গোপনীয়তা নীতি

This Policy explains how bdoor compliance ltd. collects, uses, shares, protects and retains personal data through bdoor.io, customer applications, accounts, communications and coordinated services. bdoor acts as the organisation responsible for its own platform and coordination processing. A professional provider or government authority may separately control the data it receives for its own legal or professional duties.

Depending on the stage and requested service, we may collect:

• contact data: name, email, telephone, preferred language and country;
• application data: intended jurisdiction, business activity, ownership plan, timeline, service needs and budget;
• account data: authentication identifiers, security events and preferences;
• identity and verification data after the legal launch gate opens: date of birth, nationality, NID or passport details, photograph, proof of address and verification results;
• business data: proposed names, addresses, ownership, capital, directors, shareholders, partners, beneficial owners, licences and corporate records;
• financial and risk data: invoices, payment status, refund information, source-of-funds information, tax residency, sanctions and politically exposed person screening results;
• communications: messages, calls, support requests, complaints and instructions;
• provider and case data: assignments, milestones, document requests, professional advice status and filing outcomes; and
• technical data: IP address, browser, device, language, referring page, security logs and cookie choices.

Do not submit passports, NIDs, proof of address or other sensitive documents through a free application or ordinary email unless bdoor has opened an approved secure collection step.

We use personal data to:

• provide the requested assessment, account and service;
• prepare an itemised quotation and determine eligibility;
• verify identity, ownership and authority where required;
• detect fraud, conflicts, sanctions and financial-crime risk;
• coordinate approved providers and government filings;
• process payments, refunds and accounting records;
• communicate case actions, deadlines and compliance reminders;
• secure, troubleshoot and improve the platform;
• respond to rights requests and complaints;
• comply with law, lawful orders and professional obligations; and
• send marketing only where permitted and with an available opt-out.

Processing must have a documented lawful basis. Depending on context, that basis may be steps requested before a contract, performance of a contract, a legal obligation, consent, protection of legitimate interests that do not override the individual’s rights, or another basis permitted by applicable law.

We may share only the data reasonably needed with:

• a provider selected for the customer’s service, after disclosure and required consent or authority;
• government registries, tax authorities, banks and licensing bodies as necessary for an authorised application;
• identity-verification, sanctions-screening, payment, email, hosting, database, security, analytics, storage, support and document-signing vendors under appropriate contractual safeguards;
• professional advisers, auditors and insurers subject to confidentiality; and
• courts, regulators or law-enforcement bodies where disclosure is required or lawfully authorised.

We do not sell personal data. We do not allow a partner to browse unassigned customer records. A current subprocessor register must be published separately and generated from the providers actually used in production; no vendor may be listed merely because it was proposed in a design brief.

A cross-border formation request may require data to be processed in the selected jurisdiction. Technology and professional providers may also process data outside Bangladesh. Before such transfer, bdoor must identify the purpose, recipient category, destination and applicable safeguard or lawful basis. We will not claim that every overseas jurisdiction offers equivalent protection.

We keep personal data only for as long as needed for the stated purpose, legal duties, dispute handling and security. The production retention schedule must be approved by counsel and configured by data category. The intended schedule is:

• incomplete anonymous/free applications: delete or anonymise after 90 days of inactivity;
• unsuccessful or withdrawn pre-engagement applications: up to 2 years unless a shorter period is requested and no legal hold applies;
• customer, contract, case and corporate-compliance records: 7 years after the service or continuing relationship ends;
• identity, AML/KYC and beneficial-ownership records: for the period required by applicable AML/CFT law and approved compliance policy, and no longer than necessary;
• invoices, receipts, refunds and accounting records: for the period required by tax and company law;
• security and access logs: normally up to 12 months unless needed to investigate an incident; and
• marketing records: until opt-out, plus a minimal suppression record needed to respect the opt-out.

These are operational limits, not statements that every category is legally required for the full period. A legal hold, regulatory request or active dispute may extend retention. Deletion must include production systems and scheduled backup expiry where technically practicable.

Subject to applicable law and valid exceptions, you may ask to:

• know whether and why your personal data is processed;
• access a copy of relevant personal data;
• correct, update or complete inaccurate data;
• withdraw consent for future consent-based processing;
• object to or restrict certain processing;
• request deletion when data is no longer required;
• request an available portable copy; and
• complain about the handling of personal data.

Send a request to hello@bdoor.io with the subject “Privacy request”. We may verify identity before acting and will not disclose another person’s information. We will acknowledge, track and answer requests within the period required by applicable law.

bdoor may use rules or software to identify missing documents, possible eligibility issues or risk indicators. No customer should be rejected, reported or subjected to a significant final decision solely by an unreviewed AI output. Material decisions require authorised human review, except where automated blocking is necessary to prevent an immediate security threat.

We use risk-appropriate technical and organisational safeguards, including access controls, private document storage, encrypted transport, role-based permissions, logging, backups and multi-factor authentication for privileged users. No internet service is completely secure. Customers must use the designated secure upload process and protect their account credentials.

If a personal-data incident occurs, bdoor will contain and assess it, preserve evidence, notify affected parties and authorities when required, and document remedial action.

Cookies and similar technologies are governed by the Cookie Policy. Non-essential analytics or advertising technologies must not load until the required choice has been obtained. Sensitive application, KYC and document pages must be excluded from session replay.

The service is intended for adults and business representatives. We do not knowingly collect applications from anyone under 18. If such data is identified, the application will be closed and the data deleted unless law requires otherwise.

Material changes will be shown with a new version and effective date. Privacy questions and requests may be sent to hello@bdoor.io. Formal role titles and regulatory contact details must be added when appointed and legally required.