Privacy policy

BanglaBagan operates this store. When you order, act as our customer or contact us, the personal data we hold about you is the data of an individual, and this page explains how we handle it. Our contact details are on the contact page.

• Order details: your name, delivery address, upazila and district, and phone number. If you create an account, we also store your email address and a securely hashed password.
• Payment status: whether a payment succeeded, failed or was pending, and which method you used.
• Product reviews: the rating and text you publish, together with your display name.
• Technical data: the IP address and browser used when you sign in, recorded for security so that we can spot credential-stuffing attempts.

We never ask for and never want your card number, PIN, bKash or Nagad password, or your bank login details. If anyone claiming to represent us asks for those, it is a fraud attempt — end the conversation and tell us.

• To take, deliver and support your order, and to handle returns.
• To keep your account secure and to sign you in.
• To send you your order confirmation and delivery updates.
• To answer your messages and to act on your requests.
• To meet our accounting and tax record-keeping obligations.
• To prevent fraud and abuse of the store.

We do not sell your data, and we do not share it with anyone for their own advertising.

We use a small number of cookies, all of them necessary for the store to work:

• bb_session keeps you signed in.
• bb_guest_cart remembers what you put in your cart before you sign in. It is merged into your account when you register.
• bb_order_receipt is set after you order so that you can return to your confirmation without an account.
• bb_admin_session is for staff only and is not set for shoppers.

We do not use advertising or cross-site tracking cookies. If you block cookies, cart and sign-in will not work.

Only where a party needs the data to do their part, and no further:

• Courier partners, so they can deliver your parcel.
• Payment gateways, for bKash, Nagad and card payments. They handle your payment under their own privacy policy.
• Our hosting and email providers, so the site and messages can run.
• Government authorities, where the law requires it, such as a court order or a valid tax demand.

Order and payment records are kept for as long as Bangladesh's accounting and tax rules require. Data that serves no further purpose — such as an abandoned cart or a lapsed sign-in attempt — is deleted on a short cycle. Password reset links expire quickly and are removed once used.

• See it — your account shows your order history and saved items.
• Correct it — contact us and we will fix your name, phone number or address. Getting a delivery address right before dispatch is the fastest way to receive your parcel.
• Delete it — ask us to delete your account. We will remove your profile, wishlist and reviews. Order records are retained where the law requires it, but we can remove your contact details from them.
• Withdraw consent — stop us messaging you at any time.

Contact us through any channel on the contact page and we will action it. We do not discriminate against people who exercise these rights.

Passwords are stored only as salted hashes and can never be read back, sessions use HTTP-only cookies that scripts cannot access, sign-in attempts are rate limited, and connections are encrypted in transit. No system is perfect, but if a breach affects your data we will tell you and tell the relevant authority.

The store is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child's data has reached us, contact us and we will delete it.

If we change this policy in a way that affects you, we will update the date at the top of this page and, for significant changes, tell you by email or on the site.