Sign inCreate account
Legal information

Privacy Policy

This policy explains which personal data we collect when purchasing bus tickets, for what purposes we process them, and what your rights are. We are committed to protecting your privacy.

1. Data controller

The controller of your personal data is the Seller, which operates through the website panonex.com:

Name
Panonex LLC
Address
30 North Gould Street, Sheridan, Wyoming 82801, USA
PIB
—

2. Which data we collect

To complete the purchase and issue the ticket, we collect only the following data:

  • passenger's first and last name;
  • email address (for ticket delivery and communication);
  • phone number (for contact);
  • journey data (route, date and time of departure, carrier).

In addition, we record visits to the site without cookies, including the steps of search and purchase, for the aggregate statistics described in section 3.

If you allow analytics in the cookie notice, we also collect data on how you use the site, as described in section 3.

If you allow Google Ads in the cookie notice, we also record whether a booking followed a click on one of our ads, as described in section 3.

3. Purpose of data processing

We process your data in order to complete the purchase and issue the ticket, deliver the ticket to your email address, and to contact you regarding your order (confirmations, changes, support and complaints).

We do not use the data for purposes for which we have not obtained a legal basis or your consent.

We measure visits to the site with Umami, open-source software that runs on our own server. The visit data stays on that server, and we do not pass it on to third parties.

Umami sets no cookies and stores nothing on your device. It does not follow you across other websites, and it does not link visits to your name, email address, phone number or order.

We record the pages visited and where the visit came from, the type of device, browser and operating system, the browser language, the screen size, the approximate location (country, region and city) and the steps of search and purchase (route, number of seats and amount).

Umami uses your IP address only while it receives the data: it derives the approximate location from it and, together with your browser details, computes a pseudonymous visitor identifier that changes at least once a month. The IP address itself is not stored.

The legal basis for this processing is our legitimate interest in measuring overall visits to the site and improving it on that basis. We use the data only for aggregate statistics, not for advertising or profiling.

You can object to this processing at any time. The button below stops the counting of your visits in this browser. At your request, the choice is remembered in this browser only, so repeat it in any other browser or on any other device.

If you allow it in the cookie notice, we use Google Analytics 4 (Google Ireland Limited, with its parent company Google LLC) for aggregate statistics on how the site is used. The legal basis for this processing is your consent; without it, Google Analytics is not loaded.

We process a pseudonymous identifier from the cookie, the pages visited and how you arrived, your device and browser type, your approximate location and the steps of your search and purchase (route, amount and order number). We do not send your name, email address or phone number. Google Analytics 4 does not log or store IP addresses: it derives the approximate location from the IP address when the data arrives and then discards the address.

Google Analytics keeps event-level data for no longer than 14 months and then deletes it automatically; only aggregate reports remain after that. The data may be transferred to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

You can withdraw your consent at any time, as easily as you gave it, without affecting the lawfulness of processing before the withdrawal:

If you separately allow it in the cookie notice, we use Google Ads (Google Ireland Limited, with its parent company Google LLC) to measure which of our ads lead to bookings and to spend our advertising budget accordingly. The legal basis for this processing is your consent; without it the Google Ads tag does not load.

We process the ad click identifier, which Google adds to the page address and we keep in the _gcl_aw cookie (_gcl_ag or _gcl_gb on some devices), a pseudonymous identifier from the _gcl_au cookie, the address of the page the tag loads on (never your order's page) and, once you complete a booking, the order number and what it is worth to us. We do not send your name, email address or phone number, and ad personalisation and remarketing are switched off.

Google Ads cookies expire after 90 days. Data may be transferred to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

You can withdraw your consent at any time, as easily as you gave it, without affecting the lawfulness of processing before the withdrawal:

4. Payment card data

For payments in euros (EUR), card processing is handled by Stripe, a PCI DSS Level 1 certified card processor; details are entered in Stripe's secure form and never reach our system.

5. Sharing data with the carrier

We share the necessary passenger and travel data with the carrier, that is, with the inventory provider (Distribusion), solely to the extent required for the ticket to be issued and the journey to be carried out.

We do not sell the data to third parties, nor do we share it for marketing purposes without your explicit consent.

Because carriers and the inventory provider (Distribusion) operate abroad, your data may be transferred to other countries to issue the ticket and carry out the journey, with appropriate safeguards under data protection law. If you allow Google Analytics or Google Ads, data about how you use the site, or about a booking that followed a click on our ad, may also be transferred to Google in the USA, as described in section 3.

6. Data retention

We retain your data for as long as is necessary to complete the purchase and to fulfil legal obligations (e.g. the obligations to keep records and to resolve complaints). Upon expiry of these periods, the data is deleted or anonymised.

We keep the visit data Umami records for 14 months and then delete it automatically.

7. Your rights

In accordance with the Personal Data Protection Act, you have the right to:

  • access to the data we process about you;
  • rectification of inaccurate data;
  • erasure of data, where the conditions for it are met;
  • restriction of data processing;
  • objection to data processing;
  • data portability;
  • withdrawal of consent previously given, without affecting the lawfulness of processing prior to the withdrawal.

A request to exercise these rights may be sent to the email address specified in the Contact section.

If you believe that your data is being processed contrary to the regulations, you have the right to lodge a complaint with the supervisory authority — the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik) (www.poverenik.rs).

8. Contact

For all questions regarding data protection and the exercise of your rights, contact us:

Phone
—