Privacy Policy

The controller of personal information collected through this website is Travokey (SMC-Private) Limited, a single member private company limited by shares registered in Pakistan with the Securities and Exchange Commission of Pakistan (SECP) under incorporation number 0232187. Its National Tax Number is A476672.

You can reach us about anything in this policy at info@travokey.cloud. Our postal address is in clause 12.

We handle personal information in two distinct capacities, and it matters which one applies:

• On this website, we decide what is collected and why. We are the controller, and this policy governs it in full.
• Inside the platform, the records our customers enter — their travellers, members, suppliers, staff and sub-agents — belong to the customer. The customer decides what goes in and why; we hold and process it on their instructions. They are the controller, we are the processor, and clause 7 explains what that means in practice.

If you are a traveller or client of an agency that uses Travokey, that agency is responsible for your information. Ask them first — we will help them answer you, but we cannot give out or delete their records on your say-so.

Very little, and we would rather keep it that way. This site sets no cookies. It runs no analytics, no advertising or remarketing pixels, no session recording, no heatmaps and no chat widget. It does not build a profile of you, and there is nothing here to consent to or opt out of.

Web fonts are downloaded when the site is built and served from this domain, so loading a page makes no request to Google or any other font host.

The page source carries a Meta domain-verification tag. It is a static line of HTML that lets Meta confirm we own this domain. It sets nothing, sends nothing and does not track you.

Like any website, ours is served by hosting infrastructure that keeps short-lived technical logs — IP address, timestamp, the page requested, browser and operating system — to deliver pages, spot faults and defend against abuse. We do not use those logs to identify visitors or link them to anything else.

The demo request form asks for your name, agency name, email address, phone or WhatsApp number, how many branches and users you have, which modules interest you, and whatever you write in the message box. You choose what to put in it.

You can also reach us by email, by phone on either of the numbers on this site, or on WhatsApp. When you do, we hold what you send us and our reply.

If you are an existing customer, we also hold the contact and billing details needed to administer your account and invoice you.

We use the information in clause 4 to:

• reply to you, arrange a demonstration and follow it up;
• scope and price the service for your organisation, and prepare an agreement if you go ahead;
• provide, support, secure and invoice for the service once you are a customer;
• meet our legal, tax and accounting obligations in Pakistan.

We rely on your consent when you choose to contact us, on the necessity of performing a contract once you are a customer, on our legitimate interest in running and securing a business-to-business service, and on legal obligation where the law requires us to keep records.

We do not sell personal information, rent it, or share it with anyone for their own marketing. We do not send marketing email to people who have not asked to hear from us, and anything we do send has a way to stop it.

WhatsApp is a normal way to reach us, and the button on this site opens a conversation with our office number. Messages sent that way travel through WhatsApp, whose own privacy policy governs that leg of the journey — we do not control it. Once a message reaches us we treat it exactly as we treat email under this policy.

Please do not send passport scans, CNIC copies, visa documents or payment card details over WhatsApp or ordinary email. If we need a document, we will tell you a safer way to send it.

Our customers use Travokey to run their agencies, so the system holds records about their travellers, members, suppliers, staff and sub-agents — names, contact details, booking and visa records, wallet and ledger entries, and documents they upload.

That information belongs to the customer. We use it only to provide, secure, support, back up and maintain the service for them, and on their instructions. We do not mine it, sell it, use it to advertise, or use one customer’s data to benefit another. Each organisation’s data is kept separate and reachable only through logins that organisation controls.

Our staff access it only where support, security or maintenance genuinely requires it. What happens to that data — how long it is kept, who in the agency may see it, when it is deleted — is set by the customer and by our agreement with them, which is summarised in our Terms of Service.

We keep the list of outsiders short. Personal information may be shared with:

• service providers who host, secure, back up or deliver the service for us, under contracts that limit them to doing exactly that;
• professional advisors — accountants, auditors and lawyers — where they need it to advise us;
• a law enforcement agency, regulator or court, where we are legally required to hand it over;
• a buyer or successor, if the business is sold or reorganised, on terms that keep this policy’s protections in place.

For platform data, we do not add a new provider that processes customer records without our customers being able to find out who it is.

We are based in Pakistan. Some of the providers who host or support the service operate infrastructure outside Pakistan, which means personal information may be stored or processed abroad.

Where that happens we use reputable providers and require them by contract to protect the information to the standard described here, whatever country it sits in. If you want to know where your own data is held, ask us and we will tell you.

• Demo enquiries that do not become customers — up to 24 months from your last contact with us, then deleted. Ask sooner and we will delete them sooner.
• Customer account and platform data — for the life of the agreement. After it ends you have 30 days to ask us for an export, after which we may delete it.
• Invoices and accounting records — for as long as Pakistani tax and company law requires us to keep them, regardless of the above.
• Technical logs — a short period set by our hosting provider, then overwritten.

The platform uses device-level login approval, role-based permissions that limit what each user can see, full audit trails on bookings and vouchers, and daily backups. Traffic to this site and to the platform is encrypted in transit. No system is perfectly secure, but if a breach affects your personal information we will tell you and the relevant authorities as the law requires.

You can ask us to:

• tell you what we hold about you and give you a copy;
• correct it if it is wrong;
• delete it, where we are not required to keep it;
• stop using it for a particular purpose, including marketing.

Email info@travokey.cloud and we will respond within 30 days. We may need to confirm who you are first. If your request concerns records held by an agency that uses Travokey, we will pass it to them, since it is their data to act on.

Travokey is a business product. It is not intended for children, and we do not knowingly collect information from anyone under 18 through this website.

If this policy changes, the date at the top of the page changes with it. Where a change materially affects how we handle your information, we will give reasonable notice by email or in the product before it takes effect.