Privacy Policy

1. Introduction & Scope

IBIAN Club Ltd. is committed to protecting the privacy and personal data of its members, applicants, and website visitors in full compliance with applicable Bangladeshi law, including the Digital Security Act, 2018, and the Information & Communication Technology Act, 2006, as amended.

This Privacy Policy describes how we collect, use, store, disclose, and protect personal information gathered through our digital platform, membership application processes, and Club operations. It applies to all individuals who access or use the IBIAN Club Ltd website or digital platform, apply for or hold membership in any category under the Club's Articles of Association, interact with the Club's Executive Committee, Secretariat, or authorised representatives, or attend Club events, programmes, or activities.

By using our platform or submitting a membership application, you acknowledge that you have read, understood, and agreed to the terms of this Policy.

2. Personal Data We Collect

We collect only the minimum personal data necessary for the lawful purposes described in this Policy. The categories of data we collect include Identity & Contact Data (Full legal name, date of birth, gender, National ID (NID) number or Passport number, Current residential and mailing address, Mobile phone number and email address, Profile photograph), Academic & Professional Data (Academic records from Islamic University Kushtia (batch, department, year), Current occupation, employer, and designation, Professional qualifications and achievements), Financial Data (Membership fee payment records and receipts, Annual subscription payment history, Bank transaction references), Platform & Technical Data (Login credentials, IP address, browser type, and device information, Access logs, session duration, and pages visited, Cookies and similar tracking technologies), and Event & Activity Data (Attendance records for Club events and General Meetings, Voting records in General Meetings, Communications sent to or received from the Club Secretariat).

3. Purpose & Legal Basis for Processing

We process your personal data only for specific, lawful purposes such as processing and evaluating membership applications (Contractual necessity / legitimate interest), maintaining the Club's official member register (Legal obligation (Companies Act 1994)), collecting and recording membership fees and subscriptions (Contractual necessity), communicating Club news, events, and General Meeting notices (Legitimate interest / consent), administering Club elections and voting in General Meetings (Legitimate interest), providing access to the digital platform and member portal (Contractual necessity), complying with regulatory and legal requirements (Legal obligation), protecting the Club's security and preventing fraud (Legitimate interest), and analysing platform usage to improve services (Legitimate interest).

4. Data Sharing & Disclosure

IBIAN Club Ltd. does not sell, rent, or trade your personal data to third parties. Data may be shared only in limited circumstances such as with Regulatory & Legal Bodies (The Registrar of Joint Stock Companies & Firms, Bangladesh Revenue Authority, or law-enforcement agencies where we are legally required to disclose information), Islamic University Kushtia (For verification of academic records or alumni status, strictly limited to data necessary for membership eligibility confirmation), Authorised Service Providers (Trusted third-party vendors engaged to support Club operations, bound by confidentiality agreements), and the Executive Committee & Secretariat (Internal access is restricted to authorised Club officers on a need-to-know basis for carrying out their official duties). In any other circumstance, we will seek your prior written consent before sharing your personal data.

5. Data Security & Storage

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. Our security measures include encryption (All data in transit is encrypted using TLS 1.3. Passwords are stored using bcrypt hashing), access controls (Role-based access control (RBAC) ensures only authorised personnel can access specific data categories), audit logging (All access to member data is logged with timestamps, user identity, and action performed), and regular reviews (Our security posture is reviewed periodically and updated in line with industry best practices).

Member data is retained for the duration of membership and for a period of seven (7) years following cessation of membership, in compliance with applicable Bangladeshi corporate record-keeping requirements. Platform access logs are retained for two (2) years. Data retained solely for legal compliance is not used for any other purpose.

6. Your Rights as a Data Subject

Subject to applicable Bangladeshi law, you have the following rights regarding your personal data held by IBIAN Club Ltd.: Right of Access (Request a copy of the personal data we hold about you), Right to Rectification (Request correction of any inaccurate or incomplete personal data), Right to Erasure (Request deletion of your data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations), Right to Restriction (Request that we restrict processing of your data in certain circumstances), Right to Object (Object to processing based on legitimate interests), Right to Data Portability (Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller, where technically feasible), and Right to Withdraw Consent (Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing).

To exercise any of these rights, submit a written request to the Club Secretariat at secretariat@ibianclub.org. We will respond within 30 days of receipt. Identity verification may be required before processing requests.

7. Cookies & Tracking Technologies

Our digital platform uses cookies and similar technologies to enhance functionality, maintain session security, and analyse usage patterns. The following cookie types are used: Strictly Necessary (Authentication, session management, security - Session duration), Functional (Remembering language and display preferences - 1 year duration), Analytical (Anonymised usage statistics to improve the platform - 2 years duration), and Preference (Dark/light mode and notification settings - 1 year duration).

Strictly necessary cookies cannot be disabled as they are essential to platform operation. You may manage or disable non-essential cookies through your browser settings or our cookie preference centre. Disabling analytical cookies does not affect core platform functionality.

8. Children & Minor Members

The Club does not knowingly collect personal data from individuals under the age of 18 without verified parental or guardian consent. Dependent Members, who must be between 21 and 27 years of age per Article 19 of the Articles of Association, are adults for the purpose of this Policy. If you believe that a minor has provided us with personal data without appropriate consent, please contact the Secretariat immediately at secretariat@ibianclub.org, and we will take prompt action to delete such data.

9. International Data Transfers

IBIAN Club Ltd. is a Bangladeshi entity and primarily processes data within Bangladesh. In cases where third-party service providers process data outside Bangladesh (e.g., cloud hosting infrastructure), we ensure that appropriate safeguards are in place, including Data Processing Agreements (DPAs) with all third-party processors, contractual clauses requiring processors to maintain security standards equivalent to those required under Bangladeshi law, and minimisation of data transferred cross-border to only what is technically necessary.

10. Data Breach Response

In the event of a personal data breach that poses a risk to your rights and freedoms, we will immediately take steps to contain and mitigate the breach, including revoking compromised credentials and isolating affected systems. We will inform affected individuals within 72 hours of becoming aware of the breach, where technically feasible, describing the nature of the breach and recommended actions. We will also notify the Bangladesh Telecommunication Regulatory Commission (BTRC) and any other applicable authority as required by law, and conduct a thorough investigation and implement remediation measures to prevent recurrence.

11. Policy Amendments

This Policy may be updated periodically to reflect changes in our data practices, legal obligations, or Club operations. When material changes are made, the revised Policy will be published on the Club's digital platform with an updated effective date. A notice will be sent to all registered members via email or platform notification. Where required by law, explicit consent will be sought for any new processing activities. Continued use of the platform or maintenance of membership following notification of an amendment constitutes acceptance of the updated Policy.

12. Contact & Complaints

For any privacy-related queries, data subject requests, or complaints, please contact the Club Secretariat at secretariat@ibianclub.org. We aim to resolve all complaints within 30 days. If you remain dissatisfied with our response, you may escalate your complaint to the Bangladesh Telecommunication Regulatory Commission (BTRC) or seek legal redress through the courts of competent jurisdiction in Dhaka.