1. Responsible organisation
Sauvage Adventure Limited, registration number 261040900011, registered address Republic of Kazakhstan, Astana city, Yessil district, Mangilik El avenue, building 55/23, block C4.4, office No.334, operates under the Sauvage Adventure brand (the “Company”). The Company contracts with participants for the selected programme, receives payments, engages partners to provide particular services and appoints its own guides. The Company determines the purposes and means of its processing of personal data and is its controller. Data enquiries and rights requests: [email protected]. Processing is governed by applicable AIFC Data Protection Regulations and other mandatory rules.
This Policy describes the Company’s processing and disclosure of necessary information to partners, guides and other recipients. A recipient’s status as a controller or processor depends on who actually determines the purposes and means of processing, not merely its role in delivering the programme. Information about another controller’s independent processing is provided in its own notice; this Policy does not replace it.
2. Data and purposes
Applications and participation: names, contact details, selected departures, experience, preparation and correspondence are used to assess applications, check participation requirements, handle bookings, communicate, and conclude and perform the contract with the Company. The basis is steps requested before a contract and contract performance.
Documents and logistics: necessary passport details, visas, permits, insurance, arrival information and emergency contacts are used to check requirements, arrange services, coordinate with partners and guides and organise assistance. Only information needed for the particular programme is requested. The basis is the contract, applicable legal duties and separate consent where required.
Health: participant-provided limitations, allergies and other material information are used to assess safe participation, implement necessary safety measures, adjust services and organise emergency assistance. This is sensitive data. The primary basis is explicit written consent, including an electronic record. Access is limited to those who need the information for these tasks. In an emergency, another basis expressly permitted by law may apply, including protection of vital interests where the participant is physically or legally incapable of giving consent.
Payments and legal duties: payment amounts, currencies, statuses and references, refunds, contract records and acceptance evidence are used for payments, accounting, legal compliance and protecting rights. The bases are contract performance, legal duties and a legitimate interest in protecting rights balanced against participant rights. Full card details and security codes are not required in the application; payment credentials are processed by the relevant payment provider.
Security and website operation: technical events, device and session information, necessary access logs and action confirmations support private pages, abuse prevention, error diagnosis and evidence of lawful operations. The basis is contract performance, legal duties or the Company’s legitimate interests balanced against user rights. Non-essential tracking requires applicable consent under the Cookie Policy.
3. Required information and sources
Data is supplied by users, authorised group applicants, guides, programme partners and payment providers, or generated through use of the service. Group applicants confirm authority to share the information and receipt of the other participants’ necessary consents, including explicit consent to share health information where provided. This assertion is not treated as the other participants’ personal action: adults personally confirm the documents before their first payment. Emergency contacts must be informed that their contact details have been provided.
Required fields are identified in the form or document request. Without necessary contact details, evidence of meeting requirements and programme documents, the Company may be unable to assess an application, confirm participation or provide the relevant service. Optional information may be withheld. Health information is limited to a text description of matters materially affecting safety; medical files are not requested. This text is held separately from general notes with restricted access and is excluded from the contract PDF, ordinary emails, notifications, analytics and external AI processing.
4. Recipients and international transfers
Access is limited to those needing the data for the relevant task: the Company’s authorised staff; guides appointed by the Company; partners providing particular programme services, transport and accommodation providers; insurers, medical and rescue services; permit authorities; IT, hosting, storage, communications and payment providers; professional advisers and competent authorities where there is a lawful basis.
Each recipient receives only necessary information. Health data is shared only for the stated safety or assistance purposes. Recipients processing data on the Company’s behalf act under written terms and documented instructions, with confidentiality and protection obligations. Recipients determining the purposes and means of their own processing are independent controllers for that processing. Before sharing health information with them, the Company provides their identity, contact details and purposes and obtains necessary explicit consent or establishes another basis expressly permitted by law. General application consent does not cover unidentified independent controllers. If a recipient or purpose changes, the Company provides notice and obtains fresh consent where necessary.
Recipients may be outside the AIFC, including programme destinations and service-hosting countries. Transfers rely on recognised adequate protection or a basis provided by applicable AIFC rules, such as necessary performance of a contract with the participant or in their interests, required written consent or a permit from the Commissioner of Data Protection. Security measures and an agreement with a recipient do not by themselves replace a required transfer basis. General consent does not authorise sharing any data with anyone for unrestricted purposes. Current details of recipients, countries and the applicable basis are available from [email protected].
5. Automated tools
Automated tools, including artificial-intelligence services, may support technical checks of document readability and completeness where there is a lawful basis and appropriate protection. Data shared is limited to the verification task. Medical information is not sent to external artificial-intelligence services under the general application consent; such processing requires a separate legal assessment and any necessary specific consent. Final eligibility decisions are not made solely through automated processing and can be reviewed by a Company staff member at the participant’s request. Data is not supplied for training public models without a separate lawful basis and any necessary consent.
6. Retention and protection
The Company keeps data only as long as necessary for the stated purposes. Retention depends on application assessment, contract performance, accounting requirements, applicable claim periods and protection of rights. Data is then deleted or anonymised unless a legal duty or specific dispute requires further retention. Independent controllers disclose their own retention periods in their notices.
Passport copies and medical information are not automatically retained for the full contract-record period: their necessity is assessed separately and access is restricted. Technical logs and backups have separate retention periods and deletion cycles. Details of the applicable period or criteria for a category are available from [email protected].
Access controls, safeguards for transmission and storage, and private-document access records are maintained. No transmission method eliminates all risk. Following a security incident, the Company fulfils applicable response and notification duties.
7. Rights and enquiries
Where provided by law, users may obtain processing information and access to data, request correction, deletion or blocking, object to processing and withdraw consent. Requests should be sent to [email protected]. Proportionate identity verification may be requested. Responses are provided without excessive delay or expense in accordance with applicable law. Where a request concerns an independent controller known to the Company, it promptly forwards the relevant request or withdrawal to that controller. The right to contact that controller directly remains unaffected.
Withdrawal does not affect the lawfulness of earlier processing or stop processing supported by another independent lawful basis. If withdrawal prevents safe provision of a particular service, the Company explains the consequences and available options; contractual and mandatory participant rights remain unaffected.
Users may also contact the AIFC Commissioner of Data Protection through official AIFC channels or another competent authority. This Policy is not consent to marketing or publication of participant images. Those activities require a separate lawful basis and independent consent where necessary.
8. Updates
The current version is published on the website. Material changes to processing purposes or methods are communicated appropriately, and new consent is obtained where required. A policy update does not automatically expand consent previously given.