The Short Version
- We handle three different kinds of people’s data and the rules are not the same for each. Website visitors, people who work at our client companies, and the people we actually employ in Bangladesh.
- For the people we employ we are the employer, so we hold identity documents, salary details, bank or mobile wallet numbers and tax records. We have to. The law requires an employer to keep them.
- We do not sell personal data. We have never sold personal data and we do not run advertising based on it.
- Your national identity number and other government identifiers stay inside Bangladesh except where the law allows a transfer and we have a documented reason for it.
- You can ask us what we hold about you, ask us to correct it, and ask us to delete it. We answer within thirty days. Some records we cannot delete because a statute says we must keep them.
1Who We Are and What This Policy Covers
This policy is published by EOR BD, the Employer of Record and managed workforce business of Eicra Soft Limited, a company registered in Bangladesh with its office at JCX Business Tower, Level 5, Plot 1136/A, Block I, Japan Street, Bashundhara R/A, Dhaka 1229. In this policy we, us and our mean that business.
It explains what personal data we collect, why we hold it, who we give it to, how long we keep it and what you can ask us to do about it. It covers this website and every service we run, including Employer of Record, payroll outsourcing, onboarding and off-boarding, HR administration, payroll tax compliance, company incorporation, contractor management, managed remote teams, offshore development centres, global capability centres and employee benefits administration.
We process personal data in line with the Personal Data Protection Act 2026, and with the record-keeping duties placed on an employer by the Bangladesh Labour Act 2006 and on a withholding agent by the Income Tax Act 2023.
2The Three Groups of People This Policy Applies To
Most privacy policies describe one relationship. Ours has to describe three, because the data we hold about a website visitor and the data we hold about someone we employ are not remotely the same thing.
| Who You Are | What We Typically Hold | Why We Have It |
|---|---|---|
| Website visitor | IP address, device and browser type, pages viewed, referring site, and anything you type into an enquiry or quote form | To run and secure the site and to answer you |
| Client contact | Name, job title, work email, work phone, company details, billing and contract records, and our correspondence with you | To agree and run a commercial engagement |
| Employee candidate or contractor | Full identity and employment file including national identity document, tax identification number, salary, bank or mobile wallet details, leave and attendance records, and benefit enrolments | Because we are the legal employer or the engaging party and the law requires these records |
3When We Are the Controller and When We Are the Processor
This distinction decides who you go to with a request, so it is worth being precise about it.
For the people we employ or engage in Bangladesh. We decide what the employment record must contain because the law places that duty on the employer, not on the client. We are also the controller for website visitors and for our own client contacts.
We act as processor where a client sends us personal data about its own staff for a limited purpose that the client has defined, for example a payroll file for people the client itself employs under its own entity. In that case the client decides the purpose and we act on its documented instructions. If you are one of those people, your first point of contact is your own employer, and we will support them in answering you.
4The Personal Data We Collect
From Everyone Who Uses the Website
- Technical data: IP address, browser and device type, operating system, screen size, language and time zone.
- Usage data: pages viewed, time on page, the link that brought you here, and interactions such as opening a question in a frequently asked questions list.
- Anything you choose to type into a form, which is normally your name, company, email, phone number and a description of what you need.
From Client Contacts
- Identification and contact details, job title and the company you represent.
- Contract, quote, invoice and payment records.
- Correspondence with our team, including email, messaging and call notes.
- Company verification information where we are required to check who we are contracting with.
From Employees Candidates and Contractors
- Identity data: full name, date of birth, gender, photograph, national identity card and passport details where relevant.
- Tax and statutory data: taxpayer identification number, provident fund membership, statutory deduction records.
- Employment data: role, employment contract, appointment letter, probation and confirmation dates, salary and allowances, working hours, attendance, leave balances, service book entries and performance or disciplinary records.
- Payment data: bank account or mobile financial services wallet details used to pay salary.
- Emergency contact and next of kin details.
- Background verification data where the role requires it and the check is lawful.
- Health data limited to what a group health plan, a maternity benefit claim or a statutory sick leave record requires.
5Where We Get Your Data From
- Directly from you when you fill in a form, send an email, sign a contract, submit documents at onboarding or make a benefits claim.
- From your employer or prospective employer where a client refers a candidate to us or sends us the details of people to be onboarded.
- Automatically from your device when you use the website, as described in section 13.
- From public and official sources such as a company registry, where we need to verify a business we are contracting with.
- From service providers acting for us, such as a background verification provider or an insurer administering a claim.
6Why We Process Your Data and on What Basis
We process personal data only where we have a lawful reason. The table sets out each purpose and the basis we rely on.
| Purpose | Basis We Rely On |
|---|---|
| Answering an enquiry or preparing a quote | Steps taken at your request before entering a contract |
| Agreeing and running a service engagement | Performance of a contract with the client |
| Employing a person and running their payroll | Performance of the employment contract |
| Withholding and remitting income tax and statutory contributions | Legal obligation under the Income Tax Act 2023 |
| Keeping appointment letters identity cards leave records and service books | Legal obligation under the Bangladesh Labour Act 2006 |
| Administering provident fund festival bonus gratuity and maternity benefit | Legal obligation and performance of the employment contract |
| Enrolling an employee in a group health plan and supporting a claim | Consent of the employee |
| Background verification where a role requires it | Consent and our legitimate interest in a lawful hire |
| Securing the website and preventing abuse | Our legitimate interest in a safe service |
| Improving how the website works | Consent where the analytics are not strictly necessary |
| Responding to a lawful request from an authority | Legal obligation |
Where we rely on consent you can withdraw it at any time. Withdrawing consent does not make anything we did before unlawful, and it does not affect processing we carry out under a legal obligation. In practice this means you can withdraw from a group health plan but you cannot withdraw from having your tax withheld.
7Sensitive Personal Data
Some of what we hold is treated as sensitive and receives extra protection. That includes national identity numbers, passport details, biometric identifiers where any are ever collected, and health information.
- We collect sensitive data only where a service genuinely requires it, and we collect the minimum needed.
- Health data is limited to what an insurer needs to enrol a member or settle a claim, or what a statutory maternity or sick leave record requires. Managers are told outcomes such as approved leave dates. They are not given clinical detail.
- Access to sensitive data is restricted to named staff who need it for their role.
- Government identifiers are subject to the transfer restrictions described in section 9.
8Who We Share Your Data With
We do not sell personal data and we do not share it for anyone else’s marketing. We share it only where a service or the law requires it.
| Recipient | What They Receive and Why |
|---|---|
| Government authorities | The National Board of Revenue for tax withholding and returns, labour authorities for inspection or statutory filing, and other regulators where the law requires disclosure |
| Banks and mobile financial services | Name account or wallet number and amount so that a salary or payment can be disbursed |
| Insurers licensed by the IDRA | Enrolment and claim data for a group health plan where the employee has consented |
| The client who directs the work | Role attendance leave and cost information needed to manage the engagement. Clients do not receive identity documents or bank details |
| Professional advisers | Auditors lawyers and accountants bound by confidentiality where advice or an audit requires it |
| Technology providers | Hosting email payroll and document storage providers acting under contract on our instructions |
| A buyer of the business | If the business is sold or reorganised the data moves with it under the same protections |
9Sending Data Outside Bangladesh
Our clients are usually based outside Bangladesh, so some data crosses borders. We handle that under the rules in the Personal Data Protection Act.
Where personal data about people in Bangladesh is stored on infrastructure outside the country, a synchronised copy is kept inside Bangladesh. Bulk transfers of government identifiers such as national identity card numbers and passport numbers are restricted and are not made without the approval the Ordinance requires.
In plain terms: your employer abroad receives what it needs to manage the work and pay for it. It does not receive a copy of your national identity card as a matter of routine.
Where we do transfer data outside Bangladesh we do it under a written agreement that binds the recipient to protections equivalent to those in this policy, and only for a purpose set out in section 6.
10How Long We Keep Your Data
We keep data only as long as we need it. Where a statute sets a minimum period that period wins, even if you ask us to delete the record sooner.
| Record | How Long We Keep It |
|---|---|
| Website analytics | Up to 26 months from collection |
| Enquiry and quote correspondence that does not become an engagement | 24 months from our last contact with you |
| Unsuccessful candidate applications | 12 months from the decision unless you ask us to keep them longer for future roles |
| Client contracts invoices and billing records | The term of the engagement plus the period required by tax and company law |
| Employment records payroll registers and statutory filings | The period required by the Bangladesh Labour Act the Labour Rules and the Income Tax Act after employment ends |
| Identity documents collected at onboarding | For the duration of employment and then only as long as a statutory or audit requirement applies |
| Health and insurance claim records | As long as the insurer and the applicable statute require |
When a retention period ends we delete the record or irreversibly anonymise it. Where a record sits inside a backup it is removed on the normal backup cycle rather than extracted individually.
11How We Protect Your Data
- Access is granted by role. Payroll and identity files are visible only to the staff who need them to do their job, and access is removed the day someone leaves or changes role.
- Data is encrypted in transit. The website is served over a secure connection.
- Payroll and employment files are held in access-controlled systems with activity logging.
- Staff handling personal data are bound by written confidentiality obligations.
- Providers acting for us are engaged under contracts that require them to protect the data and to use it only on our instructions.
- Physical records held at our Dhaka office are kept in secured storage.
No system is perfectly secure and we will not pretend otherwise. What we commit to is that the measures above are real, that we review them, and that if something goes wrong we will tell you rather than hope you do not notice. Section 14 sets out what we do.
12Your Rights and How to Use Them
Subject to the limits described below you have the following rights over your own personal data.
- Access. Ask what we hold about you and receive a copy.
- Correction. Ask us to fix data that is wrong or incomplete.
- Erasure. Ask us to delete data we no longer have a lawful reason to keep.
- Withdraw consent. Where we rely on your consent you may withdraw it at any time.
- Portability. Ask for a copy of data you gave us in a commonly used electronic format.
- Object. Object to processing we carry out on the basis of our legitimate interest.
- Complain. Raise a concern with us or with the supervisory authority.
How to Make a Request
Email info@eor.bd with the word Privacy in the subject line and tell us what you want. We may ask you to confirm your identity before we act, because releasing an employment file to the wrong person would itself be a breach.
We answer within thirty days. If a request is unusually complex we will tell you inside that window and explain how much longer we need. We do not charge for a request unless it is repetitive or excessive.
What we cannot always do. We cannot delete a record that a statute requires us to keep, such as a payroll register or a tax filing. We cannot release data about one person to another person without a lawful reason, which means a client cannot obtain an employee’s identity documents or bank details by asking. Where we refuse part of a request we will tell you which part and why.
13Cookies and Website Analytics
This site uses a small number of cookies and similar technologies.
- Strictly necessary. Cookies that make the site work, remember your session and protect forms from abuse. These cannot be switched off without breaking the site.
- Analytics. Cookies that tell us which pages people read and where they arrive from, so that we can improve the content. These are used in aggregate and we do not use them to build a profile of you as an individual.
- Security. The contact forms on this site are protected by a service that helps distinguish people from automated abuse.
You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site working. We do not run advertising cookies and we do not sell audience data.
14If Something Goes Wrong
If a security incident affects personal data we investigate it, contain it, and record what happened.
- Where an incident is likely to cause significant harm we notify the supervisory authority within the period the Ordinance requires.
- Where the risk to an individual is high we tell that person directly and in plain language, including what happened, what data was involved and what we advise them to do.
- Where a client is the controller for the affected data we notify the client without undue delay so that the client can meet its own obligations.
- We keep a record of incidents and of the decisions we took, whether or not notification was required.
15Changes to This Policy
We update this policy when our services change, when the law changes or when we improve how we explain something. The current version and its effective date are shown at the top of this page.
Where a change materially affects how we handle data about people we employ we will tell them directly rather than relying on this page alone.
16How to Contact Us or Complain
Privacy questions and requests go to our office in Dhaka.
| Route | Detail |
|---|---|
| info@eor.bd with Privacy in the subject line | |
| Phone and WhatsApp | +880-1711990010 |
| Office | JCX Business Tower, Level 5, Plot 1136/A, Block I, Japan Street, Bashundhara R/A, Dhaka 1229, Bangladesh |
| Hours | Saturday to Thursday, 9:00 am to 8:00 pm Bangladesh time, GMT+6. Closed Friday |
| Response time | Thirty days for a rights request. Sooner where we can |
If you are not satisfied with how we have handled a request, tell us first so that we have a chance to put it right. You also have the right to complain to the data protection supervisory authority in Bangladesh. If you are an employee and your concern is about how your own employment data has been handled, you may also raise it through the grievance route in your employment contract.
Our terms and conditions explain the commercial relationship this policy sits alongside.
This policy describes our actual practice and is written to be readable rather than to be impressive. It is not legal advice to you, and where your own organisation has obligations of its own you should take advice on those. If anything here is unclear or looks wrong to you, write to us and say so. We would rather fix it than defend it.