Privacy Policy

1. Who We Are & Data Controller

Dhaka Holiday UK operates as the Data Controller responsible for your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

2. Personal Information We Collect

Depending on the travel service you request (visa processing, flight bookings, or tour packages), we may collect and process:

• Identity & Contact Details: Full legal name, title, gender, date of birth, phone numbers, email address, and home address.
• Travel & Passport Biodata: Passport number, nationality, issue and expiration dates, previous visa stamps, and national ID / UK Share Code details (for visa applications).
• Financial & Transaction Data: Payment transaction identifiers, billing addresses, and payment confirmation status. Note: All credit/debit card transactions are processed directly via Stripe; we do not store full credit card numbers on our local servers.
• Technical & Usage Data: IP address, device type, browser settings, and page session metrics recorded anonymously for security and analytics.

3. Lawful Basis for Processing

We only process your personal data when permitted by law under Article 6 of the UK GDPR:

• Performance of a Contract: Necessary to issue airline e-tickets, reserve hotels, or compile and lodge your visa application with consular bodies.
• Legal Obligation: Necessary to comply with international border control, anti-money laundering regulations, and UK accounting standards.
• Legitimate Interests: Necessary for fraud prevention, server security, and maintaining high service quality standards.

4. How We Use Your Personal Data

Your data is used strictly to fulfill your travel requests:

• Preparing visa application forms (DS-160, Schengen portals, Canadian IRCC portals).
• Issuing confirmed flight reservations and communicating schedule changes.
• Sending booking vouchers, invoices, and WhatsApp concierge updates.
• Responding promptly to your inquiries and support tickets.

5. Third-Party Disclosures & Transfers

We share information only with trusted operational third parties required to deliver your journey:

• Airlines & Global Distribution Systems (GDS): To issue tickets under your name with carriers like Emirates, Qatar Airways, Singapore Airlines, etc.
• Embassies, Consulates & Visa Centers: Foreign diplomatic missions and official centers (VFS Global, TLScontact, BLS) processing your visa applications.
• Payment Processors: Stripe Inc., facilitating secure, encrypted PCI-DSS compliant transactions.

6. Data Security & Storage Controls

We enforce strict administrative, physical, and digital safeguards. All electronic data transfers use 256-bit SSL encryption. Access to client visa dossiers is restricted exclusively to authorized senior personnel, and files are securely archived in compliance with UK statutory retention schedules.

7. Your Statutory Rights Under UK GDPR

You possess enforceable statutory rights regarding your personal records:

• Right of Access: Request a copy of personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data when retention is no longer legally mandated.
• Right to Restrict or Object: Object to processing under specific circumstances.

8. Cookies & Site Analytics

Our website utilizes minimal, essential session cookies and an anonymous real-time visitor heartbeat tracker to ensure platform stability, secure bookings, and prevent malicious bots. You may disable cookies in your browser settings at any time.

9. Contacting Our Data Protection Team

If you have questions about this Privacy Policy or wish to exercise your statutory rights, please reach out directly: