Who controls your information

Arkhipelag is responsible for the personal information collected through Arkhipelag.

Information we collect

For accounts and bookings we collect your name, telephone number, email address, country, participant names, selected experience, date and payment status. Partnership enquiries include the details entered in that form. Technical security logs may include IP address, browser information and request time.

How we use it

We use this information to manage your account, process bookings, issue vouchers, provide customer support, prevent fraud and comply with accounting or legal obligations.

Identity verification

Before payment, we may ask you to complete an identity check powered by Didit. Document images, identity details and biometric information required by the selected verification workflow are collected and processed in Didit’s hosted interface. Arkhipelag stores the verification session reference, consent time and result status, but does not store your document images. See Didit’s privacy notice for information about its processing.

Payments

Payment credentials are collected by the chosen payment provider. We retain the provider transaction reference and payment status, but not card numbers or online-banking credentials.

Sharing

Necessary data may be shared with Didit for identity verification, the experience supplier, and service providers involved in payment and email delivery, only to the extent needed to provide the service or comply with law.

Retention and security

Data is retained only as long as necessary for fulfilment, support and legal obligations. Passwords are stored as one-way hashes, account sessions use secure cookies, administration access is restricted and production traffic uses HTTPS.

Your choices

You may request access, correction or deletion of your personal data, subject to legal retention requirements, by contacting support@arkhipelag.shop.