Privacy Policy

Last updated: 18 August 2026

This Privacy Policy explains how Iran Train Ticket collects, uses, stores, discloses, transfers, and protects your personal data when you use our website, create an account, search for journeys, purchase tickets, make payments, contact customer support, or otherwise communicate with us.

1. Data Controller

Iran Train Ticket is a travel booking service operated by Markar Travel.

Markar Travel is an officially registered Iranian travel agency authorised to sell passenger train tickets for Iran’s railway network. Unless otherwise stated, Markar Travel determines the purposes and methods of processing personal data collected through Iran Train Ticket and therefore acts as the data controller.

Website: Iran Train Ticket
Operating Travel Agency: Markar Travel
Country of Registration: Iran
Email: info@irantrainticket.com
WhatsApp: +98 933 440 6373
Website: https://irantrainticket.com/
Registered Address: [Insert Markar Travel’s registered legal address]
Licence Number: [Insert travel agency licence number]

Transport operators, payment providers, and certain other service providers may act as separate and independent data controllers for the personal data they receive.

2. Scope of This Privacy Policy

This Privacy Policy applies to:

• Visitors to the Iran Train Ticket website;
• Users who create or use an account;
• Customers who search for or purchase train or bus tickets;
• Passengers whose information is included in a booking;
• People who contact our customer support;
• Customers requesting amendments, cancellations, or refunds; and
• People who subscribe to marketing communications, where applicable.

The person making and paying for a booking may be different from the passenger travelling.

3. Personal Data We Collect

3.1 Identity and Passenger Information

Depending on the journey and the requirements of the transport operator, we may collect:

• Full name;
• Date of birth;
• Gender, where required for ticket issuance;
• Nationality;
• Country of residence;
• Passport or national identity document number;
• Document issue and expiry dates; and
• A copy or image of an identification document, only where genuinely necessary.

Please do not send us a passport or identity document unless we request it through an official communication channel.

3.2 Contact Information

We may collect:

• Email address;
• Telephone number;
• WhatsApp number;
• Country or region of residence; and
• Billing address, where required.

3.3 Travel and Booking Information

We may process information relating to your journey, including:

• Origin and destination;
• Travel date and departure time;
• Type of transport;
• Train or bus operator;
• Train or bus number;
• Coach, compartment, berth, or seat information;
• Number and identity of passengers;
• Seat, berth, or compartment preferences;
• Booking reference and booking status;
• Requests for amendments, cancellations, or refunds; and
• Booking and travel history.

Seat and compartment preferences cannot always be guaranteed because availability is controlled by the relevant transport operator.

3.4 Account Information

If you create an account, we may process:

• Username;
• Email address;
• Internal customer identification number;
• Encrypted or securely hashed password;
• Login and account status;
• Booking history; and
• Saved preferences and settings.

We do not intentionally store account passwords in plain text.

3.5 Payment and Transaction Information

All payments made through Iran Train Ticket are calculated using the euro as the reference currency.

We may collect or receive:

• Amount paid in euros;
• Currency and exchange-related transaction information;
• Payment date and time;
• Transaction reference;
• Payment status;
• Name of the payment provider;
• Masked payment card details, where supplied by the payment provider;
• Refund information; and
• Payment disputes or chargeback information.

Complete card details and card security codes should be processed directly by an authorised payment provider. Iran Train Ticket does not intend to store complete payment card numbers or security codes.

Payment providers may process your personal data according to their own privacy policies.

3.6 Communications and Customer Support

When you contact us by email, website form, account message, telephone, or WhatsApp, we may collect:

• The content of your message;
• Date, time, and communication channel;
• Contact details;
• Attachments;
• Booking reference;
• Our replies; and
• The outcome of your request or complaint.

If you contact us through WhatsApp, WhatsApp and its service providers may process message content and metadata under their own terms and privacy policies.

3.7 Technical, Device, and Security Information

When you use our website, we may automatically collect:

• IP address;
• Browser type and version;
• Device type;
• Operating system;
• Access dates and times;
• Pages visited;
• Referring website or page;
• Session identifiers;
• Website error logs;
• Security and fraud-prevention events; and
• Cookie preferences and consent records.

Non-essential analytics, personalisation, or advertising technologies will only be used where permitted and, where required, after obtaining your consent.

3.8 Communication and Marketing Preferences

Where applicable, we may process:

• Newsletter subscription status;
• Preferred communication methods;
• Marketing consent or withdrawal;
• Date and method of consent;
• Opt-out records; and
• Engagement with our communications.

Accepting our Terms and Conditions does not automatically mean that you consent to receive marketing communications.

3.9 Accessibility and Special Assistance Information

If you request assistance for a disability, reduced mobility, medical condition, or accessibility need, we may process limited information concerning:

• Boarding or mobility assistance;
• The need for a companion;
• Accessibility requirements; and
• Other information necessary to arrange your journey.

We only request such information when it is necessary and knowingly provided by you. We seek to collect the minimum amount of sensitive information required.

4. Sources of Personal Data

We may receive personal data from:

• You directly;
• The person making a booking on your behalf;
• Your Iran Train Ticket account;
• Train or bus operators;
• Ticketing and reservation systems;
• Banks and payment providers;
• Fraud-prevention and security services;
• Cookies and analytics technologies, where consent has been provided; and
• Customer-support communications.

5. Purposes and Legal Bases for Processing

Where the General Data Protection Regulation or similar data-protection laws apply, we process personal data under one or more of the following legal bases.

5.1 Performance of a Contract

We may process personal data when necessary to:

• Search for journeys and available capacity;
• Prepare or complete a booking;
• Issue and deliver tickets;
• Process payments;
• Create and administer an account;
• Handle passenger requests;
• Process amendments, cancellations, or refunds;
• Communicate with transport operators;
• Provide customer support; and
• Perform our obligations under the booking contract.

This basis also covers steps taken at your request before entering into a contract.

5.2 Compliance With Legal Obligations

We may process and retain personal data to:

• Meet accounting, taxation, and financial-record requirements;
• Respond to lawful requests from competent authorities;
• Prevent and investigate fraud;
• Manage disputes and legal claims; and
• Comply with applicable travel, ticketing, and transport regulations.

5.3 Legitimate Interests

Where permitted by law, we may process personal data for legitimate business interests, including:

• Protecting our website, customers, and booking systems;
• Preventing fraud and unauthorised transactions;
• Identifying technical problems;
• Providing and improving customer support;
• Maintaining appropriate business records;
• Responding to complaints;
• Establishing, exercising, or defending legal claims; and
• Measuring the general performance of our services without unnecessary tracking.

Before relying on legitimate interests, we consider whether our interests are overridden by your rights and reasonable expectations.

5.4 Consent

We may rely on your consent for:

• Non-essential analytics or advertising cookies;
• Newsletters and promotional communications;
• Optional travel preferences;
• Optional sensitive information;
• Certain international data transfers where explicit consent is legally permitted; and
• Other processing activities for which consent is required.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

5.5 Vital Interests

In an emergency, we may process or share limited personal data where necessary to protect the life, health, or physical safety of a passenger or another person, where permitted by law.

6. Required and Optional Information

Certain information is necessary to:

• Identify passengers;
• Create a booking;
• Issue a valid ticket;
• Process a payment;
• Comply with transport-operator requirements; or
• Provide customer support.

If you do not provide required information, we may be unable to complete your booking or provide the requested service.

Optional information will, where practical, be identified as optional.

7. Bookings Made for Other People

If you provide personal data about another passenger, you confirm that:

• You are authorised to provide the information;
• The information is accurate;
• You have made this Privacy Policy available to the passenger; and
• You have obtained any necessary consent before providing sensitive personal data.

We may request evidence of your identity or authority where reasonably necessary.

8. Sharing Data With Train and Bus Operators

To issue and manage a ticket, we may need to provide the relevant transport operator with information such as:

• Passenger name;
• Date of birth;
• Nationality;
• Passport or identity-document details;
• Travel itinerary;
• Seat, berth, coach, or compartment information; and
• Accessibility or assistance requirements.

Transport operators may process this information as independent data controllers and according to their own legal obligations and privacy policies.

We provide only the information reasonably necessary for the relevant journey or service.

9. Other Recipients of Personal Data

We may disclose personal data to:

• Train and bus companies;
• Reservation and ticketing systems;
• Payment providers, banks, and financial institutions;
• Website hosting and IT service providers;
• Email, messaging, and communications providers;
• Cybersecurity and fraud-prevention providers;
• Customer-support providers;
• Accountants, auditors, lawyers, and professional advisers;
• Insurers, where relevant;
• Government authorities, courts, regulators, or law-enforcement agencies where legally required; and
• Analytics or advertising providers, where applicable and subject to required consent.

Service providers acting as processors are expected to process personal data only according to our documented instructions, contractual requirements, and applicable law. Some recipients, such as transport operators, banks, and government authorities, may act as independent controllers.

10. We Do Not Sell Personal Data

Iran Train Ticket does not sell or rent your personal data in exchange for money.

We do not disclose personal data for behavioural advertising without providing appropriate information and obtaining consent where legally required.

11. Marketing Communications

We will only send promotional emails or similar marketing communications when:

• You have consented; or
• Another valid legal basis permits the communication.

You may unsubscribe at any time by using the unsubscribe option in the communication or contacting us.

Unsubscribing from marketing does not prevent us from sending essential service messages relating to your account, booking, payment, ticket, cancellation, refund, or customer-support request.

12. Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy.

Where required, you may use the website’s cookie controls to:

• Accept cookies;
• Reject non-essential cookies;
• Manage cookie categories; or
• Withdraw previous consent.

Non-essential analytics and advertising technologies should remain disabled until valid consent has been obtained.

13. International Data Transfers

Markar Travel operates in Iran. As a result, personal data provided through Iran Train Ticket may be processed in Iran and may also be transferred to service providers or transport operators located outside the European Economic Area.

Iran is not currently covered by a general European Union adequacy decision. Where European data-protection law applies, we will use an appropriate legal basis or transfer mechanism, which may include:

• A transfer strictly necessary to perform a travel contract or take requested pre-contractual steps;
• Standard Contractual Clauses, where applicable;
• Explicit and informed consent for a specific transfer, where legally permitted;
• A transfer necessary for establishing, exercising, or defending legal claims; or
• Another transfer mechanism recognised under applicable law.

We seek to transfer only the minimum amount of personal data necessary.

Where applicable, you may contact us to request information about the transfer mechanism or available safeguards.

14. Processing of Data in Iran

Processing in Iran may be necessary to:

• Communicate with Iranian train or bus operators;
• Access local reservation and ticketing systems;
• Issue passenger tickets;
• Provide local customer support;
• Process amendments, cancellations, or refunds;
• Respond to service disruptions; and
• Comply with Iranian transport requirements.

Customers in the European Union or European Economic Area should understand that passenger information required for an Iranian journey may need to be processed in Iran.

15. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy and to comply with legal, accounting, security, and dispute-resolution requirements.

Our expected retention periods are:

• Enquiries that do not result in a booking: normally up to 12 months;
• Failed or abandoned orders: normally up to 90 days, unless longer retention is required for fraud prevention;
• Booking, payment, and accounting records: normally up to seven years after the journey or for any longer period required by law;
• Passport or identity-document copies: normally deleted within 90 days after the journey, unless longer retention is required by law or because of a complaint, refund, fraud investigation, or legal dispute;
• Account information: retained while the account remains active and normally for up to 24 months after inactivity, subject to prior notice where appropriate;
• Customer-support and complaint records: normally up to three years after the matter is closed;
• Technical and security logs: normally up to 12 months;
• Marketing information: until consent is withdrawn or normally after 24 months of inactivity;
• Consent, withdrawal, and objection records: normally up to five years; and
• Cookie information: according to the periods shown in our Cookie Policy or cookie settings.

Certain information may be retained for longer where necessary for legal claims, unresolved disputes, regulatory requirements, security investigations, or fraud prevention.

After the applicable retention period, data will be securely deleted or anonymised.

16. Information Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse, or destruction.

These measures may include:

• Encrypted website connections using HTTPS;
• Role-based access controls;
• Restricted staff access;
• Secure password hashing;
• Security and access logging;
• Secure backups;
• Software and security updates;
• Reputable payment providers;
• Staff training;
• Confidentiality obligations; and
• Incident-response procedures.

No website, transmission method, or storage system is completely risk-free. We cannot guarantee absolute security, but we take reasonable measures to reduce foreseeable risks.

17. Personal Data Breaches

If a personal data breach occurs, we will:

• Investigate the incident;
• Take reasonable steps to contain and limit the breach;
• Assess the potential risk to affected individuals;
• Document the incident;
• Notify the relevant supervisory authority where legally required; and
• Notify affected individuals without undue delay where the breach is likely to create a high risk to their rights and freedoms and notification is required by law.

18. Your Data-Protection Rights

Depending on your location and the applicable law, you may have the right to:

• Request access to your personal data;
• Request correction of inaccurate or incomplete data;
• Request deletion of personal data, subject to legal exceptions;
• Request restriction of processing;
• Receive certain data in a structured, commonly used, machine-readable format;
• Request that eligible data be transferred to another controller;
• Object to processing based on legitimate interests;
• Object at any time to direct marketing;
• Withdraw your consent;
• Request human review of certain automated decisions; and
• Complain to a competent data-protection supervisory authority.

These rights are not absolute. For example, we may need to retain certain booking, payment, tax, fraud, or legal records even after receiving a deletion request.

19. Exercising Your Rights

To submit a privacy request, contact us through:

Email: info@irantrainticket.com
WhatsApp: +98 933 440 6373
Suggested email subject: Privacy Request

Please provide enough information for us to identify you and understand your request. We may request reasonable evidence of identity before disclosing, correcting, deleting, or transferring personal data.

Where the GDPR applies, we will normally respond without undue delay and within one month. This period may be extended where legally permitted because of the complexity or number of requests. If an extension is necessary, we will inform you.

Privacy requests are generally handled free of charge. A reasonable fee may be charged, or a request may be refused, where permitted by law and where the request is manifestly unfounded, repetitive, or excessive.

20. Automated Decision-Making and Fraud Checks

We may use automated security or fraud-prevention tools to identify suspicious bookings, payment attempts, or account activity.

A flagged transaction may be reviewed manually, delayed, or rejected for security reasons.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects unless:

• A valid legal basis exists;
• Appropriate safeguards are provided; and
• You have access to human review or another remedy where required by law.

21. Children’s Data

Iran Train Ticket is not intended to allow children to make independent bookings.

A parent, legal guardian, or responsible adult should make a booking for a child. We collect only the child’s information required to issue and manage the ticket or provide the requested assistance.

We do not knowingly use children’s personal data for behavioural advertising or marketing profiling.

22. Third-Party Websites and Services

Our website may contain links to or interact with third-party services, including:

• Payment providers;
• Mapping services;
• Messaging platforms;
• Train and bus operators; and
• Other travel-related websites.

These third parties may process personal data as independent controllers under their own privacy policies. We encourage you to review those policies before using their services.

Iran Train Ticket is not responsible for the independent privacy practices of third parties, although we exercise reasonable care when selecting service providers.

23. Your Responsibilities

You are responsible for:

• Providing accurate and current information;
• Correcting information that becomes inaccurate;
• Protecting your account credentials;
• Ensuring that you are authorised to provide another passenger’s personal data;
• Informing us promptly of suspected unauthorised account access; and
• Avoiding the disclosure of unnecessary sensitive information through public or insecure channels.

Only send passport or identity documents through an official channel when such documents are genuinely required.

24. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes to our services;
• New technologies or service providers;
• Changes to our data-processing practices;
• Legal or regulatory developments; or
• Security and operational requirements.

The updated version will be published on this page with a revised “Last updated” date.

Where a change materially affects your rights or the use of your personal data, we will provide appropriate notice. If a new processing activity requires consent, we will request new consent before carrying out that activity.

25. European Union or EEA Representative

If Markar Travel is legally required to appoint a representative in the European Union or European Economic Area, the representative’s details will be published below:

EU/EEA Representative: [Insert representative’s full legal name]
Address: [Insert registered address]
Email: [Insert email address]
Countries Covered: [Insert applicable countries]

These details should not be completed unless a representative has been formally appointed.

26. Contact and Complaints

For questions, privacy requests, complaints, or concerns about the handling of personal data, contact:

Iran Train Ticket
Operated by: Markar Travel
Email: info@irantrainticket.com
WhatsApp: +98 933 440 6373
Website: https://irantrainticket.com/
Registered Address: [Insert Markar Travel’s registered legal address]
Licence Number: [Insert travel agency licence number]

Iran Train Ticket is operated by Markar Travel, an officially registered Iranian travel agency authorised to sell passenger train tickets for Iran’s railway network.