Codedmask

Privacy Policy

This policy explains what personal data Codedmask collects, why we collect it, how long we keep it, and how you can ask us to delete it.

Last updated 15 August 2026. Effective from the same date.

1. Who we are

Codedmask (“we”, “us”) is a business registered in Bangladesh, trade licence 05-50182, with its registered office at Hashem Villa, 150/5, East Rayer Bazar, Dhanmondi, Dhaka 1209, Bangladesh.

We are the data controller for personal data described in this policy that relates to our own website visitors and our direct business contacts. Where we operate our Navigo platform on behalf of a client travel business, that client is the data controller and we act as their data processor.

For any privacy question or request, contact contact@codedmask.com.

2. What we collect

We collect only what we need to run our services:

  • Contact details — name, email address, telephone number, and company name, when you contact us or when a client creates a user account.
  • Booking and travel data — traveller names, contact details, trip and itinerary details, and payment status, processed inside Navigo on behalf of our clients.
  • Messaging data — the content and delivery status of messages sent to or received from customers over WhatsApp and other channels, together with the phone number used.
  • Technical data — IP address, browser type, and request timestamps recorded in server logs for security and troubleshooting.

We do not collect special category data (health, religion, biometrics, political opinion) unless a client explicitly requires it for a trip and has its own lawful basis for doing so.

3. Why we use it

  • To provide, operate, and support the Navigo platform.
  • To send service messages — booking confirmations, itinerary and schedule changes, payment reminders, and replies to enquiries a customer has started.
  • To respond to enquiries sent to us directly.
  • To keep our systems secure and diagnose faults.
  • To meet accounting, tax, and other legal obligations.

We do not sell personal data. We do not share it with advertising networks or use it to build advertising profiles.

4. WhatsApp Business messaging

We use the WhatsApp Business Platform, provided by Meta Platforms, Inc., to send and receive messages on behalf of our clients.

  • Opt-in. A customer's phone number is only used for messaging where that customer has given consent — during booking, on a client's own website or form, or by messaging the business first.
  • What we send. Service and transactional messages relating to a booking or enquiry. We do not send unsolicited marketing.
  • Opt-out. Reply STOP to any message, or email contact@codedmask.com. We stop messaging that number and record the opt-out so it is not contacted again.
  • Meta's role. Message delivery is carried out by Meta, and message data passes through Meta's infrastructure under Meta's own terms and privacy policies.

5. Who we share data with

We share personal data only with:

  • The client whose business the data belongs to, where we act as processor.
  • Infrastructure and service providers who host or transmit data for us — cloud hosting, email delivery, payment processing, and messaging providers including Meta. Each is bound by a contract limiting use of the data to providing that service.
  • Authorities, where we are legally required to disclose.

Some of these providers operate outside Bangladesh, so data may be transferred and stored abroad. We use providers that apply recognised safeguards for international transfers.

6. How long we keep it

  • Booking and traveller records — for as long as our client's account is active, and afterwards only as long as needed for legal, tax, or dispute purposes.
  • Message history — 24 months from the date of the message, then deleted.
  • Opt-out records — kept indefinitely, because we must remember not to message that number again.
  • Server logs — 90 days, then deleted.

7. How we protect it

Data is encrypted in transit using TLS and encrypted at rest by our hosting providers. Access is limited to staff who need it, protected by individual accounts and multi-factor authentication. We log administrative access and review it.

8. Your rights

You may ask us to:

  • tell you what personal data we hold about you;
  • correct data that is wrong or incomplete;
  • delete your data, where we have no legal reason to keep it;
  • stop using your data for a particular purpose;
  • provide your data in a portable, machine-readable format.

Write to contact@codedmask.com. We respond within 30 days. If the data belongs to one of our clients' customers, we will pass the request to that client and support them in answering it.

9. Data deletion requests

To have your personal data deleted, email contact@codedmask.com with the subject line Data deletion request, including the email address or phone number concerned so we can locate the records.

We confirm receipt within 5 working days and complete deletion within 30 days, except where we are legally required to retain specific records — for example accounting records, or the opt-out list described in section 6.

10. Cookies

This website sets no cookies and runs no analytics or tracking scripts. Our Navigo application uses only strictly necessary cookies to keep a signed-in user's session active.

11. Children

Our services are sold to businesses and are not directed at children. We do not knowingly collect data from anyone under 18 other than traveller details supplied by a parent or guardian as part of a booking.

12. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes affecting our clients will be notified to them directly.

13. Contact and complaints

Questions or complaints: contact@codedmask.com, or by post to Hashem Villa, 150/5, East Rayer Bazar, Dhanmondi, Dhaka 1209, Bangladesh.