Zookzy — multi-country travel

Zookzy Privacy Policy

Controller of personal data: Zookzy AI Technologies (Pvt) Ltd, brand Zookzy (hereinafter, the "Company", "we", "us", "our").

Contact details and statutory information are published on the Contacts page.

This Privacy Policy (the "Policy") governs the processing of users' personal data when using our websites, mobile applications, APIs, bots, and related services (together, the "Service").

Applicable law: the operator is established in Asia and complies with the Personal Data Protection Act No. 9 of 2022 (PDPA Asia), and — where applicable — the GDPR, UK GDPR, and other laws in the user's jurisdiction.

Data Protection Officer (DPO): [email protected] (Data Protection Officer).

1. Scope and age restriction

The Service is intended solely for persons aged 18 or over. The Company does not knowingly collect personal data from minors in a targeted manner. If we become aware that a child's data were provided without the consent of a parent or legal guardian, such data will be deleted without undue delay. If you believe a child has provided us with their data, please contact us via Contacts.

2. Categories of personal data we process

2.1. Identification and account data

Display name, email address, password hash, unique user identifiers, profile data obtained through OAuth (when you sign in via third-party services), language preferences, region, referral or partner codes.

2.2. Listing and commercial content data

Text, photos, video, geolocation data, prices, availability information, and payment details that the user voluntarily publishes in a listing.

2.3. Transaction and operation data relating to Zookzy platform services

Records of payments for paid listing placement, "boost" services, top-ups of the internal wallet, subscriptions, and other platform features.

Zookzy does not process or store data about payments that the user makes directly to a service provider (cash, transfers, payment terminals, etc.), because the Company is not a party to those settlements. Signals from anti-fraud systems relating to account activity may also be recorded.

2.4. Usage and device data

IP address, approximate geolocation (based on IP or device data), user agent, page views, timestamps, search queries, clicks, diagnostic data, error logs.

2.5. Communication data

Messages in cooperation requests, support enquiries, and (where you use the relevant features) voice recordings or transcripts thereof.

2.6. Security data

Account login history, CAPTCHA verification results, rate-limit counters, device fingerprinting used to prevent abuse.

2.7. Marketing data (where consent applies)

Mailing preferences and data used to send promotional emails where the law requires explicit user consent.

2.8. Listing SMS notifications (where consent applies)

Where a provider enables SMS for a listing, we process the phone number in the listing and the content of transactional SMS (cooperation requests, verification codes, Honesty programme PINs, request status updates) to deliver notifications via our SMS gateway or telecom operator. Promotional SMS are not sent without separate consent. Consent is recorded when the listing is published (web form or bot) and may be withdrawn via My data or support; withdrawal does not affect the lawfulness of processing before withdrawal.

3. Purposes of processing and legal bases

Personal data are processed on the following bases and for the following purposes:

Legal basis	Purposes of processing
Performance of a contract (Article 6(1)(b) GDPR; PDPA Asia — lawful basis "contract" / analogous provisions in other jurisdictions)	Operating your account, publishing listings, enabling interaction between users, and fulfilling our obligations to the user.
Legitimate interests of the Company	Ensuring Service security, fraud prevention, product usage analytics, content moderation, internal reporting, and improving functionality.
User consent	Processing non-essential cookies, marketing campaigns where required by law, and enabling experimental features, as well as transactional SMS notifications to the provider about a listing (with separate consent at publish). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
Legal obligation	Compliance with tax law, responses to lawful requests from public authorities, and execution of court decisions.

Where consent is withdrawn, the Company ceases processing based on that consent unless another lawful basis permits continued processing of the same data.

4. Automated decision-making and artificial intelligence

The Company uses machine learning and artificial intelligence algorithms for listing ranking, recommendations, risk assessment, spam detection, transcription of voice messages, and support chatbots.

Automated profiling does not produce legal or similarly significant effects concerning the user within the meaning of Article 22 GDPR without separate notice. If fully automated decision-making with legal effects is introduced, the Company will notify users separately. Users may request human review of a moderation decision where applicable law so provides.

5. Disclosure of personal data to third parties (sub-processors)

The Company does not sell personal data in the sense of exchanging information for monetary consideration. Data may be shared with the following categories of recipients:

Your counterparties: when you submit a cooperation request or disclose contact details — limited to the information you yourself provide.
Infrastructure providers: hosting, DNS, CDN, email and SMS services, logging and backup systems (under confidentiality agreements).
Mapping and geolocation services: when you use maps or reverse geocoding, coordinates may be sent to third-party APIs (e.g. Google Maps).
AI and speech-recognition providers: limited data are transmitted as needed for those features.
Payment gateways: when you top up the internal wallet, you are redirected to our payment partner’s hosted checkout (SriPay, WebXPay, PayHere, etc.). Card numbers, CVV, and other payment credentials are entered only on the partner’s page (PCI DSS). Zookzy receives and stores payment status, amount, and order reference metadata only — not full card data.
External messengers and communication channels: when you follow a link to WhatsApp, Telegram, or Viber, make a phone call, or use another external service, you leave the Zookzy Service. Further processing of personal data (including phone numbers, messages, and files) is governed by those external services' policies. Zookzy does not control and is not responsible for processing after you leave the Service in that way.
Public authorities: on the basis of lawful requests or to protect vital interests.
Successors in reorganisation: in a merger, acquisition, or sale of assets, data may be transferred to a new controller subject to an equivalent level of protection.

See our public Subprocessors register for the current list of infrastructure and service partners.

6. International transfers

Where data is stored: Zookzy AI Technologies (Pvt) Ltd is established in Asia, but our primary platform infrastructure (application and PostgreSQL database) is hosted by subprocessors in United States / European Union (primary application and database). This is our default model (Tier 0): PDPA Asia does not require all servers to be physically located in Asia where appropriate cross-border safeguards are in place.

Data may also be processed in other countries where subprocessors operate (CDN, LLM, email/SMS). See our Subprocessors register. We maintain a Transfer Impact Assessment (TIA) and data processing agreements (DPA/SCC) with providers.

For data subjects covered by the GDPR or UK GDPR, we use Standard Contractual Clauses (SCCs), adequacy decisions, or other permitted mechanisms, plus supplementary technical measures (encryption, data minimization, admin access logging).

If binding law or a direction from the Data Protection Authority of Asia requires in-country storage, we will implement a phased residency plan (hybrid or full SL) and notify users via an updated Policy.

7. Retention periods

Account and listing data are retained for as long as the account remains active. After account deletion or receipt of a deletion request, the Company erases or anonymises personal data within a reasonable period (usually no more than 21 days under PDPA Asia or 30 days under the GDPR, whichever applies), except where longer retention is required:

to comply with legal obligations (e.g. financial records in accordance with tax-law retention periods);
for anti-fraud and security purposes;
for backups (until automatic rotation of copies).

Chat messages (including cooperation requests) are retained for the life of the account or until deleted by the user. After account deletion, messages may be anonymised or deleted, except where they are needed for fraud investigations or complaints (in such cases — for up to one year from the last message).

Aggregated statistics that do not identify a data subject may be retained indefinitely.

8. Cookies and similar technologies

The use of cookies is described in the separate Cookie Policy. Strictly necessary cookies (enabling sign-in, security, and language choice) are processed on the basis of legitimate interest. Marketing and analytics cookies are processed on the basis of user consent.

9. Data subject rights

Depending on your jurisdiction, you may have the following rights:

right of access to your personal data;
right to rectification of inaccurate data;
right to erasure ("right to be forgotten");
right to restriction of processing;
right to data portability;
right to object to processing based on legitimate interests;
right to withdraw consent at any time;
right to lodge a complaint with a supervisory authority (in the EEA, with your national data protection authority; in Asia, with the Data Protection Authority of Asia — dpa.gov.lk).

Self-service (recommended): sign in and open My data & privacy to export a ZIP, delete your account, manage cookies, enable "Do Not Sell", and view your consent history.

For rectification, restriction of processing, or other requests, use My data & privacy or contact us via Contacts with the subject "Privacy" / "Confidentiality". The Company may ask you to verify your identity. A response will be provided within the time limits set by applicable law (usually within 21 days under PDPA Asia or 30 days under the GDPR).

10. Security measures

The Company implements organisational and technical measures to protect personal data against unauthorised access, destruction, alteration, blocking, and other unlawful processing. Further detail is provided on the Security page. Nevertheless, absolute security of data transmitted over the Internet cannot be guaranteed.

You are responsible for the security of your device (antivirus protection, updates, avoiding compromised or rooted environments) and for the confidentiality of messenger and phone conversations after contact details have been disclosed through the Service. Zookzy does not guarantee protection of data that you voluntarily share with third parties outside the Service's technical environment.

11. Third-party links and external communication channels

Listings and user content may contain links to external resources (websites, social networks) and contact details for messengers (WhatsApp, Telegram, Viber, etc.), phone calls, or SMS. Zookzy does not control and is not responsible for the privacy practices, security, or data processing on such external resources or channels once you initiate interaction outside the Service. We recommend reviewing the policies of the relevant third-party services.

12. Changes to this Privacy Policy

The Company may amend this Policy. Users will be informed of material changes by publishing a new version on this page and, where appropriate, by email or in-Service notice. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

13. Contact

All questions regarding the processing of personal data and data-subject requests should be sent to:

[email protected] (DPO / Data Protection Officer);
the Contacts page, subject line clearly marked "Privacy" / "Confidentiality";
or My data & privacy in your account (registered users).

For suspected data breaches or unauthorised access, the email subject must also include "URGENT SECURITY" in addition to "Privacy" / "Confidentiality".