Privacy Policy

1Who We Are

Al-Thaqlein Travel & Tours is responsible (the "data controller") for personal data collected through www.althaqlein.com and our own booking channels. Our main office is in Rawalpindi, Pakistan, with operations in Najaf (Iraq) and offices in Karachi, Ahmedabad (India) and Dearborn (USA). When a partner travel agency sends us its travellers' details, that agency is responsible for collecting them lawfully and informing its travellers; we process those details to deliver the services the agency has booked.

2Information We Collect

• Contact details: name, phone / WhatsApp number, email address, city and country, and for partner agencies the business name, contact person and business address.
• Travel documents: passport data page and number, nationality, date of birth, sex, father's or husband's name, photographs and, where an authority requires it, national ID details. These are needed to apply for visas and to issue tickets and hotel bookings.
• Booking details: travel dates, group size, flights, hotels, nights per city, transport, meal choices, quotations, invoices and payment records.
• Communications: messages you send us by email, WhatsApp, phone or our forms, and whether you open or reply to our business emails.
• Technical data: IP address, device and browser type, pages viewed and similar data collected through cookies and analytics tools (see section 6).

We collect this information directly from you, from the travel agency that books for you, and from public business sources (such as an agency's own website or business listings) when we contact travel agencies about our B2B services.

3How We Use Information

• To prepare quotations and to apply for Iraq and Iran visas with the relevant government authorities.
• To book and issue flight tickets, hotel rooms, transport and ground handling.
• To send booking confirmations, itineraries, travel alerts and support messages by email or WhatsApp.
• To manage partner agency accounts, invoices, balances and payments.
• To send business emails about our rates and services to travel agencies (see section 5).
• To read passport details automatically so visa forms are filled faster; staff check the results before submission.
• To keep our website secure, understand how it is used, and meet legal, tax and immigration obligations.

4Legal Bases

Where data protection laws such as the EU/UK GDPR apply, we rely on: performance of a contract (handling your booking or visa); legal obligation (immigration, tax and accounting records); legitimate interests (running our business, preventing fraud, and contacting travel businesses about relevant B2B services); and consent (non-essential cookies and, where required, marketing messages). You can withdraw consent at any time.

5Business Emails & Messages

• We send business-to-business emails about visa rates, hotel rates and partnership offers to travel agencies, using contact details they have published or shared with us.
• Every such email shows who we are and includes a simple way to unsubscribe. Once you unsubscribe, or ask us by reply, we stop and keep your address only on a do-not-contact list.
• Addresses that bounce or are reported as invalid are removed from our lists.
• WhatsApp messages are mainly used for bookings and support. You can ask us to stop non-essential WhatsApp messages at any time.

6Cookies, Analytics & Advertising

• Essential cookies keep the website working and secure, and improve page speed.
• Analytics: we use Google Tag Manager and Google Analytics to understand visits (pages viewed, approximate location, device). Google may process this data as described in How Google uses information from sites that use its services. You can opt out with the Google Analytics opt-out add-on.
• Embedded maps: our contact page shows Google Maps, which may set Google cookies when loaded.
• Advertising: we use Google Ads to show our services to people who may be interested, including people who have visited our website (remarketing), and to measure which ads lead to enquiries (conversion tracking). Google may use cookies and similar identifiers for this. You can turn off personalised ads in Google My Ad Center.
• Your choice: visitors in the EEA, UK and Switzerland are asked for consent before analytics and advertising cookies are used, and can change that choice at any time through the cookie settings link. We use Google Consent Mode so Google tags respect that choice. You can also block or delete cookies in your browser settings.
• US residents: we do not sell personal information for money. Some US state laws treat advertising cookies as "sharing" or "targeted advertising"; you can opt out through the cookie settings link, and we honour the Global Privacy Control (GPC) browser signal.

7Sharing & Service Providers

We do not sell or rent personal data. We share it only as needed:

• To deliver your trip: government visa portals and embassies (Iraq, Iran and others), airlines, hotels, transport and ground-handling partners, and the travel agency that booked for you.
• Technology providers that work for us: website and server hosting (Hostinger), Google Workspace (email, Drive, Sheets and Apps Script for forms and records), Google AI services used to read passport scans when our own reader cannot, Google Analytics, Google Ads, and WhatsApp (Meta). They may use the data only to provide their service to us.
• Legal reasons: when required by law, a court or a government authority, or to protect our rights, customers and staff.
• Business transfer: if our business is merged or sold, data may move to the new owner under this policy.

8International Transfers

Travel involves several countries. Your data may be processed in Pakistan, Iraq, Iran, India, the United States and other countries where our offices, partners or service providers operate, which may have different data protection laws. When we transfer data, we take reasonable steps (such as provider agreements and access controls) so that it stays protected.

9Security

Passport scans and booking records are kept in access-controlled systems over encrypted (HTTPS) connections, and only authorised staff can view them. No system is completely secure. If a breach affects your data, we will inform you and the authorities where the law requires it.

10Retention

We keep booking, visa and payment records as long as needed to provide the service and to meet legal, tax and accounting requirements, normally up to 6 years after your trip. Passport scans are deleted or archived securely once they are no longer needed for the booking or for a legal requirement. Business contact details are kept until you unsubscribe or ask for deletion.

11Your Rights

Depending on where you live, you may have the right to:

• access a copy of your personal data, and correct it if it is wrong;
• ask us to delete it, or to limit how we use it (subject to records we must keep by law);
• object to marketing or to processing based on legitimate interests, and withdraw consent at any time;
• receive your data in a portable format;
• complain to your local data protection authority.

To use any right, contact us using the details below. We reply within 30 days and may ask you to confirm your identity first. We do not treat you differently for using your rights.

12Children

Our website is not directed at children. Children's passport and travel details are accepted only from a parent, guardian or the booking agency acting for the family, and are used only for that child's trip.

13Changes & Contact

We may update this policy when our services or the law change; the "Last updated" date above shows the latest version. Our website may link to other sites, which have their own privacy policies. For any question or request about your data, contact us: