Privacy Policy for Arafah - Grow Your Business

Effective Date: October 7, 2025

Arafah Shop Ltd. ("we," "us," or "our") operates the Arafah Seller - Grow Your Business mobile application ("App") and website (www.arafah.shop). We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App or website. By using the App or website, you consent to the practices described in this Policy.

This Policy applies to sellers ("you" or "users") who register and use the App or website to manage their e-commerce business on the Arafah - Online Shopping Mart platform. It complies with applicable laws, including the Personal Data Protection Ordinance 2025 of Bangladesh, the Digital Security Act 2023, the Information and Communication Technology Act 2006 (as amended), and international standards such as the EU General Data Protection Regulation (GDPR) where relevant (e.g., for users in the EU or processing EU data).

If you do not agree with this Policy, please do not use the App or website. We may update this Policy periodically; changes will be posted in the App and on www.arafah.shop with the updated effective date. Your continued use of the App or website after changes constitutes acceptance.

1. Information We Collect

We collect information to provide, improve, and secure our services. The types of information include:

Personal Information

• Account Information: Name, email address, phone number, business name, address, and tax identification number (e.g., TIN in Bangladesh) provided during registration.
• Financial Information: Bank account details or other payment method information for receiving payouts.
• Product and Business Data: Product descriptions, photos, prices, inventory levels, and sales data you upload.
• Transaction Data: Order details, payment history, shipping information, and customer interactions related to your sales.

Automatically Collected Information

• Device and Usage Data: IP address, device type, operating system, app version, browser type, and usage patterns (e.g., pages viewed, time spent).
• Log Data: Crash reports, error logs, and interaction data (e.g., button clicks).

Information from Third Parties

We may receive information about you from:

• Payment processors or shipping partners for order fulfillment.
• Advertising partners for personalized ads (with your consent where required).

For users under 13 years old (or the applicable age in your jurisdiction), we do not knowingly collect personal information without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA).

We do not collect sensitive personal information (e.g., health data, political opinions) unless required for business verification and with your explicit consent.

2. How We Use Your Information

We use your information for legitimate business purposes, including:

• Providing Services: To manage your seller account, process product uploads, track sales/orders, handle payments, and integrate with the Arafah customer app.
• Improving the App: To analyze usage trends, debug issues, and develop new features (e.g., using aggregated analytics).
• Communications: To send notifications about orders, payments, promotions, or support (e.g., via email, SMS, or in-app alerts). You can opt out of marketing communications.
• Security and Fraud Prevention: To detect and prevent unauthorized access, fraud, or abuse (e.g., monitoring login attempts).
• Compliance and Legal: To comply with tax laws, anti-money laundering regulations, or respond to legal requests.
• Personalization: To tailor recommendations, such as popular products or sales insights.

Under the Personal Data Protection Ordinance 2025, processing is based on consent, contract performance, or legitimate interests. For EU users (under GDPR), we rely on similar bases and ensure explicit consent where required.

3. How We Share Your Information

We do not sell your personal information. We may share it in limited circumstances:

• Service Providers: With trusted third parties who assist us, such as payment processors (Bkash, Nagad), cloud storage (e.g., AWS), analytics tools (Google Analytics), and shipping partners. These providers are contractually obligated to protect your data and use it only for our specified purposes.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.
• Legal Requirements: To comply with laws, respond to subpoenas, court orders, or government requests (e.g., under the Digital Security Act 2023). We will notify you unless prohibited.
• With Your Consent: For any other purpose with your explicit approval.
• Aggregated Data: Anonymized or aggregated data (e.g., market trends) may be shared publicly or with partners.

Cross-border transfers (e.g., to servers outside Bangladesh) will only occur with adequate safeguards, such as standard contractual clauses, in line with the Personal Data Protection Ordinance 2025.

4. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information, including encryption for payment data (e.g., SSL/TLS), secure servers, and access controls. However, no system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required by law (e.g., tax records for 7 years). Account data is retained while your account is active; inactive accounts may be deleted after 2 years. You can request deletion at any time (see Section 7).

6. Your Rights and Choices

You have control over your personal information. Depending on your location, you may have the following rights:

• Access: Request a copy of your data.
• Correction: Update inaccurate information.
• Deletion: Request removal of your data (subject to legal obligations).
• Objection/Restriction: Object to or restrict processing (e.g., for marketing).
• Portability: Receive your data in a structured format.
• Withdraw Consent: For processing based on consent.

To exercise these rights, contact us at contact@arafah.shop. We will respond within 30 days (or as required by law). For CCPA purposes, California residents can also request information on sales (none occur) or opt out of sales (not applicable).

You can also:

• Opt out of marketing emails via the unsubscribe link.
• Disable cookies in your browser settings (though this may affect functionality).
• On iOS: Limit ad tracking via Settings > Privacy > Advertising > Limit Ad Tracking.
• On Android: Opt out of personalized ads via Google Settings > Ads > Opt out of Ads Personalization.

For EU users, our Data Protection Officer can be reached at the contact email above.

7. Data Deletion

You can delete your account and associated data through the App settings or by emailing us. We will permanently delete your data within 30 days, except where retention is required by law (e.g., transaction records). This complies with Google Play's data deletion requirements and Apple's user control guidelines.

8. Children's Privacy

The App and website are not intended for children under 18. We do not knowingly collect data from minors. If we discover such data, we will delete it promptly. Parents/guardians: Contact us if you believe we have collected your child's data.

9. Third-Party Links and Services

The App and website may link to third-party sites (e.g., payment gateways). We are not responsible for their privacy practices. Review their policies before providing information.

10. International Users

Arafah Shop Ltd. is based in Bangladesh. If you are outside Bangladesh, your information may be transferred to and processed in Bangladesh or other countries where our service providers operate. We ensure appropriate safeguards, such as Standard Contractual Clauses for EU data transfers, to protect your information.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you via email or in-App notice for material changes. Continued use of our Services after changes constitutes acceptance.

12. Contact Us

If you have questions about this Privacy Policy, please contact:

Arafah Shop Ltd.
Plot No. 23 and 25, Sonargaon Janapath, Sector-13, Uttara, Dhaka 1230, Bangladesh
Email: contact@arafah.shop
Phone: +8801869963922
Website: www.arafah.shop

For privacy complaints, you may also contact your local data protection authority (e.g., Data Protection Commissioner in Bangladesh).

This Privacy Policy was last updated on October 7, 2025.