Privacy Policy — Bostrobazar

Bostrobazar ("we", "us", "our") is an online marketplace operated from Dhaka, Bangladesh, that connects buyers and sellers of new, pre-loved, and handmade goods. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our website, mobile experience, and related services (collectively, the "Platform").

This Policy is issued in accordance with the laws of the People's Republic of Bangladesh, including the Information and Communication Technology Act, 2006 (as amended), the Digital Security Act, 2018, the Consumer Rights Protection Act, 2009, and the principles set out in Article 43 of the Constitution of Bangladesh (right to privacy). Where the forthcoming Personal Data Protection Act of Bangladesh becomes effective, this Policy will be read in line with its provisions.

1. Who we are

Bostrobazar is the data controller for the personal data we process about you. You can contact us at support@bostrobazar.com for any privacy-related request.

2. Information we collect

We collect the following categories of information:

Account data: name, email, phone (NID number only if you are a verified seller), profile photo, password (hashed).
Shop & listing data: shop name, location, descriptions, product photos, prices.
Transaction data: orders placed, items sold, delivery addresses, payment confirmation references (we do not store full card numbers — payments are processed by licensed PSPs such as bKash, Nagad, Rocket, SSLCommerz).
Communication data: messages between buyer and seller, support tickets, reviews.
Technical data: IP address, device type, browser, approximate location (district level), cookies and similar identifiers.
Optional data: NID/passport copy and bank/MFS details for seller payout verification.

3. How we use your data

To create and operate your buyer or seller account.
To list products, process orders, arrange delivery, and handle returns.
To verify the identity of sellers and prevent fraud, scams, and prohibited listings.
To send transactional messages (order updates, OTPs) by SMS, email, or in-app notification.
To respond to your support requests and resolve disputes.
To improve the Platform, run analytics, and personalise recommendations.
To send marketing communications and our newsletter — only where you have opted in, and you can unsubscribe at any time.
To comply with legal obligations, court orders, and lawful requests from Bangladeshi authorities.

4. Legal basis for processing

We process personal data on the basis of (a) your consent, (b) performance of the contract between you and Bostrobazar, (c) compliance with our legal obligations under Bangladeshi law, and (d) our legitimate interest in operating, securing, and improving the Platform.

5. Sharing of data

We share personal data only with:

Other users as needed to complete a transaction (e.g. a seller receives the buyer's name, delivery address, and phone number).
Delivery partners such as Pathao, RedX, Steadfast, Sundarban, etc.
Payment service providers licensed by Bangladesh Bank (bKash, Nagad, Rocket, Upay, SSLCommerz, Visa/Mastercard acquirers).
Cloud and infrastructure providers who host the Platform under confidentiality obligations.
Government authorities, regulators, or courts where required by law, including the Bangladesh Police, NBR, BTRC, and the Directorate of National Consumer Rights Protection.

We do not sell your personal data to third parties.

6. International transfers

Some of our infrastructure providers are located outside Bangladesh. Where data is transferred abroad, we ensure appropriate contractual safeguards are in place and that the transfer complies with applicable Bangladeshi data protection requirements.

7. Data retention

We retain account and transactional data for as long as your account is active and for up to six (6) years after closure, in line with the record-keeping requirements of the Income Tax Act and the Value Added Tax and Supplementary Duty Act, 2012. NID copies submitted for seller verification are retained only as long as needed to maintain verified status.

8. Your rights

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and associated data, subject to legal retention rules.
Withdraw consent for marketing communications.
Lodge a complaint with the Directorate of National Consumer Rights Protection (DNCRP) or other competent Bangladeshi authority.

To exercise these rights, email privacy@bostrobazar.com.

9. Security

We use industry-standard measures including TLS encryption in transit, hashed passwords, role-based access control, and row-level security on our database. No system is 100% secure, and you are responsible for keeping your login credentials confidential.

10. Children

The Platform is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has registered, please contact us so we can remove the account.

11. Cookies

We use cookies and similar technologies for authentication, session management, basic analytics, and personalisation. You can disable cookies in your browser but some features of the Platform may not work properly.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified through the Platform or by email. Continued use after the effective date constitutes acceptance.

13. Contact

Bostrobazar — Dhaka, Bangladesh
Email: support@bostrobazar.com / privacy@bostrobazar.com