BONEEK

boneek.com.bd

PRIVACY POLICY

Effective Date: May 2026

Version: 1.0

Governed by: Laws of Bangladesh

Welcome to Boneek. We take your privacy seriously. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and what rights you have over your data when you use the Boneek platform (boneek.com.bd).

By registering an account or using the platform, you agree to the practices described in this Privacy Policy. This Policy forms an integral part of our Terms & Conditions.

As used in this Policy: “Boneek”, “we”, “us”, or “our” refers to the company operating the Boneek platform. “Merchant”, “you”, or “User” refers to any individual or business entity accessing or using the platform. “Customer” refers to the end consumers who purchase from a Merchant’s Boneek store.

Table of Contents

1. Information We Collect
2. How We Use Your Information
3. Cookies & Tracking Technologies
4. How We Share Your Information
5. AI Calling Feature & Data
6. Merchant Customer Data
7. Data Retention
8. Data Security
9. Your Rights
10. Children’s Privacy
11. International Data Transfers
12. Changes to This Policy
13. Information We Collect

1.1 Information You Provide Directly

When you register and use Boneek, you may provide:

• Full name, email address, and mobile phone number
• Business name, business address, and related details
• Billing and payment information (we do not store full card or mobile banking account numbers)
• Store content: product images, descriptions, and pricing
• Your customers’ information entered on your store (name, address, phone number, and order details)

1.2 Information Collected Automatically

When you use the platform, we automatically collect:

• Device information: device type, operating system, and browser
• IP address and approximate location
• Platform activity logs: login timestamps, pages visited, and actions taken
• Data from Cookies and similar tracking technologies

1.3 Information Received from Third Parties

We may receive information from the following third-party sources:

• Payment gateways (bKash, Nagad, card processors) — transaction confirmation data
• Courier partners (Pathao, RedX, Steadfast, and others) — delivery status updates
• Facebook / Meta — if you log in via Facebook or have the Facebook Pixel enabled on your store
• WhatsApp Business API — data related to customer communications initiated through the platform

2. How We Use Your Information

2.1 To Deliver Our Services

• Creating and managing your Boneek account
• Setting up and operating your online store
• Processing subscription payments and managing billing
• Facilitating courier bookings, parcel tracking, and delivery management
• Operating the AI Calling feature on your behalf
• Providing customer support and technical assistance

2.2 To Improve the Platform

• Designing new features and enhancing existing ones
• Ensuring system security, stability, and performance
• Analysing usage patterns to improve user experience

2.3 To Communicate with You

• Sending important service-related notices and system alerts
• Notifying you of platform updates, new features, and policy changes
• Sending promotional messages or offers — only with your consent

2.4 For Legal & Security Purposes

• Preventing fraud, abuse, and unauthorised access
• Complying with applicable laws, regulations, and lawful government requests

3. Cookies & Tracking Technologies

3.1 Types of Cookies We Use

Boneek uses Cookies and similar technologies for the following purposes:

• Essential Cookies — required for core platform functionality (login sessions, security tokens)
• Functional Cookies — to remember your preferences and settings
• Analytics Cookies — to understand how the platform is used (e.g. Google Analytics or similar)
• Marketing Cookies — including Facebook Pixel, to support your advertising and remarketing activities

3.2 Managing Cookies

You can control or disable Cookies through your browser settings. Please note that disabling essential Cookies may prevent certain parts of the platform from functioning correctly.

4. How We Share Your Information

Boneek does not sell your personal or business data to any third party — ever.

Your information may be shared in the following limited circumstances:

4.1 Service Provider Partners

• Payment gateways (bKash, Nagad, card processors) — for payment processing
• Courier partners (Pathao, RedX, Steadfast, and others) — for delivery booking and tracking
• WhatsApp Business API / Meta — for customer communication services
• Cloud infrastructure providers — for secure data storage and processing
• SMS gateway providers — for OTP verification and notifications

4.2 Dropshipping Suppliers

When you fulfil an order through a supplier on the Boneek Dropshipping Marketplace, the minimum necessary customer information (name and delivery address) will be shared with that supplier solely for fulfilment purposes.

4.3 Legal Requirements

• When required to comply with a valid legal order, court ruling, or government authority request
• When disclosure is necessary to protect the rights, property, or safety of Boneek, its users, or the public

4.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of Boneek’s business, your data may be transferred to the acquiring entity. You will be notified in advance of any such transfer and the applicable privacy protections.

All third-party partners are subject to their own independent privacy policies and data protection obligations.

5. AI Calling Feature & Data

5.1 Data Processed

When the AI Calling feature is used, call-related data — including the purpose of the call, response outcomes, and interaction logs — may be stored within the platform.

5.2 Use of Call Data

This data may be used in anonymised form to improve call quality and enhance the AI model’s performance over time.

5.3 Merchant Responsibility

By using the AI Calling feature with your customers’ phone numbers, you confirm that your customers have provided appropriate consent to be contacted, in accordance with applicable laws and regulations.

6. Merchant Customer Data

6.1 Data Controller vs. Processor

The data submitted by your customers on your Boneek store (names, addresses, phone numbers, and order information) is controlled by you, the Merchant. Boneek processes this data on your behalf solely to deliver platform services — acting as a data processor, not a data controller.

6.2 Merchant Obligations

You are solely responsible for ensuring that your collection and use of your customers’ personal data complies with all applicable laws of Bangladesh and any other jurisdiction in which you operate.

6.3 No Independent Use

Boneek will not use your customers’ data for its own marketing, profiling, or commercial purposes beyond what is necessary to operate the services you have subscribed to.

7. Data Retention

• While your account is active, all your data is retained in full.
• Following account cancellation or termination, your data remains accessible for download for 30 days.
• After 30 days, your data will be permanently deleted, except where retention is required by law (e.g. financial transaction records).
• Transaction and financial records may be retained for the period required under applicable Bangladeshi laws and regulations.

8. Data Security

8.1 Security Measures

Boneek implements the following safeguards to protect your data:

• SSL/TLS encryption for all data in transit
• Access controls and role-based permission management
• Regular security audits and vulnerability assessments
• PCI-DSS aligned practices for payment data handling

8.2 Breach Notification

No digital system can guarantee absolute security. In the event of a data breach that affects your information, Boneek will notify impacted Merchants as promptly as practicable, along with the steps being taken to address the situation.

9. Your Rights

You have the following rights regarding your personal and business data held by Boneek:

• Right to Access — You may request a copy of the data we hold about you.
• Right to Rectification — You may request correction of inaccurate or incomplete data.
• Right to Erasure — In certain circumstances, you may request deletion of your data.
• Right to Data Portability — You may export your business data from the platform at any time.
• Right to Opt Out — You may unsubscribe from promotional communications at any time.

To exercise any of these rights, please contact us at privacy@boneek.com.bd. We will respond within 7 business days of receiving your request.

10. Children’s Privacy

The Boneek platform is intended exclusively for users aged 18 years and above. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that such data has been collected, it will be deleted promptly.

11. International Data Transfers

Some of our third-party service providers — including cloud infrastructure providers, Meta (Facebook), and Google — may process your data outside Bangladesh. In such cases, we take appropriate steps to ensure that adequate data protection standards are maintained, consistent with this Privacy Policy.

12. Changes to This Policy

12.1 Right to Update

Boneek reserves the right to update or modify this Privacy Policy at any time. The most current version will always be available at boneek.com.bd/privacy.

12.2 Notice of Changes

For material changes, we will provide at least 14 days’ advance notice via email or a prominent notice on the platform dashboard.

12.3 Continued Use

Your continued use of the platform following any update constitutes your acceptance of the revised Privacy Policy.

Privacy Enquiries & Contact

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

• Email: hello@boneek.com.bd
• WhatsApp Support: 01806-975141
• Website: www.boneek.com.bd

© 2026 Boneek. All rights reserved. This Privacy Policy is governed by the laws of the People’s Republic of Bangladesh.