Legal · Annex

Privacy Notice

Effective Date: 21 April 2026 · GÜÜR LLC · Governed by the Law of Mongolia on the Protection of Personal Information

This Privacy Notice explains how GÜÜR LLC collects, uses, protects, and discloses your personal information when you use our Services, in compliance with the Law of Mongolia on the Protection of Personal Information.

At a glance

We collect User, Booking, Space, payment, and device data to operate the Platform. We rely on contract performance, legitimate interests, legal obligations, and consent. You have rights to access, rectification, deletion, and to complain to the National Human Rights Commission of Mongolia. We retain tax and identity records for 5–10 years to comply with Mongolian tax and AML law.

1. Introduction

This Privacy Notice explains how GÜÜR LLC, a company incorporated under the laws of Mongolia (together “GÜÜR” or “we”), collects, uses, protects, and discloses personal information when you use our products and services, our website and online services, and any other website, mobile app, or other online service created or hosted by us from time to time on which this Privacy Notice appears, or otherwise interact with us (together, our “Services”) and we are acting as a data controller; when you provide services to us and we collect your personal information in connection with this; and when we collect personal information from third parties.

This Privacy Notice does not apply to, and GÜÜR is not responsible for, any third-party websites, including any such websites which may be accessible through links from the Services.

GÜÜR operates in compliance with the Law of Mongolia on the Protection of Personal Information. By using the Services, you agree to the collection and use of your personal information as described in this Privacy Notice. If you do not agree, please do not use the Services.

Where you use our Services, or your personal data is processed in connection with such Services, and we control the purpose for which that data is processed, GÜÜR will be the data controller (Мэдээлэл хариуцагч) of such information.

2. Information we collect

“Personal data,” “personal information,” and, if the context requires, “information” is any information that identifies you or that we can reasonably link to you. We collect and process the following categories of personal information to provide our Services, in accordance with the Law of Mongolia on the Protection of Personal Information.

Category	Examples	Source
User data	Name, email, postal code, phone number (with country code), city, title, affiliated organisations, uploaded photos, social-media handles, website URLs, and Platform communications (email and chat).	Provided by you (Users) and third parties. Associated with a unique Host ID or Guest ID.
Identity verification	Identity document images, facial images, ID numbers and addresses, device information from verification vendors, and government identifiers (e.g. State Registration Number — Регистрийн дугаар).	You (Users) and third-party verification vendors (governed by their own privacy policies). Alternative verification means may be requested.
Device & location data	Internet/network information, browser type, device type, sign-on method, device ID, IP address.	Your devices.
Platform activity data	Access date/time, pages viewed, searches, messages, inquiries, requests, bookings, reviews, boards created, analytics, error logs.	How you interact with the Users and the Platform.
Cookies & similar tech	Information about your interaction with our Services, including pages visited, links clicked, referring/exit pages, time and date of visits. See the Cookie Notice.	GÜÜR and third parties.
Space information	Street address, building number, city, district (дүүрэг), khoroo (хороо), province/aimag, postal code, country, latitude/longitude, time zone, capacity, contact information, entry instructions, Wi-Fi access. Assigned a Space ID and Listing ID.	Users and third parties.
Booking information	Start/end date and time; Booking details (services, event description, attendee count, prices, taxes, fees); communications regarding the Booking. Each unique Booking has a Booking ID.	Users.
Vendor information	Vendor email, services description, locations, contact information, website, survey and questionnaire responses.	Vendors.
Survey & feedback	Form responses, feedback, email correspondence.	Users.
Contract information	Contracts signed, electronic signatures, affiliate information, contract terms, and other information related to agreements between Users.	Users, Vendors, and third parties.
Sensory information	Voice and audio data — for example, recordings of support phone calls or calls connecting Users.	Users.
Payment data	Card information, bank account information (including QPay/SocialPay transaction identifiers), collected and stored by our payment processors on our behalf.	Users and third parties.
Other data	Calendar information (if access is provided), Space Wi-Fi information, communications and information related to Events/Bookings/Spaces/Users (guest lists, dietary or physical restrictions, etc.).	Users, Vendors, and third parties.
User interaction / dispute resolution	Information related to interactions between Users and other Users or third parties — for communications, dispute resolution, and compatible business purposes.	Users, Vendors, and third parties.
Background check information	Information from state registration or authorised identity databases to help ensure the safety and security of Users.	Background-check service providers.

3. Legal basis for the use of personal data

In accordance with the Law of Mongolia on the Protection of Personal Information, GÜÜR processes your personal data based on the following legal grounds:

Performance of a contract

We may need to collect and use your personal data to enter into or perform a contract with you — for example, where you are a Host making Spaces available on the Platform, or a Guest making a Booking, and where we provide services in accordance with the GSA.

Legitimate interests

Where use of your information is (a) non-detrimental to you, (b) within your reasonable expectations, and (c) necessary for our own or a third party's legitimate purpose, we may use your personal data for:

Direct marketing or continued communication, subject to your express consent if required in your country of residence.
Ensuring network and information security in compliance with the Law on Cyber Security of Mongolia.
Preventing fraud; internal administrative purposes; personalising our Services.
Preventing unauthorised access to electronic communications networks and damage to computer systems.
Reporting possible criminal acts or threats to public security to the Police or other competent Mongolian authorities.

Compliance with a legal obligation

We may be required to process your information due to legal requirements — including the General Taxation Law, the VAT Law (e-Barimt reporting), and anti-money-laundering regulations.

Consent

You may be asked to provide your consent for certain services. Where we rely on your consent, you may withdraw it at any time by contacting us — note that we may no longer be able to provide services that rely on it.

4. How we use personal information

Depending on the circumstances, we may use your information to provide you with services and information, or for:

Providing GÜÜR's Services and facilitating your use of the Platform as a Guest or Host.
Accepting, coordinating, managing, and processing Listings and Bookings.
Facilitating purchase transactions for goods and services.
Providing customer support, accommodations, and personalised services and amenities.
Responding to your inquiries and developing our relationship with you.
Quality control to improve our offerings.
Facilitating communications between parties.
Content-based or interest-based advertising.
Providing information, services, and marketing communications you have requested or that may interest you.
Evaluating, recruiting, and hiring personnel.
Ensuring the safety and security of Users, staff, and visitors — including verifying identity via the State Registration Number (Регистрийн дугаар) or other authorised biometric and digital identity systems.
Preventing, detecting, and investigating fraud, cyber incidents, or other illegal activity.
Communicating with you in relation to your use of our Services, including legal updates.
Record-keeping for legal, tax, and operational purposes — including the issuance of e-Barimt and compliance with the General Taxation Law of Mongolia.
Exploring new ways to provide products and services; doing our best to fulfil your requests.

We may use your contact information to send automated SMS notifications and system alerts related to your Bookings and account security via Mongolian telecommunications providers.

We may aggregate and/or de-identify information collected through our Services so it can no longer be linked to you or your device (“De-Identified Information”), and may use or share De-Identified Information for any purpose — including research and marketing.

We may combine information collected through the Services with information from other sources. If we intend to change the purpose for which we hold your personal data, we will give you prior notice.

5. How we disclose personal information

To provide our Service and to fulfil our business and commercial purposes, we may disclose your personal information within GÜÜR LLC for administrative purposes such as billing, promoting events and services, and providing services to you or your organisation, in all cases consistent with the legal bases above and applicable law.

Publicly posted information

Some User information is posted publicly on the Platform — profile information, Listings, reviews, ratings, and other feedback. Precise location information is not publicly posted.

Disclosures between Users

Our Services are designed to connect Users. We may disclose your personal information to any agents or third parties you authorise — including operators, managers, agents, or other parties associated with an Event or Booking. Disclosure is necessary to perform the contract between you and GÜÜR, and/or you and a third party.

Service providers

We may disclose your information to trusted third-party service providers — including cloud, web-development, analytics and security providers, communications providers, internal and external advisors or auditors, local payment gateways (QPay, SocialPay), Mongolian insurance providers (Mandal, Ard), cloud hosts, dispute resolution providers, marketing providers, governmental entities, social networks, fraud-prevention entities, background-verification providers, and other Users.

Other disclosures

Where you have consented;
Where reasonably necessary to provide the services you have required;
To law enforcement bodies or similar governmental authorities;
To comply with a civil, criminal, or regulatory inquiry, investigation, or court order by Mongolian judicial, law-enforcement, or regulatory authorities;
To exercise and defend legal or payment-related claims;
To protect the rights, freedoms, property, or safety of GÜÜR, our employees, clients, or others;
As part of a prospective or completed merger, acquisition, bankruptcy, or other business transaction;
In any other manner permitted by law, including protected speech.

Building management and owners

We may disclose Host and Guest personal information — including Booking details, physical address, phone number, and information related to compliance with applicable laws and property-management agreements — to landlords, management companies, building security, reception, Apartment Owners Associations (СӨХ), and property caretakers to facilitate Host Services, security, billing, and compliance with applicable laws and building rules.

We may disclose information that does not reasonably identify you or your organisation, including de-identified or anonymised information, as permitted by applicable law.

6. Retention

We retain personal information for no longer than necessary to fulfil the purposes for which it was collected. Please note that GÜÜR is required to retain certain transaction and identity data for a minimum period (typically 5 to 10 years) to comply with the General Taxation Law of Mongolia and anti-money-laundering regulations.

7. Security

We have implemented administrative, technical, and physical measures designed to safeguard personal information against theft, loss, and unauthorised access, use, modification, and disclosure. However, the transmission of information via the internet is not completely secure — you provide us with your information and transmit it over the internet at your own risk.

You may access and change information you submitted during registration at any time by providing your username and password. Please keep your password in a safe place and do not share it. Use a password unique to GÜÜR. Keep your phone number and email address current — GÜÜR will not be liable for difficulties arising from your failure to maintain an active and accurate phone or email on the Platform.

8. International data transfers

GÜÜR LLC is a Mongolian entity. To provide a high-quality digital experience, the information we collect may be processed on secure servers located outside of Mongolia (such as in Singapore or the United States) using global cloud infrastructure providers. By using the Services, you acknowledge that your data may be transferred to and processed in jurisdictions with different data-protection laws. We take all measures required by the Law of Mongolia on the Protection of Personal Information to ensure these transfers are secure.

9. Your rights and choices

Marketing communications

We may send you marketing communications regarding our Services or services of third parties that may interest you. You can opt out at any time using the instructions in the communication or by contacting us. Even after opting out, we may still use information as permitted by this Privacy Notice or as required by applicable law (for example, transactional emails confirming requests or providing updates to our Privacy Notice).

In accordance with local regulations, no Mongolian mobile information or SMS originator data will be shared with third parties for marketing purposes. Your consent for text messaging and system alerts is strictly used for GÜÜR service communications and will not be disclosed to third-party marketers.

Rights regarding your information

Under the Law of Mongolia on the Protection of Personal Information, you have the following rights:

Right to be informed: to know why and how your data is being processed.
Right to access: to request a copy of the personal information we hold.
Right to rectification: to correct or update inaccurate data.
Right to deletion: to request destruction of your data when it is no longer needed or if consent is withdrawn.
Right to lodge a complaint: to file a complaint with the National Human Rights Commission of Mongolia if you believe your data rights have been violated.

You also have the right to withdraw consent to the processing of your personal information where consent is the legal basis. Withdrawing consent may prevent us from providing certain Services.

To verify your identity, we may verify your State Registration Number (Регистрийн дугаар) and registered phone number. If we cannot verify your identity, we may be unable to respond. You have the right not to be discriminated against for exercising your rights.

To exercise any of these rights, contact us using the information in the “Contact us” section and select “Data Privacy Request” as the contact reason. You may designate an authorised agent (signed written permission or power of attorney required). You may have a right to appeal a denied request and to lodge a complaint with a supervisory authority.

Disclosure to third parties for marketing

GÜÜR does not sell your personal information to third parties for monetary gain. We may use cookies or analytics partners to improve our service — see the Cookie Notice. If you wish to limit processing for advertising purposes, contact us at support@guur.mn.

Depending on where you live, you may have the right to opt out of “sales” and “sharing” of your personal information for targeted advertising. To opt out, visit our Cookie Settings page. You will need to opt out on each device you use to access the Services. If you have a recognised browser-based opt-out signal, we will recognise it as required by law.

10. Online analytics and advertising

Online analytics

We may use third-party web analytics services such as Google Analytics to collect and analyse usage information, engage in auditing/research/reporting, prevent fraud, and provide email-marketing insights. You can install the Google Analytics Opt-out Browser Add-on to prevent Google Analytics from using your information.

Tailored online advertising

We work with third-party advertising technology partners such as ad networks and ad servers. We allow these third parties to place cookies or similar technologies on your browser to collect information about you (see our Cookie Notice). They may use this information to serve relevant content and advertising as you browse the internet.

To control how cookies are used on your device, adjust your mobile-device settings (e.g. “Limit Ad Tracking” on iOS or Android) or your web-browser's privacy settings. GÜÜR does not control the opt-out mechanisms of third-party advertising partners and is not responsible for their availability.

11. Children's privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we discover we have received personal information from an individual under the age of 18, we will promptly destroy such information in accordance with the Law of Mongolia on the Protection of Personal Information. If you are under the age of majority in your jurisdiction, do not use the Services or provide any personal information to us. If you believe we have personal information from a child, please contact us.

12. Third-party sites

The Services may contain links to websites that are not operated by or for us (“Third-Party Sites”). This Privacy Notice does not apply to Third-Party Sites. We have not reviewed and do not control them, and we are not responsible for their content or privacy policies. If you access any Third-Party Site, you do so at your own risk and should review the third party's policies.

13. Changes to this Privacy Notice

We may revise this Privacy Notice from time to time. We will indicate updates through the “Last updated” date at the top. If there are material changes, we will communicate them prior to implementation in accordance with applicable law. Information collected under previous versions will then become subject to the terms of the new Notice.

14. Contact us

If you would like to update your information, modify your communication preferences, opt out of marketing, or exercise your data rights, please contact us at support@guur.mn and select “Data Privacy Request” as the contact reason.

If you have any questions or comments regarding our privacy practices, or about the manner in which we or our service providers treat your personal information, please contact support@guur.mn.