Privacy Policy

1. Data Controller

Primiaco OÜ
Sakala 7, 10141 Tallinn, Estonia

2. Data We Collect

We collect the following personal data to process your ticket bookings:

• Account data: email address and password (hashed)
• Passenger data: full name, passport/ID number, document type, date of birth, document expiry date, nationality, gender
• Contact data: phone number, email for notifications
• Booking data: travel dates, routes, train numbers, seat preferences
• Payment data: processed by Stripe; we do not store card details

3. Purpose of Processing

Your data is processed exclusively to:

• Book train tickets on 12306.cn on your behalf
• Send booking confirmations and status updates
• Process payments for our service
• Provide customer support

4. Data Sharing

Your passenger data (name, document number, nationality) is transmitted to China Railway (12306.cn) as required to complete your booking. Payment data is processed by Stripe, Inc. We do not sell or share your data with any other third parties.

5. Data Retention

We retain your account and booking data for the duration of your account plus 12 months after deletion. Booking records may be retained longer as required by applicable tax and accounting regulations.

6. Your Rights (GDPR)

Under EU data protection law, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Lodge a complaint with a supervisory authority

7. Security

We use industry-standard encryption (TLS) for all data in transit and store passwords using secure hashing algorithms. Access to personal data is restricted to authorized personnel only.

8. Cookies

We use essential cookies for authentication (JWT session token stored in localStorage). We do not use tracking cookies or third-party analytics.