Privacy Policy

The BUS GO Policy on the confidentiality and protection of your personal data forms an integral part of the Public Offer Agreement set out at the https://busgo.in.ua/en/info/terms link.

BUS GO respects the right of every user to privacy and to the confidentiality of the personal data processed in connection with the use of this website. BUS GO takes all necessary technical and organisational measures in accordance with the requirements of Regulation (EU) 2016/679 (GDPR) and the Law of Ukraine “On Personal Data Protection” to prevent unauthorised access to, and accidental loss, destruction, alteration or unlawful disclosure of, such data.

At the same time, in view of the risks inherent in the electronic environment, we cannot guarantee the absolute security of information. However, BUS GO takes all reasonable measures to ensure that the personal data of data subjects are protected to the greatest possible extent and processed in accordance with applicable law.

BUS GO, as a ticket sales system, acts on behalf and in the interests of road carriers on the basis of concluded agreements and therefore acts as a processor in respect of your personal data. The controller of the personal data is the carrier whose transport services you will use. For all matters relating to the processing, place of storage and use of your personal data, please contact: Individual Entrepreneur Yuliia Ahalakova, Ukraine, 61172, Kharkiv Oblast, Kharkiv, 52 92nd Brigade St, apt. 61, tel. +38 (099) 755 94 59, +38 (096) 068 97 38, email: info@busgo.in.ua. Your personal data are processed in accordance with the Law of Ukraine “On Personal Data Protection” and, where applicable, Regulation (EU) 2016/679 (GDPR), other legislative acts of Ukraine and the terms set out below. The provision of personal data to BUS GO is voluntary. If you do not agree with the personal data protection policy, you must not use the Site and must leave it immediately.

BUS GO collects, stores and processes personal data only to the extent necessary for the conclusion and performance of contracts for the provision of transport services, as well as for the fulfilment of other legal obligations, in accordance with the requirements of the Law of Ukraine “On Personal Data Protection” and, where applicable, Regulation (EU) 2016/679 (GDPR).

The personal data that may be collected and processed include (but are not limited to):

• Identification data: surname, first name, patronymic (if any), date of birth, citizenship, sex, mobile telephone number, email address, postal address;
• Identity document data: passport series and number, its period of validity, other details (where required to identify the person in the performance of the contract);
• Payment information: payment card number, its expiry date, cardholder name (the CVC/CVV code is neither stored nor processed, in accordance with the requirements of PCI DSS);
• Automatically collected technical data (via cookies or other technologies): IP address, browser type, URLs, data on interaction with the website, device identifier, geolocation, etc.;
• User profile data: search and booking history, personal settings;
• Other information voluntarily provided by you while using the site.

Where the proper provision of the Services requires special (sensitive) categories of personal data to be taken into account (for example, state of health, special needs, religious beliefs), such information is processed only subject to your explicit, specific, informed and freely given consent, in accordance with Articles 7 and 11 of the Law of Ukraine “On Personal Data Protection” and Articles 9 and 6 of the GDPR.

The said personal data may also be collected where the Services are ordered and paid for on behalf of third parties. In such a case, you confirm that you have obtained the proper consent of such persons to the transfer and processing of their personal data and have informed them of the provisions of this Policy.

Persons under 18 years of age may use the Site only with the consent of their parents or legal representatives. BUS GO does not knowingly collect personal data of minors without such consent. If it becomes known that the data of a minor have been processed without proper consent, such data will be deleted within a reasonable period.

When you use the BUS GO Site, we may automatically collect certain data from your device for the purposes of improving the operation of the Site, analytics, security and content personalisation. Such collection is carried out in accordance with this Policy and applicable law.

While you use the Site, we may automatically collect the following data:

• device type, model, operating system, browser type and version;
• IP address, approximate location;
• date, time and duration of visits to the Site;
• pages viewed, referral source, links clicked;
• preferences regarding the Services selected.

Collection is carried out by means of cookies, web beacons, server logs or analytics services such as Microsoft Clarity (subject to the Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement) Google Analytics and the advertising service Google Ads (subject to the Google Privacy Policy: https://policies.google.com/privacy), as well as the advertising service ChatGPT Ads (subject to the OpenAI Privacy Policy: https://openai.com/policies/privacy-policy/).

Cookies are small text files stored on your device when you visit the Site. They do not contain personal data in plain form and cannot run programs or transmit viruses.

If you log in via social media accounts (for example, Google or Facebook), we may receive limited data from them (name, email, profile photo, etc.) in accordance with the privacy settings of your account. Such data are transferred on the basis of your consent and the rules of the relevant provider.

On your first visit to the Site, we ask you to consent to the use of cookies (other than strictly necessary cookies) by means of a banner. You have the right to:

• accept or reject certain categories of cookies;
• withdraw your consent at any time;
• change the cookie settings in your browser.

Please note: if you block all or some cookies, certain functions of the Site may be unavailable or may not work properly.

Automatically collected data are stored for the period necessary to achieve the stated purposes, or in accordance with the policies of third parties (for example, Microsoft, Google). Some data may be transferred to services located outside Ukraine/the EU, subject to appropriate safeguards (for example, Standard Contractual Clauses).

We process your personal data for the following purposes:

• ensuring the provision of the services ordered (ticket booking, ticket sales, reservation management, communication regarding changes);
• performance of contractual obligations to carriers;
• processing payments and confirming payments;
• technical support and responding to user enquiries;
• improving the quality of the site’s operation and functionality;
• sending informational and marketing communications (with consent);
• participation in loyalty programmes and surveys, and collection of feedback;
• detection and prevention of fraud and other unlawful acts;
• compliance with legal requirements.

Legal bases for processing:

• performance of a contract (Art. 6(1)(b) GDPR / Art. 11 of the Law of Ukraine);
• compliance with legal obligations (Art. 6(1)(c));
• legitimate interest (Art. 6(1)(f));
• consent of the data subject (Art. 6(1)(a)) – for marketing, transfer of data to partners, etc.

The site uses Microsoft Clarity, a web analytics service of Microsoft Corporation (USA), which helps us better understand how users interact with the site through heatmaps and anonymised session recordings (cursor movements, scrolling, clicks). Clarity may process the following data: device type, IP address, operating system, browser, pages visited, time spent on the site, etc. Data entered in form fields and personal data on the ticket, account and checkout pages are masked and are not transmitted to Clarity. Clarity is switched on only after you give consent in the cookie banner; you can withdraw consent at any time via the “Cookie settings” link at the bottom of the site. Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement.

The site also uses Google Analytics 4, a web analytics service of Google LLC (USA) / Google Ireland Limited, connected via Google Tag Manager. It helps us count visits, understand where users come from and which pages are useful, and measure ticket bookings and payments (order number, route, amount — without names, phone numbers, e-mail or passport data). Google Analytics may process: a pseudonymous browser identifier (the _ga cookie), device type, browser, operating system, approximate location (derived from the IP address; the IP address itself is not stored), pages visited, referral source and visit duration. Google Analytics and Google Tag Manager are loaded only after your consent in the cookie banner (Google Consent Mode); advertising features are enabled only with separate consent to the “Advertising” category (see below). You can withdraw consent at any time via the “Cookie settings” link at the bottom of the site. Data are kept in Google Analytics for no longer than 14 months. Google Privacy Policy: https://policies.google.com/privacy.

If you have separately consented to the “Advertising” category in the cookie banner, the site also uses Google Ads, an advertising service of Google Ireland Limited / Google LLC (USA). It is used to: (1) count which ticket purchases happened after a click on our ads in Google (conversions), and (2) show our ads to people who have already visited the site (remarketing). Google Ads may process: advertising cookies and the ad click identifier (e.g. _gcl_au, gclid), pages visited, the fact of a booking and payment (order number, route, amount — without names, phone numbers, email or passport data), device type, browser and approximate location. Without this consent no advertising cookies are set (Google Consent Mode: ad_storage, ad_user_data and ad_personalization are “denied”). You can withdraw consent at any time via the “Cookie settings” link at the bottom of the site, and manage personalised Google ads at https://myadcenter.google.com. Google advertising cookies are kept for up to 90 days; other data in accordance with the Google Privacy Policy: https://policies.google.com/privacy. Legal basis: your consent (Art. 6(1)(a) GDPR).

If you have separately consented to the “Advertising” category in the cookie banner, the site also uses the measurement pixel of ChatGPT Ads, an advertising service of OpenAI (USA). It is used to count which ticket bookings and payments happened after a click on our ads in ChatGPT (conversions). The pixel sets the cookies __oppref (ad click identifier, up to 30 days) and __obref (random browser identifier, up to 365 days) and sends OpenAI information about the pages you view on the site (page address without ticket keys), your device and browser type and your IP address. About bookings and payments our server tells OpenAI only the order number, trip, number of seats and amount together with these two identifiers — without names, phone numbers, email or passport data. Without this consent the pixel is not loaded and no booking information is sent to OpenAI. You can withdraw consent at any time via the “Cookie settings” link at the bottom of the site; the pixel’s cookies are then deleted. OpenAI Privacy Policy: https://openai.com/policies/privacy-policy/. Legal basis: your consent (Art. 6(1)(a) GDPR).

The processing is based on your consent given via the cookie banner. Data may be transferred to servers located outside Ukraine, in particular in the USA.

To keep the site working reliably, we maintain our own technical error log. If a page or the server malfunctions, technical details of the failure are sent to our server: the error text, the page address (without ticket keys or tokens), the type of browser, operating system and device, the site language, the country (determined from the IP address; the IP address itself is not stored), and a list of the latest actions on the page (navigation, button clicks, requests to the server) — without any data entered into form fields. The log does not use cookies, does not allow you to be identified and is not shared with third parties. The legal basis is our legitimate interest in keeping the site operational and secure (Art. 6(1)(f) GDPR). Records are kept for no longer than 30 days.

So that the details you enter while booking a ticket are not lost, we store an unfinished booking on our server: phone number and email, passenger names, passport details (for international trips), the comment and the selected trip — from the moment you open the booking page, before you press “Book”. This lets us restore the form after you reload the page or come back to the site, and return the same seats if the hold time has run out. If the booking is not completed, we may contact you by the phone number or email you entered to help you complete it. The legal basis is our legitimate interest in providing the service you started to order (Art. 6(1)(f) GDPR). Passport details from an unfinished booking are deleted 24 hours after the last entry, everything else after 30 days; once the order is placed, the data is kept in it in accordance with this Policy. You can ask us to delete this data by writing to us.

Social media plug-ins (Facebook, Instagram, Twitter, etc.) may be integrated into the site. If you interact with them (even without logging in), data may be transferred to the relevant providers.

Please note: we have no control over the further processing of such data. We recommend that you read the privacy policies of the relevant services.

Your data may be transferred only to the extent necessary for the provision of the services, and exclusively:

• To service operators (carriers);
• To payment services;
• To partners providing technical or marketing support (processors);
• To business partners where a service is provided jointly (with your separate consent);
• To supervisory authorities, to the extent required to fulfil legal obligations;
• In the event of a restructuring of the company (merger, sale, liquidation).

All processors act on the basis of a contract and are required to maintain a level of protection equivalent to ours.

In certain cases, data may be transferred outside Ukraine, in particular to EU countries, the USA and Canada, solely to ensure the performance of the services or the processing of technical information.

We guarantee that such transfers are carried out in accordance with:

• Article 29 of the Law of Ukraine “On Personal Data Protection”;
• Articles 45–49 of the GDPR (existence of appropriate safeguards: Standard Contractual Clauses, certification, consent).

You have the right to opt out of receiving commercial communications at any time:

• by clicking the “unsubscribe” link in the email;
• or by sending a request to the email address specified in the contacts section.

You have the right:

• of access to your personal data;
• to rectification of inaccurate data;
• to erasure (“right to be forgotten”);
• to restriction of processing;
• to object to processing;
• to data portability;
• to lodge a complaint with a supervisory authority (in Ukraine, the Ukrainian Parliament Commissioner for Human Rights).

We may make changes to this policy. All updates are published on the site together with the date of the update. By using the site after changes have been published, you agree to the new version.

You have the right to request the erasure of your personal data collected and processed by BUS GO in the cases provided for by law, in particular:

• where the personal data are no longer necessary for the purposes for which they were collected or processed;
• where you have withdrawn your consent and there is no other legal ground for the processing;
• where the personal data have been processed unlawfully;
• where this is required by the legislation of Ukraine or Regulation (EU) 2016/679 (GDPR), where applicable.

A request for the erasure of personal data may be sent to the email address: info@busgo.in.ua, or in writing to the address specified in Section 6 of this Policy.

BUS GO will consider the erasure request and notify you of the outcome within 30 calendar days of receipt of the request. In the event of a justified refusal to erase the data (for example, where the processing is necessary for compliance with a legal obligation), we will provide the relevant justification.

Erasure of personal data does not apply where the processing:

• is necessary for compliance with legal obligations;
• is carried out for the establishment, exercise or defence of legal claims;
• is carried out in the course of scientific, historical or statistical activities, subject to appropriate safeguards.

If your personal data have been transferred to third parties (carriers, payment services, partners), BUS GO will notify such parties of your erasure request where this is technically possible and does not involve disproportionate effort.

Deletion of a User Account via the App

You may initiate the deletion of your account via the relevant function in the mobile app.

Once the initiation has been confirmed, the account will be automatically deleted within 14 calendar days. During this period, the user may withdraw the request by contacting the support service.

As a result of the deletion of the account, the following personal data will be permanently removed from our system:

• telephone number;
• email address;
• surname, first name, patronymic;
• date of birth and sex;
• unique user ID;
• loyalty programme data and personal settings.

Tickets purchased before the account is deleted are not cancelled and remain valid for travel. Tickets are linked to the user by means of the ID, which is also eliminated once the account is deleted.

• Name of the Site owner Individual Entrepreneur Yuliia Yuriivna Ahalakova, taxpayer ID (RNOKPP) 3103301849
• Registered office Ukraine, 61172, Kharkiv Oblast, Kharkiv, 52 92nd Brigade St, apt. 61
• Customer support service
• Phone +38 (099) 755 94 59, +38 (096) 068 97 38 (24/7, at the operators’ rates)
• Email info@busgo.in.ua