Privacy Policy (Protection of Personal Data)

Limited Liability Company “KLR UA”, EDRPOU code 43262137, registered address: 29011, Ukraine, Khmelnytskyi, 12/2 Vinnytske Highway, website https://klr.com.ua/ (hereinafter — KLR Bus), ensures the protection and confidentiality of your personal data.

1. General Provisions

The Privacy and Personal Data Protection Policy of KLR Bus constitutes an integral part of the Public Offer Agreement available at: https://klr.com.ua/terms.

KLR Bus respects each user’s right to privacy and ensures the confidentiality of personal data processed in connection with the use of this website. KLR Bus implements all necessary technical and organisational measures in accordance with Regulation (EU) 2016/679 (GDPR) and the Law of Ukraine “On Personal Data Protection” to prevent unauthorised access, accidental loss, destruction, alteration, or illegal disclosure of such data.

However, given the inherent risks of the electronic environment, we cannot guarantee absolute information security. Nevertheless, KLR Bus undertakes all reasonable measures to ensure that the personal data of data subjects are reliably protected and processed in compliance with the applicable legislation.

As a ticket sales system, KLR Bus acts on behalf and in the interests of road carriers on the basis of concluded agreements; therefore, with respect to your personal data, KLR Bus acts as a data processor. The data controller is the carrier whose transportation services you intend to use.

For any questions related to the processing, storage, or use of your personal data, please contact: LLC “KLR UA”, 29011, Ukraine, Khmelnytskyi, 12/2 Vinnytske Highway, tel. +380 (68) 770-60-30, email: feedback@klr.com.ua.

Your personal data are processed in accordance with the Law of Ukraine “On Personal Data Protection”, and, where applicable, Regulation (EU) 2016/679 (GDPR), as well as other legislation of Ukraine and the terms set out herein. Providing your personal data to KLR Bus is voluntary. If you do not agree with this Privacy Policy, you must refrain from using the Website and leave it immediately.

2. Categories of Personal Data We Collect

KLR Bus collects, stores, and processes personal data solely to the extent necessary for the conclusion and performance of transportation service agreements, as well as for fulfilling other lawful obligations, in accordance with the Law of Ukraine “On Personal Data Protection” and, where applicable, Regulation (EU) 2016/679 (GDPR).

The personal data that may be collected and processed include, but are not limited to, the following categories:

· Identification Data: surname, first name, patronymic (if applicable), date of birth, citizenship, gender, mobile phone number, email address, postal address;

· Identity Document Data: passport series and number, validity period, and other relevant details (if required for the purpose of identity verification in connection with the performance of a contract);

· Payment Information: payment card number, expiration date, cardholder name (CVC/CVV codes are not stored or processed in compliance with PCI DSS requirements);

· Automatically Collected Technical Data (via cookies or similar technologies): IP address, browser type, URL paths, interaction data with the website, device identifier, geolocation, and similar information;

· User Profile Data: search history, booking history, personal preferences and settings;

· Other Information: any additional information voluntarily provided by you while using the Website.

If the proper provision of services requires the processing of special (sensitive) categories of personal data (e.g., health-related information, special needs, religious beliefs), such processing shall be carried out only on the basis of your explicit, specific, informed, and voluntary consent, in accordance with Articles 7 and 11 of the Law of Ukraine “On Personal Data Protection” and Articles 9 and 6 of the GDPR.

If an order or payment for services is placed on behalf of a third party, you confirm that you have obtained such person’s proper consent to transfer and process their personal data and have informed them of the provisions of this Policy.

The use of the Website by persons under 18 years of age is permitted only with the consent of parents or legal guardians.

KLR Bus does not knowingly collect personal data of minors without such consent.

If it is discovered that the data of a minor have been processed without the necessary authorisation, such data will be deleted within a reasonable timeframe.

3. Automated Data Collection and Cookies

When using the KLR Bus Website, certain data may be automatically collected from your device for the purposes of improving the Website’s operation, enhancing security, enabling analytics, and personalising content. Such data collection is carried out in accordance with this Policy and applicable legislation.

The following categories of data may be collected automatically:

· Device type and model, operating system, browser type and version;

· IP address, approximate geolocation;

· Date, time, and duration of Website visits;

· Pages viewed, referral sources, links clicked;

· Preferences related to selected services.

Data may be collected through cookies, web beacons, server logs, or analytics tools, including Google Analytics (in accordance with Google’s Privacy Policy: https://policies.google.com/privacy).

Cookies are small text files stored on your device when you use the Website. They do not contain personal data in an open form and cannot run programs or transmit viruses.

If you log in using social media accounts (such as Google or Facebook), we may receive limited data from those platforms (including name, email address, and profile photo), in accordance with your privacy settings. The transfer of such data is carried out based on your consent and subject to the rules of the relevant service provider.

Upon your first visit to the Website, you will be asked to provide consent for the use of cookies (except for strictly necessary cookies) via a cookie consent banner. You may:

· Accept or decline specific categories of cookies;

· Withdraw your consent at any time;

· Change cookie settings in your browser.

Please note that blocking all or certain categories of cookies may result in some Website features becoming unavailable or functioning improperly.

Automatically collected data are retained only for the period necessary to achieve the purposes for which they were collected, or as defined by third-party policies (e.g., Google). Certain data may be transferred to services located outside Ukraine or the EU, subject to appropriate safeguards such as Standard Contractual Clauses.

4. Use of Personal Data

We process your personal data for the following purposes:

· ensuring the provision of the requested services (ticket reservations, ticket sales, management of bookings, communication regarding any changes);

· performance of contractual obligations with carriers;

· processing and confirming payments;

· providing technical support and responding to user enquiries;

· improving the performance and functionality of the Website;

· sending informational and marketing communications (subject to your consent);

· enabling participation in loyalty programmes, surveys, and feedback collection;

· detecting and preventing fraud or other unlawful activities;

· ensuring compliance with applicable legislation.

Legal Grounds for Processing:

· performance of a contract (Article 6(1)(b) GDPR / Article 11 of the Law of Ukraine “On Personal Data Protection”);

· compliance with legal obligations (Article 6(1)(c) GDPR);

· legitimate interests (Article 6(1)(f) GDPR);

· your consent (Article 6(1)(a) GDPR) — including for marketing purposes or the transfer of data to partners.

The Website uses Google Analytics, a web analytics service provided by Google LLC (USA), which enables us to better understand how users interact with the Website.

Google may process data such as: device type, IP address, operating system, browser type and version, pages visited, time spent on the Website.

Processing is based on your consent obtained through the cookie banner.

Data may be transferred to servers located outside Ukraine, including the United States.

The Website may integrate social media plug-ins (e.g., Facebook, Instagram, Twitter). When you interact with such plug-ins (even without being logged in), certain data may be transferred to the respective service providers.

Please note that we do not control the further processing of such data.

We recommend reviewing the privacy policies of the relevant platforms.

Your personal data may be shared solely within the scope necessary to provide services and only with the following categories of recipients:

· transportation service providers (carriers);

· payment service providers;

· partners providing technical or marketing support (processors);

· business partners in cases of jointly provided services (subject to your separate consent);

· supervisory and regulatory authorities, where required by law;

· in cases of company restructuring (merger, sale, liquidation).

All processors act on the basis of a binding agreement and are required to ensure a level of protection equivalent to ours.

In certain cases, your personal data may be transferred outside Ukraine, including to EU Member States, the United States, and Canada, strictly for the purpose of service provision or technical processing.

Such transfers are carried out in accordance with:

· Article 29 of the Law of Ukraine “On Personal Data Protection”;

· Articles 45–49 GDPR (adequate safeguards such as Standard Contractual Clauses, certification mechanisms, or explicit consent).

You may withdraw your consent to receive marketing communications at any time by:

· clicking the “unsubscribe” link in emails;

· sending a request to the email address indicated in the Contact section.

You have the right to:

· access your personal data;

· rectify inaccurate or incomplete data;

· request deletion of your personal data (“right to be forgotten”);

· restrict the processing of your data;

· object to processing;

· exercise the right to data portability;

· lodge a complaint with a supervisory authority (in Ukraine — the Ukrainian Parliament Commissioner for Human Rights).

We may update this Policy from time to time.

All changes will be published on the Website with the corresponding revision date.

By continuing to use the Website after the publication of updates, you agree to the revised version of the Policy.

5. Deletion of Personal Data

You have the right to request the deletion of your personal data collected and processed by KLR Bus in cases provided for by applicable legislation, including where:

· the personal data are no longer necessary for the purposes for which they were collected or processed;

· you have withdrawn your consent and no other legal grounds for processing exist;

· the personal data have been processed unlawfully;

· deletion is required under the legislation of Ukraine or, where applicable, Regulation (EU) 2016/679 (GDPR).

A request for the deletion of personal data may be submitted via email to: feedback@klr.com.ua, or in writing to the address specified in Section 6 of this Policy.

KLR Bus will review your deletion request and inform you of the outcome within 30 calendar days from the date of receipt.

In cases where deletion is lawfully refused (for example, where processing is required to comply with a legal obligation), we will provide a justified explanation.

Deletion of personal data does not apply where processing is:

· necessary to fulfil legal obligations;

· carried out for the establishment, exercise, or defence of legal claims;

· performed for scientific, historical, or statistical purposes, provided that appropriate safeguards are applied.

If your personal data have been transferred to third parties (carriers, payment service providers, partners), KLR Bus will notify such parties of your deletion request where technically feasible and where such notification does not require disproportionate effort.

Deletion of a User Account via the Mobile Application

You may initiate the deletion of your user account through the corresponding function in the mobile application.

Once initiated, the account will be automatically deleted within 14 calendar days.

During this period, you may withdraw your request by contacting customer support.

Upon deletion of your account, the following personal data will be permanently removed from our system:

· phone number;

· email address;

· surname, first name, patronymic;

· date of birth and gender;

· unique user ID;

· loyalty programme data and personalised settings.

Tickets purchased prior to the deletion of the account are not cancelled and remain valid travel documents.Ticket linking is performed via the user ID, which is also removed after account deletion.

6. Company Details

Name of the Website Owner: LLC “KLR UA”

Registered Address: Ukraine, 29011, Khmelnytskyi, 12/2 Vinnytske Highway

Customer Support Service:

Phone: +380 (68) 770-60-30 (available 24/7; charges according to operators’ tariffs)

Email: info@klr.com.ua

(version as of 31 October 2025)