PRIVACY POLICY

Effective Date: 14 September 2026
Last Updated: 14 September 2026

Oikko Proyash Community (“Oikko Proyash”, “we”, “our”, or “us”) is committed to protecting the privacy, dignity, security, and personal information of our members, donors, volunteers, beneficiaries, supporters, website visitors, and other individuals who interact with us.

This Privacy Policy explains how we collect, use, store, disclose, transfer, protect, and otherwise process personal data through our website, online platforms, programs, events, charitable activities, membership activities, donation programs, social media channels, forms, communications, and other services.

We process personal data in accordance with applicable laws of Bangladesh, including the Personal Data Protection Act, 2026, the Cyber Security Act, 2026, and other applicable laws, regulations, rules, and lawful governmental requirements.

Where applicable, we also seek to follow internationally recognized privacy principles, including principles reflected in the EU General Data Protection Regulation (“GDPR”), such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability.

By using our website or voluntarily providing personal information to us, you acknowledge the practices described in this Privacy Policy.

1. Who We Are

For purposes of applicable data protection law, the organization responsible for determining how and why personal data is processed is:

Oikko Proyash Community
Website: oikkoproyash.org
Email: oikkoproyash@gmail.com
Telephone: +880 1927-935161
Address: H16R4 Block-A, Banasree, Rampura, Dhaka, Bangladesh

Where required by applicable law, Oikko Proyash acts as the data fiduciary, data controller, or equivalent responsible organization in relation to personal data under its control.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data collected through:

• our website and online forms;
• membership applications;
• volunteer registrations;
• donation and fundraising activities;
• beneficiary applications and assistance programs;
• events, meetings, campaigns, community projects, and charitable programs;
• email, phone, messaging applications and social media communications;
• photographs, videos, testimonials, interviews and event documentation;
• surveys, feedback forms and complaints;
• employment, internship or service-provider applications;
• payment and donation processing systems;
• analytics, cookies and similar website technologies; and
• any other activity where this Privacy Policy is presented or referenced.

Third-party websites, platforms, payment providers and social networks may maintain their own privacy policies. Their independent processing practices are governed by their respective policies.

3. Personal Data We May Collect

Depending on how you interact with Oikko Proyash, we may collect different categories of information.

Identity and Contact Information

This may include your:

• full name;
• telephone number;
• email address;
• postal or residential address;
• date of birth or age where necessary;
• profession or occupation;
• organization or affiliation; and
• emergency contact details where necessary.

Membership and Volunteer Information

We may collect information regarding membership, volunteering interests, availability, assigned responsibilities, participation history, qualifications, skills, attendance, training and related organizational records.

Donation and Transaction Information

Where you donate or make payments to Oikko Proyash, we may process information such as:

• donor name;
• contact details;
• amount donated;
• date and method of payment;
• transaction or reference number;
• campaign or project supported; and
• accounting, receipt and financial compliance information.

Where payments are processed through banks, mobile financial services, payment gateways or other payment providers, those providers may independently process financial information according to their own privacy policies.

Unless specifically necessary, Oikko Proyash does not intend to collect or store complete payment-card credentials or internet-banking passwords.

Beneficiary Information

For charitable and social-welfare programs, we may need to collect information necessary to assess eligibility, distribute assistance, prevent duplication or fraud, maintain accountability and demonstrate proper use of organizational funds.

Depending on the particular program, this information may include household information, financial circumstances, family size, occupation, income range, identification information, location, assistance history or information relating to a person’s particular needs.

We will seek to collect only information reasonably necessary for the relevant charitable purpose.

Sensitive Personal Data

Certain information may be considered sensitive, confidential or specially protected under applicable law.

This can include, where relevant and lawfully required:

• national identification information;
• passport or other government-issued identification;
• financial information;
• health or disability-related information;
• biometric information;
• information relating to children;
• precise location information;
• photographs or videos revealing sensitive circumstances; and
• other information classified as sensitive, confidential or restricted under applicable law.

We will process sensitive personal data only when there is an appropriate lawful basis and appropriate safeguards.

Website and Technical Information

When you use our website, certain information may be collected automatically, such as:

• IP address;
• browser type;
• device type;
• operating system;
• referring website;
• pages viewed;
• approximate location derived from IP address;
• date and time of access;
• session information;
• cookie identifiers; and
• security or diagnostic information.

4. How We Collect Personal Data

We may collect personal information directly from you when you complete a form, communicate with us, become a member, volunteer, donate, participate in an event, request assistance, subscribe to communications or otherwise interact with Oikko Proyash.

We may also receive information from authorized representatives, partner organizations, volunteers, service providers, publicly available sources or other lawful sources where appropriate.

Where information is obtained from another source, we will handle it according to applicable law and the purposes for which it was legitimately obtained.

5. Lawful Bases for Processing

We process personal information only where we have a lawful and appropriate reason to do so.

Depending on the circumstances, our lawful basis may include:

Consent. You have freely provided specific and informed consent for a particular purpose.

Performance of an agreement. Processing is necessary to administer membership, volunteering arrangements, donations, services or another relationship you have requested.

Legal obligation. Processing is required for taxation, accounting, regulatory, reporting, law-enforcement or another legal requirement.

Legitimate interests. Processing is reasonably necessary for legitimate organizational purposes and does not unjustifiably override your rights and interests.

Vital interests. Processing may be necessary to protect someone’s life, safety or essential interests.

Public or charitable interests. Processing may be undertaken where permitted by law for legitimate humanitarian, charitable, public-interest or community-welfare purposes.

Where processing is based on consent, consent will be requested in a manner intended to be voluntary, specific, informed, clear and capable of withdrawal.

6. How We Use Personal Data

We may use personal information to operate Oikko Proyash and carry out legitimate charitable and community activities, including to:

• manage memberships and organizational administration;
• coordinate volunteers;
• receive, record and acknowledge donations;
• provide charitable assistance;
• assess applications for support;
• communicate regarding programs, meetings, events and projects;
• respond to questions, complaints and requests;
• issue receipts or other records;
• maintain financial accountability;
• prevent fraud, misuse or duplicate benefit claims;
• maintain project, volunteer and beneficiary records;
• improve our website and services;
• protect our website, systems, members and beneficiaries;
• conduct authorized research, statistics or impact measurement;
• comply with legal, tax, accounting, audit or regulatory requirements;
• establish, exercise or defend legal rights;
• maintain organizational transparency and accountability; and
• carry out other purposes disclosed to you at the time information is collected.

We will not use personal data for materially incompatible purposes without an appropriate lawful basis.

7. Beneficiary Privacy and Human Dignity

Because Oikko Proyash may work with vulnerable or financially disadvantaged individuals, we consider beneficiary privacy particularly important.

Receiving charitable assistance does not mean that a beneficiary gives up their right to privacy or dignity.

We will seek to avoid unnecessarily publishing a beneficiary’s:

• national identification number;
• detailed financial circumstances;
• medical information;
• complete residential address;
• private family circumstances;
• personal telephone number; or
• other information that could expose them to embarrassment, discrimination, exploitation, harassment, fraud or physical risk.

Where beneficiary stories are used to demonstrate charitable impact, we will seek appropriate consent and, where reasonably possible, minimize unnecessary identifying information.

Assistance will not normally be made conditional upon a beneficiary consenting to publicity unless the publicity is genuinely necessary for the relevant program and legally permitted.

8. Photographs, Videos and Media

Oikko Proyash may photograph or record events, charitable projects, meetings, distributions, campaigns or other activities for documentation, transparency, educational, archival or communications purposes.

Where an individual is the primary identifiable subject of sensitive, testimonial or beneficiary-focused content, we will seek appropriate permission before publishing the content unless another lawful basis clearly applies.

Special care will be exercised when photographs or videos:

• feature children;
• show people receiving charitable assistance;
• disclose health or disability information;
• disclose sensitive personal circumstances; or
• could reasonably cause harm, embarrassment or exploitation.

Where reasonably practicable, a person who previously consented to publication may contact us requesting removal of material under our control. We will evaluate such requests in accordance with applicable law, legitimate archival requirements and technical limitations.

Content already shared by third parties or independently copied outside our control may not always be capable of complete removal from the internet.

9. Children’s Privacy

We provide heightened protection to personal data relating to children.

Where applicable under Bangladesh law, a parent, legal guardian or another legally authorized person must provide appropriate consent for processing personal data relating to a person under 18 years of age when such consent is required.

We will not knowingly collect unnecessary personal information directly from children.

Children’s photographs, videos, identification information, health information and other sensitive information will receive additional safeguards.

If you believe that we have improperly collected or published a child’s personal information, please contact us immediately at oikkoproyash@gmail.com.

10. Donations and Financial Privacy

Donation information will be used primarily for donation administration, accounting, receipts, financial reporting, auditing, fraud prevention, donor communications and compliance with applicable law.

We do not sell or rent donor personal information.

We do not disclose donor identities publicly merely because someone has made a donation unless:

• the donor has consented;
• disclosure is reasonably necessary for a stated fundraising or transparency purpose and is lawful;
• the information has already been deliberately made public by the donor; or
• disclosure is required by law.

Anonymous donation preferences will be respected where legally and operationally possible.

11. Sharing Personal Data

We do not sell personal information.

We may share information only where reasonably necessary with trusted recipients such as:

• website hosting and technology providers;
• cloud or data-storage providers;
• payment processors and financial institutions;
• accountants, auditors and legal advisers;
• communications or email service providers;
• authorized volunteers or officers who require access for their duties;
• project partners and service providers;
• security and fraud-prevention providers;
• governmental, judicial, regulatory or law-enforcement authorities where legally required; and
• other parties where you have authorized disclosure.

Service providers receiving personal data on our behalf should receive only the information reasonably necessary to perform their assigned function and should be subject to appropriate confidentiality and data-protection obligations.

12. No Sale of Personal Data

Oikko Proyash does not sell, rent, trade or commercially broker personal data.

We also do not provide beneficiary or donor databases to third parties for independent commercial marketing purposes.

If our practices materially change in the future, this Privacy Policy will be updated and any consent required by law will be obtained.

13. International and Cross-Border Data Transfers

Some technology providers, cloud services, communication platforms or website infrastructure used by Oikko Proyash may process information outside Bangladesh.

Any cross-border transfer of personal information will be undertaken only where permitted under applicable law and subject to appropriate safeguards.

Depending on the circumstances, safeguards may include:

• obtaining required consent;
• using providers located in jurisdictions with appropriate safeguards;
• contractual data-protection obligations;
• encryption;
• access controls;
• transfer-risk assessments; and
• other measures required by Bangladesh law.

Sensitive or restricted data will receive any additional safeguards required by applicable law.

Where GDPR or another foreign privacy law applies, additional transfer mechanisms may be used where legally required.

14. Cookies and Similar Technologies

Our website may use cookies and similar technologies to operate the site, maintain security, remember preferences, understand website performance and improve user experience.

Cookies may include:

Essential cookies, which are necessary for website functionality and security.

Preference cookies, which remember settings or choices.

Analytics cookies, which help us understand website usage.

Marketing or third-party cookies, where such technologies are intentionally enabled.

Where applicable law requires consent before non-essential cookies are placed, we will seek such consent.

You may also be able to control cookies through your browser settings. Disabling certain cookies may affect website functionality.

15. Analytics and Third-Party Services

We may use third-party services for website analytics, hosting, security, embedded content, maps, forms, email distribution, social media integration or similar functionality.

Such services may receive technical information such as your IP address, browser details, cookie identifiers or device information.

We will seek to select reputable providers and limit disclosure consistent with the service being provided.

Users should also review the privacy policies of relevant third-party providers.

16. Data Security

We maintain reasonable and proportionate technical, organizational and administrative safeguards designed to protect personal data from:

• unauthorized access;
• unauthorized disclosure;
• alteration;
• misuse;
• accidental loss;
• destruction;
• malware;
• theft; and
• other unlawful processing.

Depending on the sensitivity and risk involved, safeguards may include encryption, secure connections, password controls, role-based access, backups, system updates, security monitoring, limited administrative privileges, confidentiality requirements and staff or volunteer awareness measures.

Access to personal information should be limited to persons who reasonably require such access for authorized duties.

No internet-connected system can be guaranteed to be completely secure. Accordingly, while we maintain appropriate safeguards, we cannot guarantee absolute security.

17. Personal Data Breaches

Oikko Proyash will maintain procedures for identifying, investigating, containing and responding to suspected personal-data breaches.

When a breach occurs, we may:

• secure affected systems;
• determine the nature and scope of the breach;
• identify affected categories of information and individuals;
• assess potential harm;
• take remedial measures;
• preserve appropriate incident records; and
• notify the competent authority and/or affected individuals where required by applicable law.

Where the GDPR applies to particular processing, we will follow applicable GDPR breach-notification requirements.

18. Data Retention

We do not intend to retain identifiable personal information indefinitely.

Personal data will normally be retained only for as long as reasonably necessary for the purposes for which it was collected, taking into account:

• applicable legal requirements;
• accounting and audit obligations;
• tax requirements;
• dispute or complaint periods;
• fraud prevention;
• safeguarding;
• contractual obligations;
• organizational accountability; and
• legitimate historical or archival interests.

Where Bangladesh law requires us to retain records concerning personal-data processing for a specified period, we will retain those records accordingly.

When information is no longer required and no legal basis exists for continued retention, we will take reasonable steps to delete, anonymize or securely dispose of it.

19. Your Privacy Rights

Subject to applicable law and relevant exceptions, you may have the right to:

Be informed about how your personal information is collected and processed.

Access your data and request information about personal data held about you.

Request a copy or portability of eligible personal data.

Correct inaccurate information relating to you.

Complete or update incomplete information.

Request deletion or erasure where the legal conditions for deletion are satisfied.

Withdraw consent where processing is based on consent.

Request restriction or cessation of certain processing where permitted by law.

Object to certain processing where applicable.

Receive information regarding recipients with whom your data has been shared where legally required.

Receive information concerning international transfers and relevant safeguards where legally required.

Raise concerns regarding automated decision-making, if such processing is used and applicable law provides such rights.

Lodge a complaint with the competent data-protection authority where you believe your rights have been violated.

These rights cannot be contractually waived where applicable law makes them fundamental or non-waivable.

20. Exercising Your Rights

To make a privacy request, contact:

Email: oikkoproyash@gmail.com
Telephone: +880 1927-935161
Subject: Privacy Rights Request

Please clearly identify:

• your name;
• the nature of your relationship with Oikko Proyash;
• the right you wish to exercise; and
• sufficient information to allow us to locate the relevant record.

To protect individuals from unauthorized disclosure or fraud, we may need to verify identity before responding to a request.

We will respond within the period required by applicable law.

We may refuse, limit or delay a request where permitted or required by law, including where fulfilling the request would adversely affect another person’s legal rights, interfere with legal obligations or require retention of information that we are legally obligated to maintain.

21. Withdrawal of Consent

Where our processing relies on your consent, you may withdraw that consent through the method provided when consent was obtained or by contacting us at oikkoproyash@gmail.com.

Withdrawal of consent does not normally affect the lawfulness of processing that occurred before consent was withdrawn.

After withdrawal, we will stop consent-based processing unless another lawful basis permits or requires continued processing.

22. Marketing and Communications

We may send organizational announcements, project updates, newsletters, fundraising communications or similar messages where permitted by applicable law.

Where consent is required for promotional communications, we will obtain appropriate consent.

You may unsubscribe from promotional electronic communications using the unsubscribe mechanism provided or by contacting us.

Administrative, security, transaction, membership or legally required communications may still be sent where necessary.

23. Automated Decision-Making

Oikko Proyash does not intend to make decisions producing significant legal or similarly significant effects solely through automated processing without appropriate safeguards.

If we introduce such systems in the future, we will implement the transparency, human-review and other safeguards required by applicable law.

24. Confidentiality Within the Organization

Members, officers, employees, volunteers and representatives who receive access to personal information in connection with organizational responsibilities are expected to maintain confidentiality.

Access to beneficiary, donor, member or volunteer databases should not be used for personal, political, commercial or unrelated purposes.

Unauthorized copying, downloading, sharing or publishing of confidential personal information may result in removal of access, internal disciplinary action, termination of responsibilities and, where appropriate, legal action.

25. Legal Requests and Law Enforcement

We may disclose personal information where we reasonably believe disclosure is required to:

• comply with applicable law;
• respond to a valid court order;
• comply with a lawful request of a competent public authority;
• investigate suspected fraud or criminal activity;
• protect the safety or rights of individuals;
• establish, exercise or defend legal claims; or
• comply with another legally binding obligation.

Where legally permitted and appropriate, we will seek to limit disclosure to information reasonably necessary to satisfy the lawful request.

26. Organizational Changes

If Oikko Proyash undergoes restructuring, merger, incorporation into another nonprofit entity, transfer of operations or another organizational change, relevant information may be transferred to the successor organization where lawful and necessary.

Any successor handling personal information will be required to respect applicable data-protection obligations.

27. External Links

Our website may contain links to websites operated by third parties.

Oikko Proyash is not responsible for the privacy, security, content or data-processing practices of independent third-party websites.

We encourage you to review the relevant privacy policy before providing personal information to an external service.

28. Privacy by Design and Data Minimization

Oikko Proyash seeks to apply privacy considerations when designing programs, forms, databases and technology systems.

Whenever reasonably practicable, we will:

• collect less information rather than unnecessary information;
• restrict access to authorized persons;
• use anonymous or aggregated information where identifiable information is unnecessary;
• minimize publication of beneficiary information;
• protect sensitive information with additional safeguards; and
• periodically review whether information remains necessary.

29. Accountability

Oikko Proyash is responsible for adopting reasonable measures to implement this Privacy Policy.

We may periodically review:

• what information we collect;
• why we collect it;
• who has access to it;
• where it is stored;
• which third parties receive it;
• how long it is retained; and
• what security measures are appropriate.

Where required by applicable law because of the nature or scale of our processing, we will implement additional governance measures such as impact assessments, audits, documented processing records or appointment of responsible data-protection personnel.

30. Changes to This Privacy Policy

We may update this Privacy Policy from time to time because of changes to our services, organizational practices, technology or applicable laws.

When material changes are made, we will update the “Last Updated” date at the beginning of this Policy and may provide additional notice where appropriate.

Where a change would require new consent under applicable law, we will seek that consent before relying on the revised processing purpose.

We encourage users to review this Privacy Policy periodically.

31. Governing Law

This Privacy Policy and Oikko Proyash’s processing of personal data in Bangladesh are governed by the applicable laws of the People’s Republic of Bangladesh, including the Personal Data Protection Act, 2026, and other applicable legislation, rules, regulations and lawful requirements.

Where another jurisdiction’s privacy legislation applies to particular processing because of the location of an individual or the nature of the processing, Oikko Proyash will seek to comply with those applicable requirements.

32. Contact Us

Questions, concerns, complaints or requests concerning this Privacy Policy or your personal information may be directed to:

Oikko Proyash Community
Privacy Contact / Data Protection Contact
Email: oikkoproyash@gmail.com
Telephone: +880 1927-935161
Address: H16R4 Block-A, Banasree, Rampura, Dhaka, Bangladesh
Website: oikkoproyash.org

Please write “Privacy Request” or “Data Protection Complaint” in the subject line where appropriate.

We take privacy concerns seriously and will seek to address legitimate requests in accordance with applicable law.