Privacy Policy

1. Personal Data Controller

This policy describes the processing of personal data on kurumbagarden.com. The controller is Alexander Vasilyevich Grigoriev, address: Studyony proezd 4, bldg. 5, apt. 92, Moscow, Russia; a personal data processing notification has been filed with Roskomnadzor (No. 100320759) under art. 22 of Federal Law No. 152-FZ "On Personal Data".

Controller's contacts, including for personal data requests: email Show email address, phone Show phone number.

2. What Data We Process

We only process data you give us yourself: in the site's forms, or when booking by phone or messenger (the controller enters such bookings manually). No registration is required.

• Villa or excursion booking: name, phone or messenger, country, dates, selected property.
• Contact form and custom trip request: name, email, phone (optional), message text, trip preferences.
• Review: name, email or phone, country, rating and text, stay dates, selected villa/excursions/services, photos.
• Technical data: IP address and browser details at the time of the request, to run and protect the site.
• Only with your consent to analytics cookies: Yandex Metrika visit data, including session recording (Webvisor). Webvisor does not record what you type into forms.

3. Purposes and Legal Grounds

• Processing and confirming bookings, replying to enquiries, preparing trips — based on your consent (art. 6(1)(1) of 152-FZ) and to perform a contract you are a party to (art. 6(1)(5)).
• Publishing a review — based on a separate consent to publication (art. 10.1 of 152-FZ).
• Traffic analytics — based on the consent given with the "Accept" button in the cookie banner.

Before submitting any form you tick a consent checkbox; the form cannot be sent without it, and the date and time of consent are stored with the request. Consent texts: consent to processing, consent to review publication.

4. Actions With Data

Collection, recording, organisation, accumulation, storage, clarification, retrieval, use, blocking, deletion and destruction — with and without automation.

5. Where Data Is Stored and Who Receives It

• All data, including backups, is stored on a server in Moscow (hosting provider AdminVPS LLC), in line with the Russian data localisation requirement (art. 18(5) of 152-FZ).
• New request notifications are delivered to the controller via the Yandex LLC email service (Russia).
• Yandex Metrika (Yandex LLC, Russia) — only after you consent to analytics cookies.
• Fonts and map images are loaded through our own server: your browser does not contact third-party services or send them your IP address.

No cross-border transfer of personal data takes place. We do not sell data or share it with third parties for advertising.

If you choose to message us on Telegram via a link on the site, that conversation is processed by the messenger under its own terms; we do not pass form data to messengers.

6. Retention

• Villa and excursion bookings — 3 years after the end of the stay or the excursion date.
• Enquiries and trip requests — 3 years after they are sent.
• Reviews — until consent to publication is withdrawn.
• Data is deleted automatically when the term expires. If you withdraw consent, data is destroyed within 10 business days and a review is taken down within 3 business days.
• Database backups are kept for 30 days, so deleted data disappears from them within 30 days at the latest.

7. Your Rights

You may request information about the processing of your data, ask for it to be corrected, blocked or destroyed, withdraw consent, and appeal to Roskomnadzor or a court. Send requests to the controller's email; we reply within 10 business days (art. 20 of 152-FZ).

8. Security

Connections to the site are encrypted (HTTPS/TLS), only the controller and authorised administrators can access the database and admin panel, passwords are stored hashed, and backups are made daily. Metadata, including geolocation, is stripped from uploaded photos.

9. Cookies

Which cookies we use and how to change your choice — see the Cookie Policy.