Privacy Policy

Last updated: 10 October 2026

Who we are

This website (www.arbustan.com) is run by Arbustan, a trading name of Off the Map by Tommaso Aguzzi, Nusupbekov St. 15/8, Apt. 44, 050002 Almaty, Kazakhstan (the "data controller", "we", "us"). For any question about your personal data, write to contact@arbustan.com.

This policy explains what personal data we collect through this website, why, and what rights you have. It applies to visitors from the European Union, Italy included, under the General Data Protection Regulation (GDPR).

What we collect and why

1. Booking and contact requests

When you fill in a form on this site (booking request, contact, travel consultation), we receive the data you type in: your name, email address, phone number, number of travellers, the tour you are interested in and your message.

• Purpose: to answer your request, prepare your trip or quote and, if you book, manage your booking.
• Legal basis: steps taken at your request before entering into a contract, and performance of the contract (Art. 6(1)(b) GDPR).
• Retention: up to 24 months after our last exchange if you do not book. If you book, until the trip has been fully carried out and then for as long as required by accounting and tax rules.

The fields marked as required are needed to handle your request. If you send us data about other travellers (for example the people you are booking for), please make sure they agree.

2. Chat and messaging

The "Chat with our guide" button opens WhatsApp or Instagram. When you write to us there, the conversation is handled by those services under their own privacy policies, and we use your messages only to answer you.

3. Statistics (only with your consent)

If you accept "Statistics" cookies, Microsoft Clarity records how visitors use the site (pages viewed, clicks, scrolling, device type) so we can improve it. Form fields are masked. Legal basis: your consent (Art. 6(1)(a) GDPR). Without consent, Clarity does not set cookies on your device.

4. Advertising measurement (only with your consent)

If you accept "Marketing" cookies, the Meta Pixel (Meta Platforms Ireland Ltd.) and the TikTok Pixel (TikTok Technology Limited) measure the results of our ads and may be used to show you Arbustan ads on Facebook, Instagram and TikTok. Legal basis: your consent (Art. 6(1)(a) GDPR).

5. Technical data

Our hosting provider records technical data (IP address, browser, pages requested) to deliver the site securely. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

6. Legal obligations and claims

We may keep and use the data needed to comply with the law, to answer a lawful request from public authorities, or to establish, exercise or defend our rights in court. Legal basis: legal obligation (Art. 6(1)(c) GDPR) and our legitimate interest (Art. 6(1)(f) GDPR).

Who receives your data

We do not sell your data. We share it only with the providers that help us run the site and our trips:

• Webflow, Inc. (USA): website hosting and form submissions.
• Microsoft Corporation (Clarity): site statistics, with your consent.
• Meta Platforms Ireland Ltd. and TikTok Technology Limited: advertising measurement, with your consent.
• Chaty: the chat button that links to WhatsApp and Instagram.
• Local partners in Central Asia (guides, drivers, guesthouses) receive the data strictly needed to run your trip, once you have booked.

Some of these providers are located outside the European Union. Transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. Data shared with partners in Central Asia is transferred because it is necessary to perform your travel contract (Art. 49(1)(b) GDPR).

How long we keep your data

We keep personal data only as long as needed for the purpose it was collected for: data linked to a booking until the contract has been fully performed, data based on our legitimate interest as long as that interest exists, and data based on your consent until you withdraw it. We may keep data longer when the law requires it. Once these periods end, the data is deleted.

Your rights

You can ask us at any time to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time, for cookies through the cookie settings. You can object at any time, without giving a reason, to any use of your data for direct marketing. Requests are free of charge: write to contact@arbustan.com and we will reply within one month.

You also have the right to lodge a complaint with a data protection authority, for example the Garante per la protezione dei dati personali in Italy (www.garanteprivacy.it).

Cookies

Details about the cookies we use and how to manage them are in our Cookie Policy.

Changes

We may update this policy. The date at the top always shows the latest version. If a change affects processing based on your consent, we will ask for your consent again where required.