Your data is needed for your trips

Updated 31 October 2026

Who is responsible for your data

Your data is the responsibility of the carrier Roman Komarnytskyi s.p. (Dolga Gora 7c, 3232 Ponikva, Slovenia). What you submit through the request form is sent to a server and reaches our staff.

What we collect

• What you enter yourself: first and last name (for the passenger list), phone, preferred way to reach you, optionally e-mail, the service, route, dates, pick-up time, flight or train number, number of passengers and bags, details about children and car seats, for a move — what you are moving, for a parcel — what you are sending, its weight and dimensions, plus your comment.
• Attached automatically: the quote you saw on the site at the moment of sending, the page address, the tags of the link you came through (for example, from an ad — only so we know where the request came from), the country by IP address and what your browser itself reports to websites: its name, version and operating system. This lets us understand what it is about and reply in your language.
• Chat with us on the site — if you write in the chat: your messages, your name and phone (if you gave them), the language, the page you are writing from, the time of the messages and a note of your consent. This is needed to answer your question. Our staff see the messages — in a Telegram bot and in the staff panel; they are stored on Cloudflare servers, and the retention period is the same as for requests.
• Payment — the amount, date, status and payment number in Stripe, the name and e-mail you entered on the payment page, and the card brand and last 4 digits. We never receive the full card number.
• Parcel recipient — the first name, last name and phone number of the addressee you enter when sending. Needed to hand the parcel over in person; only the driver and our staff see them.
• Parcel form — if we sent you a link to the parcel form: first and last name, address, phone and messenger — yours and the recipient’s; the delivery type and speed, what the parcel looks like, weight, dimensions and estimated value, the list of contents, how it should be handed over, and your confirmations that there is nothing prohibited inside, that you agree to the items being inspected before sending and that you hand them over to us for transport. The list of contents and the value are needed for customs, the addresses to hand the parcel over; the label in the link only shows which mailing the form came from. While you fill in the form, what you have entered is kept in the memory of this browser tab and is erased after sending or when you close the tab. Our staff receive only a short card in Telegram — names, phone numbers, type, speed and value; addresses and the list of contents are visible only in the staff panel.
• Seat in the minibus — when you pick a seat, the site asks the server which seats are already taken on your date. Only the date and the cities of the trip are sent, none of your data.
• My account — opens via a personal link that we issue. The link key is stored in your browser’s memory until you press “Sign out” in the account; it is used to show only your trips and parcels and the number of TourCoins in the site header. The phone number in the account is partly hidden.
• Requesting a link to My account — the phone number and name you give so that we can send you the link. The request goes to our staff.
• Parcel tracking — by number you see only the status, cities and dates, with no names, phone numbers or prices.
• Reviews — the home page shows reviews from Google Maps with the authors’ names as published on Google. There is no review form on the site.
• Settings — the site remembers your chosen language in your browser’s memory and in one service cookie (tsLang, for a year) — it is needed only so that we do not switch you to another language automatically, and is used for nothing else.
• Records in your browser’s memory — besides the language, the account key and the friend’s code (described in this list and in the “TourCoins” section), the site stores on your device: tsChat — the chat conversation key and the number of the last message you read, so the conversation continues on any page (erased when you sign out of your account or when we delete the conversation); tsCabBal — the number of TourCoins for the site header, we ask the server no more than once every 5 minutes (erased when you sign out of your account); tsRefX — a note that you closed the friend invitation message; tsLeadDraft — a draft of the request form (first and last name, phone, e-mail, way to reach you) while you move from the request to the calculator and back — until you send the request or close the tab; tsRefWho — the server’s answer about the invitation (your friend’s name and the number of TourCoins) — until you close the tab. These records are kept only in your browser; you can delete them by clearing the site data in your browser settings.
• TourCoins — an account linked to your phone number, your balance and award history, a referral code. More in the section “TourCoins”.

Who we pass it to

• Cloudflare, Inc. — the site runs on its servers, and that is where requests and chat messages are received and stored. Cloudflare processes the data on our instructions; if any of it ends up outside the EU, this is covered by the standard contractual clauses approved by the European Union.
• Telegram — as soon as a request is accepted, its card is sent as a message to our staff on Telegram; chat messages from the site go to the same place. This way we see what you sent straight away. Telegram is a company outside the EU; by submitting a request or a chat message you also consent to this transfer (the GDPR allows this with your explicit consent).
• Stripe (Stripe Payments Europe, Ltd., Ireland) — processes card payments via the link we send you. You enter your card details on Stripe’s page; Stripe processes them as an independent controller under its own policy (stripe.com/privacy) to make the payment and prevent fraud. We never see or store the full card number: we see the amount, date, status and payment number, the name and e-mail entered on the payment page, and the card brand and last 4 digits. Stripe may transfer data to its parent company Stripe, Inc. (USA) — covered by the EU Data Privacy Framework decision and the EU standard contractual clauses.
• The site developer (LOVAI) — as technical administrator of the server, under contract and only to keep the site running.
• Map server (Esri) — sees your IP address while the map layer is loading; more in the section “Cookies and the map”.
• Route calculation on the “Car with driver” and “Moving” pages and in the “Tour builder”. The cities or addresses you enter (or that the form on the home page filled in) are sent by your browser to OpenStreetMap servers: nominatim.openstreetmap.org — to find the place, router.project-osrm.org — to work out the road distance (the tour builder only looks up the place). They see your IP address and these places. They do not reach us unless you submit a request yourself.
• E-mail. E-mails to info@tourslo.net and privacy@tourslo.net are received by Cloudflare (Email Routing); they are kept in our staff panel and read by two members of the company’s staff. Replies to e-mails are sent through the Resend service (USA) — this is a transfer outside the EU.
• No one else. Data is neither sold nor passed to other companies for advertising.

Cookies and the map

We have a single cookie — a service one, for the language; there are no advertising or analytics cookies, and no third-party trackers either: we do not build a profile of your behaviour. The only things loaded from outside are the map layer (Esri), OpenStreetMap services on the route calculation pages (see “Who we pass it to”) and the “I am not a robot” check in forms (more on it below). The map layer loads when the map comes into view, or earlier if you pressed the button on the map itself; at that moment the map server sees your IP address. When you click into a form, the Cloudflare Turnstile check (“I am not a robot”) is loaded: your IP address and browser data are passed to it. To protect the form from automated submissions, we keep your IP address together with a submission counter for up to 2 hours, after which the record is erased. To show prices, the country is determined from your IP address and is not stored by us: your browser remembers it until you close the tab, and the site language does not depend on it. In a request, a chat and a request for an account link, the country is recorded together with the other data.

Legal basis and retention

The legal basis is your consent, the steps needed to prepare a transport contract and its performance (payment). We keep the request and related correspondence while we arrange the trip and while questions about it may still come up, then delete it; payment records (amount, date, payment number) are kept as long as Slovenian tax and accounting law requires — a legal obligation of ours. We keep chat messages and a request for an account link in the same way as a request: while we answer and while questions about them may still come up, then delete them. We keep a parcel form together with its request and delete it together with the request. To have your request, chat messages or link request deleted sooner, write to us.

TourCoins

TourCoins are TourSlo bonus points: they cannot be bought, sold or cashed out. We keep a TourCoin account for you.

• What we keep: an account linked to your phone number; your balance and the history of awards and deductions; your referral code and who invited whom (we recognise an invited friend by a hash (pseudonym) of part of their number, not by the number itself).
• Why: to run the bonus programme — award TourCoins, accept them as payment and keep track of friend referrals.
• How long: as long as the programme runs and the account is active. TourCoins never expire. We delete the request under the rules above, while the TourCoin account is kept separately.
• The transaction log is not edited or deleted by us: we need it for accounting and fraud protection. But at your request (write to us) we will anonymise the account: your name and phone number will be deleted, and the history will remain without a name or phone number. So that the account cannot be set up again from an old link, we will keep only a hash (pseudonym) of part of the number — the number itself will not remain with us in readable form.
• Referral link. The code from a friend’s link is stored in your browser’s memory for up to 90 days and attached to your request — that is how we know who invited you. The code is shown at the top of the page, in the invitation message, so you can give it to the manager if you book by phone or by message.
• Inviting a friend. A friend who opens your link sees that you invited them: we show them your name — as you are registered with us — and tell them about their TourCoins. You both get TourCoins when they first travel with us; the award is made once that trip has taken place, and parcels do not count.

Promotional messages

If you have already travelled with us or sent a parcel (we hold your request), a member of our team may occasionally message you on WhatsApp, Viber or Telegram about a new offer — for example the “Website update gift”: a personal link to your account where you can spin the TourCoin wheel for free. A person writes these by hand, not a robot. We do not send such messages to people who have never ordered anything from us.

• Basis: our legitimate interest in telling past customers about similar services. This is permitted by the rules on messages to a company’s own customers (ePrivacy Directive, Art. 13(2); in Slovenia — ZEKom-2), provided every message offers a simple way to opt out.
• How to opt out: every such message contains the line “If you do not want to receive such messages, reply ‘stop’.” After that your number goes on a “do not message” list. You can also object in writing — write to us.
• What the “do not message” list holds: not the number itself but a hash (pseudonym) of its last 8 digits, and a masked version of the number — only so that we do not write to you again. The “sent” marks are stored the same way.

Your rights and where to write

You can find out what we hold about you, have it corrected or deleted, restrict how it is processed or object to it. You can withdraw your consent at any time and ask for a copy of your data. We reply within one month. If you believe we have breached your rights, you can complain to the data protection supervisory authority — in Slovenia that is Informacijski pooblaščenec (the Information Commissioner).

To have your request deleted or to find out what we hold about you, write to: privacy@tourslo.net — we will reply and carry out your request.

Ask about my data

The site’s photo credits are on a separate page.