At bKash, we respect (all types of bKash account holders’) privacy and are committed to protecting their personal and account information. This Privacy Notice explains how bKash collects, processes/uses, shares and protects personal/account information, how bKash conforms to these commitments, in accordance with applicable laws and regulations.

Identity of the Data Fiduciary
bKash Limited is the Data Fiduciary responsible for the collection, use, storage, disclosure, and other processing of your Personal Data in accordance with the applicable Personal Data Protection Law.

Categories of Information We Collect
We may collect and process the following types of personal information:

• Identity Information, e.g. name, date of birth, gender, photograph, parent’s names, nationality, government-issued identification numbers (NID/Passport/Birth Certificate/Driving License) or other photo ID (where applicable), occupation, nominee information.
• Contact information, e.g. address, mobile number, email, etc.
• Financial and transaction Information, e.g. account number, balance information, TIN, transaction history and payment records, source of fund/income, and payment card details.
• Biometric Data, e.g. facial recognition data.
• Usage Data, e.g. access logs, app usage behavior, support requests.
• Device and technical identifiers, e.g. device type, operating system, IP address, IMEI number, location data (if permitted).

Methods of Data Collection

• We collect your personal data directly from you (through KYC/eKYC), from your use of bKash App or account.
• Data may also be obtained from public sources or regulatory bodies where legally permitted.

Purpose of Processing

• We collect and process your personal data for the following specific, explicit and legitimate purposes:
• To register and manage your bKash account
• To process your financial transactions, facilitate and offer services
• To verify your identity, comply with KYC/AML requirements
• To ensure the security of your bKash account, prevent fraud, unauthorized access and financial crime as well as to assist in the investigation of such incidents
• To conduct statistical analysis, research and enhancement activities to improve the services of bKash and user experience
• To send you important updates about your account
• To provide customer support and respond to inquiries
• To comply with legal and regulatory requirements
• To send you promotional offers

Lawful Basis for Processing Personal Data 

We process personal data based on one or more of the following lawful basis other than Consent as per the prevailing laws relating to Personal Data protection:

• Contractual Necessity: We use your data to provide the services you request, such as transfers, bill payments, remittances, card transactions and managing your account.
• Pre-Contractual Measures at Your Request: We use your data to prepare services you’ve requested before a contract is in place, such as account setup, identity verification, eligibility checks and respond to your applications or inquiries.
• Legal Obligation: We use your data to comply with applicable laws and regulatory requirements.
• Legal Claims or Defense: We may use your data to establish, exercise or defend legal rights.
• Vital Interests: We may use your data to protect your life, health or the safety of others.
• Employment and Social Protection: Where relevant, we use your data to meet obligations under employment, labor or social protection laws.
• Publicly Disclosed Data: We may use data that you have made publicly available.
• Prevention of Harm: We may use your data if needed to prevent harm to someone, especially where consent cannot reasonably be obtained.
• Further Processing: We may use your data for related purposes that are compatible with the original reason for collection, as allowed by law.

Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable laws and regulations. Once the retention period expires and no lawful basis remains, the data will be securely deleted or anonymized.

Transfer of Personal Data 
Personal data may be transferred within or outside the country only when:

• The recipient jurisdiction or organisation ensures appropriate technical, administrative and security safeguards;
• Such transfer is permitted under applicable laws and regulations.

All transfers are conducted in compliance with applicable data protection and privacy laws to protect the rights and confidentiality of data subjects.

Data Sharing and Disclosure
We may share your personal data with certain parties only, when necessary, for legitimate purposes, and in accordance with applicable laws and regulations.

Your personal information may be shared with the following categories of parties for the abovementioned purpose on one or more of the lawful bases above:

• Partner Banks, Financial Institutions and Payment Networks: To process transactions such as bank transfers, utility bill payments, remittances, card transactions and related settlement activities.
• With Authorized Service Providers: To provide services that you have requested. Third-party service providers (e.g., vendors, etc.) engaged under strict confidentiality agreements and data protection obligations.

       Lawful basis: contractual necessity or legitimate interest.

• Government and Regulatory Authorities: To comply with applicable laws, regulations, or lawful requests, including regulatory reporting and audits.
• Courts or Tribunals: To respond to legal proceedings or defend legal claims. 

        Lawful basis: legal claims or defense.

• Partner Service Providers for Dispute Resolution: To investigate and resolve disputed transactions, chargebacks, fraud claims, or customer complaints. 

Safeguards: Data shared with any recipient is strictly limited to what is necessary for the stated purpose. All recipients are required to implement appropriate technical, administrative, and organizational measures to protect your personal data. For sensitive or restricted personal data, additional safeguards are applied in accordance with applicable laws and regulatory guidance.

Data Security
We take appropriate technical and organizational measures to keep your personal data secure, accurate, and confidential, and to protect it from loss, misuse, unauthorized access, disclosure, or alteration. These measures include:

• Encryption: We protect sensitive data using encryption
• Pseudonymization: We reduce identification risks (where appropriate) by using techniques like pseudonymization.
• Access Controls: We restrict access to personal data through role-based permissions and secure authentication.
• Maintenance & Updates: We regularly update and improve our security controls to address risks and vulnerabilities.
• Security Audits: We conduct periodic reviews and audits to identify and fix potential security gaps.
• Incident Management: We have procedures in place to quickly restore access to data in case of any physical or technical incident.
• Processor Accountability: Third-party service providers are required to follow strict data security standards and maintain equivalent levels of protection.

Your Rights
Subject to applicable laws, you have the following rights regarding your personal data:

• Right to Access: You can request access to your personal data and receive a copy in a clear and understandable format.
• Right to Rectification: You can ask us to correct any inaccurate or incomplete data.
• Right to Update: You can request updates to ensure your data remains accurate and up to date.
• Right to Erasure: You can request deletion of your data, subject to legal and regulatory requirements. 

Contact
You may exercise your data rights through our app, website, or by contacting [email protected]. You also have the right to lodge complaints with the relevant data protection authority if you believe your rights are not being upheld. If you have any queries or concerns about our privacy notice or data practices, please contact us at [email protected]. We are committed to protecting your data and resolving any concerns promptly.

Updates to This Notice

We may update this Privacy Notice to reflect changes in our practices or regulatory requirements.