Privacy Policy

1.1. This Privacy Policy explains what personal data we receive through the panbus.com.ua website (the "Platform") and customer support, why we need it, whom we share it with, how long we keep it, and what control you have over it.

1.2. The controller of your personal data is Limited Liability Company "GLOBAL HORIZONT", EDRPOU code 46332018, registered at 63/1 Medovoi Pechery St., Lviv, Ukraine ("we", "us").

1.3. A user account on panbus.com.ua is shared with the other websites operated by GLOBAL HORIZONT LLC. Your profile and all your orders placed on any of these sites are therefore kept together and shown to you on each of them.

1.4. We process data under the Law of Ukraine "On Personal Data Protection" No. 2297-VI of 01.06.2010 and, for passengers travelling to or staying in the European Union, also under the EU General Data Protection Regulation 2016/679 (GDPR).

1.5. This Policy forms part of the Public Offer and applies together with it. By using the Platform, you confirm that you have read the Policy and agree to your data being processed as described here.

2.1. From you, when you place an order: passengers' surnames, first names and, where needed, patronymics, their dates of birth, gender and citizenship; for international journeys, the series and number of their passport or ID card, its expiry date and issuing country; an email address and phone number for contact; optionally, a passenger's Viber, Telegram or WhatsApp contact.

2.2. About your trips: the journeys and dates you chose, the number of passengers, and your history of orders, refunds and cancellations.

2.3. About your account: the email address that serves as your login, your password (stored only as a hash) and your profile settings.

2.4. About payments: how and whether payments and refunds went through. We never receive or store your card number, expiry date or CVV — the payment provider handles them.

2.5. From your contacts with us: your requests to customer support, messenger conversations, and recordings of phone calls where a call is recorded.

2.6. Automatically, when you visit the Platform: IP address, device type, operating system, browser and version, language, cookie data, pages viewed and time spent on them.

3.1. To perform our contract with you (the Public Offer): finding a journey, reserving a seat, issuing and sending the ticket, passing passenger details to the carrier, taking payment and making refunds, telling you about journey changes or cancellations, confirming pay-the-driver bookings and answering your requests.

3.2. To meet our legal obligations: tax and accounting records, the requirements of the laws "On Road Transport" and "On Consumer Rights Protection", border control requirements on international journeys, and requests from authorised bodies.

3.3. For our legitimate interests: protecting the Platform against hacking and fraud, fixing faults, understanding how it is used so we can improve it, and checking the quality of our service.

3.4. With your consent: sending news of promotions and discounts, and using analytics and advertising cookies where the law requires consent. You may withdraw consent at any time without affecting the lawfulness of earlier processing; to stop newsletters, write to customer support.

3.5. These bases are provided by items 1 (consent), 3 (making and performing a transaction), 5 (a controller's legal obligation) and 6 (a controller's legitimate interest) of part one of Article 11 of the Law of Ukraine "On Personal Data Protection" and, for people covered by the GDPR, by Article 6 GDPR. On international journeys we also take into account Regulation (EU) No 181/2011 on the rights of passengers in bus and coach transport.

4.1. The carrier operating your journey: the passenger's surname, first name and phone number and, for international journeys, document details, to issue the ticket and clear border control. The carrier then processes these data under its own rules.

4.2. The payment provider handling online payment: the amount, the order number and the details needed for payment and refunds. You enter card details on its page, and it processes them to the PCI DSS standard.

4.3. Suppliers working for us as processors: hosting and cloud services, the service that emails tickets, error monitoring, and partners helping with customer support. Each receives only what its work requires.

4.4. Web analytics services — in de-identified form.

4.5. Viber, Telegram or WhatsApp — if you write to us there: the conversation passes through the messenger's service on its terms.

4.6. Public authorities — where the law obliges us to disclose data at the request of a court, law enforcement or another authorised body.

4.7. We do not sell personal data, and we share it only as far as needed for the purposes named in this Policy.

5.1. An international trip cannot happen without data leaving Ukraine: it goes to carriers on international routes and to border control in EU countries and other states along the route.

5.2. Analytics services and cloud suppliers may store data on servers in the EU, the USA and other countries.

5.3. We make such transfers in compliance with Article 29 of the Law of Ukraine "On Personal Data Protection" and, where the GDPR applies, its requirements, and we make sure recipients protect the data adequately.

6.1. Cookies are small files your browser stores on your device; the browser's local storage works in a similar way. Technical cookies are needed for the Platform to work at all: they keep you signed in and hold the session, the language you chose and an unfinished order. They cannot be switched off.

6.2. Analytics and advertising cookies (such as Google Analytics or ad network pixels) help us understand how visitors use the Platform and measure advertising. They collect de-identified information — device, browser, pages, visit length, language, approximate location — that may be processed on servers outside Ukraine. We use them only when such services are connected and, where the law requires it, with your consent.

6.3. You can set up or block cookies in your browser; without technical cookies, parts of the Platform may not work.

7.1. No longer than the purposes of processing require, namely:

7.2. Account — while it exists and for 6 months after deletion, so that it can be restored.

7.3. Orders and tickets — 3 years from the travel date, the general limitation period under the Civil Code of Ukraine.

7.4. Accounting and tax records — as long as tax law requires, and at least 1,095 days.

7.5. Technical data and cookies — up to 12 months.

7.6. When the period ends, the data are destroyed or de-identified.

8.1. Data exchanged between your device and the Platform is encrypted (TLS).

8.2. Payments go through a payment gateway that supports 3-D Secure; we never see full card details.

8.3. Passwords are kept only as hashes — no one on our side can read yours.

8.4. Only staff who need personal data for their work can access it, and we update our security systems regularly.

8.5. No way of sending or storing data over the internet is completely safe, but we do everything reasonably possible to keep your data secure.

9.1. The Platform is not meant to be used on their own by people under 16: tickets for children are booked by parents or other legal guardians.

9.2. If we find that we have received a child's data without parental consent, we will delete it.

10.1. You can: find out what data about you we process and get a copy; have inaccurate or incomplete data corrected; have data erased where there is no lawful ground to keep processing it; restrict processing for a time; receive your data in a structured, machine-readable format; object to processing for marketing; and withdraw consent at any time, which does not make earlier processing unlawful.

10.2. To use your rights, write to us in Viber, Telegram or WhatsApp at +380 67 662 5562 or send a written request by post to: 63/1 Medovoi Pechery St., Lviv, Ukraine. We may ask you to confirm that the request comes from you.

10.3. We reply within the time the law sets — no later than 30 calendar days after receiving the request.

10.4. If you believe your rights have been infringed, you may complain to the Ukrainian Parliament Commissioner for Human Rights (www.ombudsman.gov.ua); passengers in the EU may also complain to the data protection authority of their country.

11.1. We may change this Policy. A new version is published on the Platform with its update date at the top of the page; it applies from the day of publication, and by continuing to use the Platform you accept it. We suggest reading it from time to time.

Data controller: Limited Liability Company "GLOBAL HORIZONT", EDRPOU code 46332018

Registered address: 63/1 Medovoi Pechery St., Lviv, Ukraine

Postal address: 63/1 Medovoi Pechery St., Lviv, Ukraine

Customer support: +380 67 662 5562 (daily 09:00–22:00; Viber, Telegram, WhatsApp)

Website: https://panbus.com.ua