Privacy Policy

Personal data on tourister.az: what passes through the site and where it goes

Tourister.az is the website of Tourister, a travel agency based in Baku. Below is a plain account of the personal information that passes through it: which forms ask for it, what the server notes down by itself, which outside services take part, and how to have your details corrected or erased.

Contact for privacy questions

  • Tourister, Hasan Aliyev 1061, Baku, Azerbaijan
  • Email: info@tourister.az
  • Phone, WhatsApp and Telegram: +994 10 720 70 73

Information you enter in our forms

Tour booking

Full name, email address and phone number; the messengers you tick (WhatsApp, Telegram, Viber or WeChat); the tour date; how many adults, children and infants are coming; group or private; your hotel and room number or another pickup address; a promo or referral code if you have one; and any remarks you add. The request is saved together with the IP address it was sent from.

Transfer booking

Pickup and drop-off points, date and time, flight number, return date and time for a round trip, number of passengers, plus your name, email, phone, preferred messengers and remarks.

Contact form

Name, email, subject and message. The form forwards them to our mailbox as an email.

Reviews

The name you sign with, your rating, title and text, the country and city you decide to mention, and any photos you attach. These are published once a moderator approves the review. Alongside them we keep, unpublished, the IP address of the sender and the country and region that address points to; moderators use this to spot fake or repeated submissions (no more than three reviews per address per hour are accepted).

Blog comments

The comment itself, a name and an email address when you comment without an account, and, recorded automatically, the IP address, the browser identification line and the approximate country and city derived from the IP.

Account

Signing up is optional. An account holds a username, an email address, a password kept only as a one-way hash, and the avatar, website or social links you choose to add. We email a link to confirm the address.

No card details here

None of our forms asks for a bank card. After a request arrives we check availability and get in touch; payment is settled with us directly after that.

Information recorded without you typing it

  • Request log. For every page opened the server stores the IP address, the page address, the referring page, the browser's user-agent line, the time, and your account number if you are signed in.
  • Approximate location from the IP address. The first time an address is seen it is sent to the ip-api.com lookup service, which answers with country, region, city, rough coordinates, internet provider and whether the connection looks mobile or like a proxy. The answer is cached in our database, and the rough coordinates may be passed to OpenStreetMap's Nominatim service to name the area. We use this for visitor statistics, to suggest a display currency and to check reviews and comments for abuse. Your browser is never asked for its exact position.
  • Our own visit statistics. A script on our pages keeps a random visitor code in your browser and reports to our server which pages were viewed, clicks on WhatsApp, Telegram and phone links, steps of the booking form, and clicks from an article to another page. Each report is stored with the IP address, device type, browser, operating system and country. This script sends nothing to anyone but us.
  • Article views and likes. Counted together with the IP address and browser line, so one reader is not counted many times.

Cookies and browser storage

  • currency — cookie, 365 days: the currency you picked for prices.
  • PHP session cookie — holds the security token of our forms and, if you sign in, your login; it ends with the browser session.
  • tr_vid and tr_src — local storage: the random visitor code and where you first arrived from (a search engine, a social network, a link).
  • tr_sid and a few short flags — session storage, cleared when the tab is closed: the current visit.
  • trConsent — local storage: your answer in the analytics consent bar.
  • Cookies of Google Analytics and Yandex Metrica — only once those counters are running (next section).

Refusing or deleting any of these does not stop you from booking.

Google Analytics and Yandex Metrica

We measure traffic with Google Analytics 4 (measurement ID G-ZG2E3KEM6T) and Yandex Metrica (counter 110564897). Metrica runs with its click map and outbound link tracking; Webvisor, its session recording, is switched off.

If your device's clock is set to a European time zone (except those of Russia, Belarus, Ukraine, Moldova and Turkey), including the Canary Islands, Madeira, the Azores, Iceland and the Faroes, a banner along the foot of the screen asks first, and neither counter loads until you press “Yes, allow”. “No, thanks” keeps them off. For everyone else they start after the first scroll, click or key press, or three seconds after the page opens. To change your answer later, clear this site's stored data in your browser and the question will come back.

Other services our pages connect to

  • Hostinger — hosts the website and its database and delivers our emails (booking confirmations, replies, invitations to leave a review).
  • Google Fonts — the typefaces load from Google's servers, which therefore see your IP address.
  • Google reCAPTCHA — screens the contact and sign-up forms for automated spam.
  • OpenStreetMap tiles and the Leaflet library from unpkg.com — on transfer route maps.
  • Google Maps and YouTube — only on the few tour pages that embed a map or a video.
  • WhatsApp, Telegram and phone links — nothing is sent until you tap one; from then on that service's own rules apply.
  • ip-api.com and OpenStreetMap Nominatim — the location lookups described above.

Who sees your booking

Tourister staff; the guide, driver or partner company operating your tour or transfer, who receive what they need to meet you and run the trip; and public authorities where the law obliges us to disclose. We do not sell personal data.

Why we use it

  • to confirm, organise and run the trip you asked for, and to reach you about it;
  • to answer your messages;
  • to publish reviews and comments while keeping spam out;
  • to learn which pages help visitors and to find what is broken;
  • to keep the business records that accounting requires.

How long it stays

The website has no automatic deletion schedule. Booking records are kept as long as the trip and our accounting and tax obligations need them. Logs and statistics are kept while they remain useful for understanding traffic. Published reviews and comments stay until you ask us to take them down. When you ask for deletion we carry it out, unless a law requires us to keep a record, in which case we tell you so.

Your requests

Email info@tourister.az to receive a copy of the details we hold about you, to correct them, to delete them or to stop a particular use. A booking reference, or the email address you used, helps us find the records. You can also decline the analytics counters as described above, and block or delete cookies in your browser at any time.

Children

Bookings are made by adults. For children we note only how many are travelling and whether each is a child or an infant, because prices and seats depend on it.

Changes to this page

When our practice changes, this text is updated and the date below moves with it. Rules on cancelling and refunds are on a separate page: cancellation policy.

Last updated: 4 October 2026