Privacy Policy

A1. Summary

• You can read the website without giving us any personal data. Our servers only process the technical data every web request carries (e.g. IP address).
• We receive your name, contact details and message only when you submit a form yourself — and only after you have agreed to this policy.
• Please do not include health data, political or religious views, criminal records, military service details or similar sensitive information in forms. If such information is relevant for your case, we discuss it in a consultation; you may only include it in the form if you give a separate, explicit consent.
• We use no advertising cookies and no tracking cookies. One functional cookie stores your language choice.
• Service providers outside the EU/Russia are involved (e.g. Telegram for internal notifications, Anthropic for the optional AI concierge). Details: sections A5 and A7.
• You can request access, correction or deletion of your data and withdraw your consent at any time — see section A10.

A2. Controller and contact

The controller within the meaning of Art. 4(7) GDPR and the operator within the meaning of 152-FZ is:

For all data protection questions and requests write to us via Telegram @emigration_mir. Further legal information: Legal notice (Impressum).

A3. Scope and servers

This policy applies to our official websites one-way-ticket.co, one-way-ticket.company, one-way-ticket.org, onewayticket.company, onewayticket.ltd, onewayticket.pro, one-way-ticket.online and to requests you send us through them.

The website is operated on two servers: one in Germany (EU) and one in the Russian Federation. Depending on the domain and network route through which you reach the website, your request is processed by one of these servers. Data you enter in a form is first stored on the server that received it. Personal data of citizens of the Russian Federation is first recorded and stored in databases located in Russia (see Part B).

A4. What we process, why, and on which legal basis

4.1 Visiting the website (server logs and abuse protection).

• Data: IP address, date and time, requested URL, referrer URL, browser and operating system (user agent), HTTP status and transferred data volume.
• Purpose: delivering the website, ensuring its stability and security, detecting and preventing attacks and spam (e.g. rate limiting of forms: counters per IP address are kept only in server memory for at most 24 hours).
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure, working website.
• Retention: log files are deleted after 14 days at the latest, unless a specific security incident has to be investigated.

4.2 Consultation request / contact form.

• Mandatory data: name, one contact (Telegram username, WhatsApp or phone number). Optional: email address, general topic of your request (e.g. work, study, family), free-text message. Automatically added: the page language, the product you selected (e.g. a route map), the date and time and the version of the consents you gave.
• Purpose: answering your request, preparing an offer and a consultation, performing the contract you conclude with us.
• Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract at your request, performance of a contract) and Art. 6(1)(a) GDPR (your consent given via the checkbox).
• Special categories of data (Art. 9 GDPR): we do not ask for them. If you nevertheless include such information in your message, we process it only on the basis of your separate explicit consent (Art. 9(2)(a) GDPR) — see section A4.3.
• Retention: see section A8.

4.3 Sensitive information (Art. 9 and Art. 10 GDPR).

Migration cases can involve information about health, ethnic origin, political opinions, religious beliefs, sexual orientation, criminal proceedings or military service. Such data needs special protection. Therefore: (1) our forms do not ask for it; (2) you may only include it in a form if you tick the separate, optional box for explicit consent — otherwise please leave it out; (3) data relating to criminal convictions and offences (Art. 10 GDPR) should not be sent through the website at all — we discuss it only in a personal consultation and document it only to the extent permitted by law; (4) access is limited to the persons working on your case. You can withdraw an explicit consent at any time with effect for the future.

4.4 Newsletter.

• Data: email address, the page where you subscribed, page language, date and time of your consent.
• Purpose: sending information about new destinations, guides and offers by email.
• Legal basis: Art. 6(1)(a) GDPR (consent); for Germany additionally § 7(2) no. 2 UWG.
• Double opt-in: we will only send a newsletter after you have confirmed your address via a confirmation link sent to that address. As long as you have not confirmed, you will not receive any newsletter.
• Withdrawal: at any time, e.g. by a message to us via Telegram @emigration_mir or via the unsubscribe link contained in every newsletter.
• If we engage an email delivery service, we will name it in this policy before the first newsletter is sent.

4.5 AI travel concierge (optional).

• Data: the question you type (max. 300 characters) and the page language. Your IP address is not forwarded to the AI provider.
• Recipient: Anthropic PBC, San Francisco, USA, which generates the answer with its Claude language model on our behalf.
• Purpose and legal basis: answering your question — Art. 6(1)(b) GDPR (a service you request) and Art. 6(1)(f) GDPR.
• We do not store your questions. Under its commercial terms Anthropic does not use API inputs to train its models and deletes them after a limited retention period, unless longer retention is required for safety or legal reasons.
• Do not enter personal data in the concierge. The answers are generated automatically, may be inaccurate and are not legal advice.
• Concierge questions are processed only by our server in Germany. If you use the website via the Russian server, your question is passed through to the German server without being stored in Russia.

4.6 Internal notifications via Telegram.

To be able to answer quickly, our team is notified about new requests and subscriptions through the Telegram Bot API in a closed internal Telegram chat. Where our server stores the request locally first, the notification contains only the minimum needed (name, contact, selected product/topic, language, reference number) and not your free-text message. Legal basis: Art. 6(1)(b) and (f) GDPR. Provider: Telegram (Telegram group of companies, Dubai, United Arab Emirates). See section A7 on international transfers.

4.7 Contacting us via messengers and social networks.

If you write to us on Telegram, WhatsApp or Instagram, the respective provider processes your data under its own privacy policy; we process the content of your messages to answer you (Art. 6(1)(b) and (f) GDPR). Links to these services on our website are plain links — no data is transmitted to them before you click.

4.8 Images (Unsplash).

Most images are loaded by our server and delivered from our own domain. Some images are loaded by your browser directly from the image service of Unsplash Inc. (Montréal, Canada) and its content delivery network; in this case your IP address and browser information are transmitted to Unsplash. Legal basis: Art. 6(1)(f) GDPR (attractive, fast presentation of the website).

4.9 Weather data (Open-Meteo).

On travel pages with the “right now” planner, your browser retrieves the current weather for the city you selected from the Open-Meteo weather service (api.open-meteo.com). Only the coordinates of the selected city are sent — not your location — but, as with any request, the weather service sees your IP address. Legal basis: Art. 6(1)(f) GDPR.

4.10 Location (optional).

If you press “Use my location”, your browser asks for permission to access your location. The coordinates are used exclusively inside your browser to find the nearest city; they are not sent to us or to anyone else. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give via the browser prompt and can revoke in your browser settings.

4.11 Web analytics (Plausible, only if enabled).

We may use Plausible Analytics (Plausible Insights OÜ, Tartu, Estonia, EU) to count page views. Plausible uses no cookies, creates no user profiles and does not store IP addresses; only aggregated statistics are produced. Legal basis: Art. 6(1)(f) GDPR.

Status on this server: no analytics service is currently enabled.

4.12 Payments and contract documentation.

If you order a paid service, we process the data required for invoicing and payment (name, address if needed for the invoice, payment amount, payment reference and the bank/payment details you use). Legal basis: Art. 6(1)(b) and (c) GDPR (contract and statutory accounting and tax obligations).

A5. Recipients and service providers

We do not sell personal data. We disclose data only to the following recipients, only to the extent necessary, and — where they act on our behalf — under data processing agreements (Art. 28 GDPR / Art. 6(3) 152-FZ):

We submit documents to consulates, migration authorities or partners in the destination country only when this is part of the service you have commissioned and on your instruction.

A6. Cookies and local storage

We use only storage that is strictly necessary to provide the website functions you request (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). No advertising, marketing or cross-site tracking cookies are used, so no cookie banner is needed.

You can delete cookies and site data at any time in your browser settings; the website will then use the default language again.

A7. Transfers to countries outside the EU/EEA

• USA (Anthropic): on the basis of the EU–U.S. Data Privacy Framework adequacy decision where the recipient is certified, otherwise the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) included in the provider’s data processing terms.
• Canada (Unsplash): adequacy decision of the European Commission for Canada (commercial organisations), Art. 45 GDPR.
• United Arab Emirates (Telegram): there is no adequacy decision and no standard contractual clauses are available for this use. The transfer takes place because it is necessary for steps taken at your request prior to entering into a contract (Art. 49(1)(b) GDPR). We keep the notification to a minimum.
• Russian Federation (our Russian server): there is no adequacy decision. If you reach the website via the Russian server, your request is processed there because this is necessary to deliver the website and to take the steps you request (Art. 49(1)(b) GDPR). If you are located in the EU, you can contact us via Telegram or email instead of the form.

A8. Retention periods

After a period expires, data is deleted or anonymised.

A9. Obligation to provide data and automated decisions

You are not obliged to provide personal data. Without a contact we cannot answer a form request. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The AI concierge only provides general information and makes no decisions about you.

A10. Your rights

• Access to your data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing before the withdrawal is not affected

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons.

To exercise your rights, contact us via Telegram @emigration_mir. We may ask you to confirm your identity (e.g. by writing from the contact you gave in your request). We answer within one month (Art. 12(3) GDPR).

Right to lodge a complaint: you have the right to complain to a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

A11. Security and minors

The website is transmitted only in encrypted form (HTTPS/TLS). We protect data by technical and organisational measures appropriate to the risk, including access restriction to the persons who need the data for their work, rate limiting and spam protection of forms. No internet transmission is completely secure; for particularly sensitive documents we agree a secure channel with you.

Our services are aimed at adults. We do not knowingly process personal data of children under 16 without the consent of their parents or guardians.

B1. Russian Federation: operator and general provisions

This part is the policy of the operator regarding the processing of personal data under Art. 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (152-FZ). It applies to personal data processed by the operator, including via the website. The operator:

The consent to processing of personal data is a separate document: Consent to personal data processing.

B2. Purposes, categories of data subjects and data

Special categories of personal data (Art. 10 152-FZ: race, nationality, political views, religious or philosophical beliefs, health, intimate life, criminal record) and biometric data (Art. 11) are not collected through the website. Where their processing is necessary for a specific service, it takes place only with the separate written consent of the data subject (Art. 10(2)(1) 152-FZ) outside the website forms. Please do not include such data in forms.

B3. Actions, methods and localisation

Actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), blocking, deletion and destruction. Processing is carried out with and without the use of automation tools.

Localisation (Art. 18(5) 152-FZ). When personal data of citizens of the Russian Federation is collected, including via the internet, the recording, systematisation, accumulation, storage, clarification and extraction of such data is carried out using databases located on the territory of the Russian Federation. Requests received by the Russian server are first recorded in a database on that server; only afterwards is a minimal notification sent to the operator’s internal chat.

B4. Transfer to third parties and cross-border transfer

The operator may entrust processing to the hosting providers named in section A5 under an instruction meeting the requirements of Art. 6(3) 152-FZ. Cross-border transfer (Art. 12 152-FZ) is carried out only after notifying Roskomnadzor, only to the extent necessary and in the following cases: notifications through the Telegram service (United Arab Emirates) with minimal data; storage and processing on the operator’s server in Germany where the request was received there. Questions to the AI concierge are passed through to the operator’s server in Germany without being stored in Russia and are answered there using Anthropic (USA); users are asked not to enter personal data in them. The operator does not disseminate personal data (does not make it available to an indefinite number of persons).

B5. Retention periods and termination of processing

• Personal data is kept no longer than required by the purposes of processing (Art. 5(7) 152-FZ) — the periods are listed in section A8.
• When the purpose is achieved, the data is destroyed within 30 days (Art. 21(4) 152-FZ), unless otherwise provided by a contract or federal law.
• When consent is withdrawn, processing stops and the data is destroyed within 30 days (Art. 21(5) 152-FZ), unless the operator has another legal basis for processing.
• Destruction is documented as required by Roskomnadzor rules.

B6. Rights of the data subject

• to receive information about the processing of their personal data (Art. 14 152-FZ);
• to demand clarification, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• to withdraw consent to processing (Art. 9(2) 152-FZ);
• to appeal against actions or omissions of the operator to Roskomnadzor (the authorised body for the protection of the rights of personal data subjects) or in court (Art. 17 152-FZ).

Requests are sent to the operator via Telegram @emigration_mir. The request must contain information allowing us to identify you and to confirm your relationship with the operator (e.g. the contact given in the request). The operator answers within 10 working days of receipt; this period may be extended by no more than 5 working days with a reasoned notice (Art. 14(3) and Art. 20 152-FZ).

B7. Measures to protect personal data

The operator takes the legal, organisational and technical measures required by Art. 18.1 and Art. 19 152-FZ, including: appointing a person responsible for organising processing; adopting this policy and publishing it; restricting access to personal data; encrypted transmission (TLS); protection of forms against automated abuse; accounting of data carriers; assessing the harm that may be caused to data subjects; and internal control of compliance.

Changes to this policy

We update this policy when our services, service providers or the legal requirements change. The current version is always available on this page; the date of the last update is shown at the top. Consents you gave remain linked to the version in force at that time.