Privacy Policy & Data Protection Notice

1. Preamble & Legal Framework

Aara Technologies Limited ("Company", "we", "our", or "us"), operating the domain https://aara-tech.com and its client portal my.aara-tech.com, is committed to safeguarding the digital privacy, data integrity, and personal information of our clients, website visitors, and software users.

This Privacy Policy is drafted in strict compliance with applicable laws of the People's Republic of Bangladesh, including but not limited to:

• Information and Communication Technology (ICT) Act, 2006 (as amended in 2013);
• Cyber Security Act, 2023 (and legacy Digital Security Act provisions);
• Bangladesh Telecommunication Regulatory Commission (BTRC) directives on Domain Registration & IP Allocation;
• International Data Protection Best Practices (GDPR & ISO 27001 Security Standards).

2. Data Controller & Entity Details

For the purposes of applicable data protection legislation, the Data Controller responsible for your personal information is:

3. Categories of Information We Collect

Depending on your interaction with our services (BDIX Web Hosting, Custom Web Design, Hospital ERP Software, POS Systems, and Digital Marketing), we collect the following categories of data:

A. Personal Identification Data

Name, designation, organization name, national identity card (NID) or passport copy (required for official BTCL .com.bd domain registration under BTRC regulations), billing address, phone number, and email address.

B. Technical & Infrastructure Logs

IP addresses, browser type, device metadata, cPanel access logs, server bandwidth metrics, SSL certificate request records, and firewall protection logs (Cloudflare Enterprise WAF).

C. Billing & Payment Information

Transaction reference IDs, mobile financial service account details (bKash, Nagad, Rocket), bank payment receipts, and SSLCommerz payment tokenization data. Note: We do NOT store full credit/debit card numbers on our local servers.

D. Hospital ERP & Software Client Data

For clients utilizing our Hospital Management ERP and POS Inventory Software, client-hosted databases remain strictly confidential property of the client. Patient diagnostic records, billing ledgers, and inventory data hosted on our isolated database servers are protected under AES-256 encryption.

4. Purpose & Legal Basis for Processing Data

We process your personal data under the following legitimate legal bases:

• Contractual Performance: To provision web hosting servers, issue domain registration files, configure software licensing, and deliver customer support.
• Legal Obligation: To comply with BTRC regulations, anti-cybercrime directives under Bangladesh law, and tax reporting requirements under NBR guidelines.
• Security Integrity: To prevent Distributed Denial of Service (DDoS) attacks, brute-force intrusions, phishing, and unlawful server exploitation.

5. Data Security, Encryption & Storage Infrastructure

We enforce enterprise-grade administrative, technical, and physical security measures:

• Data Encryption: All data transmitted between your browser and our servers is encrypted via TLS 1.3 (256-bit SSL). Database backups are encrypted at rest using AES-256.
• Datacenter Security: Hosted on Tier-IV BDIX local infrastructure and Singapore NVMe server nodes with 24/7 biometric physical access security and automated RAID-10 storage redundancy.
• Access Controls: Multi-factor authentication (MFA) and strict role-based access control (RBAC) enforced across engineering environments.

6. Strict Non-Disclosure & Law Enforcement Disclosure

Aara Technologies Limited operates under a strict Zero-Sale Policy: We NEVER sell, rent, trade, or commercialize your personal data or software database contents to third-party advertisers.

Data will only be disclosed to third parties under the following conditions:

• Authorized Infrastructure Partners: Domain Registrars (ICANN / BTCL) and MFS Payment Gateways (bKash/Nagad/SSLCommerz) solely for transaction fulfillment.
• Lawful Court Orders: In response to formal judicial warrants or official directives issued by law enforcement agencies of the Government of Bangladesh under the Cyber Security Act, 2023.

7. Your Rights & Data Subject Requests

Under Bangladeshi law and global standards, you reserve the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate contact or billing information in our client portal.
• Erasure (Right to be Forgotten): Request deletion of your client account upon termination of hosting services, subject to statutory tax and legal retention requirements.

8. Contact Data Protection Officer (DPO)

For questions, data privacy inquiries, or legal concerns regarding this policy, please contact our dedicated Data Protection Officer: