Trip24 — Privacy Policy

Confidential | Last Updated: March 9, 2026

Operated in Bangladesh | Effective Date: March 9, 2026 | Version 1.0

Table of Contents

1. About Trip24 and This Policy
2. What Trip24 Does
3. Definitions
4. What Data We Collect and Why
5. Why We Need Location Permission
6. How We Store and Protect Sensitive Data
7. Data Sharing and Disclosure
8. Data Retention Policy
9. Your Rights as a User
10. Cookies and Tracking Technologies
11. Children's Privacy
12. Third-Party Services
13. Changes to This Policy
14. Governing Law and Jurisdiction
15. Contact Us

---

1. About Trip24 and This Policy

Trip24 is a technology-driven logistics platform operating in Bangladesh that connects cargo owners (customers) with truck owners and drivers through a transparent bidding and booking system. Trip24 is committed to safeguarding the personal information of all users who interact with our platform.

This Privacy Policy (“Policy”) describes in detail:

• What personal information we collect from customers, drivers, and truck owners;
• How and why that information is collected and used;
• How we store, protect, and share that data;
• Your rights over your data and how to exercise them;
• How this Policy complies with applicable Bangladeshi law.

This Policy applies to all users of the Trip24 mobile application, website, APIs, and any related services (collectively, the “Services”). It governs data processed by Trip24 and its authorized data processors.

Trip24 operates in full recognition of the applicable legal framework in Bangladesh, including but not limited to: the Information and Communication Technology (ICT) Act, 2006 (as amended); the Digital Security Act (DSA), 2018; the Bangladesh Telecommunication Regulation Act, 2001; any forthcoming Personal Data Protection legislation in Bangladesh; and guidelines issued by the Bangladesh Telecommunication Regulatory Commission (BTRC).

2. What Trip24 Does

Trip24 is a two-sided digital marketplace that facilitates the booking and management of freight transportation services across Bangladesh. The platform provides two distinct user roles:

2.1 For Customers (Cargo Owners / Shippers)

• Post trip requests with pickup location, drop-off location, cargo type, weight, and required truck specifications.
• View competing bids submitted by drivers and truck owners.
• Review driver profiles, ratings, and vehicle information before accepting a bid.
• Accept the most suitable bid and confirm a booking.
• Track the delivery of goods in real-time via GPS.
• Communicate with drivers through the in-app messaging system.
• Rate and review drivers after trip completion.
• View booking history and download trip receipts.

2.2 For Drivers and Truck Owners

• Register and create a verified driver or vehicle owner profile.
• Browse available trip postings in their region or nationwide.
• Submit competitive bids on available trips.
• Accept confirmed bookings and execute delivery trips.
• Navigate via the in-app GPS guidance system.
• Receive payments upon successful trip completion.
• Build a reputation through customer ratings and reviews.
• Manage their fleet (for owners with multiple vehicles).

2.3 Platform Infrastructure

Trip24 acts as an intermediary technology platform. We do not own or operate trucks ourselves. We provide the digital infrastructure, security framework, payment facilitation, and dispute resolution mechanisms to ensure safe and reliable logistics transactions between parties.

3. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

• Platform / App: refers to the Trip24 mobile application and related web services.
• Customer: individuals and businesses who post trip requests to transport goods.
• Driver: individuals who operate trucks registered on the platform.
• Vehicle Owner: individuals or companies who own trucks and manage them through the platform.
• Data Subject / User: any individual whose personal data is collected or processed through Trip24.
• Personal Data: any information relating to an identified or identifiable natural person.
• Sensitive Data: data that, if disclosed without authorization, could cause harm, including NID, driving license, financial details, and precise location.
• Data Controller: Trip24 (the company), which determines the purposes and means of processing personal data.
• Data Processor: third-party service providers who process data on Trip24’s behalf under contractual data protection obligations.
• Processing: any operation performed on personal data, including collection, storage, use, transfer, or deletion.

4. What Data We Collect and Why

Trip24 practices “data minimisation” — we only collect data that is strictly necessary for the operation of our services, legal compliance, and user safety. Below is a comprehensive breakdown of every category of data we collect, the specific data points involved, and our lawful basis and purpose for collecting each.

4.1 Account Registration Data

Collected from: All users (Customers, Drivers, Vehicle Owners)

• Full legal name
• Mobile phone number (primary identifier)
• Email address
• Password (stored as a cryptographic hash — never in plain text)
• User role selection (Customer / Driver / Owner)
• Date and time of account creation

Why We Need This: Account data is required to create and maintain your Trip24 account, verify your identity, enable you to log in securely, and allow us to contact you for support, notifications, and service-related communications. This is the minimum necessary to operate any user account.

4.2 Identity Verification Data

Collected from: Drivers and Vehicle Owners

• National Identity Card (NID) number and scanned image/photograph
• Bangladesh Road Transport Authority (BRTA) Driving License number and image
• Self-portrait photograph (selfie) for face-matching verification
• Date of birth (for age verification)

Why We Need This: Identity verification is a legal and safety requirement. Trip24 is obligated to ensure that every driver operating on our platform is (a) a real, identifiable individual, (b) legally authorized to operate a motor vehicle under Bangladeshi law, and (c) not operating under a false identity. This protects customers’ goods and personal safety. Verified identities also enable law enforcement cooperation in the event of accidents, theft, or fraud.

4.3 Vehicle Information

Collected from: Drivers and Vehicle Owners

• Vehicle registration certificate (blue book) — number and scanned image
• Vehicle type and category (e.g., covered van, open truck, refrigerated truck)
• License plate number
• Vehicle make, model, and year of manufacture
• Payload capacity (tonnage)
• Vehicle fitness certificate issued by BRTA
• Tax token
• Commercial vehicle insurance policy number and document
• Vehicle photographs (front, rear, interior of cargo area)

Why We Need This: Customers posting trip requests have specific transportation needs — certain cargo requires specific vehicle types, capacities, and compliance certificates. Vehicle documentation ensures our platform only facilitates legally roadworthy and appropriately insured vehicles. This protects customers’ cargo and ensures Trip24 does not facilitate illegal transport operations.

4.4 Trip and Booking Data

Collected from: All users

• Pickup address and GPS coordinates
• Delivery address and GPS coordinates
• Cargo description, type, and estimated weight/volume
• Special handling requirements (fragile, hazardous, refrigerated, etc.)
• Requested pickup date and time
• Bids submitted (amount, timestamp, driver ID)
• Accepted bid details
• Trip status milestones (posted, bid placed, bid accepted, pickup confirmed, in transit, delivered)
• Timestamps for all trip events
• Trip completion confirmation and digital signature

Why We Need This: Trip data is the operational core of the platform. It enables us to match drivers with customers, track ongoing deliveries, calculate distances and payments, resolve disputes, and maintain legally required records of commercial freight transactions.

4.5 Real-Time Location Data

Collected from: Drivers (during active trips); Customers (optional, for pickup coordination)

• GPS coordinates updated at regular intervals during an active trip
• Route path taken (sequence of GPS coordinates)
• Pickup and drop-off GPS confirmation
• Estimated time of arrival (ETA) calculations
• Location at time of dispute or incident (if any)

Why We Need This: Location data is detailed in Section 5 of this Policy. In summary, it powers live trip tracking, driver-trip matching, ETA calculations, safety monitoring, and dispute resolution. Location collection begins only when a trip is active and stops upon trip completion.

4.6 Financial and Payment Data

Collected from: All users

• Mobile financial service (MFS) account number (bKash, Nagad, Rocket, etc.) for payment receipt
• Bank account details (for payouts to owners/drivers — optional)
• Transaction reference IDs and amounts
• Payment status (pending, completed, failed, refunded)
• Billing history and invoices

Why We Need This: Payment data enables us to process trip fees, disburse earnings to drivers and vehicle owners, issue refunds, generate invoices, and maintain financial audit trails required by Bangladeshi commercial and tax regulations (including the Income Tax Ordinance, 1984 and the VAT Act, 2012 where applicable).

4.7 Communication Data

Collected from: All users

• In-app messages between customers and drivers
• Support tickets and complaint submissions
• Responses to surveys or feedback forms
• Push notification engagement
• Call logs (if in-app calling is used via anonymised number relay)

Why We Need This: Communication records enable our support team to resolve disputes, mediate disagreements between parties, and investigate complaints. In-app communications also protect users’ personal phone numbers from being shared directly.

4.8 Device and Technical Data

Collected from: All users (automatically)

• Device type, model, and operating system version
• Unique device identifier (Device ID)
• App version
• IP address
• Network operator and connection type (WiFi / mobile data)
• Crash reports and diagnostic logs
• App usage analytics (screens visited, time spent, features used)

Why We Need This: Technical data allows us to diagnose bugs, improve app performance, ensure compatibility across devices, detect fraudulent activity (e.g., multiple accounts from one device), and enhance the overall user experience.

4.9 Ratings and Reviews

Collected from: All users

• Star ratings submitted after trip completion
• Written review content
• Timestamps of ratings submitted

Why We Need This: Ratings and reviews maintain platform quality and trust. They allow customers to make informed decisions when selecting drivers and incentivise all parties to maintain high service standards.

5. Why We Need Location Permission

Location access is one of the most sensitive permissions a mobile application can request. Trip24 takes this responsibility seriously and only accesses location data when there is a clear, necessary, and proportionate reason to do so.

5.1 When and How Location Is Accessed

Driver location is accessed only when the driver is logged in and has an active trip in progress. Location collection pauses automatically when a trip is completed or cancelled. Background location (when the app is not open) may be used for drivers with an active trip to ensure continuous tracking. Customer location is requested optionally to auto-fill the pickup address. Customers can manually enter their address without granting location permission.

5.2 Specific Purposes for Location Collection

5.2.1 Trip Matching for Faster Bidding

When a driver opens the app and browses available trips, we use their location to prioritise and surface nearby trip postings. This reduces empty miles, saves fuel, and enables faster response times for customers.

5.2.2 Real-Time Delivery Tracking

Once a trip begins, customers can track the precise real-time location of their goods on a live map. This provides peace of mind, allows for coordination at the delivery point, and reduces customer anxiety about cargo safety.

5.2.3 Estimated Time of Arrival (ETA) Calculations

GPS data combined with road network data allows Trip24 to compute accurate ETAs for deliveries. This helps customers plan their operations and allows drivers to communicate realistic timelines.

5.2.4 Route Verification and Dispute Resolution

The GPS route log of a completed trip is preserved as a tamper-resistant record. In the event of a dispute (e.g., a driver claiming they completed a delivery while a customer claims they did not), the stored route data provides objective evidence.

5.2.5 Safety Monitoring and Emergency Response

In the event of an accident, breakdown, or emergency, the last known GPS location of the driver is available to our safety team and, where legally required, to law enforcement. This can be critical in facilitating rapid emergency response.

5.2.6 Geofencing for Pickup and Delivery Confirmation

Trip24 uses geofencing technology to automatically detect and confirm when a driver arrives at the pickup location and when they arrive at the drop-off point. This creates automatic, verifiable timestamps for billing and legal record purposes.

5.2.7 Fraud Prevention

Location data helps Trip24 identify anomalous patterns that may indicate GPS spoofing, fake trip completions, or other fraudulent activities. This protects the financial interests of both customers and honest drivers.

6. How We Store and Protect Sensitive Data

The protection of sensitive personal data is the highest-priority security obligation for Trip24. We implement a multi-layered security architecture that combines technical, administrative, and physical safeguards.

6.1 Data Classification

Trip24 classifies all data into the following tiers:

• Tier 1 — Highly Sensitive: National ID (NID) images, Driving License images, Vehicle registration documents, selfie photos, financial account numbers, precise GPS location logs.
• Tier 2 — Sensitive: Phone numbers, email addresses, trip history, payment transaction references.
• Tier 3 — Standard: App usage analytics, device information, ratings and reviews.

Each tier is subject to progressively elevated access controls, encryption standards, and audit requirements.

6.2 Encryption in Transit

All data transmitted between the Trip24 app and our servers is encrypted using TLS 1.2 or TLS 1.3 — the industry-standard encryption protocol. Certificate pinning is implemented in the mobile app to prevent man-in-the-middle attacks. All API endpoints are served exclusively over HTTPS. Unencrypted HTTP connections are rejected.

6.3 Encryption at Rest

All Tier 1 sensitive documents (NID, driving license, vehicle documents, selfies) are stored in encrypted object storage using AES-256 encryption. Database fields containing personal identifiers (phone numbers, NID numbers) are encrypted at the column level. Encryption keys are managed separately from the encrypted data and are rotated periodically. Backups of sensitive data are also encrypted with separate keys.

6.4 Access Control

Role-Based Access Control (RBAC) is enforced across all internal systems. An employee can only access the data necessary for their specific job function. Tier 1 sensitive documents are accessible only to the verification team and senior security personnel. General customer support agents cannot view NID images or license documents. All administrative access to sensitive data requires multi-factor authentication (MFA). Access sessions expire automatically after a period of inactivity. Third-party data processors are contractually prohibited from accessing data beyond the scope of their designated service.

6.5 Document Storage for NID, Driving License, and Vehicle Documents

These documents represent the most sensitive category of data on our platform. We apply the following specific measures:

• Document images are stored in an isolated, dedicated storage system not directly connected to the general application database.
• Access to the document storage system is strictly limited to the automated verification pipeline and authorised verification staff.
• Once identity verification is complete and approved, access to the original document image is further restricted. Only the verification status (Approved / Rejected / Pending) is surfaced to general app functions.
• Trip24 does not share original document images with any third party except where legally compelled by a valid court order or directive from a competent Bangladeshi authority.
• Physical access to servers (if hosted locally) is restricted to authorised personnel only, with CCTV and access logging.

6.6 Phone Number and Email Protection

Phone numbers are used as primary account identifiers but are not displayed publicly on the platform. When a customer needs to contact a driver (or vice versa), communications are routed through an in-app messaging or anonymised call relay system, preventing direct phone number disclosure. Email addresses are not publicly visible and are used only for account communications and support.

6.7 GPS and Location Data Security

GPS data is streamed over encrypted channels (TLS 1.3). Historical GPS route data is retained only for the duration specified in Section 8 (Data Retention). Access to real-time GPS data is restricted to the active parties in a trip (the customer who booked and the driver who accepted). Historical GPS logs are accessible only to authorised internal personnel for dispute resolution and to law enforcement upon lawful request.

6.8 Incident Response

Trip24 maintains a formal Data Breach Incident Response Plan that includes:

• Automatic alerts triggered by anomalous access patterns to sensitive data.
• A dedicated security incident response team responsible for investigating and containing breaches within 72 hours of detection.
• Notification to affected users in the event of a breach that is likely to result in a high risk to their rights and freedoms.
• Reporting to relevant Bangladeshi authorities (e.g., BTRC, law enforcement) as required by applicable law.

6.9 Security Audits and Monitoring

All access to sensitive data is logged, including who accessed it, when, from which IP address, and what action was taken. Audit logs are immutable and stored separately from operational systems. Trip24 conducts regular internal security reviews and periodic third-party security audits. Penetration testing is performed at least annually on all critical systems.

7. Data Sharing and Disclosure

Trip24 does not sell personal data. We do not permit advertisers to purchase user information. We share data only in the following circumstances:

7.1 Between Users on the Platform

When a customer posts a trip, their pickup and drop-off locations and cargo details are shared with drivers who are browsing available trips. When a driver’s bid is accepted, their name, phone number (via relay), vehicle type, and license plate are shared with the booking customer. Customer ratings and driver ratings are visible to relevant parties as part of the trust system.

7.2 With Authorised Service Providers (Data Processors)

Trip24 engages third-party service providers who process data on our behalf under strict data processing agreements (DPAs) that prohibit them from using the data for any purpose beyond the agreed service. These include:

• Cloud infrastructure and hosting providers (for server and database services);
• Payment gateway providers (bKash, Nagad, SSL Commerz, or similar) for payment processing;
• SMS/OTP gateway providers for account verification;
• Push notification services;
• Analytics platforms (for anonymised, aggregated usage analytics only);
• Identity verification API providers (if automated KYC is used).

7.3 Legal Obligations

Trip24 may disclose personal data when required to do so by law, including:

• In response to a valid court order, subpoena, or legal process;
• Upon a lawful request from a Bangladeshi government authority, law enforcement agency, or BTRC;
• To prevent, investigate, or take action against suspected illegal activity, fraud, or violations of our Terms of Service;
• To protect the safety of users or the public in emergency situations.

Trip24 will, to the extent permitted by law, notify affected users before complying with government data requests unless prohibited from doing so.

7.4 Business Transfer

In the event of a merger, acquisition, corporate restructuring, or sale of Trip24 assets, personal data may be transferred to the acquiring entity. Users will be notified in advance of any such transfer, and the new entity will be required to honour this Privacy Policy or obtain fresh consent if material changes are made.

8. Data Retention Policy

Trip24 retains personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, and to resolve disputes. The following retention periods apply:

Data Category	Retention Period	Basis
Account registration data	Duration of account + 3 years after deletion	Legal obligation, dispute resolution
NID and Driving License documents	Duration of account + 5 years after deletion	Legal compliance, fraud prevention
Vehicle registration documents	Duration of vehicle registration on platform + 5 years	Legal compliance
Trip and booking records	7 years from trip date	Commercial / tax / accounting law
Payment transaction records	7 years from transaction date	Bangladesh tax and financial regulations
GPS location data (active trip)	90 days after trip completion	Dispute resolution
In-app communications	2 years from message date	Dispute resolution, safety
Device/analytics data	12 months on a rolling basis	Performance optimisation
Ratings and reviews	For the lifetime of the account	Platform trust system

After the applicable retention period expires, data is permanently and irreversibly deleted or anonymised so that it can no longer be linked to any individual. Deletion is performed using secure deletion methods that prevent recovery.

9. Your Rights as a User

As a user of Trip24, you have the following rights with respect to your personal data. These rights are consistent with internationally recognised data protection standards and are upheld by Trip24 to the fullest extent practicable under Bangladeshi law.

• Right to Access: You may request a copy of all personal data Trip24 holds about you. We will respond within 30 days of receiving a verified request.
• Right to Rectification: If any personal data we hold is inaccurate or incomplete, you may request that it be corrected. This includes updating your name, phone number, or vehicle information.
• Right to Deletion / Erasure: You may request that we delete your account and personal data. We will comply unless retention is required by law (e.g., for financial records). Note that deletion of your account will prevent you from accessing Trip24 services.
• Right to Restriction of Processing: In certain circumstances (e.g., while we are investigating the accuracy of data you have contested), you may request that we pause processing of your data.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to Data Portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).
• Right to Lodge a Complaint: You may file a formal complaint with Trip24’s Data Protection Officer (DPO) or with the relevant Bangladeshi regulatory authority (e.g., BTRC) if you believe your data rights have been violated.

To exercise any of these rights, please contact our Data Protection Officer at the contact details provided in Section 15.

10. Cookies and Tracking Technologies

The Trip24 mobile application does not use browser cookies. However, we use the following tracking technologies within the app:

• Session Tokens: Unique device identifiers to maintain your login session and prevent you from having to log in repeatedly.
• Analytics SDKs: We may use analytics SDKs (e.g., Firebase Analytics) to collect anonymised, aggregated information about how users interact with the app. This data cannot be used to identify you personally.
• Push Notification Tokens: We use push notification tokens (such as Firebase Cloud Messaging) to deliver real-time alerts about your bookings, bids, and account activity. You may disable push notifications in your device settings at any time.

We do not use any advertising tracking technologies, third-party advertising SDKs, or cross-app tracking mechanisms.

11. Children’s Privacy

Trip24 is a commercial logistics platform intended exclusively for adults. Our Services are not directed at, and we do not knowingly collect personal data from, individuals under the age of 18.

By creating an account, you represent and warrant that you are at least 18 years of age and legally competent to enter into binding agreements under Bangladeshi law.

If we discover or are notified that we have collected personal data from a minor, we will immediately delete such data from our records. If you believe a minor has registered on Trip24, please contact us immediately at the details in Section 15.

12. Third-Party Services

Trip24 integrates with certain third-party services to deliver its core functionality. These services have their own privacy policies, and we encourage users to review them:

• Payment gateways (bKash, Nagad, SSL Commerz): Used for processing payments. Trip24 does not store your full MFS PIN or banking credentials.
• Mapping and navigation services (e.g., Google Maps API): Used for displaying maps, route calculation, and ETA estimation. Google’s use of map data is governed by its own Privacy Policy.
• SMS gateway services: Used to send OTP verification codes for account registration and login.
• Cloud hosting providers: Our servers and databases are hosted on cloud infrastructure bound by enterprise-grade data processing agreements.

Trip24 is not responsible for the privacy practices of third-party services. We select partners who meet our security standards and are bound by contractual data protection obligations.

13. Changes to This Policy

Trip24 reserves the right to update or modify this Privacy Policy at any time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this Policy;
• Send a push notification to all registered users informing them of the update;
• Display a prominent in-app notification requiring users to review and acknowledge the updated Policy;
• For significant changes, we may require users to explicitly re-consent before continuing to use the platform.

Your continued use of Trip24 after a Policy update constitutes your acceptance of the revised terms. If you do not agree with any changes, you must discontinue use of the platform and may request deletion of your account.

14. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the People’s Republic of Bangladesh, including the Information and Communication Technology Act, 2006 and the Digital Security Act, 2018.

Any dispute arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts of Bangladesh.

Trip24 is committed to resolving privacy complaints in a fair and transparent manner. We encourage users to contact us directly before escalating any dispute to regulatory authorities.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact our Data Protection Officer:

By using Trip24, you agree to this Privacy Policy.

Trip24 © 2026. All Rights Reserved. Operated in Bangladesh.