01Who we are
Tofiza Tours & Travels (“Tofiza”, “we”) operates the booking platform at tofiza.com from Gulshan, Dhaka 1212, Bangladesh. We are the data controller for the information described here. For anything in this policy, write to support@tofiza.com or call 01931 113300.
Tofiza is a marketplace. Hotels and other travel providers list their own properties and rates, and when you complete a booking we pass your details to that provider so they can honour your stay. They handle your information under their own policies.
02What we collect
We only collect what a booking actually needs.
- Your account
- Name, email address and — if you give it — a phone number. Your password is stored only as a one-way bcrypt hash; we never hold it in a readable form and cannot tell you what it is.
- A booking
- The lead guest’s full name, email and phone number, any special requests you type, your dates, the number of guests and rooms, and the property and room you chose.
- A payment
- The transaction reference, amount, currency, the card scheme (for example VISA) and the issuing bank, returned to us by the payment gateway. We never see or store your full card number, expiry date or CVV — those are entered on the gateway’s own page, not ours.
- Reviews
- If you review a stay, the rating and text you write, shown publicly with your display name and trip type.
- Property partners
- Businesses listing with us additionally provide company details and bank account details for disbursement of their earnings.
We do not ask for your national ID, passport number or date of birth to book a hotel, and we do not buy personal data from third parties.
03Why we hold it
- To create and confirm your booking, and to give the property the details it needs to receive you.
- To take payment and, where a refund is due, to return it to the same payment method.
- To send you transactional email — your invoice and voucher, cancellation notices, email verification and password resets.
- To let you sign in, see your bookings and cancel them.
- To keep the platform honest: detecting fraudulent bookings, and keeping the financial records the law requires us to keep.
- To answer you when you contact support.
05How long we keep it
Booking, payment and invoice records are kept for as long as accounting and tax rules in Bangladesh require, because they are financial records — closing your account does not erase them.
Everything else — your profile, saved preferences and unbooked activity — is removed when you close your account or ask us to delete it. Unpaid checkouts that were never completed expire on their own and are cleared automatically.
06What you can ask us to do
You can ask us at any time to:
- Show you the personal information we hold about you.
- Correct anything that is wrong — you can edit most of it yourself under your account profile.
- Delete your account and the information that is not a financial record we must retain.
- Stop sending you marketing email. Every marketing message has an unsubscribe link; booking confirmations and invoices are not marketing and will still be sent.
Email support@tofiza.com and we will respond within 30 days. We may ask you to confirm your identity first, so that nobody else can make these requests about you.
07How we protect it
The site is served over HTTPS. Passwords are hashed with bcrypt and are never returned by our own queries. Card details never touch our servers. Access to booking and customer records is limited to the property you booked with and to Tofiza staff who need it, and privileged staff actions are written to an internal audit log.
No system is perfect. If a breach ever affects your information, we will tell you and the relevant authority without undue delay.
