Payment Security Policy

1. Roles and responsibilities (WTTM vs payment partners)

WTTM operates a digital marketplace and related services. Payment acceptance is performed by regulated payment partners (including Stripe) and/or approved banking partners (including JSC Oktobank for certain bank-based flows). WTTM is not a bank and does not issue payment credentials.

Card scheme rules (Visa, Mastercard, and other networks as applicable) impose security obligations on participants in the payment chain. Your card issuer may apply additional authentication controls beyond WTTM’s environment.

2. Stripe: tokenisation, encryption, and hosted fields

Where Stripe is used, sensitive card data is typically collected through Stripe-hosted components or tokenisation flows designed to reduce PCI DSS scope for merchants. WTTM aims to avoid receiving, logging, or storing full Primary Account Numbers (PAN), CVV/CVC, or full magnetic-stripe equivalent data.

Stripe’s security posture, certifications, subprocessors, and regional terms are described in Stripe’s documentation and legal notices. WTTM may receive limited non-sensitive references (such as payment intent IDs, last4 brand fingerprint where permitted, and status metadata) to reconcile orders.

3. Visa and Mastercard: network authentication and issuer controls

Visa and Mastercard operate global payment networks with rules for secure acceptance, dispute handling, and fraud monitoring. Authentication experiences (including 3-D Secure / SCA workflows) may be presented by issuers or delegated authentication providers.

WTTM cannot guarantee issuer approval of a transaction. A declined authorisation does not necessarily indicate a WTTM system error; it may reflect issuer risk policy, spending limits, cross-border restrictions, or regulatory controls.

4a. Merchant obligation: no card data on WTTM servers

WTTM does not request, accept, store, or process full card numbers (PAN), CVV/CVC, magnetic-stripe data, or PIN blocks on its own websites or application servers. Card credentials are entered only on secure pages operated by licensed payment partners (Stripe hosted checkout; Uzbekistan licensed acquirer hosted pages upon activation).

Customers must never send card details by email, chat, or social media. If you receive such a request purporting to be from WTTM, report it immediately to [email protected].

4b. Bank transfer and Uzbekistan partner bank flows

Where payments are completed via bank transfer instructions involving licensed Uzbekistan partner banks or other approved banking partners, customers must follow exact beneficiary details provided through official WTTM channels. WTTM will never ask you to send funds to unrelated personal accounts via unsolicited messages.

Bank transfers may be subject to sanctions screening, AML monitoring, correspondent banking delays, and intermediary fees. Always retain proof of transfer and share it only through verified support channels when requested.

5. PCI DSS scope and assessments

WTTM seeks to maintain PCI DSS compliance aligned to its actual cardholder data environment (CDE) scope. Controls may include segmentation, access control, vulnerability management, secure SDLC practices, logging and monitoring, and vendor due diligence.

Because architectures evolve, specific PCI reports (for example AOC/ROC) may be available to enterprise customers under NDA where applicable.

6. Fraud prevention, velocity checks, and manual review

We may use automated and manual fraud controls including device fingerprinting (where lawful), IP reputation, velocity limits, behavioural signals, and payment anomaly detection. Transactions may be delayed, cancelled, or referred for enhanced due diligence where risk indicators are present.

7. Customer security hygiene

You should protect account credentials, enable multi-factor authentication where offered, avoid public Wi‑Fi for payments, verify domain names and TLS certificates, and report suspicious messages (phishing/smishing) to [email protected].

WTTM will not request your full card number by email.

8. Incident response (high-level)

If WTTM becomes aware of a material security incident affecting personal data, we will follow applicable breach notification laws and contractual obligations, including notifying regulators and/or affected individuals where required.

This section is a high-level summary and does not create third-party beneficiary rights.

WTTM - Buyuk Britaniya

WORLD TRAVEL & TOURISM MARKET LTD.

Kompaniyaning ro'yxatga olish raqami: 16672223

Ro'yxatdan o'tgan idora:
167-169 Buyuk Portlend ko'chasi
London, Angliya, W1W 5PF
Buyuk Britaniya

Direktor: Baxish Ismoil

Tel: +44 7432 200554

Bank tafsilotlari

Bank: Lloyds Bank (AT Smart Solutions Ltd orqali)

Hisob nomi: AT Smart Solutions Ltd

Hisob raqami: 66204662

Saralash kodi (Bank kodi): 30-99-50

IBAN: GB44 LOYD 3099 5066 2046 62

SWIFT / BIC: LOYDGB21287

UTTM Uzbekistan

MChJ UTTM

Ro'yxatdan o'tgan manzil: 22-24 Kichik halqa yo'li, Yunusobod tumani, Toshkent, O'zbekiston

Kompaniyaning ro'yxatga olish raqami: Davlat ro'yxatidan o'tkazish raqami: 07437461

Bank: AT “Oqtobank”, Mirzo Ulug‘bek filiali

MFO (Bank kodi): 00421

OKED / Kompaniya kodi: 07437461

TIN (INN): 312924418

Hisob-kitob hisoblari:

UZS: 20208000307437461001

USD: 20208840607437461001

EUR: 20208978007437461001

Direktor: Ernest Axmadulin (Axmadulin Ernest Timurovich)