Privacy policy

1.1. The controller is Sky Digital Lab LLC (EDRPOU code 40906769), 3 Denysa Monastyrskoho St., building 37, Kyiv, 03035, Ukraine. Contacts: info@anytrain.com.ua, +38 (096) 718-01-28.

1.2. AnyTrain acts as a ticket sales agent of JSC Ukrzaliznytsia. Tickets are issued in the passenger’s name, so to issue and refund them we process the data required by the carrier’s rules and the law.

2.1. Buyer data: phone number, email, name; history of orders, requests and refunds.

2.2. Passenger data: surname, first name and, where needed, date of birth and details of a document confirming identity or a discount — only to the extent the carrier requires for a given ticket.

2.3. Payment data: amount, status and transaction ID, masked card number (only a few digits), issuing bank. The full card number, expiry date and CVV are processed only by the payment provider; we do not receive or store them. For Auto-purchase, we store in encrypted form a card token issued by the payment provider, which can only be charged through that provider.

2.4. Auto-purchase and tracking data: route, dates, seat preferences, budget, passengers, search and notification history.

2.5. Technical data: IP address, device and browser type, operating system, language, device or app identifier, date and time of actions, pages and screens viewed, cookies and similar technologies.

2.6. Correspondence: the content of your requests to support by email, messengers and phone.

2.7. Document acceptance data: the version of the Offer and the Policy, date and time, channel (website, iOS or Android app), IP address, device identifier, Order number.

2.8. Diia.Signature verification data (only if you complete it): surname, first name, patronymic and taxpayer registration number (RNOKPP) from your Diia.Signature certificate, plus the date of birth and sex derived from the RNOKPP. We do not store the RNOKPP itself — only a cryptographic fingerprint computed with a secret key kept separately from the database, to detect the same identity being used across different accounts. Only authorised staff can access verification data, and every view is logged.

3.1. Performance of the contract — searching, reserving, issuing, paying for and refunding tickets, Auto-purchase, Personal account, service notifications, support.

3.2. Legal obligations — accounting, tax reporting, responses to requests from authorised bodies.

3.3. Legitimate interest — preventing fraud and abuse (including mass unpaid reservations and use of other people’s cards), security of the Service, protecting our rights in disputes, analysing and improving the Service. This includes keeping a record of document acceptance as evidence that the Agreement was concluded.

3.4. Legitimate interest — keeping Customers informed — emails, in-app messages and push notifications about AnyTrain services: new features and changes to the Service, ticket sale openings, routes, timetables, offers and promotions. We send them to people who have used the Service, using the contact details you provided. You can opt out at any time via the link in every email, in your Personal account or in the app settings; once you opt out, we stop sending them.

3.5. Identity verification via Diia.Signature — preventing fraud and ticket speculation, matching the passenger’s name, and confirming eligibility for restricted seats (including women-only compartments). You start the verification yourself and confirm it in the Diia app; the legal bases are performance of the contract and legitimate interest. If Booking or Auto-purchase was restricted because of a verification result, you can ask for the decision to be reviewed by a staff member by writing to info@anytrain.com.ua.

3.6. Consent — marketing SMS and messenger messages, advertising cookies and personalised advertising on third-party services. You can withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal.

4.1. We share data only to the extent needed for the relevant purpose:

4.2. We do not sell personal data.

4.3. Some providers are located outside Ukraine (EU, USA). Transfers are made in accordance with Article 29 of the Law of Ukraine “On Personal Data Protection” — to countries that ensure adequate protection, or on the basis of agreements with providers or your consent.

5.1. Necessary cookies enable sign-in, the cart, language and security and cannot be disabled.

5.2. Analytics cookies (Google Analytics, Microsoft Clarity) help us understand how the Service is used, improve it and detect failures; we use them on the basis of legitimate interest. Microsoft Clarity may record interactions with the interface (clicks, scrolling); fields for personal and payment data are masked. You can opt out of analytics by blocking cookies in your browser settings or installing the Google Analytics Opt-out add-on.

6.1. To protect customers and the Service, we analyse technical data, the number of reservations and payments, the number of different Passengers, and matches between devices, phone numbers and cards. If there are signs of fraud or speculation, we may limit reservations, require additional confirmation, block access and linked accounts, and notify the Carrier. Booking tickets for close relatives, including from abroad, is not a reason for blocking. Decisions that significantly affect you are reviewed by a staff member at your request within 14 calendar days.

7.1. We keep data for as long as necessary for the purpose of processing and legal requirements.

7.2. Data on issued and paid tickets and payment documents is kept for the period required by tax legislation (as a rule 1,095 days from filing the relevant reports, longer where the law requires) and for the limitation period to protect rights in possible disputes.

7.3. Technical logs are kept for up to 12 months. Auto-purchase data is kept until the search and related settlements are completed. A card token is deleted when the card is unlinked. The document acceptance record is kept while the Agreement is in force and for three years after the last Order (the limitation period). Data on blocking and Suspicious activity is kept for up to three years after the last breach. Diia.Signature verification data is kept while the account exists and for three years after the last Order.

7.4. After these periods, data is deleted or anonymised.

8.1. You can delete your account in the app (“Profile” → “Delete account”) or by writing to info@anytrain.com.ua. Your profile, phone number as a sign-in method, saved passengers and search history are deleted immediately; backups within 30 days.

8.2. After deletion you cannot refund a ticket yourself in the app — refund tickets before deleting your account or contact support with the order number.

8.3. Data that we must keep by law (clause 7.2) and irreversible technical identifiers used to prevent abuse (including the RNOKPP fingerprint) are retained after account deletion for the periods set out in clause 7.3.

9.1. Under Article 8 of the Law of Ukraine “On Personal Data Protection”, you have the right to know the sources, purpose and location of processing of your data, to access it, to request its correction or deletion, to object to processing, to withdraw consent, and to complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

9.2. Send requests to info@anytrain.com.ua from the phone number or email linked to your account. We respond within 30 calendar days and may ask you to confirm your identity.

10.1. We use encrypted connections, encryption of card tokens, role-based staff access and activity logging. No system can guarantee absolute security; in the event of an incident that poses a risk to you, we will notify you and, where required, the competent authority.

11.1. The Service is intended for persons aged 18 and over. Data of minor passengers is processed only to issue their tickets and is provided by parents or other legal representatives.

12.1. We may update this Policy by publishing a new dated version on this page. We will inform you of material changes in the Service or by email.

12.2. This Policy is published in Ukrainian; translations are provided for convenience and the Ukrainian text prevails in case of discrepancy.