1.1 Data protection is a matter of trust and your privacy is important to us. This Privacy Policy explains how Govaly Ltd. (“Govaly”, “we”, “our”, “us”) collects, uses, shares, and protects information in connection with the Services or use of the Platform, regardless of the type of device you use.

1.2 Where applicable, this Privacy Policy should be read together with any country specific rider for your jurisdiction (see Section 12).

1.3 When you use Govaly's applications and websites (web or mobile), as well as products, information, functions and other services operated by Govaly (collectively, the “Platform” and “Services”), we may collect, use, disclose, store and/or process data, including your personal data, in accordance with this Privacy Policy.

1.4 This Privacy Policy keeps you informed of how we handle personal data while providing the Services or access to the Platform, whether or not you have registered as a buyer or seller. We will only handle your personal data as described here.

1.5 Read this Privacy Policy together with any special notices we may provide for specific applications or features so you understand how and why we are using your personal data.

1.6 We may update this Privacy Policy from time to time due to legal, technical or business developments. We will take appropriate steps to inform you (e.g., posting an amended policy on the Platform). Where permissible, your continued use of the Services/Platform (including placing orders) after updates constitutes your acknowledgment and acceptance of the changes. You agree to review this Privacy Policy frequently for updates.

1.7 This Privacy Policy applies alongside other notices, contract terms and consent clauses that relate to our handling of your personal data, unless we state otherwise.

1.8 All terms here apply to Govaly users, whether or not they have created an account as buyers and/or sellers, unless stated to apply only to buyers or only to sellers.

2.1 We collect the personal data described below in accordance with applicable local laws and, where required, with your consent.

2.2 Personal data mean information about an individual (true or not), from which that individual can be identified (directly or indirectly), alone or with other data we have or are likely to have.

2.3 Depending on your use of our Platform/Services, you may be asked to provide certain information. If you choose not to provide some data, certain Services or features may not be available. The personal data you may provide includes:

• i. Identity and Profile Data: name, date of birth, gender, username and password, email address, phone number, interests, and any personal data in photos/videos/audio you upload.
• ii. (Sellers) Business Identity Data: company name, address, date of incorporation, registration number, business license, tax information, shareholder/director information.
• iii. Account and Transaction Data: card or bank details (processed via secure payment partners), delivery/billing address, payments and orders, and details of products/services you buy or sell through the Platform.
• iv. Usage Data: information about how and when you use the Platform/Services or view content, as well as the sites you visited before the Platform and similar statistics.
• v. Marketing and Communications Data: interests, survey responses, marketing preferences, communication preferences, feedback, and your chat/email/call history on the Platform or with our service providers.
• vi. Location Data: e.g., to check for nearby deals or delivery/pick up status.
• vii. Additional Verification Data: any information requested for due diligence checks, identity verification required by authorities, or to investigate suspected policy/terms violations.

2.4 We also automatically collect certain information when you access our Platform/Services on your devices (see Collection of Computer Data, 2.12–2.16).

How We Receive Your Personal Data

2.5 During your use of the Platform/Services, we may receive personal data:

• i. when you browse our sites (web or mobile);
• ii. when you create an account (buyer/seller);
• iii. when, as a seller, you list products/services and transact with buyers;
• iv. when you apply for, subscribe to or use any Services;
• v. when you make a transaction for products on the Platform;
• vi. when you activate/use payment functions on the Platform or via our payment partners;
• vii. when you record or upload user generated content on the Platform;
• viii. when you use chat or messaging on the Platform;
• ix. when you subscribe to publications or marketing;
• x. when you enter a competition, promotion or survey;
• xi. when you participate in any Platform activity or campaign;
• xii. when you log in via or interact with an external service/app (e.g., Google, Facebook);
• xiii. when other users comment on your content or you comment on theirs;
• xiv. when a third party lodges a complaint about you/your content; and
• xv. when you interact with us offline (including outsourced customer service).

2.6 We may collect personal data from you, third parties (e.g., agents, vendors, contractors, partners, payment providers, government sources of data, financial services providers, credit bureaus, delivery/marketing/service partners), our affiliates, or automatically when you use the Platform/Services (see also 2.12-2.16).

2.7 You agree that, where required, you have consented (to us, the third party or our affiliates) to transfer your personal data from third parties/affiliates to Govaly for the purposes in this Privacy Policy.

2.8 You agree to submit only accurate, up to date and non misleading personal data, keep it updated, and notify us of changes. We may request documentation and conduct checks to verify data as part of user verification processes or as required by law.

2.9 We can collect certain categories of personal data only if you voluntarily provide them or as otherwise allowed here. If you do not provide or later withdraw consent for certain data, some features or access may not be available.

2.10 If you provide another person's personal data to us (e.g., adding a family member as delivery recipient), you represent that you have obtained the necessary consent to share their data for processing under this Privacy Policy.

2.11 If you sign up or link your Govaly account with a social media account, we may access personal data you have provided to that provider under its policies; we will handle it under this Privacy Policy.

Collection of Computer Data

2.12 We or our authorized service providers may use cookies, web beacons and similar technologies in connection with your use of the Services/Platform.

2.13 When you visit the Platform, our servers may automatically record data your browser/app sends, which may include: IP address, date/time of access, device type, unique device identifiers, browser type, broad location (e.g., city/country), browsing patterns and details of how you interact with the Platform/Services, plus information about software/hardware, pages viewed, sessions and unique visitors. Some data are collected using cookies and similar tech (see 2.15–2.16). Where required by law, we will obtain your prior consent for cookies and similar tech. We may also derive inferences about you based on your buying/browsing activity.

2.14 We use this data for analysis and evaluation to improve our website, Services and products, personalize content to your interests more quickly, make the Platform more convenient/useful, and provide more relevant marketing.

2.15 Cookies are small text files placed in your browser/device memory; web beacons are small images in pages/emails. They help us recognize your browser/device and understand usage.

2.16 You may manage/delete cookies via your browser/device settings. Certain cookies are required for core functions (e.g., cart/checkout). Disabling them may affect Platform/Service functionality.

Purpose to use

3.1 We use/disclose personal data for the purposes below in accordance with applicable law and, where required, with your consent.

3.2 Depending on your relationship with us (buyer, seller, visitor, app user), personal data collected from you or third parties may be used for one or more purposes:

General Platform/Service Purposes

• i. to facilitate your use of the Services or access to the Platform;
• ii. to administer your online account;

Analytics, Research, Business and Development

• iii. to understand user experience with the Services/Platform;
• iv. to improve the layout/content of Platform pages and customise them;
• v. to identify visitors on the Platform;
• vi. to conduct surveys and research on our users' demographics and behaviour to improve technology via lawful means (no biometric/voice features are used by Govaly at this time);
• vii. to derive further attributes relating to you (from data you provide to us/third parties) to offer more targeted/relevant information;
• viii. to conduct data analysis, testing and research, and monitor/analyse usage and activity trends;
• ix. to further develop our products and services;

Legal and Operational Purposes

• x. to ascertain your identity for fraud detection;
• xi. to compare/verify information with third parties for accuracy;
• xii. to process complaints, feedback, enforcement actions and take down requests related to content you upload;
• xiii. to produce statistics/research for internal and statutory reporting and/or record keeping;
• xiv. to store, host and back up personal data;
• xv. to share personal data in connection with a proposed purchase, merger or acquisition of any part of our business, in compliance with data protection laws;
• xvi. to prevent or investigate suspected violations of our Terms of Use, this Privacy Policy, fraud, unlawful activity, omissions or misconduct related to your use of the Services or otherwise;
• xvii. to perform due diligence checks;
• xviii. to comply with legal/regulatory requirements (including, where applicable, displaying your name/contact/company details), including law enforcement or government requests or legal proceedings;
• xix. where necessary, to protect the life, health or safety of Govaly employees, users or the public; and
• xx. any other purpose for which your consent has been obtained.

Where You Are a Buyer

3.3 In addition, we may use your data to:

• i. Processing Your Orders
  • a. process orders you submit through the Platform;
  • b. deliver products you purchase (we may share necessary data with logistics partners or relevant authorities, e.g., customs);
  • c. update you on delivery;
  • d. provide customer support (including returns handling);
  • e. verify and process payments (including card, bank transfer, offline payments, remittances or e-wallet via payment service providers).
• ii. Providing Services
  • a. displays your name/username or profile on the Platform (e.g., on reviews you post);
  • b. responds to queries, feedback, claims or disputes (directly or via third party service providers).
• iii. Marketing and Advertising
  • a. provides information we think you may find useful or that you request;
  • b. send marketing or promotional information about our or third party sellers' products/services on the Platform (subject to your preferences);
  • c. conduct marketing and advertising, including lawful use of user generated content you choose to make public on the Platform.
• iv. Other
  • a. to know our buyers better;
  • b. to conduct automated decision making processes as permitted by law (with appropriate safeguards).

4.1 You may withdraw consent for our continued use/disclosure/storage/processing of your personal data by contacting us (see Section 11), subject to any conditions/limitations under law.

4.2 If you withdraw consent or exercise certain rights, we may be unable to continue providing some Services or perform contracts with you; we are not liable for any resulting inability to provide Services or perform contracts. Our legal rights and remedies are expressly reserved.

4.3 You may unsubscribe from marketing at any time via app settings or the unsubscribe link in marketing emails.

5.1 Your personal data must be accurate, up to date and complete for you to continue using the Platform and for us to provide the Services. You are responsible for informing us of any changes or inaccuracies.

5.2 You can update your personal data anytime via your account settings.

5.3 We may share relevant updates with third parties/affiliates with whom we previously shared your data, where still necessary for the purposes stated.

6.1 You may request information about your personal data that we hold or how it has been used/disclosed/stored/processed via your account settings or by contacting us (Section 11). You may also request corrections. We may need further information to process your request and, where permitted by law, may refuse vexatious or unreasonable requests.

6.2 Where permitted by law, we may charge a reasonable administrative fee for retrieving your records and will inform you of the fee before processing.

8.1 We retain personal data only as long as required or permitted by law or as relevant for the purposes for which it was collected.

8.2 We will cease retention by secure deletion or anonymization once it is reasonable to assume retention no longer serves those purposes and is no longer necessary for legal or business needs.

9.1 Govaly does not sell products to minors (as defined by applicable law) nor intend to provide Services/Platform use to minors. We do not knowingly collect personal data relating to minors.

9.2 You confirm that you are above the age of majority and can understand/accept this Privacy Policy. Minors may use the Platform only with a parent/legal guardian involved.

9.3 If a minor's personal data is disclosed to Govaly, you (as parent/guardian) consent to its processing and agree to be bound by this Privacy Policy and take responsibility for the minor's actions.

9.4 We are not responsible for any unauthorized use of the Services by you, persons acting on your behalf or any unauthorized user. You are responsible for making informed decisions and preventing misuse.

10.1 The Platform may contain links to other websites operated by other parties (e.g., business affiliates, merchants, payment gateways). We are not responsible for their privacy practices. Check their policies to understand how they handle information they collect.

10.2 Even if a third party is affiliated with us, we do not control their sites, which have separate privacy/data practices. We are not responsible for their content, security or activities. You access them at your own risk. We aim to protect the integrity of our Platform and welcome feedback about linked sites (including broken links).

11.1 For questions/comments/concerns about our privacy practices or to exercise rights available under law, contact our privacy office:

Email: [email protected]

Address: Govaly Ltd., [Insert Address], Bangladesh

Attention: Data Protection Officer

Provide your name and contact information with your request.

Bangladesh

• i. This Privacy Policy applies to all processing of personal data that takes place wholly or partly in Bangladesh and/or where the data subjects are domiciled or ordinarily resident in Bangladesh.
• ii. Govaly Ltd. complies with applicable Bangladeshi laws and regulations on data protection and e-commerce. Where international transfers are necessary, we will implement safeguards required by applicable law.