Privacy Policy — Smart Safety & Automations Ltd.

Data Controller: Smart Safety & Automations Ltd. (SSAL) Youth Tower Level 2, 822/2 Rokeya Sarani Dhaka-1216, Bangladesh Company Registration: [Registration Number]

Data Protection Officer (DPO): Email: privacy@smartsafety.com.bd Phone: +880 1799-986890

For any questions, concerns, or requests related to the use of your personal data, please contact our Data Protection Officer at the above details.

2.1 Data You Provide Directly

Contact Form and RFQ Submissions: When you complete our contact form or request-for-quotation form, we collect: full name, company name, designation, phone number, email address, project details, and any information you include in your message or file attachments.

Support Ticket Submissions: When you submit a support ticket, we collect: full name, company name, phone number, email address, system description, issue description, and any files attached.

Event and Webinar Registrations: When you register for SSAL events or webinars, we collect: full name, company name, designation, phone number, and email address.

Newsletter Subscriptions: When you subscribe to our newsletter, we collect: email address and, optionally, name and company.

Partner Programme Applications: When you apply for the SSAL Partner Programme, we collect: company details, contact person information, financial trading data, and business documentation.

Career Applications: When you apply for a position at SSAL, we collect: full name, contact details, employment history, educational qualifications, salary information, and CV/resume content.

Download Centre Registrations: When you register to download gated resources, we collect: name, company, email address, and solution interest.

2.2 Data Collected Automatically

Website Analytics: When you visit our website, we automatically collect: IP address (anonymised after 26 months), browser type and version, operating system, pages viewed, time spent on pages, referring URL, and click behaviour. This data is collected via Google Analytics 4.

Cookies: We use cookies and similar tracking technologies. Please see our Cookie Policy for full details of the cookies we use and how to manage them.

Server Logs: Our web server automatically logs access requests including IP address, request timestamp, page requested, HTTP status code, and bytes transferred. Logs are retained for 90 days for security purposes.

2.3 Biometric Data (Client-Deployed Systems)

SSAL designs, supplies, and installs biometric access control systems for our clients. In this context, biometric data (fingerprint templates, facial geometry templates) is collected and processed by the client using the technology systems we have installed. SSAL acts as a data processor in respect of this data only to the extent required to configure, commission, and support the client's system.

Clients deploying biometric access control systems in Bangladesh are advised that they are data controllers under PDPO 2025 with obligations including: obtaining explicit consent from individuals whose biometric data is collected, implementing appropriate security measures, defining and communicating retention periods, and registering with the Bangladesh Data Protection Authority where required.

SSAL provides guidance documentation to all clients deploying biometric systems covering PDPO 2025 compliance requirements. Clients bear ultimate responsibility for their own compliance as data controllers.

2.4 CCTV Footage Data (Client-Deployed Systems)

SSAL installs CCTV surveillance systems for our clients. Video footage captured by these systems is collected and controlled by the client as data controller. SSAL does not have access to client CCTV footage except when specifically authorised by the client during technical support sessions.

Clients operating CCTV systems are advised that CCTV footage constitutes personal data under PDPO 2025 where individuals are identifiable. Clients are responsible for complying with PDPO 2025 obligations including retention period management (Bangladesh Bank requires minimum 90-day retention for bank branch CCTV), appropriate security of stored footage, and notification to individuals where required.

We process personal data only for specified, explicit, and legitimate purposes. The purposes for which we process personal data are as follows.

Service Delivery: Processing enquiries, preparing quotations, managing project delivery, providing technical support, and fulfilling our contractual obligations to clients. Legal basis: Contractual necessity; Legitimate interests

Marketing Communications: Sending relevant service information, newsletter content, event invitations, and promotional materials to individuals who have consented or who are existing clients. Legal basis: Consent (for new contacts); Legitimate interests (for existing clients, with opt-out)

Analytics and Website Improvement: Understanding how visitors use our website in aggregate to improve content, navigation, and user experience. Legal basis: Legitimate interests; Consent (where required by cookie law)

Career Applications: Assessing and processing job applications, communicating with applicants, and retaining applications for future relevant opportunities where consent is given. Legal basis: Contractual steps at applicant request; Consent (for retention beyond active recruitment)

Partner Programme Management: Processing and managing partner applications, accounts, and programme participation. Legal basis: Contractual necessity

Legal Compliance: Complying with applicable laws, regulatory requirements, and responding to lawful requests from government authorities. Legal basis: Legal obligation

Fraud Prevention and Security: Protecting SSAL, our clients, and website users from fraud, abuse, and security threats. Legal basis: Legitimate interests

We do not sell personal data to third parties. We share personal data with the following categories of third-party processors, each of whom is contractually bound to protect data in accordance with PDPO 2025 and applicable privacy law.

HubSpot CRM — used to manage client and prospect contact records, email marketing, and pipeline management. Privacy policy: https://legal.hubspot.com/privacy-policy

Google Analytics 4 — used for website visitor analytics with IP anonymisation enabled. Privacy policy: https://policies.google.com/privacy

SendGrid (Twilio) — used for transactional email delivery (form confirmations, support ticket acknowledgements, newsletter distribution). Privacy policy: https://www.twilio.com/en-us/legal/privacy

Cloudflare CDN — used for website content delivery, performance optimisation, and DDoS protection. Privacy policy: https://www.cloudflare.com/privacypolicy/

Zoom Video Communications — used for webinar and video conference hosting. Privacy policy: https://explore.zoom.us/en/privacy/

We may also disclose personal data to government authorities, courts, or law enforcement agencies when legally required to do so under Bangladesh law.

As a data subject under Bangladesh's Personal Data Protection Ordinance 2025, you have the following rights in respect of your personal data that we hold.

Right of Access: You have the right to request confirmation of whether we hold personal data about you and, if so, to receive a copy of that data.

Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure: You have the right to request deletion of your personal data where there is no legitimate reason for us to continue processing it, where you have withdrawn consent, or where the data was unlawfully processed.

Right to Data Portability: Where processing is based on consent or contractual necessity and is conducted by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to Object: You have the right to object to processing of your personal data for direct marketing purposes at any time. You also have the right to object to processing based on legitimate interests where your individual circumstances justify this.

Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

Right to Lodge a Complaint: You have the right to lodge a complaint with the Bangladesh Telecommunication Regulatory Commission (BTRC) or the relevant data protection authority in Bangladesh.

To exercise any of your rights, contact our Data Protection Officer at privacy@smartsafety.com.bd. We will respond within 30 days of receiving your request. We may ask you to verify your identity before processing your request.

Biometric data is classified as sensitive personal data under PDPO 2025. Where SSAL processes biometric data (limited to configuration and support of client-installed biometric access control systems), we apply the following additional safeguards:

• Biometric templates are never stored on SSAL systems or servers — they reside solely on the client's access control system
• Remote access to client systems containing biometric data requires explicit written authorisation from the client data controller
• All remote support sessions involving systems containing biometric data are logged with timestamp, engineer identity, and duration
• SSAL engineers are trained on biometric data handling obligations under PDPO 2025

SSAL implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, or destruction.

Technical measures include: TLS 1.3 encryption for all website data transmission, encrypted storage for personal data in our CRM and support systems, role-based access controls limiting data access to authorised SSAL personnel, multi-factor authentication for all systems containing personal data, and regular security patching of all systems.

Organisational measures include: privacy and data protection training for all SSAL staff, a documented data breach response procedure, vendor due diligence for all third-party data processors, and periodic review of data processing activities.

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, SSAL will notify the relevant Bangladesh authority within 72 hours of becoming aware of the breach, and affected individuals without undue delay where required.

We use cookies on our website. For full details of the cookies we use, their purpose, and how to manage your cookie preferences, please see our Cookie Policy.

Our website may contain links to third-party websites. SSAL is not responsible for the privacy practices of those websites. We encourage you to read the privacy policies of any external sites you visit through links on our website.

Our website and services are directed at businesses and adult professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact privacy@smartsafety.com.bd and we will delete it promptly.

This Privacy Policy is governed by the laws of the People's Republic of Bangladesh, including the Personal Data Protection Ordinance 2025. Any disputes arising from this policy shall be subject to the jurisdiction of the courts of Bangladesh.

You have the right to lodge a complaint with the Bangladesh Telecommunication Regulatory Commission (BTRC) or the relevant data protection authority established under PDPO 2025.

BTRC Contact: Bangladesh Telecommunication Regulatory Commission, IEB Bhaban (Level 14 & 15), Ramna, Dhaka-1000 | www.btrc.gov.bd

SSAL may update this Privacy Policy from time to time to reflect changes in our data processing activities, legal requirements, or business operations. We will publish the updated policy on this page with an updated effective date. For material changes, we will notify registered newsletter subscribers and active clients by email. Continued use of our website or services after the updated policy is published constitutes acceptance of the revised policy.

Data Protection Officer Contact: privacy@smartsafety.com.bd | +880 1799-986890 Smart Safety & Automations Ltd., Youth Tower Level 2, 822/2 Rokeya Sarani, Dhaka-1216, Bangladesh