Privacy policy · Rail Ukraine

This Policy explains what personal data rail.ua collects, what for, whom it is passed to and how long it is kept. It is an integral part of the Public offer.

Who is responsible for your data

The controller of personal data is Kravets Serhii Petrovych, private entrepreneur, Ukraine, Kyiv, 14 Volodymyra Ivasiuka Avenue, flat 175. Processing is carried out in accordance with the Law of Ukraine "On the Protection of Personal Data".

Questions about processing: [email protected] or the contact form.

What we collect

To issue a ticket - the passenger's surname, first name and patronymic, date of birth, document type and number, and for a concession ticket the concession code and the details of the document confirming it.

To reach you - your email address and, if you give it, a phone number.

If you have created an account - your name, email, password in encrypted form, interface language, time of last sign-in, and the passengers you have saved for quick booking.

If you sign in with Google or Facebook - your identifier in that service, your name, email and profile picture. Those services pass us nothing else.

Technical data - IP address, browser type and request time in the server logs.

We do not collect payment card details. You enter them on the payment service's side, and only the result of the payment reaches us.

Why we process it

to issue, change or refund a ticket - this is performance of the contract with you;
to send the ticket, the payment confirmation and notices about the state of your order;
to meet the requirements of tax and accounting law;
to answer your enquiry;
to keep the service secure and to investigate abuse.

Marketing mail goes only to those who agreed to it. You can unsubscribe from any such message.

Whom we pass data to

JSC Ukrainian Railways - the passenger data needed to issue a travel document. Without that transfer there is no ticket.
LiqPay - to take the payment and to refund it.
Brevo - the service our mail goes through.
Hetzner - servers in the European Union on which the site runs.
Cloudflare - protection and acceleration of the site.
State authorities - only on a written demand made under the law, and only to the extent that demand covers.

We do not sell personal data and do not pass it to advertising networks.

Cookies and analytics

The site uses three technical cookies: the session, form protection against request forgery, and the saved interface language. There are no advertising pixels, counters or tracking systems on the site - none at all. Cookies can be switched off in the browser, but then signing in to your account will not work.

How long we keep it

Order data and accounting documents - at least 1095 days, as the Tax Code of Ukraine requires.
Account and saved passengers - as long as the account exists. They are deleted immediately once it is closed.
Server logs - 14 days.
Correspondence through the contact form - while the enquiry is being handled and for a year afterwards.

Your rights

You have the right to know what data we hold, to receive a copy of it, to correct inaccurate data, to delete your account and data, to withdraw consent to marketing mail, and to complain to the Ukrainian Parliament Commissioner for Human Rights.

The quickest way to delete your data is described on the Deleting your data page. We answer written requests within 30 days.

How we protect it

The site works only over a secure connection. Passwords are stored as irreversible hashes - we do not know your password and cannot show it to you. Only those who need it for their work have access to the data. Should there be a breach that threatens your rights, we will notify you and the Commissioner.

Children

The service is not intended to be used by children on their own. A ticket for a child is booked by an adult, who enters the child's details as passenger data.

Changes

A new revision takes effect on the day it is published on this page. The date of the last update is shown at the top.