Privacy Policy

1. Who we are and what this policy covers

One Way Group LLC ("ONE WAY TOUR", "we", "us") is a licensed tour operator registered in the Republic of Armenia. Our office is at 16 Parpetsi Street, Yerevan, Republic of Armenia.

This policy covers onewaytour.com, customer accounts, booking and enquiry forms, our self-hosted customer-support system at chat.onewaytour.com, and conversations you start with us by email, phone, Facebook Messenger, Instagram Direct, WhatsApp, Telegram or Viber.

2. Personal data we collect

Depending on how you use our services, we may collect:

• contact details such as your name, email address and phone number;
• account details such as nationality, date of birth, gender, language and an encrypted password;
• trip details such as travel dates, destinations, pickup and drop-off addresses, participant numbers and ages, room or meal preferences, guide language and notes you send us;
• booking and payment records such as order number, amount, currency, payment method, status and gateway reference; we do not store your complete bank-card number;
• the content of enquiries, support messages, reviews, feedback and files you choose to send;
• technical data such as IP address, device and browser information, referring page, pages viewed, timestamps, session identifiers and interaction events.

Please do not send passport, bank-card or other sensitive information in free-text forms or AI search unless our team specifically requests it through an appropriate channel for a confirmed service.

3. Where the data comes from

Most data comes directly from you when you create an account, submit a form, make a booking or payment, or contact us. We may also receive necessary booking details from a person organising travel for a group, from a travel partner acting on your behalf, or from the payment provider you select.

When you message our Facebook Page or Instagram Business account, Meta may provide your public profile name, username, profile picture, platform-scoped user ID, message content, attachments, delivery or read status and timestamps. We receive this only after you initiate the conversation; we do not receive your platform password, friend list or unrelated posts.

4. Why we process personal data

We process personal data only for defined purposes, including to:

• answer enquiries and provide customer support;
• prepare, confirm, deliver and manage tours, transfers, hotel requests and related travel services;
• create and manage your account and saved preferences;
• process payments, refunds and financial reconciliation;
• prevent fraud, abuse and security incidents;
• measure and improve website performance, search and customer experience;
• comply with accounting, tax and other legal obligations and handle legal claims.

Processing is based on the Law of the Republic of Armenia on Protection of Personal Data and other applicable law. Where the GDPR applies, our bases may include performing a contract or taking steps at your request, complying with a legal obligation, our legitimate interests in operating and securing the service and responding to enquiries, and consent where required. You may withdraw consent without affecting earlier lawful processing.

5. Cookies, analytics and online services

The website uses necessary session and security technologies. It also uses Google Tag Manager and Google Analytics, Meta Pixel and Yandex Metrica to understand visits and interactions and to measure advertising performance. These providers may receive identifiers, IP address, device and browser data, page URLs and interaction events and may set or read cookies under their own policies.

Cloudflare Turnstile may process technical signals to protect forms from automated abuse. If you use AI Tour Search, the text of your search is sent to OpenAI to interpret the request; do not enter passport, payment or other sensitive data there. You can control or delete cookies in your browser, although blocking necessary cookies may affect account, booking or security functions.

6. Payments

Online payments are completed on the secure page of the payment method or gateway you select, including supported bank-card, Telcell or MIR channels. The provider processes the payment credentials under its own privacy and security terms. We receive and retain the information needed to match the payment to your booking, such as status, amount, currency and transaction reference, but not your complete card number or security code.

7. Who receives personal data

We disclose only the information reasonably needed for the purpose to:

• hotels, transport providers, guides and other suppliers involved in the service you requested;
• payment providers and banks;
• hosting, security, communications, analytics and IT-service providers acting for us;
• professional advisers, insurers and auditors where necessary;
• public authorities or courts where disclosure is required by law.

Some technology providers may process data outside Armenia. Their location and safeguards depend on the provider and service. We do not sell personal data or give conversation data received from Meta to third parties for their own marketing.

8. Storage and security

Bookings and operational records are stored in our access-controlled systems. Messages from supported channels may be stored in our self-hosted Chatwoot customer-support system. We use encrypted connections, role-based access, logging and backups, and limit access to authorised staff who need the data for their work.

No online system can be guaranteed completely secure. If you believe your data or account may be at risk, contact us promptly.

9. How long we keep data

• support-message history is normally kept for up to 24 months after the last message;
• account data is kept while the account is active or until a valid deletion request, subject to records we must retain;
• booking, payment and accounting records are kept for the period required by Armenian law and for resolving disputes;
• security logs and analytics information are kept for operational periods or according to the applicable provider settings.

When a retention period ends, data is deleted or irreversibly anonymised unless continued retention is required by law or needed for a legal claim.

10. Your rights

Depending on the applicable law and circumstances, you may ask us to:

• confirm whether we process your personal data and provide access to it;
• correct incomplete or inaccurate data;
• delete data or stop processing it where there is no lawful reason to continue;
• restrict or object to certain processing;
• provide a portable copy where that right applies;
• withdraw consent where processing relies on consent.

Send a request from the email address or account connected with the data. We may ask for proportionate information to verify your identity. We aim to respond within 30 days; complex or legally restricted requests may require additional explanation or time. You may also contact the Personal Data Protection Agency of the Republic of Armenia.

11. Facebook, Instagram and WhatsApp data deletion

Deleting a conversation in Facebook, Instagram or WhatsApp does not automatically remove the copy held in our support system. Send us a deletion request so we can locate and remove or anonymise the related records, except records we are legally required to retain.

12. Children and school groups

Website accounts and bookings are intended for adults. A parent, guardian, school or group organiser should provide only the participant information needed to arrange a school or family trip and should have the authority to do so. We do not knowingly invite children to create accounts or send unnecessary personal data. Contact us if you believe a child has provided data without appropriate authority.

13. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The current version is published on this page with its last-updated date. Material changes will be highlighted here or communicated through an appropriate channel.

14. Contact

One Way Group LLC, 16 Parpetsi Street, Yerevan, Republic of Armenia. For privacy questions or requests, email [email protected].