Your business name and address, the names and emails of staff you give logins to, and your subscription and payment history with us.
Whatever you enter: names, phone numbers, passport and CNIC details, dates of birth, travel dates and payments. Passport scans where you upload them.
This information belongs to your pilgrims and is in your care. We process it so the software can do its job and for nothing else.
Enquiry forms record what the visitor typed. We store a one-way marker for the sender rather than their full address: enough to spot a flood of automated submissions, and not a lasting record of who visited.
These are treated differently from everything else. They are stored outside the public part of the server and are served only to signed-in staff of the agency that uploaded them. They are included in daily backups, because an agency cannot recreate them.
When a subscription ends, scans are returned with your export and then removed.
Where you use the passport scanning feature, the image is sent to a third party service to read the machine readable strip. We will tell you which service and under what terms before you switch it on, and it can be left off entirely: the same fields can be typed by hand.
| What | How long |
|---|---|
| Your operational records | While you subscribe, then 90 days |
| Passport scans | While you subscribe, then removed after export |
| Accounting records | Kept for the period your tax law requires |
| Website enquiries | While you subscribe |
| Our own invoices to you | As Pakistani tax law requires |
On servers we control, with daily backups. Access is limited to the people at Arfaa Tech who need it to support you, and support access is logged.
Passwords are hashed and never stored in a readable form. Credentials for suppliers and payment providers are encrypted. Every change to a record is recorded with who made it and when.
If we ever believe your data has been exposed, we will tell you promptly and plainly, including what we know and what we do not.
If one of your pilgrims asks what you hold about them, or asks you to correct or remove it, that request is yours to answer. We will help you find, export or delete their records at no charge.
Write to hello@travel360.pk. We answer privacy questions from agencies and from their pilgrims.