Skip to content

Privacy policy

Last updated: 18 October 2026

This policy explains what personal data CRS handles, why, who receives it, how long we keep it and how you can see, change or delete it. It is written to meet the EU General Data Protection Regulation (GDPR), the laws of Bangladesh, the Meta Platform Terms and the Google API Services User Data Policy.

1. Who we are

CRS is a property management and booking service run by TRAVELIA, S#7, 1st Floor, Sky View K Box Tower, 76/1 Manik Nagar, Dhaka 1203, Bangladesh ("we", "us"). For any privacy question or request, write to privacy@crs.bd.

2. Our two roles

  • Controller for the data of property owners and staff who use CRS, and of visitors to this website.
  • Processor for the data of a property's guests. The property (hotel, resort, cruise or tour operator) decides how its guests' data is used and is its controller; we handle it only on the property's instructions, to run the service for them.

Each property is responsible for having a lawful reason to collect its guests' data and for telling its guests how it is used.

If you are a guest of a property that uses CRS, the property is your first contact. You can also write to us and we will pass your request on and help the property answer it.

3. What we collect

From properties and their staff: name, email, phone, password (stored encrypted), role, sign-in history and the business details entered in the panel (property, rooms, prices, bank and tax details, invoices).

About guests, on a property's behalf: name, phone, email, nationality, address, booking dates and room, special requests, payments and bills, identity document details and photos when the property asks for them at check-in, loyalty points, reviews, and messages the guest sends the property.

From messaging channels the property connects: when a guest writes to the property on WhatsApp, Facebook Messenger, Instagram, Telegram, email or the website chat, we receive the message, any photo, voice note or file, the time, and the sender's name and account or phone number on that channel.

From visitors to this website: what you type in the contact form (name, phone, email, property, message). Our servers record technical data such as IP address, browser and pages requested, to keep the service secure.

Payments: card and mobile-wallet payments are made on the payment provider's own secure page. We never see or store full card numbers or wallet PINs; we keep only the payment reference, amount and result.

Sensitive data: please do not put health, religious, political or similar sensitive details into CRS unless a guest's stay needs it (for example an accessibility need). Identity document numbers are stored encrypted and document photos are visible only to staff with permission.

4. Data from Meta (Facebook, Instagram, WhatsApp)

A property can connect its Facebook Page, Instagram business account and WhatsApp Business number to CRS. When it does, we receive through Meta's official interfaces:

  • the Page, Instagram account and WhatsApp number IDs and the access tokens Meta issues for them (stored encrypted);
  • messages people send to the property, with their attachments, and the property's replies;
  • for Facebook Page and Instagram posts: the comments people leave and the replies, so the property can answer them;
  • the sender's name and their Messenger, Instagram or WhatsApp ID or phone number.

We use this data only to show these conversations and comments in the property's CRS inbox, to send the property's replies, to let the property's AI assistant (if switched on) answer questions about rooms, prices and bookings, and to match a sender to the property's own guest record.

We do not sell this data, use it for advertising, share it with data brokers, or use it for any purpose other than providing CRS to that property. We follow the Meta Platform Terms and Developer Policies. A property can disconnect a channel at any time in CRS; we then stop receiving new data from it and delete its access tokens. See section 11 for how anyone can ask us to delete data that came from Meta.

5. Data from Google

CRS can send a property's room prices and availability to Google so they appear in Google search and Maps; this contains no guest data. If you connect a Google account or service to CRS, we use the data only to provide the feature you asked for.

CRS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not let people read it except with your consent, for security or where the law requires, and do not use it to train AI models.

6. Why we use it, and our legal basis (GDPR)

  • To provide CRS (accounts, bookings, messages, payments, accounting, reports, notifications): performance of our contract with the property; for guest data, on the property's instructions.
  • To keep CRS secure (sign-in protection, fraud checks, logs, backups): our legitimate interest in a safe service.
  • To keep records the law requires (invoices, tax, accounting): legal obligation.
  • To answer messages sent through this website: our legitimate interest in replying to you.
  • Marketing emails and loyalty programmes: only with consent, which can be withdrawn at any time.

7. AI assistant

If a property switches on the AI assistant, guest messages and the property's own information (rooms, prices, policies) are sent to an AI service provider to write a reply. The data is used only to produce that reply. We do not use your data to train AI models, and the assistant hands the conversation to a person when it is unsure or the guest asks for one.

8. Who receives the data

We do not sell personal data. We share it only with:

  • the property the data belongs to and the staff it gives access to;
  • service providers that work for us under written contracts and confidentiality: cloud hosting and storage, email, SMS and messaging delivery, payment processing, AI services and security;
  • Meta, Google or another platform, only when a property connects it and only to deliver what the property asked for (for example, sending a reply on WhatsApp);
  • travel sellers and agents the property chooses to sell through, which receive the booking details they need;
  • authorities, when the law requires it;
  • a buyer of our business, under the same protections, if the business is sold.

9. International transfers

Our providers may process data outside Bangladesh or outside the European Economic Area. When data from the EEA or UK is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses or another lawful safeguard. You can ask us for a copy.

10. How long we keep data

  • Property accounts and their data: while the account is active. When an owner closes the account, we delete its data within 90 days, after giving time to export it.
  • Invoices, payments and accounting records: as long as Bangladesh tax and accounting law requires.
  • Photos, voice notes and files from guest chats: deleted after 15 days by default; each property can change this.
  • Messages sent through this website's contact form: as long as needed to answer and follow up, then deleted.
  • Server and security logs: only as long as needed to investigate problems, normally no more than 90 days.
  • Backups: kept up to 5 weeks, then deleted.

11. Deleting your data

Anyone can ask us to delete their personal data, including data that came from Facebook, Instagram or WhatsApp. See Data deletion for the steps. We confirm and complete deletion within 30 days, except for records the law requires us to keep.

12. Your rights

You have the right to see the data we hold about you, to correct it, to have it deleted, to limit or object to its use, to receive it in a portable format, and to withdraw consent at any time. Write to privacy@crs.bd; we answer within 30 days, may ask you to confirm your identity first, and charge nothing unless a request is clearly unfounded or excessive. If you are in the EEA or UK and are not satisfied with our answer, you may complain to your local data protection authority.

13. California and other US states

We do not sell or share personal information, as those words are used in the California Consumer Privacy Act and similar US state laws, and have not done so in the past 12 months. California residents and residents of other states with similar laws can ask to know what we hold, to correct it or to delete it, directly or through an authorised agent, by writing to privacy@crs.bd. We verify requests by email, confirm receipt within 10 working days, answer within 45 days, and never treat you differently for using these rights. This website does not track you across other sites, so browser "Do Not Track" signals do not change how it works.

14. Children

CRS is a service for businesses and is not directed at children. We do not knowingly collect data from children under 16, except details of children travelling with an adult that the adult or the property enters for a booking.

15. Security

Data travels over encrypted connections (HTTPS). Passwords are stored as one-way hashes; access tokens, identity numbers and payment settings are stored encrypted. Each property's data is kept separate, staff access follows their role, staff can turn on two-factor sign-in, and we keep backups and watch for misuse.

16. Data breaches

If a security incident puts personal data at risk, we tell the affected properties without undue delay so they can inform their guests, and we notify the data protection authority within 72 hours where the GDPR requires it.

17. Cookies

This website uses only the cookies it needs to work. See our Cookie policy.

18. Changes

When we change this policy we update the date at the top. If a change is important we tell property owners by email before it takes effect.

19. Contact

TRAVELIA, S#7, 1st Floor, Sky View K Box Tower, 76/1 Manik Nagar, Dhaka 1203, Bangladesh. Email: privacy@crs.bd.