Politique de confidentialité du site

Politique de confidentialité

Version 1.1

Effective date: September 20, 2026

Ce document est actuellement disponible en anglais. Pour les questions régies par le droit russe, la version russe prévaut.

This document is an English translation of the Russian original, available at https://luntan.pro/ru/legal/privacy/. A Simplified Chinese translation is also available. If the versions differ, the Russian original is used to interpret the provisions only to the extent permitted by applicable law. This does not limit mandatory user rights or the right to receive information in a language the user understands.

1. SCOPE

1.1. This Notice describes processing when you use https://luntan.pro and its subdomains, including https://flights.luntan.pro (the “Website”), or contact us by email.

1.2. It does not govern luntantravel mobile applications, sellers' websites or independent third-party services. Their own notices apply.

2. CONTROLLER AND CONTACTS

2.1. Data Controller and Website Owner: Igor Vladimirovich Repin (Russian legal name: Репин Игорь Владимирович), Russian Federation, Republic of Bashkortostan.

2.2. The public developer name for the project’s applications is Игорь Репин / Igor Repin. Both names refer to the same Controller. Email for privacy requests: support@luntan.pro.

2.3. Russian Register of Personal Data Operators number: 2-26-060086. Order No. 143 dated August 19, 2026. Processing commencement date: August 24, 2026.

3. WHAT DATA WE PROCESS

3.1. The Controller processes only data needed for specified purposes, does not combine incompatible datasets and does not retain data longer than necessary.

3.2. The main Website has no accounts, forms, subscriptions, comments, payments, profiles or personalized advertising. Visitors may read content, follow links and independently send an email.

3.3. The Controller does not sell personal data, receive passenger passport or payment data through the Website, or combine Travelpayouts affiliate statistics with Yandex Metrica. Special-category and biometric data are not intentionally collected.

3.4. The main Website and email are hosted using NIC.RU infrastructure in Russia. The provider may maintain technical logs to operate and secure its infrastructure under its own documents. This does not mean that the Controller has access to all provider logs.

4. EMAIL INQUIRIES

4.1. Purposes: prepare the requested response, provide support, handle a request or complaint, meet applicable obligations and protect the parties' rights.

4.2. Data: email address; name or alias if supplied; message and voluntary attachments; date, time and standard technical email headers. The sender is the source.

4.3. You initiate the inquiry and the Controller uses your email to respond and provide the requested service. Separate consent is not requested where applicable law permits this processing on another basis; if consent is mandatory, it is requested before the relevant processing. The legal basis depends on the context and is not asserted cumulatively in every case: steps at your request or performance of an agreement; compliance with law; or the parties' legitimate interests in handling inquiries and protecting rights. Under Russian law, the relevant case in Article 6(1) of Federal Law No. 152-FZ applies; where the GDPR or UK GDPR applies, the relevant basis may include Article 6(1)(b), (c) or (f). These foreign-law bases do not replace mandatory requirements of other applicable laws.

4.4. Ordinary support correspondence is retained for up to 12 months after the inquiry ends. It may be kept longer for an ongoing claim or dispute, contract performance, protection of rights or a mandatory legal retention period. Excessive attachments may be deleted earlier.

4.5. Recipients where necessary: NIC.RU as the email and hosting provider; professional advisers for the protection of rights; and public authorities where required by law.

5. YANDEX METRICA

5.1. Purpose: audience statistics, understanding page use, identifying technical or navigation issues and improving the Website.

5.2. Tag 111838256 is configured on luntan.pro and the separate tag 111838109 is configured on flights.luntan.pro. Each loads only after “Accept all” or enabling “Statistics” in the relevant site's independent banner. Rejecting analytics does not restrict core content or search.

5.3. Once loaded, Metrica may process the network IP address, ClientID and other browser identifiers, cookies and local storage, browser and device information, language, time zone, screen resolution, URL and referral source, visit time and duration, page views and interactions, and approximate location.

5.4. For both tags, Webvisor is disabled, “Do not save full IP addresses of site users” is enabled, and the Yandex Metrica Data Processing Agreement has been accepted. These are voluntary data-minimization measures: Yandex masks the last IPv4 octet or the last 64 bits of IPv6. Obvious identifiers must not be placed in tracked fields or URLs.

5.5. The legal basis is consent expressed by an affirmative banner choice: Article 6(1)(1) and Article 9 of Russian Federal Law No. 152-FZ; where the GDPR or UK GDPR applies, Article 6(1)(a). Consent is not inferred from accepting the Terms, scrolling or continuing to browse.

5.6. Recipient: YANDEX LLC, 16 Leo Tolstoy Street, Moscow 119021, Russia. Separate tags maintain separate datasets. Retention depends on withdrawal and tag settings, subject to Yandex's independent legal obligations. Withdrawal stops future loading but does not invalidate prior processing.

6. FLIGHTS.LUNTAN.PRO AND TRAVELPAYOUTS

6.1. Before you click “Search”, the Owner controls the White Label wrapper: its design, banner, local preferences and, with consent, its separate Metrica tag. A Travelpayouts script loads to render the search form, so your browser connects to its infrastructure at this stage. Under its documents, Travelpayouts may receive the IP address, browser and device information and other data needed for the connection; route parameters have not yet been submitted as a search query.

6.2. By clicking “Search”, you actively send origin, destination, dates, passenger count, class, language and currency to Travelpayouts infrastructure in addition to the connection data. Travelpayouts may combine them with cookies, technical identifiers, referrals and attribution events. The Owner does not store the raw query, connection data or technical logs in its own database and does not determine subsequent processing within Travelpayouts.

6.3. Travelpayouts generates affiliate statistics about referrals and desired actions for the Owner and may calculate remuneration. The Partner ID identifies the Owner as an affiliate, not the visitor on its own; Travelpayouts may combine it with cookies and technical identifiers for attribution. The Owner does not use the resulting statistics to identify visitors or combine them with Metrica.

6.4. After selecting an offer, you move to the seller and give it your name, contact, passenger, document, payment and booking details. The Owner does not receive them; your contract is with the seller, which independently determines processing.

6.5. Travelpayouts' public data-processing policy governs the Travelpayouts platform. It does not replace the Owner's Website documents, constitute a controller-processor agreement between the Owner and Travelpayouts, or establish Travelpayouts as the Owner's processor. Roles are assessed separately for each actual stage.

7. COOKIES AND LOCAL STORAGE

7.1. luntan.pro uses “Necessary” and “Statistics” categories. flights.luntan.pro uses “Necessary”, “Website preferences” and “Statistics”. Optional categories are off by default; the sites have independent banners and retain each choice for 180 days.

7.2. The White Label banner controls only the Owner's technologies and has no Travelpayouts attribution toggle. Rejecting analytics does not block search and is not a promise to delete or disable every Travelpayouts technology. Details: https://luntan.pro/legal/cookies. You can manage consent to optional technologies through the cookie banner and browser settings; the Website has no separate permissions settings or user account. The “Cookie settings” link in the footer reopens the banner.

8. INTERNATIONAL PROCESSING

8.1. The Website is available to an international audience. Depending on the visitor's location, the selected service and provider infrastructure, data may be processed in Russia and other countries.

8.2. The Controller complies with requirements applicable to international transfers it controls. Independent providers and sellers are responsible for their own processing and safeguards. Nothing in this Notice limits rights under mandatory local law.

9. SECURITY

9.1. The Controller applies proportionate legal, organizational and technical measures, including access restrictions, secure connections, software updates, backups and deletion procedures.

9.2. No method of transmission or storage guarantees absolute security. In the event of an incident, the Controller takes steps to limit its effects and meets applicable notification duties.

9.3. Do not email passwords, full payment-card details, identity-document copies or other excessive information unless necessary.

10. YOUR RIGHTS

10.1. To the extent provided by applicable law, you may ask about processing purposes and procedures, access and obtain a copy of your data, request correction or completion, deletion or restriction, object to processing, receive data in a portable format and withdraw consent. Withdrawal does not affect the lawfulness of processing before withdrawal; the procedure for optional cookies is described in section 7 and the Cookie Policy.

10.2. Send your request to support@luntan.pro with a description and enough information to locate the relevant records. To protect data, the Controller may request only necessary and proportionate identity verification; a passport, ticket or complete document is not required without a justified need. A response is provided within the period required by applicable law or, where none is specified, within a reasonable period. If a request cannot be fully met, the Controller will explain the reasons and available means of appeal.

10.3. You may complain to Roskomnadzor or a competent supervisory authority where applicable law gives you that right.

11. AUTOMATED DECISIONS AND CHILDREN

11.1. The Controller does not make decisions based solely on Website data that produce legal or similarly significant effects.

11.2. The Website is not specifically directed to children. Where applicable law requires a parent’s or legal guardian’s consent, it must be obtained before the relevant processing. In particular, where PRC law applies, this concerns the personal information of children under 14. If such data has been processed without required consent, contact the Controller for review and appropriate action, including deletion where required.

12. CHANGES TO THIS NOTICE

12.1. The current version of this Notice is published on the Website with its version number and effective date. You are encouraged to review it on subsequent visits. The Website has no registration or user account, and does not send individual notifications about updates to this Notice. Where applicable law requires a separate notice or renewed consent, information about the changes and the consent request are provided through the cookie banner before the relevant optional processing starts. Continued browsing does not replace required consent.