More information: cloudflare.com/privacypolicy

7.2 Google Analytics

We use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies to analyze the use of our website.

Processed data includes your (shortened) IP address, device information, browser information, pages visited, interactions, and approximate location data. We have activated IP anonymization, so your IP address is shortened by Google within the EU/EEA before being transferred to the United States.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TTDSG (consent via cookie banner). You can revoke your consent at any time with effect for the future.
Transfer to the USA: Google LLC is certified under the EU-U.S. Data Privacy Framework.
Storage period: maximum 14 months.
Opt-out: You can additionally prevent the collection by Google Analytics via the browser add-on at tools.google.com/dlpage/gaoptout.
More information: policies.google.com/privacy

7.3 Formspree (Form Processing)

To process inquiries submitted via our contact and booking forms, we use the service Formspree, provided by Formspree, Inc., 251 Little Falls Drive, Wilmington, DE 19808, USA.

When you submit a form on our website, the data entered into the form (e.g. name, email address, phone number, message, booking details) is transmitted to Formspree, processed there, and forwarded to our email address. Formspree acts as a data processor within the meaning of Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (contract performance / pre-contractual measures) or Art. 6(1)(f) GDPR (efficient handling of inquiries).
Transfer to the USA: The transfer is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR offered by Formspree, and — where applicable — on the EU-U.S. Data Privacy Framework.
More information: formspree.io/legal/privacy-policy

7.4 Google Maps (where embedded)

Where Google Maps (Google Ireland Ltd., Ireland) is embedded on the website, the Google privacy policy applies: policies.google.com/privacy

7.5 Other

8. Your Rights as a Data Subject

You have the following rights regarding your personal data:

To exercise your rights, an informal message is sufficient: [email protected]

9. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority — in particular the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

10. Data Security

We use SSL/TLS encryption in transit. You can identify an encrypted connection by the "https://" and the lock symbol in your browser's address bar.

11. Validity and Changes to this Privacy Policy

This privacy policy was last updated in April 2026. Due to the further development of our website or changes in legal requirements, amendments may become necessary. The current version is available at https://www.gotokirgistan.com/en/privacy.