Privacy Policy for Addiba

Effective Date: 13th August 2026

Welcome to Addiba ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy governs the privacy policies and practices of our website, mobile application, and the services provided by Addiba.

By accessing or using our platform, you agree to the collection and use of information in accordance with this Privacy Policy. This policy complies with the Digital Commerce Operational Guidelines 2021 (Bangladesh) and international app store regulations (Google Play Store & Apple App Store).

1. Information We Collect

We collect personal information that you voluntarily provide to us when registering on the App or Website, expressing an interest in obtaining information about our products, or otherwise contacting us.

The personal information we collect may include the following:

Account Details: Name, email address, phone number, and password.

Delivery Information: Physical addresses, landmarks, and contact numbers necessary for delivering your orders.

Transaction Information: Order history, wallet balance, loyalty points, and purchase preferences.

Device & Usage Data: Mobile device ID, FCM (Firebase Cloud Messaging) tokens for push notifications, IP address, and app interaction data to improve your shopping experience.

Identity & Verification Data (B2B Accounts Only): If you apply for a Wholesale or Dropshipper (Reseller) account, we collect sensitive business and personal identifiers to comply with KYC (Know Your Customer) policies. This includes your Business Name, Trade License Number, Facebook Page/Website URLs, Tax Identification Number (TIN/BIN), Government IDs (NID Front and Back photos), and Facial Images (Selfie photos). This information is strictly optional and is not collected from standard retail customers.

2. How We Use Your Information

We use the information we collect or receive for various business purposes, including:

Fulfillment of Orders: To process transactions, prepare your order, and coordinate delivery.

Account Management: To create, manage, and authenticate your user account.

Identity Verification & Fraud Prevention: For Wholesale and Dropshipper applicants, we use collected Government IDs and Facial Images strictly to verify your identity, confirm your business legitimacy, and prevent fraudulent wholesale applications. These images are securely stored on our servers for administrative review and are not processed ephemerally.

Communication: To send you administrative information, order updates, OTPs (One Time Passwords), and promotional offers.

Service Improvement: To analyze usage trends and improve the overall user experience.

Legal Compliance: To retain transaction records as required by the laws of Bangladesh (e.g., maintaining financial logs for a minimum of 6 years).

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. However, we must share specific data with trusted third-party service providers solely to facilitate our business operations:

Payment Gateways (e.g., SSLCommerz, bKash, shurjoPay): When you make a purchase, we securely share order and payment routing information with our payment processors. We do not store your direct bank or mobile banking PINs on our servers.

Courier & Logistics Services (e.g., Steadfast, Pathao, RedX, Carrybee): We share your name, delivery address, and phone number with our delivery partners so they can deliver your orders to your doorstep. (Note: Sensitive KYC data such as Government IDs, Selfies, and Trade Licenses are kept strictly confidential and are NEVER shared with logistics partners).

Cloud Infrastructure & Analytics: We may use secure cloud providers (e.g., Google Firebase for push notifications) to host our data and send you real-time updates.

Legal Obligations: We may disclose your information where legally required to do so in order to comply with applicable law, governmental requests, or a judicial proceeding.

4. Account Deletion & Data Retention

You have the right to request the deletion of your account and personal data at any time.

How to Request Deletion: You can request account deletion directly within the Addiba mobile app by navigating to Profile > Delete Account, or by contacting our support team.

Grace Period: Upon requesting deletion, your account will be immediately deactivated and logged out. We provide a 30-day grace period. If you log back into the app within 30 days, you will have the option to cancel the deletion request and restore your account.

Permanent Anonymization: If the 30-day grace period expires without cancellation, your personal identity (name, phone number, email, push tokens, and uploaded KYC documents/photos) will be permanently scrambled, deleted, and anonymized in our database.

Mandatory Data Retention: Please note that in compliance with the Digital Commerce Operational Guidelines 2021 of Bangladesh, we are legally required to retain basic, anonymized financial transaction and order history records for a minimum of six (6) years for audit and tax purposes.

5. Data Security

We have implemented appropriate technical and organizational security measures (including SSL encryption, rate-limiting, and secure server storage) designed to protect the security of any personal information we process. Sensitive uploads like Government IDs and Selfies are transmitted securely. However, please also remember that we cannot guarantee that the internet itself is 100% secure.

6. Your Privacy Rights

Depending on your location and applicable laws, you may have the right to:

Access the personal data we hold about you.

Request the correction of inaccurate data.

Opt-out of marketing communications and push notifications via your device settings.

Request the deletion of your account (as detailed in Section 4).

7. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. The updated version will be indicated by an updated "Effective Date," and the new policy will be effective as soon as it is accessible.