Legal
Privacy policy
Last updated: 25 September 2026. GHORA GHURI Travel & Tour, Daulatpur, Khulna, Bangladesh.
What this build does - and does not - do
This is a static preview. The booking and contact forms write only to your own browser's localStorage
(keys gg.bookings.v1, gg.messages.v1, gg.subscribers) and nothing is transmitted
to any server. Analytics, advertising pixels, reCAPTCHA and the payment gateway are disabled placeholders. When the
site is deployed with the included server-stubs/ endpoints, the same fields are stored in the operator's
booking database instead.
Personal data we collect from enquiries
| Field | Why | Retention |
|---|---|---|
| Name, email, phone, country | To answer the enquiry and confirm the booking | 36 months after last contact |
| Traveller counts, ages, dates, pick-up and drop-off points | Availability, vehicle and room allocation | 36 months |
| Passport name/number scans (foreign guests, permit filings only) | Forest and Hill Tracts permit applications | Deleted 30 days after trip end |
| Dietary, medical and access notes | Service delivery and safety | 12 months, then removed unless recurring |
| Payment reference numbers | Reconciliation; card data is never stored by us | Per Bangladeshi record-keeping law (5 years) |
| Website analytics (anonymised, only with consent) | Which destinations and pages earn traffic | 14 months |
We do not collect or process financial card numbers, and we do not buy personal data.
How data is used
- To prepare and price itineraries, book suppliers, file permits and run the trip
- To send the itinerary, guide details and safety notes before departure
- To answer support queries and handle complaints, and to meet tax and tourist-board record-keeping duties
- Occasionally, to tell you about a season or route you asked about - only if you ticked the marketing box
We never sell personal data. We share the minimum necessary with the suppliers actually running your trip (hotel, launch owner, driver, guide, permit office) and with our payment provider for reconciliation.
Cookies and local storage
| Name | Type | Purpose |
|---|---|---|
gg.cookie | localStorage | Remembers your analytics/advertising choice. Required for the notice to stay dismissed. |
gg.destinations.v1 / gg.packages.v1 | localStorage | Caches the edited content set so admin changes survive a reload on a static host. |
gg.bookings.v1 / gg.messages.v1 / gg.subscribers | localStorage | Your own submissions, in your browser only, until you clear them. |
gg.admin.session / gg.admin.hash | localStorage | Preview-only admin session marker. Never a security control. |
_ga, _fbp | cookie (only after consent) | Google Analytics / Meta pixel, if the operator fills in the ID placeholders in site-data.js. |
Rejecting optional cookies costs you nothing: the site, the search, the maps and the booking form all still work.
Consent mechanisms on this site
- Explicit consent - a required, unticked checkbox on the booking and contact forms, recorded with a timestamp.
- Cookie consent - a dismissible bar with Accept all / Necessary only, storing your choice before any third-party script loads. Analytics and pixel scripts are injected dynamically only when the stored choice allows them.
- Bot and abuse control - a honeypot field, an arithmetic check, and optional Google reCAPTCHA v3 (invisible, score-based) once a site key is configured; the form explains this rather than hiding it.
- Withdrawal - email us and your enquiry is deleted; on this build, "Forget" next to each saved request removes it from your browser instantly.
Your rights
Access, correction, deletion, objection to processing, and a copy of your data in JSON or CSV. Write to info.borshon@gmail.com with the subject "Data request"; we answer within 30 days. If you are in the EU/UK we also honour GDPR-style rights as a matter of company policy and treat Bangladesh as lacking an adequacy decision, so transfers for permit filings use supplier confidentiality clauses.
Security
Site served over HTTPS; booking data behind authentication in the admin panel; least-privilege database accounts; weekly encrypted off-site backups; passcodes hashed (never plaintext) in the server environment. No system is perfect - if you believe we have failed, tell us at the same email and we will investigate and write back.
Children
We book family travel but do not collect personal data directly from children; parent/guardian details are used, and only ages are recorded for children.
Changes
Material changes are announced on the site and to active booking holders. The date at the top of this page marks the current version.