Privacy Policy

1. Who we are and what this policy covers

One Way Group LLC ("ONE WAY TOUR", "we", "us") is a licensed tour operator registered in the Republic of Armenia. Our office is at 16 Parpetsi Street, Yerevan, Republic of Armenia.

This policy covers onewaytour.com, the OneWay Tour mobile app for Android and iOS (see section 12), customer accounts, booking and enquiry forms, our self-hosted customer-support system at chat.onewaytour.com, and conversations you start with us by email, phone, Facebook Messenger, Instagram Direct, WhatsApp, Telegram or Viber.

2. Personal data we collect

Depending on how you use our services, we may collect:

• contact details such as your name, email address and phone number;
• account details such as nationality, date of birth, gender, language and an encrypted password;
• trip details such as travel dates, destinations, pickup and drop-off addresses, participant numbers and ages, room or meal preferences, guide language and notes you send us;
• passport details of travellers (name in Latin letters, passport number, expiry, date of birth, issuing country) for insurance, hotel registration, border crossing and tax purposes, and — in the mobile app — location, photos, chat messages and a push-notification token, as described in section 12;
• booking and payment records such as order number, amount, currency, payment method, status and gateway reference; we do not store your complete bank-card number;
• the content of enquiries, support messages, reviews, feedback and files you choose to send;
• technical data such as IP address, device and browser information, referring page, pages viewed, timestamps, session identifiers and, on the website, interaction events.

Enter travellers' passport details only in the passport form of a confirmed booking, in the app or in your account on the website (see section 12). Please do not send passport, bank-card or other sensitive information in free-text forms, chats or AI search.

3. Where the data comes from

Most data comes directly from you when you create an account, submit a form, make a booking or payment, or contact us. We may also receive necessary booking details from a person organising travel for a group, from a travel partner acting on your behalf, or from the payment provider you select.

When you message our Facebook Page or Instagram Business account, Meta may provide your public profile name, username, profile picture, platform-scoped user ID, message content, attachments, delivery or read status and timestamps. We receive this only after you initiate the conversation; we do not receive your platform password, friend list or unrelated posts.

When you sign in with Google or Apple on the website or in the app, Google or Apple passes us your name, email address, whether that email address is verified and your account identifier; Google also passes your profile picture, which we use as your account avatar unless you upload your own. We do not receive your Google or Apple password or access to any other data in your Google or Apple account. You can disconnect sign-in at any time by removing OneWay Tour's access in your Google or Apple account settings, and you can ask us to delete your account and data as described in section 10 and at https://onewaytour.com/data-deletion.

4. Why we process personal data

We process personal data only for defined purposes, including to:

• answer enquiries and provide customer support;
• prepare, confirm, deliver and manage tours, transfers, hotel requests and related travel services;
• create and manage your account and saved preferences;
• process payments, refunds and financial reconciliation;
• prevent fraud, abuse and security incidents;
• measure and improve website performance, search and customer experience;
• keep travellers safe on the tour day, including the bus location and SOS alerts in the mobile app;
• comply with accounting, tax (including the tax treatment of services provided to foreign visitors), hotel registration, border and other legal obligations and handle legal claims.

Processing is based on the Law of the Republic of Armenia on Protection of Personal Data and other applicable law. Where the GDPR applies, our bases may include performing a contract or taking steps at your request, complying with a legal obligation, our legitimate interests in operating and securing the service and responding to enquiries, and consent where required. You may withdraw consent without affecting earlier lawful processing.

5. Cookies, analytics and online services

The website uses necessary session and security technologies. It also uses Google Tag Manager and Google Analytics, Meta Pixel and Yandex Metrica to understand visits and interactions and to measure advertising performance. These providers may receive identifiers, IP address, device and browser data, page URLs and interaction events and may set or read cookies under their own policies.

Cloudflare Turnstile may process technical signals to protect forms from automated abuse. If you use AI Tour Search, the text of your search is sent to OpenAI to interpret the request; do not enter passport, payment or other sensitive data there. You can control or delete cookies in your browser, although blocking necessary cookies may affect account, booking or security functions.

6. Payments

Online payments are completed on the secure page of the payment method or gateway you select, including supported bank-card, Telcell or MIR channels. The provider processes the payment credentials under its own privacy and security terms. We receive and retain the information needed to match the payment to your booking, such as status, amount, currency and transaction reference, but not your complete card number or security code.

7. Who receives personal data

We disclose only the information reasonably needed for the purpose to:

• hotels, transport providers, guides and other suppliers involved in the service you requested;
• payment providers and banks;
• hosting, security, communications, push-notification (Google Firebase Cloud Messaging and Apple Push Notification service, via our push delivery provider), analytics and IT-service providers acting for us;
• the insurance company that insures tour participants (travellers' names and passport details); passport details are otherwise given only to the hotel where you stay overnight and to border and tax authorities when required;
• professional advisers and auditors where necessary;
• public authorities or courts where disclosure is required by law.

Some technology providers may process data outside Armenia. Their location and safeguards depend on the provider and service. We do not sell personal data or give conversation data received from Meta to third parties for their own marketing.

8. Storage and security

Bookings and operational records are stored in our access-controlled systems. Messages from supported channels may be stored in our self-hosted Chatwoot customer-support system; chats with your guide in the mobile app are stored in our booking system. Passport details are stored encrypted. We use encrypted connections, role-based access, logging and backups, and limit access to authorised staff who need the data for their work.

No online system can be guaranteed completely secure. If you believe your data or account may be at risk, contact us promptly.

9. How long we keep data

• support-message history is normally kept for up to 24 months after the last message;
• account data is kept while the account is active or until a valid deletion request, subject to records we must retain;
• passport details are erased automatically 1 year after the last day of the tour, and passport or visa scans 30 days after it; the periods for app data (bus positions, chats, SOS alerts) are in section 12;
• booking, payment and accounting records are kept for the period required by Armenian law and for resolving disputes;
• security logs and analytics information are kept for operational periods or according to the applicable provider settings.

When a retention period ends, data is deleted or irreversibly anonymised unless continued retention is required by law or needed for a legal claim.

10. Your rights

Depending on the applicable law and circumstances, you may ask us to:

• confirm whether we process your personal data and provide access to it;
• correct incomplete or inaccurate data;
• delete data or stop processing it where there is no lawful reason to continue;
• restrict or object to certain processing;
• provide a portable copy where that right applies;
• withdraw consent where processing relies on consent.

Send a request from the email address or account connected with the data. We may ask for proportionate information to verify your identity. We aim to respond within 30 days; complex or legally restricted requests may require additional explanation or time. You may also contact the Personal Data Protection Agency of the Republic of Armenia. In the mobile app you can also correct your profile and delete your account yourself (Profile → Delete my account).

11. Facebook, Instagram and WhatsApp data deletion

Deleting a conversation in Facebook, Instagram or WhatsApp does not automatically remove the copy held in our support system. Send us a deletion request so we can locate and remove or anonymise the related records, except records we are legally required to retain.

12. Mobile application

This section applies to the OneWay Tour app for Android and iOS (the "app"), published by One Way Group LLC. Everything else in this policy applies to the app as well. Where this section is more specific, this section applies.

The app is used by travellers to find, book and pay for tours and to take part in them, and by our own guides and drivers ("crew") to run the tour. The app has no advertising and contains no analytics, advertising or crash-reporting tools. We do not use the app to track you across other companies' apps or websites.

12.1 What data the app collects

• Account: your e-mail address, and a password if you choose one, or the account identifier, name and e-mail address that Google or Apple passes to us when you sign in with them. The app keeps its sign-in key in the phone's secure storage.
• Profile: first and last name, e-mail address, phone number, date of birth and nationality (required), and gender and address (optional). We need these details to prepare your bookings and the documents for your tours.
• Bookings: the tour, date, number and type of travellers, the names and phone numbers of the travellers you add, hotel pickup, notes, lunch choices, private-tour and transfer requests, reviews, booking and payment status, loyalty and gift-card balances.
• Passport details of travellers: for each traveller of a booking you have made, the name as written in the passport (Latin letters), passport number, expiry date, date of birth and issuing country. We ask for them only after a booking is made, and only through the passport form in the app or in your account on the website. We use passport details only to (1) arrange travel insurance for the tour participants; (2) register guests at hotels on tours with overnight stays; (3) prepare the passenger lists needed to cross the border on tours to Georgia; (4) apply the correct tax treatment for services provided to foreign visitors under the tax legislation of the Republic of Armenia.
• Payments: the app does not ask for, see or store your bank-card details. When you pay, the app opens the secure payment page of the bank or payment service (for example ACBA Bank, MIR or Telcell). You enter your card details there, and the provider processes them under its own terms. We receive only what section 6 describes: status, amount, currency and transaction reference.
• Location of travellers: the app does not track your location. Only if you tick "share my location" when you send an SOS or help alert to your guide does the app send your position, once, together with the alert.
• Location of drivers: while the driver's own tour is in progress (from boarding to the end of the tour), the driver's phone sends the bus position about every 10 seconds, also when the app is in the background or the screen is off, so that the travellers of that tour can see where the bus is. While this happens, Android shows a permanent notification ("Sharing the bus location for today's tour") and iOS shows its location indicator. Sharing stops when the tour ends or the driver signs out. A driver may allow location only while the app is open.
• Location of guides: the app does not track a guide's position.
• Photos: photos you choose to send in the chat with your guide, from the camera or the photo library. Drivers also take photos of the vehicle check, breakdowns and fuel or expense receipts. The guide uses the camera to scan the QR code of e-tickets; that image is not stored or sent.
• Messages: your chat with the guide of your tour, messages the guide sends to the group, notes added to an SOS alert, and the crew's end-of-tour reports.
• Search: the text you type in the search and in AI search is sent to our server. AI search text is also sent to OpenAI to interpret the request, as described in section 5. Do not enter passport, payment or other sensitive data there.
• Push notifications: if you allow notifications, the app registers a push token of your device, the platform (Android or iOS) and the app language, so that we can tell you about your booking, the tour day and chat messages.
• Crew only: for our guides and drivers the app also processes their schedule, availability, earnings, cash collected from travellers, fuel and expense amounts, vehicle checks and attendance marks. These data concern staff only.
• Stored on your phone only: downloaded trip data for use without signal (e-tickets, plans, stops, photos), recently loaded screens, favourites, language and currency. Passport details you have typed but not yet sent wait on the phone until there is signal and are removed when you sign out. You can remove downloaded trip data in Profile → Offline → "Delete downloaded data", or by removing the app.

12.2 Why we use the data and on what legal basis

• creating and running your account, sign-in — performance of a contract (our terms of service);
• preparing, confirming and providing tours, transfers and related services, the tour-day card and the chat with the guide — performance of a contract;
• passport details for insurance, hotels and the border — performance of a contract, and a legal obligation where hotel registration or border rules require it;
• passport details for the tax treatment of services to foreign visitors — a legal obligation under the tax legislation of the Republic of Armenia;
• payments, refunds and accounting — performance of a contract and a legal obligation;
• the bus position for travellers of the tour — performance of a contract with travellers, our legitimate interest in running the tour safely and on time, and the driver's employment or service contract;
• your location with an SOS alert — your consent (the tick-box), and protecting your vital interests in an emergency;
• photos, chat and reports — performance of a contract, and your choice to send them;
• push notifications — your consent (the system permission), which you can withdraw in the phone's settings;
• security, preventing abuse and keeping technical logs — our legitimate interest in keeping the service secure.

The general rules in section 4 (Law of the Republic of Armenia on Protection of Personal Data, and the GDPR where it applies) apply here too.

12.3 Who receives the data

• The guide and the driver assigned to your tour see, in the passenger list, the travellers' names, the pickup, the number of travellers, booking notes, check-in marks and the amount still to pay, and the name, phone number and e-mail address of the person who made the booking, so that they can reach you on the tour day. They do not see the phone numbers of the other travellers. In the chat neither side sees the other's phone number or e-mail address. The guide sees whether a traveller's passport details are complete, but never the passport number; neither the guide nor the driver ever sees passport numbers. The guide and the driver receive your SOS alert, and your position if you chose to share it.
• Travellers of the same tour see the bus position while the tour is in progress, and the name of the guide.
• Our office staff who organise the tour, according to their role.
• Passport details are given only to the insurance company that insures the tour participants, to the hotel where you stay overnight, and to border and tax authorities when the law requires it.
• Banks and payment services — ACBA Bank (card payments through its vPOS page), and MIR or Telcell if you choose them — for the payment.
• Push notification services — Google Firebase Cloud Messaging (Android) and the Apple Push Notification service (iOS), via our push delivery provider. They receive the device token and the text of the notification.
• Google and Apple, if you choose to sign in with them.
• OpenAI, for the text of AI search (section 5).
• Hosting and storage — Amazon Web Services (AWS), which runs our servers and file storage, including photos, in Frankfurt, Germany (region eu-central-1); files are delivered through the Amazon CloudFront content delivery network.
• Public authorities or courts where disclosure is required by law.

Section 7 applies in all other respects. We do not sell personal data.

12.4 How long we keep app data

• the driver's bus positions: 7 days, then deleted automatically;
• passport details: until 1 year after the last day of the tour, then erased automatically; passport and visa scans: 30 days after the last day of the tour;
• technical records of actions sent from the app without signal: 7 days; technical request logs: 30 days;
• chat messages and chat photos, SOS alerts (including the shared location), vehicle logs and photos, and end-of-tour reports: 24 months after the tour, then deleted automatically; the chat closes for new messages 24 hours after the end of the tour, and both sides can still read it until it is deleted;
• the push token: until you request deletion of your account or the push service reports that the app was removed;
• account, booking and payment data: as described in section 9.

12.5 Your choices and rights

• You can see and correct your profile in the app (Profile → Edit) and your travellers' passport details on the booking.
• You can turn off notifications, location or camera access at any time in the phone's settings. Without location permission, SOS alerts are sent without your position.
• Deleting your account: request it in the app (Profile → "Delete my account") or on the website at https://onewaytour.com/data-deletion. The app signs you out on all devices and stops push notifications at once. We complete the deletion of your account and personal data within 30 days and confirm it by e-mail, except records we must keep by law (for example invoices and payment records).
• All the rights in section 10 apply to app data.

12.6 Children

The app, like the website, is intended for adults; we do not direct it to children under 18. A parent, guardian or group organiser who books for a child provides the child's details, including passport details where needed, and must have the authority to do so (section 13).

12.7 Security

All traffic between the app and our server uses encrypted connections (HTTPS). The sign-in key is kept in the phone's secure storage. Passport details are stored encrypted on our server; after you save them, the app shows only the last four characters of the passport number, and the full number is never sent back to the phone. Access to data in our systems is limited by role. Section 8 applies as well.

12.8 Contact

One Way Group LLC, 16 Parpetsi Street, Yerevan, Republic of Armenia, [email protected].

13. Children and school groups

Accounts on the website and in the mobile app, and bookings, are intended for adults (18 and over). A parent, guardian, school or group organiser should provide only the participant information needed to arrange a school or family trip and should have the authority to do so. We do not knowingly invite children to create accounts or send unnecessary personal data. Contact us if you believe a child has provided data without appropriate authority.

14. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The current version is published on this page with its last-updated date. Material changes will be highlighted here or communicated through an appropriate channel.

15. Contact

One Way Group LLC, 16 Parpetsi Street, Yerevan, Republic of Armenia. For privacy questions or requests, email [email protected].