1. Who is responsible
Data controller: limited liability company “________”; country: ________; registration number: ________; address: ________. Identity and legal form must be completed before final publication. Data protection and rights contact: support@reisno.com. EU representative and data protection officer, where appointment is required: ________. This policy covers visitors, company representatives, contact persons and individuals named in submitted documents.
2. Data and sources
You and company representatives provide names, work contacts, company details and country, profiles, listings, reviews, requests and verification files. Authentication uses a password hash and server sessions. Acceptance records contain representative and company details, time, language, version and copies of the terms. Servers process network and technical data needed to deliver requests and protect the service and record supported actions and contact access. Do not submit unnecessary identity, medical, payment or other sensitive information; redact details not needed for verification. Anyone supplying another person’s data needs a lawful basis; the operator’s own information duties remain applicable.
3. Purposes and legal bases
Registration, authentication, requested functions and support are needed to perform a contract with the individual or take steps at their request. Where the contract is with a legal entity, staff contact data relies on the legitimate interest in business communication, subject to balancing individual rights. Company checks, abuse prevention, access security and evidence of legally significant actions rely on legitimate interests and, where applicable, legal obligations. Mandatory tax and other statutory records rely on legal obligations. Optional Google Analytics relies on separate consent. Consent is not treated as a universal basis for every operation.
4. Visibility and recipients
Visitors and search engines may see listings and approved public fields. Contacts and protected information are disclosed according to access permissions; recipients are responsible for subsequent processing for their own purposes. Verification files are available to authorised operator personnel for review and protection, not to other participants. Hosting, backup, email and security providers may process necessary data under appropriate contracts. Authorities, advisers and courts receive data only where lawfully necessary. Data is not sold as contact lists.
5. Providers and international transfers
The optional integration uses Google Analytics (Google Ireland Limited / Google LLC as specified in the service terms). The email module supports SendPulse SMTP; actual use depends on configuration. The register of active hosting, backup and email providers, processing countries and periods is to be completed: ________. It must be completed before final publication. International transfers require an appropriate basis such as an applicable adequacy decision or contractual and supplementary safeguards supported by a risk assessment. A recipient’s eligibility for a transfer mechanism is checked before use. Request a copy or description of applicable safeguards through support.
6. Statistics without optional cookies
For internal service management, we calculate aggregate registrations, publications and contact reveals from records already generated when providing the service. The report is restricted to administrators, is not sent to Google and uses no additional visitor identifier, fingerprinting or hidden device tracking. Source records may still be personal data processed on the bases described above; aggregation does not remove their protection. Objections to legitimate-interest processing are assessed individually. The report does not measure unique visitors, advertising attribution or completed transport contracts.
7. Google Analytics and choice
Google Analytics loads only after permission to measure views and permitted events. We send a sanitised page path, language, company or listing type and action type; our event parameters exclude names, email addresses, phones, content and files. Google also receives technical request data and cookie identifiers, so this analytics is not described as fully anonymous. Advertising signals and personalisation are disabled in the integration. Decline or withdraw via Cookies. Withdrawal stops future collection; requests about previously transmitted data are handled separately. Registration and core features remain available without permission.
8. Retention and deletion
Account data is kept while necessary for the active account and service. On closure requests we verify identity and delete or anonymise unnecessary data; records needed for a legal duty or specific dispute are access-restricted until the applicable period ends. Retention periods for verification files, logs, acceptance evidence and backups must be approved in the retention register: ________. Automatic cleanup of these categories is not implemented in the current version; this draft does not promise an operational deletion schedule. Login sessions last up to 7 days and the analytics preference up to 180 days. The Google Analytics data-retention setting must be verified and stated before final publication: ________.
9. Your rights
Depending on applicable law, you may request information and access, correction, erasure or restriction, a portable copy, object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. Email support@reisno.com with your request and reply contact, never your password. Proportionate identity verification may be needed. We respond within applicable statutory periods; under GDPR generally within one month, with notice of any permitted extension. You may complain to the Ukrainian Parliament Commissioner for Human Rights or a competent EEA data protection authority. Contacting us first is not a prerequisite.
10. Security, required data and changes
We use access restrictions, password hashing, private document storage and session protection; no system guarantees absolute security. Missing data objectively necessary for registration, verification or a requested feature may prevent that feature. Optional analytics is not such a requirement. The service is not directed at children. Decisions with legal or similarly significant effects are not based solely on automated advertising profiling. Material changes are notified and new purposes requiring consent are subject to a separate request.