Privacy & Data Protection Policy
Resnova Tech Limited ("Resnova", "we", "us") designs systems that institutions trust with consequential data. This Policy explains how we process personal data when you engage with us, and the rights you hold. It is drafted to meet the standards of the EU General Data Protection Regulation (GDPR), the OECD Privacy Guidelines, and applicable Bangladesh data-protection law, whichever affords the greater protection.
Data sovereignty
Client and citizen data is processed in-country by default — on the National Data Centre or your own cloud.
Encrypted lifecycle
AES-256 at rest, TLS 1.3 in transit, with key custody held by the operating institution.
Never sold
We do not sell, rent, or trade personal data, and we serve no third-party advertising.
Data controller & scope
For personal data processed through our corporate website and business communications, Resnova Tech Limited acts as the data controller. For data processed within client deployments, Resnova generally acts as a data processor on documented instructions from the client (the controller), governed by a Data Processing Agreement (DPA) under GDPR Article 28.
This Policy applies to all individuals whose personal data we process, regardless of jurisdiction. Where local law (including the GDPR for EU/EEA data subjects) grants stronger rights, those rights prevail.
Definitions
- Personal data
- Any information relating to an identified or identifiable natural person (GDPR Art. 4(1)).
- Processing
- Any operation performed on personal data — collection, storage, use, disclosure, or erasure.
- Controller
- The party that determines the purposes and means of processing.
- Processor
- A party that processes data on behalf of, and on the instructions of, a controller.
- Special categories
- Sensitive data (health, biometrics, etc.) afforded heightened protection under GDPR Art. 9.
Categories of data we collect
We practise data minimisation: we collect only what is necessary for a specified purpose.
- Identity & contact data you submit — name, organisation, role, email, telephone, and the context of your enquiry.
- Technical data — IP address, device and browser type, collected via privacy-preserving, aggregated analytics.
- Security & audit logs — access records retained for integrity, incident response, and legal obligation.
Purposes & lawful bases of processing
We process personal data only where a lawful basis under GDPR Article 6 applies:
| Lawful basis | Purpose |
|---|---|
| Consent | Responding to enquiries, newsletter subscription, and optional communications — withdrawable at any time. |
| Contract | Performing services and pre-contractual steps you request. |
| Legal obligation | Meeting statutory, tax, and regulatory record-keeping duties. |
| Legitimate interests | Securing our systems and improving our services, balanced against your rights and freedoms. |
International data transfers
Resnova prefers in-country processing. Where a cross-border transfer is unavoidable, we rely on a recognised transfer mechanism — an adequacy decision, the European Commission’s Standard Contractual Clauses (SCCs), or equivalent safeguards — and we conduct a transfer-impact assessment where required.
Security of processing
We implement technical and organisational measures appropriate to the risk, aligned with ISO/IEC 27001 and SOC 2 control objectives (GDPR Art. 32):
- Encryption — AES-256 at rest, TLS 1.3 in transit; key custody with the operating institution.
- Access control — least-privilege, role-based access with multi-factor authentication.
- Resilience — backups, tested recovery, and continuity procedures.
- Assurance — logging, monitoring, and periodic penetration testing and review.
Data retention
We retain personal data only as long as necessary for the purpose collected or as required by law. Enquiry data is retained up to 24 months from last contact; security and audit logs per the governing contract or statutory minimum. On expiry, data is securely erased or irreversibly anonymised.
Your data-subject rights
Subject to applicable law, you may exercise the following rights (GDPR Arts. 15–22) free of charge:
- Access — obtain confirmation and a copy of your data.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion ("right to be forgotten") where grounds apply.
- Restriction & objection — limit or object to processing, including profiling.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — at any time, without affecting prior lawful processing.
We respond within 30 days (GDPR Art. 12(3)). You also have the right to lodge a complaint with your competent supervisory authority.
Contact & supervisory authority
Privacy enquiries and rights requests: [email protected]. Postal: Resnova Tech Limited, 3/1 Sky View Henolux Centre, Purana Paltan, Dhaka-1000, Bangladesh. We confirm receipt within two business days.