Privacy Policy

1. Introduction

HEEMS ("we", "us", or "our") operates the website www.heemsbd.com and is committed to protecting the personal information of individuals who visit and purchase from our platform. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and what rights you have in relation to your personal data.

We do not require you to create an account to shop with us — every order is placed as a one-time, guest checkout. This Policy describes exactly what we collect during that process and afterward, with no exaggeration and nothing left out.

By accessing or using our website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please refrain from using our website or services.

2. Information We Collect

We collect information that you provide directly to us, as well as certain information that is collected automatically when you use our website.

Information you provide:

• Full name, phone number, and shipping address, which you give us when you place an order.
• Email address, only if you choose to provide one at checkout — it is optional. If you don't provide one, we simply have no way to email you about your order (see Section 3).
• If you pay the advance delivery charge by bKash or Nagad: the transaction ID and the phone number you sent the payment from. See Section 4 for exactly how this is handled.
• Photos and written comments you submit when leaving a product review, or when filing a return or exchange request.
• Messages and correspondence you send us through our contact form, email, or Facebook Page.

Information collected automatically:

• IP address, browser type, device information, and general browsing behavior, collected via Google Analytics as described in Section 7.
• Your cart contents and the details you type into the checkout form, saved in your browser's local storage so the form autofills the next time you visit. This stays on your device — we only receive it when you actually submit an order.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To process, verify, fulfill, and deliver your order, including screening for fraud risk before dispatch (see Section 5).
• To confirm your order by SMS and, if you provided one, to send order, shipping, invoice, and review-related emails to your email address.
• To respond to your inquiries and provide customer support.
• To detect, investigate, and prevent fraudulent transactions and other prohibited activities.
• To display your product review — including your name as entered on the order, star rating, comment, and any photos you upload — publicly, as described in Section 6.
• To improve the functionality, performance, and content of our website.
• To comply with our legal obligations under applicable Bangladesh law.

We do not currently send marketing, promotional, or newsletter communications of any kind. If we introduce this in the future, we will only do so with your prior consent, and we will give you a clear way to opt out at any time.

4. Payment Information

We do not use a card payment gateway and do not hold a merchant account with any bank or card processor. There is currently no option to pay by debit or credit card on our website, so we never receive, process, or store card numbers of any kind.

The price of the product itself is paid in cash, directly to the courier, on delivery (Cash on Delivery). Separately, a flat delivery charge is collected in advance: you send this amount yourself, using your own bKash or Nagad app, to a HEEMS-operated mobile account, and then enter the resulting transaction ID and your sending phone number into our order form.

We never receive or store your bKash/Nagad PIN, password, or login credentials — only the transaction ID and phone number you manually enter. A member of our team checks this information against our own mobile account statement to confirm payment before your order is processed. This transaction reference is stored with your order record and is visible only to our admin staff.

5. Sharing of Information

We do not sell, trade, or rent your personal information to third parties for their marketing purposes. We share your information only with the following parties, strictly as necessary to run our business:

• Steadfast Courier Limited — our delivery partner. We share your name, phone number, and shipping address so they can deliver your order, and we use their fraud-screening service, which checks your phone number against their delivery database before we dispatch certain orders.
• SMS.net.bd — our SMS provider, used to send your order confirmation text to the phone number you give us.
• Mailtrap — our email delivery provider, used to send order confirmation, shipping/invoice, review-request, and return-status emails, only if you provided an email address.
• Google Analytics — used to understand how visitors use our website, as described in Section 7.
• Law enforcement or government authorities, when we are legally required to do so, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Public Display of Reviews

If you submit a product review, your first name together with the first initial of your last name (for example, "Ayesha R."), your star rating, your written comment, and any photos you upload are displayed publicly on the relevant product page. Please do not include information in a review's text or photos that you do not want to be publicly visible. You may edit your review within 30 days of submitting it; after that window, or if you'd like it removed sooner, contact us as described in Section 14.

7. Cookies and Local Storage

We do not use cookies to run the shopping experience itself. Your cart contents and checkout form details are saved in your browser's local storage, not a cookie — this data stays on your device and does not sync across devices or browsers.

Google Analytics, which we use to understand site traffic, sets its own cookies to distinguish visitors. We have configured Analytics to exclude pages that contain private access links — order tracking, invoices, reviews, and returns — so those page addresses and the tokens they contain are never sent to Google.

Our admin login system separately uses a secure, essential session cookie for staff access only; this is not set for ordinary visitors or customers.

8. Where We Store Your Data

Our website, database, and image storage run on third-party cloud infrastructure. Some of this infrastructure is located outside Bangladesh — our application server and image storage are hosted in Malaysia, and our database is hosted with a United States-based provider. Your personal data may therefore be processed and stored on servers outside Bangladesh. We require our infrastructure providers to maintain appropriate technical safeguards, and we are reviewing our setup in light of Bangladesh's Personal Data Protection Act 2026.

9. Data Retention

We retain order and transaction records, including the personal data associated with them, for six years, consistent with standard business record-keeping requirements under Bangladeshi commercial and tax law. A published product review may remain visible on our website indefinitely unless you ask us to remove it. Where data is no longer required for these purposes, we delete or anonymize it.

10. Security

We implement reasonable and appropriate technical and organizational measures to protect your personal information, including your payment transaction references, against unauthorized access, alteration, disclosure, or destruction. However, no transmission of data over the internet is completely secure, and we cannot guarantee the absolute security of information transmitted to or from our website.

11. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• The right to access the personal information we hold about you.
• The right to request correction of inaccurate or incomplete data.
• The right to request deletion of your personal data, subject to our legal record-keeping obligations described in Section 9.

Because we do not operate customer accounts, we handle these requests manually. Contact us using the details in Section 14, and provide the name, phone number, and order ID used on your order so we can locate and verify your data before acting on your request. We will respond within a reasonable time frame.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the People's Republic of Bangladesh, including the Digital Commerce Operation Guideline 2021, the Consumer Rights Protection Act 2009, the Cyber Security Act 2023, the Personal Data Protection Act 2026, and any other applicable data protection regulations. Any disputes arising in connection with this policy shall be subject to the exclusive jurisdiction of the courts of Bangladesh.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us through our Contact page or write to us at: HEEMS, Patuakhali, Bangladesh.