1. Who we are
TravelZone BD ("TravelZone", "we", "us", "our") is a Sylhet-based consultancy providing visa processing, overseas manpower recruitment, and Ministry of Foreign Affairs (MOFA) document attestation services to individuals and businesses in Bangladesh and abroad. We act as the data controller for the personal information described in this policy.
- Registered office: 40/7, Moushumi R/A, Kumarpara, Sylhet, Bangladesh
- Email: [email protected]
- Phone / WhatsApp: +880 1711-236484
2. Scope of this policy
This policy applies to personal data we collect through our website (travelzonebd.com), client portal, in-office consultations, telephone or messaging communications, paper application forms, and any TravelZone-branded service. It explains the categories of data we collect, why we collect each category, who we share it with, how long we retain it, and the rights you may exercise.
3. Categories of personal data we collect
Depending on the service you request, we may collect:
- Identity data: full name, date of birth, gender, nationality, marital status, NID number, passport number, photographs, biometric reference numbers (where embassies require fingerprint or facial capture).
- Contact data: postal address, email address, mobile and landline numbers, emergency contact details.
- Family data: spouse, parents, and dependents' identity and travel details where a visa or recruitment process requires it.
- Academic & professional data: certificates, transcripts, IELTS/TOEFL results, CVs, employment letters, salary slips, trade or skill certifications.
- Financial data: bank statements, solvency certificates, source-of-funds documentation, payment transaction references (bKash, Nagad, bank transfer), invoice and receipt history.
- Travel data: prior travel history, visa stamps, itineraries, accommodation bookings, insurance policy numbers.
- Case data: application progress notes, embassy correspondence, advisor notes, document checklists, and outcomes.
- Communications data: emails, WhatsApp messages, voice call records (when made for case clarity), in-portal chat history, and AI assistant transcripts.
- Technical data: IP address, device and browser information, language preference, cookie identifiers, pages visited, and approximate location derived from IP.
4. Why we use your data (purposes & lawful bases)
| Purpose | Lawful basis |
|---|---|
| Assessing eligibility and preparing your visa, recruitment, or attestation file | Performance of contract |
| Submitting documents to embassies, employers, MOFA, or government authorities on your behalf | Performance of contract |
| Collecting fees and issuing invoices and receipts | Performance of contract / Legal obligation (NBR record-keeping) |
| Verifying identity and preventing fraud or document tampering | Legal obligation / Legitimate interest |
| Sending case status updates, document reminders, and appointment notifications | Performance of contract |
| Responding to your enquiries via website forms, email, phone, or WhatsApp | Legitimate interest / Consent |
| Marketing newsletters or promotional offers | Consent (you may withdraw at any time) |
| Improving our website, AI assistant, and internal processes through anonymised analytics | Legitimate interest |
| Complying with court orders, embassy requests, BMET regulations, anti-money-laundering checks, or other statutory duties | Legal obligation |
6. International transfers
Delivering a visa, employment, or attestation service inherently requires us to transfer your data to recipients located outside Bangladesh — for example to the embassy of your destination country or to a foreign employer. By engaging our services you acknowledge and consent to such transfers. We take reasonable steps to ensure recipients handle the data lawfully and only for the purpose for which it was disclosed.
7. How long we keep your data
| Record type | Retention period |
|---|---|
| Active case file (visa, recruitment, attestation) | Until case closure |
| Closed case file & supporting documents | 3 years from closure (longer if a regulator requires) |
| Financial records (invoices, receipts, payment proofs) | 7 years (NBR / Income Tax Ordinance requirement) |
| Client portal account | Until you request deletion, or 5 years of inactivity |
| Marketing subscription data | Until consent is withdrawn |
| Website analytics & server logs | 12 months |
| AI assistant conversation transcripts | 12 months |
Where law allows, we may retain limited information beyond these periods to defend or pursue legal claims.
8. How we protect your data
- Role-based access control: only the advisor, verifier, or accountant assigned to your case can view what they need.
- Encryption of data in transit (TLS) and at rest in our managed database.
- Audit logging of access to sensitive records.
- Two-factor authentication for staff accounts.
- Locked physical storage for paper documents at our Sylhet office, with restricted key access.
- Periodic staff training on confidentiality and document handling.
Despite these measures, no transmission over the internet or method of electronic storage is 100% secure. We will notify affected clients and the relevant authorities without undue delay if a personal data breach is likely to result in a high risk to your rights.
9. Your rights
Subject to applicable law, you may at any time:
- Request access to the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of data we no longer have a lawful basis to hold.
- Request a copy of the data you provided in a portable format.
- Withdraw consent where consent is the lawful basis (this does not affect prior lawful processing).
- Object to direct marketing at any time.
- Lodge a complaint with the appropriate Bangladeshi authority if you believe your rights have been infringed.
To exercise any of these rights, email [email protected] with the subject line "Privacy request" along with proof of identity. We respond within 30 days.
10. Children's data
Our services are intended for adults aged 18 and over. Where a visa, family migration, or dependant recruitment case involves a minor, the parent or legal guardian provides and consents to the use of the minor's data. We do not knowingly collect data directly from children for marketing purposes.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in law, technology, or our services. We will revise the "effective date" at the top of the page and, for material changes, notify active clients by email or through the client portal at least 14 days before the changes take effect.
13. Contact us
Privacy queries, complaints, or rights requests should be addressed to: TravelZone BD, 40/7, Moushumi R/A, Kumarpara, Sylhet — [email protected] — +880 1711-236484.
A note on this document
This policy has been prepared in good faith and reflects current Bangladeshi law and standard consultancy practice as of 30 May 2026. It does not constitute legal advice. For specific questions about your case, please consult a licensed Bangladeshi advocate or contact us at [email protected].