Privacy Policy

VERIFIED BM SHOP ("we", "us", "our") explains in this Privacy Policy what information we collect, why we collect it, how we use it, and how we protect it when you browse our website, place an order, or contact our support team.

We handle personal information in line with the Bangladesh Personal Data Protection Act, 2026 (Act No. 63 of 2026). Where other privacy laws apply to you, we aim to honour the rights those laws provide.

You can use our website and complete a purchase without accepting optional analytics. Analytics is optional, off by default, and currently disabled (see sections 07 to 10 and 14).

VERIFIED BM SHOP is an independently owned and operated online business based in Bangladesh, serving customers internationally. The business is individually owned and is not presented as a registered company; there is no company registration number or trade licence to disclose.

• Business name: VERIFIED BM SHOP
• Business structure: individually owned business (not a registered limited company)
• Business address: 20 Madargonj, Pirgonj, Rangpur, Bangladesh - 5470
• Privacy contact: privacy@verifiedbm.shop
• General support: info@verifiedbm.shop, WhatsApp +880 1798 939390, Telegram @vbmshop

For the Bangladesh Personal Data Protection Act, 2026, we act as the data fiduciary for the personal information described in this policy. Where other laws use the word controller, we are the controller of that information.

We may collect the following information when you use our website or services:

• Personal Information: Your name, email address, and other contact details you provide when you create an account, place an order, or contact us. If you create an account or place an order you may also provide a phone number, a WhatsApp number, or a Telegram username.
• Account Information: Your email address, a securely hashed password, and account preferences. If you sign in with a social provider, we receive a provider account identifier and basic profile details from that provider (see section 06).
• Transaction Data: Information related to your order and payment, such as the products ordered, order amount and currency, coupon used, the payment method, transaction reference, payment status, and any payment proof you upload (for example a screenshot, the transaction ID, the amount paid, and the network used).
• Technical Data: Your IP address, browser type, operating system, device information, and general browsing activity collected through cookies and similar technologies (see section 07).
• Communication Data: Messages and information you provide when contacting us through our website, our support chat, WhatsApp, Telegram, or email, including the name and email you provide to start a chat.

We do not knowingly collect sensitive personal data (as defined in the Bangladesh Personal Data Protection Act, 2026), such as health, biometric, genetic, or similar data. Please do not send us sensitive personal data.

We use your information for the purposes described in this policy, including:

• Process, manage, and deliver your orders.
• Provide customer support and respond to your requests.
• Send order confirmations, payment updates, and service-related communications.
• Maintain and improve our website, products, and services.
• Detect, investigate, and help prevent fraud, abuse, and unauthorized transactions.
• Maintain the security and reliability of our website and services.
• Send promotional communications where permitted and where you have chosen to receive them.

Under the Bangladesh Personal Data Protection Act, 2026, we process personal information on a lawful basis:

• We process your order and payment information because it is necessary to perform our contract with you.
• We process optional analytics only with your consent, which you may withdraw at any time.
• We also process information where we have a legal obligation or another lawful basis permitted by the Act (for example, to establish or defend legal claims, or to protect vital interests).

We do not use your information for automated decision-making that produces legal or similarly significant effects about you.

We take reasonable technical and organizational measures to help protect the information we process, consistent with the security standards described in the Bangladesh Personal Data Protection Act, 2026.

• HTTPS/TLS is used to protect information transmitted between your browser and our website.
• Access to administrative systems and customer information is restricted to authorized personnel.
• We use security controls designed to reduce unauthorized access, disclosure, alteration, or loss of information.

No method of transmitting or storing information online is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in significant harm, we will take reasonable steps to address it and will notify the National Data Management Authority as required by the Act, and will provide further notifications where required by applicable law.

You may create an account with an email address and password. Passwords are stored in a securely hashed form. If you choose to sign in or connect an account using a social provider, we receive a provider account identifier and basic profile details from that provider. The providers we support are Google, Facebook, X (Twitter), and Telegram. We use this information to authenticate you and to manage your account.

We use cookies and similar technologies for three purposes:

• Necessary cookies (always active): required for the website to function, such as keeping items in your cart, maintaining your login session, protecting forms against cross-site request forgery, and securing checkout. These do not require consent because the website cannot work without them.
• Optional analytics cookies: with your permission we may use Google Analytics to understand how visitors use our website and to measure visits and purchases. Analytics is off by default and is currently disabled; when activated it loads only after you choose Accept analytics. Choosing Reject analytics is equally available and is remembered. You can change your choice at any time (see section 08).
• Preference storage: may remember certain choices or settings, such as a display theme, to improve your experience.

You can also manage or disable cookies through your browser settings. Disabling certain cookies may affect how some website features work.

Cookies and storage we use

• Session cookie (application session): keep you logged in and preserve your cart/session; necessary; session / up to 120 minutes.
• XSRF-TOKEN: cross-site request forgery protection; necessary; session.
• vbb_consent_subject: anonymous consent subject identifier (not a customer id); preference (consent); about 180 days.
• vbb_consent_receipt: records your analytics accept/reject choice; preference (consent); about 180 days.
• _ga, _ga_<property>: Google Analytics browser identifiers; optional analytics; set by Google Analytics only after you accept.

Google Analytics is currently disabled on our website. The consent feature is installed but not activated, and no Google Analytics or Microsoft Clarity tags are loaded on our pages at this time. Server-side purchase measurement is also disabled.

When optional analytics is activated, and only if you choose Accept analytics, Google Analytics may set first-party browser identifiers (such as _ga and _ga_<property>) on your device and collect events such as page views and ecommerce actions.

In addition, if and when server-side purchase measurement is separately approved and enabled, after a payment is genuinely confirmed we may send a server-side purchase measurement to Google Analytics. That measurement can include a stable order reference (transaction id), the order total and currency, and the products purchased (name, quantity, unit price, and any discount).

We do not send your name, email address, phone number, payment proof, or transaction hash to Google Analytics. Advertising storage and advertising personalization are set to denied in our configuration. We do not use analytics to make automated decisions about you.

Microsoft Clarity (session recording) is disabled and is not loaded. Re-enabling it would require a separate review and an updated version of this policy.

When optional analytics is active, you can accept or reject analytics, and change your choice at any time, using the Cookie preferences control in the website footer or the consent banner. Accept and Reject are equally prominent, and neither is pre-selected. You can always complete your purchase without accepting analytics; checkout, payment, and order completion do not depend on your analytics choice. While analytics is disabled, no analytics is collected and the consent control is not shown.

If you withdraw analytics consent, we stop collecting analytics for your browser, remove analytics identifiers we have not yet sent, and do not start new analytics requests under that consent. Data already received by Google Analytics cannot be recalled by us, but we will not send more. Necessary cookies stay active regardless of your choice.

We also treat browser privacy signals (such as Global Privacy Control and Do Not Track) as a request to keep analytics off.

Our analytics cleanup runs on a scheduled daily basis. Because cleanup is not instant, the periods below are approximate and removal occurs at the next scheduled cleanup after each period:

• Your analytics choice is remembered for about 180 days and is not extended simply by visiting the site.
• Analytics identifiers attached to an order that has not yet been confirmed are kept for a maximum of about 30 days.
• Unsent analytics events are removed after about 72 hours, and terminal analytics data within about 24 hours.
• Consent records are kept for about 12 months after the choice expires or is withdrawn.

We keep a minimal, non-identifying order reference so that a purchase is never measured twice. These periods are operational settings and may be adjusted. They apply to optional analytics only; order and payment records are governed by section 13.

To request access, correction, or deletion of your personal information, see section 11. Where you ask us to delete data, we will remove our own stored analytics identifiers and unsent analytics data. We cannot retroactively delete information already received by a third-party provider; we will explain this when you contact us and, where applicable, how to use the provider's own controls.

Under the Bangladesh Personal Data Protection Act, 2026, and, where they apply to you, other privacy laws, you have the right to:

• Access and portability: Request information about the personal data we process about you and, where applicable, receive a copy in a concise and understandable form.
• Correction: Ask us to correct, complete, or update inaccurate or incomplete information. Where we make a correction, we will notify you and others concerned within the time required by the Act.
• Deletion: Request deletion of certain personal information where applicable, including where the purpose for processing no longer exists, where you withdraw consent, or where the processing is unlawful.
• Withdraw consent: Withdraw your consent to optional processing (such as analytics) at any time.
• Objection or restriction: Ask us to stop or limit certain uses of your information where applicable.
• Marketing preferences: Opt out of promotional communications at any time.
• Complaint: Lodge a complaint with us, and with the National Data Management Authority, if you believe your rights have been infringed.

To make a privacy-related request, contact privacy@verifiedbm.shop. We may need to verify your identity before taking action, and we aim to provide an initial response within 30 days. We will delete eligible information when legally permitted; we will clearly distinguish records we control from information retained by external providers, and we will not promise deletion of provider-held data where we have no confirmed capability to do so.

We use third-party service providers to help operate our website, process payments, provide communications, analyze website usage, and deliver our services. Different providers receive different categories of information according to their role. Depending on the services you use, these providers may include:

• Analytics providers: Google (Google Analytics), which receives analytics identifiers and event data only after you accept analytics, plus, if separately enabled, the server-side purchase measurement described in section 08.
• Payment providers: Cryptomus, a third-party crypto payment processor used to facilitate and verify transactions.
• Hosting provider: Hawk Host, which hosts and operates our website and related systems.
• Communication platforms: Telegram and WhatsApp, used for customer communication and support, and for internal order/contact notifications.
• Social sign-in providers: Google, Meta (Facebook), X, and Telegram, used only when you choose to sign in or connect an account.
• Email infrastructure: our hosting email service, used to send transactional emails (for example order confirmations and password resets).

These providers may process information according to their own privacy policies and applicable terms. Some providers process data in countries other than your own; for example, our website is hosted outside Bangladesh (currently in Singapore), and our analytics, payment, communication, and social sign-in providers operate globally, including in the United States, Canada, and the European Union.

Under the Bangladesh Personal Data Protection Act, 2026, personal data may be transferred outside Bangladesh where permitted, for example with your consent or where the transfer is necessary for a contract with you for goods or services, and only to recipients and locations that maintain appropriate technology and safeguards. Where the law requires safeguards for such transfers, we rely on the safeguards those providers make available under their terms; the exact mechanism depends on the provider and the applicable law. We do not claim any specific safeguard that we have not verified.

We do not sell your personal information, and we do not use your data for personalized advertising on this website.

We keep records of our processing of personal data for at least 5 years, as required by the Bangladesh Personal Data Protection Act, 2026, unless another law requires a different period.

We retain order, payment, and invoice records for as long as required by applicable accounting, tax, and legal obligations and legitimate business needs, and we delete or securely dispose of personal information when retention is no longer necessary, subject to applicable law. Financial and order records are kept separately from optional analytics and are not affected by your analytics choice.

Previously, before our consent mechanism was installed, our website loaded Google Analytics (measurement ID G-R4CN54VEJ2) and Microsoft Clarity (project ID yj70b50m3n) on public pages without a consent gate. Our consent mechanism is now installed and analytics is currently disabled. Because of the earlier loading, data may already have been collected by those providers.

We cannot retroactively delete data held by those providers; deletion of provider-held data requires the providers' own processes. Google Analytics supports data-deletion requests for a property (which can take several weeks to process), and Microsoft Clarity retains playback data for about 30 days and click/heatmap data for about 9 months, after which it is deleted and cannot be recovered. We disclose this transparently and will not overstate any deletion outcome. When optional analytics is activated, it will load only after you accept.

Our website and services are intended for adults and businesses. Under the Bangladesh Personal Data Protection Act, 2026, a child is a person below 18 years of age. We do not knowingly collect personal information from children, and we do not process a child's personal data without the consent of a parent or legal guardian. If you believe that a child has provided personal information to us, please contact privacy@verifiedbm.shop and we will take appropriate steps to remove it.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and update the Last updated date, and we will take reasonable steps to bring material changes to your attention. The effective date is the date the policy is published.

This policy is governed by the laws of Bangladesh. If any part of this policy conflicts with mandatory applicable law, the law prevails.