Privacy Policy

1. Who we are

Start Travel MMC (“Start Travel”, “we”) is a travel agency registered in the Republic of Azerbaijan. We operate the website starttravel.az, where customers search for and book flights and other travel services. We are the controller of the personal data described here.

We process personal data in line with the Law of the Republic of Azerbaijan “On Personal Data” and, where it applies to our customers, the EU General Data Protection Regulation (GDPR).

2. What data we collect

• Account data: first name, last name, e-mail address, phone number, preferred language, and a securely hashed password (if you register with a password).
• Passenger data needed to issue a ticket: names as in the travel document, date of birth, gender, nationality, passport or ID card number, its expiry date and issuing country, and the passenger type (adult, child, infant).
• Contact data for the booking: e-mail and phone number to which we send tickets and schedule changes.
• Booking data: routes, dates, chosen fare, seats and extras, prices paid, booking and ticket numbers.
• Payment data: payment status and amount. We never see or store your card number — you enter it on the secure page of our bank, Kapital Bank.
• Technical data: IP address, browser type, and security logs (sign-in attempts, errors), plus the cookies described in our Cookie Policy.

3. Signing in with Google

If you choose “Sign in with Google”, we ask Google only for the basic scopes openid, email and profile. From your Google account we receive and store your name, your e-mail address (and whether Google has verified it) and your Google account identifier, so that we can create or find your Start Travel account and sign you in.

• We do not receive your Google password and we do not ask for access to Gmail, Drive, Contacts, Calendar or any other Google service.
• We use this data only to sign you in and to run your account (your bookings, tickets and notifications). We do not use it for advertising, we do not sell it, and we do not share it with third parties except as needed to provide the service you asked for, as described below.
• Start Travel’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• You can disconnect Start Travel from your Google account at any time at myaccount.google.com/permissions, and ask us to delete your account (see “Your rights”).

4. Why we use your data

• To book and issue your travel (performance of a contract): pricing, booking and ticketing with the airline, seat and baggage requests, sending your e-ticket.
• To take payment and prevent fraud (contract and legal obligation).
• To keep you informed about your trip: confirmations, schedule changes, reminders before departure.
• To run your account and provide customer support.
• To keep the site secure and improve it (legitimate interest), including anonymous statistics only if you allow them in the cookie settings.
• To meet legal duties such as accounting, tax and requests from competent authorities.

We do not send marketing messages unless you have agreed to receive them.

5. Who we share data with

We share personal data only as far as needed to provide your booking:

• Amadeus (global distribution system) and the airline(s) of your trip — passenger and contact data are required to book and issue a ticket. Airlines may pass passenger data (API/PNR) to border and security authorities of the countries you travel to or through, as the law requires.
• Kapital Bank — to process your card payment.
• Hosting and e-mail providers that store our site and send our e-mails on our behalf.
• Government authorities when the law requires it.

We do not sell personal data. Some recipients (for example Amadeus and foreign airlines) are located outside Azerbaijan; such transfers are necessary to perform the booking you requested.

6. How long we keep data

Booking, ticket and payment records are kept for as long as accounting and tax law requires (generally up to 5 years). Account data is kept while your account exists and deleted or anonymised after you ask us to close it, except what we must keep by law. Security logs are kept for a limited period.

7. How we protect data

The site works only over HTTPS. Passwords are stored as one-way hashes, administrator access is protected by a second factor, and card data is handled only by the bank. Access to personal data inside Start Travel is limited to staff who need it to serve you.

8. Your rights

You can ask us to access, correct or delete your personal data, to restrict or object to its processing, to receive a copy of it, and to withdraw consent you gave (for example for cookies). Write to [email protected]; we answer within 30 days. Data on a ticket that has already been issued may have to stay with the airline under its own rules. You may also complain to the data protection authority of the Republic of Azerbaijan.

9. Children

Our service is meant for adults. Data of children and infants is entered by the adult who books for them and is used only to issue their tickets.

10. Changes to this policy

We may update this policy when our service or the law changes. The date at the top shows the latest version; for significant changes we will notify account holders by e-mail.