Privacy Policy

Effective date: 18 July 2026 Data controller: Tawakkul Distribution, House 01, Road 5, Block H, Eastern Housing, Mirpur 12, Dhaka, Bangladesh. Contact: supportqafila@gmail.com · 01717505001

This policy explains what personal data Qafila collects on its website, why, who it is shared with, and the choices you have.

1. What we collect

From Pilgrims

Google account basics when you sign in: name, email address, profile photo.
Mobile phone number, verified by one-time code.
The content of your trip requests (RFQs): trip type, dates, number of travellers, budget, and notes you write.
Reviews and ratings you submit, and fraud reports you file.
Basic technical data: device and browser information, IP address, and usage logs.

Identity documents (National ID or passport) are optional for Pilgrims. We do not ask for them at sign-up, and they are never required to use Qafila or any of its features. You may choose to submit a National ID and/or passport number and photo only to get a Verified badge on your requests. These documents are stored privately, are visible only to Qafila administrators, and are never shown to travel agencies. You may delete them, or request their deletion, at any time. Any identity documents a travel agency separately requires for your booking or visa are provided directly to that agency, outside Qafila.

বাংলা: পরিচয়পত্র (জাতীয় পরিচয়পত্র বা পাসপোর্ট) হজযাত্রীদের জন্য ঐচ্ছিক। সাইন-আপের সময় আমরা এগুলো চাই না, এবং Qafila বা এর কোনো সুবিধা ব্যবহার করতে এগুলো কখনও বাধ্যতামূলক নয়। শুধুমাত্র আপনার অনুরোধে যাচাইকৃত ব্যাজ পেতে চাইলে আপনি জাতীয় পরিচয়পত্র এবং/অথবা পাসপোর্টের নম্বর ও ছবি জমা দিতে পারেন। এই নথিগুলো গোপনে সংরক্ষণ করা হয়, শুধু Qafila অ্যাডমিনরা দেখতে পারেন, এবং কোনো ট্রাভেল এজেন্সিকে কখনও দেখানো হয় না। আপনি যেকোনো সময় এগুলো মুছে ফেলতে পারেন বা মুছে ফেলার অনুরোধ করতে পারেন। কোনো ট্রাভেল এজেন্সি আপনার বুকিং বা ভিসার জন্য আলাদাভাবে যে পরিচয়পত্র চায়, তা Qafila-র বাইরে সরাসরি সেই এজেন্সিকে দেওয়া হয়।

From Agencies

Business and contact details, including the registered phone number.
Verification (KYC) documents: trade license number and photo, MoRA license number and photo, HAAB license number and photo (optional), and the responsible person's National ID and passport numbers and photos.
Token purchase and advertising transaction records, including amounts, VAT, and payment gateway transaction references.
Bids placed, ratings received, and basic technical data as above.

Payment data

Card and mobile-banking payments are processed by our payment gateway partners (including AamarPay). Qafila does not receive or store your full card number or payment credentials; we receive confirmation of payment and a transaction reference.

2. Why we use it

To operate the marketplace: accounts, RFQs, bidding, notifications, wallets.
To verify Agencies before allowing them to bid, as a trust and safety measure.
To exchange contact details when a bid is accepted — this is a core function of the service (see Section 3).
To process token and advertising purchases and to keep VAT and accounting records required by law.
To prevent, investigate, and act on fraud, forgery, and abuse.
To improve the Platform and fix problems.
To comply with legal obligations and enforce our Terms and Conditions.

3. Who we share it with

The counterparty, on bid acceptance. When a Pilgrim accepts a bid: the winning Agency receives the Pilgrim's name, phone number, and email; the Pilgrim receives the Agency's name and phone number; losing Agencies are told the winning Agency's name. This exchange is the purpose of the Platform.
Other users, in limited form. Agency names, ratings, and reviews are visible on the Platform. Pilgrim RFQ contents are visible to Agencies so they can bid; Pilgrim contact details are not shown before acceptance.
Service providers. We host data on Google Firebase / Google Cloud Platform, with our primary data location in the asia-southeast1 (Singapore) region — meaning your data is stored outside Bangladesh with a processor bound by its own security commitments. Payment processing is handled by our payment gateways.
Authorities. We disclose data where required by Bangladeshi law, court order, or a lawful request from a competent authority, and where necessary to investigate fraud.
We do not sell personal data.

4. How we protect it

Data is encrypted in transit.
Agency KYC document images are stored privately and are accessible only to the account owner and authorized Qafila administrators, enforced by server-side security rules.
Access to administrative functions is restricted and logged.
No system is perfectly secure; we cannot guarantee absolute security, but we take reasonable technical and organizational measures appropriate to the sensitivity of the data.

5. How long we keep it

Account data: for as long as your account exists.
Transaction, VAT, and accounting records: for the period required by Bangladeshi tax and commercial law, even after account deletion.
Agency KYC documents: for as long as the Agency account is active, plus any period required for legal, fraud-prevention, or audit purposes.
Fraud and enforcement records: as long as reasonably necessary to protect the Platform and its users.

6. Your choices and rights

You can access and correct your profile information in your account.
You can request a copy of your data, or deletion of your account and data, at supportqafila@gmail.com or 01717505001. We will honour deletion requests except where retention is required by law (for example, VAT records) or for legitimate fraud-prevention purposes.
You can withdraw from the service at any time by closing your account.

7. Children

Qafila is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will remove it.

8. Cookies and analytics

The website uses cookies and similar technologies necessary for sign-in and session security. We do not currently use third-party advertising or analytics cookies; if this changes, we will update this policy with a new effective date.

9. Changes to this policy

We may update this policy. Material changes will be announced on the Platform with a new effective date. Continued use after the effective date constitutes acceptance.

10. Contact

Questions, requests, or complaints: Tawakkul Distribution, House 01, Road 5, Block H, Eastern Housing, Mirpur 12, Dhaka, Bangladesh — supportqafila@gmail.com · 01717505001