Data Protection & SafePay Compliance

Privacy & Data Protection Policy

Transparent information on how GlobeTrek PK collects, protects, tokenizes, and processes traveler and vendor data in compliance with State Bank of Pakistan e-commerce standards and SafePay security protocols.

Last Updated: August 2026 · Version 2.6 (Active)

1. Overview & Scope of Policy

General Principles

GlobeTrek PK ("GlobeTrek", "we", "us", or "our") respects your privacy and is firmly committed to protecting the personal data of travelers, travel agency operators, consultants, and visitors who interact with our marketplace (https://globetrek.pk).

This Privacy Policy details how we collect, process, protect, and handle your information across all web routes, custom quote intake forms, AI chat interactions, and vendor consoles.

2. Categories of Information We Collect

Data Types
A. Traveler Contact & Inquiry Data

When you submit a tour inquiry, request a Custom Tour quotation, or file a Custom Visa consultation request, we collect your Full Name, WhatsApp Mobile Number, Email Address, Resident City, Destination Country, Intended Travel Dates, Passenger Count, and Estimated Budget.

B. Visa Case History & Refusal Context

For Custom Visa advisory, we collect user-provided details including applicant profession, bank statement availability, preferred submission office (e.g. Gerry's Islamabad, VFS Lahore, Anatolia Karachi), and any prior visa rejection history/clauses submitted voluntarily to facilitate file re-application.

C. Vendor KYC & Verification Documents

For travel agencies, tour operators, and visa consultants joining the platform, we collect Agency Legal Business Name, Department of Tourist Services (DTS) license copy, FBR NTN tax registration, owner CNIC/Passport, and corporate bank account IBAN.

D. Technical, Device & Analytics Data

IP address, browser type, operating system version, referring URLs, session timestamps, and anonymous interaction metrics collected to optimize platform performance and security.

3. SafePay Gateway & Payment Card Security

PCI-DSS Level 1

Zero Raw Card Storage Guarantee:

GlobeTrek PK integrates directly with SafePay Gateway (licensed by the State Bank of Pakistan) for all online credit/debit card, bank transfer, and mobile wallet transactions.

  • GlobeTrek PK does NOT collect, view, transmit, or store your 16-digit Card Number, Cardholder PIN, or CVV2/CVC security codes on our application servers or database.
  • Payment processing occurs entirely within SafePay's end-to-end encrypted PCI-DSS Level 1 certified checkout environment.
  • GlobeTrek PK only receives secure, tokenized transaction identifiers (e.g. trans_...) and payment confirmation statuses (Paid/Failed) to unlock software subscriptions or lead credits.

4. How We Process & Use Your Data

Processing Purposes
  • Connecting Travelers with Verified Agencies: Displaying submitted custom inquiries to licensed Pakistani vendors who bid with tailored tour and visa proposals.
  • Automated WhatsApp Notifications: Dispatching real-time quote delivery links, proposal updates, and payment receipts directly to your WhatsApp mobile number.
  • Regulatory KYC & Verification: Validating agency business legitimacy with the Department of Tourist Services (DTS) and FBR NTN registry to eliminate fraudulent operators.
  • AI Travel Concierge Queries: Grounding AI responses in live database listings to deliver accurate package recommendations in English and Roman Urdu.

5. Third-Party Sharing & Anti-Spam Lead Controls

Zero Data Selling

GlobeTrek PK has a strict ZERO-SPAM policy. We NEVER sell, rent, or lease your personal contact details to third-party telemarketers, bulk SMS brokers, or advertising networks.

Controlled B2B Marketplace Sharing:
  • Custom Tour Requests: Unmasked to a strict maximum of 3 verified travel agencies who unlock the inquiry to submit competing bids.
  • Custom Visa Requests: Unmasked to a strict maximum of 5 verified visa consultants to prevent overwhelming the applicant.
  • Catalog Direct Inquiries: Transmitted solely to the specific travel agency whose listing you inquired about.

6. Technical Security & Data Retention

256-Bit SSL & RLS

All database operations and API calls are secured with 256-bit SSL encryption and strict Supabase Row-Level Security (RLS) policies. Unauthenticated users cannot access sensitive customer contact numbers or vendor KYC documents.

Inquiry records and proposal histories are retained to enable travelers to access their Traveler Hub archive. Users can request immediate permanent deletion at any time.

7. Your Rights & Data Erasure Requests

User Control

You have the right to request access to, correction of, or permanent erasure of your personal data stored on GlobeTrek PK:

  • Right to Rectification: Update your profile name, phone number, and city anytime in your account dashboard.
  • Right to Deletion: Email privacy@globetrek.pk with the subject "Data Erasure Request". We will permanently purge your inquiry records within 7 business days.
  • Right to Opt-Out: You can opt out of non-transactional WhatsApp notifications by replying STOP to any platform message.

8. Privacy Officer & Regulatory Inquiries

Contact

If you have questions regarding this Privacy Policy, SafePay security practices, or data handling protocols, please reach out to our Compliance Desk:

📧 Privacy & Data Protection: privacy@globetrek.pk
💳 Billing & Payment Support: billing@globetrek.pk
🌐 Official Portal: https://globetrek.pk