Privacy Policy

1. Who We Are (Data Controller)

SM Supports ("we", "us", or "our") is a software development, design, and consulting business operating from Savar, Dhaka, Bangladesh. For the purposes of applicable data protection law, SM Supports acts as the data controller / data fiduciary for personal data collected through this website. Where we process personal data on behalf of a client as part of a project, we act as a data processor under that client's instructions.

2. Information We Collect

We collect information that you provide directly to us when you:

• Fill out contact forms or schedule meetings
• Subscribe to our newsletter or communications
• Request quotes or information about our services
• Communicate with us via email or other channels

We also automatically collect limited technical data (such as IP address, browser type, device information, and pages visited) through cookies and similar technologies. See our Cookie Policy for details. We do not intentionally collect sensitive personal data (such as religious, biometric, or health information) through this website.

3. Legal Bases for Processing

We only process your personal data where we have a lawful basis to do so. Depending on the context, we rely on:

• Consent: where you have given us clear, specific, and revocable permission (e.g. marketing emails, non-essential cookies). You may withdraw consent at any time.
• Contract: where processing is necessary to provide a service you requested or to take steps before entering an agreement.
• Legitimate interests: to operate, secure, and improve our website and services, balanced against your rights.
• Legal obligation: where we must process data to comply with applicable law.

Under the Bangladesh Personal Data Protection Ordinance 2025, the burden of demonstrating valid consent rests with us, and consent can be withdrawn as easily as it was given.

4. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve our web development, design, and consulting services
• Communication: To respond to your inquiries, send you updates, and provide customer support
• Project Management: To manage and execute your projects effectively
• Marketing: To send you promotional materials and updates about our services (only with your consent)
• Analytics: To understand how our services are used and improve user experience
• Legal Compliance: To comply with legal obligations and protect our rights

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enable core functionality, remember your preferences, and (with your consent) measure how our website is used. Non-essential cookies are only set after you give consent. You can manage your choices at any time through your browser settings or our cookie controls.

Full details are available in our Cookie Policy.

6. Data Security

We implement appropriate technical and organizational security measures, proportionate to the sensitivity of the data, to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using SSL/TLS protocols
• Secure storage of sensitive information
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Employee and contractor training on data protection practices

7. International Data Transfers

We work with clients and service providers around the world. As a result, your personal data may be processed and stored outside Bangladesh and outside your own country — including in the United States and the European Union — by the trusted providers we use to host our website and deliver communications.

When we transfer personal data internationally, we take steps to ensure an equivalent level of protection as required by the Bangladesh Personal Data Protection Ordinance 2025 and the GDPR, such as relying on providers that offer appropriate safeguards (for example, Standard Contractual Clauses) and that maintain recognized security and privacy certifications.

8. Third-Party Services & Sub-Processors

We use a small number of trusted third-party providers (sub-processors) to operate our website and business. These providers may process limited personal data on our behalf and are contractually obligated to protect it and to use it only for the services they provide to us:

This list may be updated as our service providers change. We do not sell your personal information.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer period is required or permitted by law. As a general guide:

• Contact & enquiry data: up to 24 months after our last interaction, unless you become a client
• Client & project records: for the duration of the engagement and up to 6 years afterwards for legal, tax, and accounting purposes
• Marketing data: until you unsubscribe or withdraw consent
• Analytics data: in line with our analytics provider's retention settings

When we no longer need your information, we securely delete or anonymize it.

10. Your Privacy Rights

Subject to applicable law, you have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal data (subject to legal requirements)
• Restriction & Objection: Object to or restrict certain processing of your data
• Withdraw Consent: Withdraw consent at any time, without affecting prior lawful processing
• Data Portability: Receive your data in a portable format or have it transferred to another provider
• Lodge a Complaint: Complain to the relevant authority (in Bangladesh, the National Data Governance Authority)

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law (typically 30 days) and may need to verify your identity first.

11. Children's Privacy

Our website and services are intended for businesses and adults. The Bangladesh Personal Data Protection Ordinance 2025 defines a child as a person under 18 years of age. We do not knowingly collect personal data from children, and our services are not directed to them. If you believe we have inadvertently collected a child's personal data, please contact us at [email protected] and we will delete it promptly.

12. Automated Decision-Making & AI

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, including profiling. We may use AI-assisted tools to help deliver and improve our services (for example, to support design, development, or content tasks), but a human remains responsible for decisions that affect you.

Where we use AI tools in client projects, we do so under appropriate safeguards and do not submit client confidential data to such tools without authorization. You have the right to object to automated processing of your personal data and to request human review where applicable.

13. Data Breach Notification

We maintain procedures to detect, investigate, and respond to personal data breaches. If a breach is likely to result in significant harm to you, we will notify the relevant supervisory authority (in Bangladesh, the National Data Governance Authority) within the time limit prescribed by law, and we will inform affected individuals without undue delay where required.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically.