1. Scope of this policy
This policy explains how information is collected, used, stored and disclosed when you create a Ticket Exchange BD account, post or book a ticket, make an EPS payment, use Conversations, submit a review or referral, contact support, or interact with administration. External EPS, SMS, banking/MFS and other websites may apply their own privacy policies.
2. Information we collect
- Account and identity: full name, email, Bangladeshi mobile number, NID number, verification times, account status and acknowledgement records.
- Payout details: MFS provider and account number, or bank account name, number, branch and routing number.
- Referral and money records: personal/used referral codes, referral earning, received referral money, buyer hold, refund, seller payment, earnings, commission and admin correction notes.
- Tickets and orders: ticket type, route/venue, vehicle/event name, time, quantity, prices, selling reason, status, buyer/seller links, order amount, EPS transaction/payment references and settlements.
- Communications and content: buyer-seller messages, image/PDF uploads, original filenames, read/validation times, platform reviews and Contact Us submissions.
- Technical and security data: IP address, user-agent/browser information, session and login times, last-seen presence, audit/security logs and request-related metadata.
The website is not designed to store EPS card credentials, banking PINs or payment OTPs. Credentials entered in EPS checkout are handled by the relevant provider; the platform retains required transaction references, status and amount.
3. How information is used
- To create accounts, verify email/mobile, manage login and reset passwords.
- To provide ticket search, posting, reservation, booking, protected delivery, validation, cancellation, refund, relisting and settlement.
- To maintain referral earnings, hold money, commission, payout and financial audit records.
- To deliver message/SMS/email notifications, support users and respond to Contact Us submissions.
- To detect, prevent and investigate fraud, double booking, account abuse, unlawful tickets, security incidents and disputes.
- To meet legal, accounting, payment-reconciliation, claim and lawful-authority requirements.
- To publish approved reviews, improve the service and prepare aggregated operational reporting.
4. What other users can see
Public ticket cards may show the seller’s name and listing information. After booking, only the linked buyer and seller can use the protected Conversation. NID, password hashes, OTPs, complete payout accounts and admin-only financial/audit details are not displayed to ordinary users. Under the current design, an approved review may publicly show the reviewer’s name, rating, comment, mobile number and posting time; consider this before submitting a review.
5. When information may be shared
Limited information may be processed by EPS, SMS/email providers, hosting/database/storage providers and security or technical providers as required to operate the service. Required records may be disclosed for transaction reconciliation, fraud prevention, legal claims, or a valid government or court request. We do not operate this service to sell personal information. A business reorganization may involve a protected transfer where permitted by applicable law.
6. Cookies and sessions
Cookies and browser storage are used for login sessions, CSRF security, language choice and light/dark theme. Disabling necessary cookies may prevent login, language or security-dependent functions from working correctly.
7. Retention
Account, ticket, order, payment, refund, settlement, message, upload and audit records are retained as needed to operate the service, maintain accounts, prevent fraud, handle disputes or chargebacks, and comply with law. OTPs have limited validity and old OTP records are cleaned by maintenance; expired sessions are revoked. Refunded Conversations may remain as read-only history. Retention periods can differ according to law, risk and record type.
8. Security
Passwords and session tokens are hashed. OTPs use hashes, expiry and attempt limits. Important forms use CSRF protection and database operations use prepared statements. Uploads are checked for size and MIME type, stored under random names and covered by server rules intended to prevent script execution. Administrative actions are audited. No internet service is risk-free, so use a strong unique password, never share an OTP and report suspicious activity promptly.
9. Your choices and requests
You can correct eligible information through My Profile. Changing email requires re-verification, and changing mobile removes mobile verification. Profile editing may be temporarily locked while a seller has a Reserved, Booked or Problematic ticket to protect transaction integrity. Use Contact Us for access, correction, account/privacy questions or a lawful deletion/objection request. Some records may need to remain for accounting, security, disputes or law, and sensitive requests require identity verification.
10. Minors, international processing and changes
A person who cannot legally enter contracts or make payments independently should use the service only with required guardian permission and supervision. If a provider’s infrastructure is outside Bangladesh, necessary data may be processed in another country under appropriate contractual and security measures. This policy may be updated when the service or law changes; the new effective date will be published here.