1. Who is responsible for your information?
The party responsible for your personal information depends on how you interact with DokanDao.
When DokanDao acts as the data controller
DokanDao determines how and why personal information is processed when we collect information for our own purposes. This includes information relating to:
- DokanDao business-account registration;
- Subscription management and billing;
- Platform security and fraud prevention;
- Service analytics and improvement;
- Customer support provided by DokanDao;
- DokanDao marketing and business communications;
- Compliance with legal and regulatory obligations.
For these activities, the responsible entity is:
When a merchant acts as the data controller
Businesses using DokanDao may collect and process information about their customers, employees, representatives, suppliers, and other individuals through their storefronts and business accounts.
For example, a merchant may use DokanDao to process:
- Customer orders;
- Delivery information;
- Customer communications;
- Product inquiries;
- Refunds and returns;
- Customer records;
- Marketing campaigns;
- Loyalty or repeat-customer programs.
In these circumstances, the merchant generally determines why and how the information is used. The merchant is responsible for its own privacy practices, and DokanDao processes the information on the merchant's behalf as a service provider or data processor.
Questions about a merchant's use of your information should normally be directed to that merchant. DokanDao may assist the merchant with a valid privacy request when appropriate.
2. Personal information we collect
The information we collect depends on your relationship with DokanDao and how you use the Services.
2.1 Business-account information
When a merchant, business owner, employee, administrator, or authorized representative creates or uses a DokanDao account, we may collect:
- Full name;
- Business name;
- Email address;
- Telephone number;
- Username and account identifiers;
- Password or authentication information;
- Profile photograph;
- Business address;
- Billing address;
- Tax, trade-license, or business-registration information;
- Role, permissions, and account-access information;
- Subscription and billing information;
- Communications with DokanDao;
- Preferences and account settings.
2.2 Customer and order information
When a person purchases from, communicates with, or otherwise interacts with a merchant using DokanDao, we or the merchant may collect:
- Full name;
- Email address;
- Telephone number;
- Billing and delivery addresses;
- Products viewed or purchased;
- Shopping-cart information;
- Order history;
- Order notes;
- Payment status and transaction references;
- Delivery and fulfilment information;
- Refund, return, and cancellation information;
- Customer-service communications;
- Marketing preferences;
- Device, browser, and activity information.
Merchants may decide to collect additional information through their storefronts. Their own privacy notices should explain any additional collection or use.
2.3 Payment information
Payments may be processed by third-party payment providers, banks, mobile-financial-service providers, or payment gateways.
Depending on the payment method, DokanDao may receive or store limited payment-related information, such as:
- Payment-provider name;
- Transaction identifier;
- Payment method;
- Payment status;
- Amount and currency;
- Billing details;
- Fraud-screening results;
- Partial or masked payment-account information.
DokanDao does not intend to store complete payment-card numbers or sensitive payment credentials unless expressly required to provide a particular service and appropriate security controls are implemented.
Payment providers process information under their own terms and privacy policies.
2.4 Delivery and fulfilment information
When merchants use delivery, courier, logistics, warehousing, or fulfilment integrations, we may process:
- Customer name;
- Telephone number;
- Delivery address;
- Order contents;
- Parcel weight or dimensions;
- Delivery instructions;
- Cash-on-delivery amount;
- Tracking number;
- Delivery status;
- Courier communications.
This information may be shared with the delivery provider selected by the merchant.
2.5 Information collected automatically
When you use the Services, we may automatically collect:
- Internet Protocol address;
- Browser type and version;
- Device type and operating system;
- Device identifiers;
- Language and time-zone settings;
- Referring and exit pages;
- Pages viewed;
- Features used;
- Links clicked;
- Login activity;
- Session information;
- Approximate location derived from an IP address;
- Error reports and diagnostic information;
- Performance and usage logs;
- Cookie and similar-technology identifiers.
2.6 Information from integrations and third parties
If a merchant connects DokanDao to another service, we may receive information from that service in accordance with the merchant's permissions and the third party's policies.
These services may include:
- Facebook and Instagram;
- WhatsApp or messaging services;
- Payment providers;
- Courier and fulfilment providers;
- Analytics platforms;
- Email and communications providers;
- Customer-relationship-management systems;
- Accounting or business-management software;
- Authentication providers;
- Advertising platforms.
Information received may include account identifiers, page or profile information, access tokens, permissions, product information, messages, campaign information, transaction information, or other data required to provide the integration.
2.7 Information processed through artificial-intelligence features
DokanDao may provide artificial-intelligence features that help merchants create content, manage products, analyze business information, respond to customers, or perform other tasks.
Depending on how these features are used, we may process:
- Prompts and instructions;
- Uploaded content;
- Product and catalog information;
- Storefront information;
- Customer-support content;
- Order or operational data;
- Generated responses;
- Feedback about generated content;
- Technical and usage information.
Merchants should not submit sensitive or unnecessary personal information to an artificial-intelligence feature unless the feature is expressly intended and authorized to process it.
3. How we use personal information
We may use personal information to:
Provide and operate the Services
- Create and maintain accounts;
- Host and operate storefronts;
- Process and manage orders;
- Support checkout and payment workflows;
- Manage products, collections, inventory, customers, and fulfilment;
- Enable communications between merchants and customers;
- Provide artificial-intelligence and automation features;
- Provide integrations requested by merchants;
- Authenticate users and manage permissions;
- Provide technical and customer support.
Maintain security and prevent abuse
- Detect and prevent fraud;
- Investigate suspicious activity;
- Protect accounts and transactions;
- Enforce access controls;
- Prevent unauthorized use;
- Detect malicious software or automated attacks;
- Maintain audit, security, and diagnostic logs;
- Protect the rights and safety of DokanDao, merchants, customers, and others.
Improve and develop DokanDao
- Analyze product usage and performance;
- Diagnose errors and service interruptions;
- Develop new features;
- Improve user experience;
- Test and evaluate platform functionality;
- Generate aggregated or de-identified analytics;
- Understand how merchants and customers use the Services.
We will not use merchant customer data to train generalized artificial-intelligence models unless we clearly disclose that use and obtain any consent or authorization required by applicable law and our agreement with the merchant.
Communicate with users
- Send service announcements;
- Provide security notifications;
- Confirm transactions or account activity;
- Respond to support requests;
- Send billing and subscription communications;
- Provide information about product updates;
- Send marketing communications where permitted;
- Conduct surveys or request feedback.
Comply with legal obligations
- Maintain legally required business records;
- Respond to valid legal requests;
- Enforce our agreements;
- Resolve disputes;
- Prevent illegal activity;
- Satisfy tax, accounting, regulatory, or reporting obligations;
- Establish, exercise, or defend legal claims.
4. Legal grounds for processing
Where applicable law requires a legal basis, we process personal information on one or more of the following grounds:
- Contract: Processing is necessary to provide the Services or perform an agreement with you.
- Consent: You have given permission for a specific activity.
- Legal obligation: Processing is necessary to comply with applicable law.
- Legitimate interests: Processing is reasonably necessary for operating, securing, improving, or protecting DokanDao, provided those interests are not overridden by your rights.
- Protection of vital interests: Processing is necessary to protect a person's life or physical safety.
- Legal claims and public interest: Processing is necessary for legal proceedings or another recognized public-interest purpose.
Where DokanDao processes personal information on behalf of a merchant, the merchant is responsible for identifying an appropriate legal basis.
5. How we share personal information
We may share personal information in the following circumstances.
Merchants and authorized users
Customer and order information may be shared with the merchant from whom the customer is purchasing and with authorized members of that merchant's organization.
Service providers
We may use companies that provide services such as:
- Cloud hosting and data storage;
- Database infrastructure;
- Content delivery;
- Authentication;
- Cybersecurity and fraud detection;
- Payment processing;
- Delivery and fulfilment;
- Email, SMS, and other communications;
- Customer support;
- Analytics;
- Error monitoring;
- Artificial-intelligence processing;
- Accounting, auditing, legal, and professional services.
These providers may process information only as necessary to provide services to DokanDao, subject to contractual, confidentiality, and security obligations where appropriate.
Integrations selected by merchants
When a merchant activates an integration, information may be transmitted to the selected provider. The merchant is responsible for evaluating and authorizing its chosen integrations.
Business transfers
Personal information may be disclosed in connection with a merger, acquisition, financing, restructuring, sale of assets, insolvency, or transfer of all or part of our business.
Where appropriate, we will require the recipient to use the information consistently with this Privacy Policy and applicable law.
Legal and safety purposes
We may disclose information when we reasonably believe disclosure is necessary to:
- Comply with a law, regulation, court order, or valid government request;
- Enforce our contracts and policies;
- Investigate fraud, security incidents, or illegal activity;
- Protect the rights, property, or safety of DokanDao or another person;
- Establish, exercise, or defend legal claims.
With your direction or consent
We may share information when you direct us to do so or give us permission.
6. Sale and targeted advertising
DokanDao does not sell personal information for monetary payment.
We may use advertising, analytics, social-media, or marketing technologies that could be classified as “sharing,” targeted advertising, or a sale under certain privacy laws.
Where required, we will provide an appropriate method for users to opt out of such processing.
Merchants may conduct their own advertising and marketing activities using information collected through their storefronts. Those activities are governed by the merchant's privacy practices and applicable law.
7. Cookies and similar technologies
DokanDao and its service providers may use cookies, pixels, software-development kits, local storage, and similar technologies.
These technologies may be used to:
- Keep users signed in;
- Remember preferences;
- Operate shopping carts and checkout;
- Protect accounts;
- Prevent fraud;
- Measure performance;
- Diagnose technical issues;
- Analyze use of the Services;
- Understand marketing effectiveness;
- Personalize content or advertising where permitted.
Some cookies are necessary for the Services to function. Where required by law, we will request consent before placing non-essential cookies.
You may be able to manage cookies through our consent-management tool or your browser settings. Blocking certain cookies may prevent parts of the Services from working properly.
Additional details may be provided in a separate Cookie Policy.
8. Marketing communications
We may send marketing communications when permitted by law.
You may unsubscribe from marketing emails by using the unsubscribe link included in the message or by contacting us at privacy@dokandao.com.
Even after opting out of marketing, you may continue to receive non-promotional communications, such as:
- Security alerts;
- Account notifications;
- Transaction confirmations;
- Billing notices;
- Service announcements;
- Responses to support requests.
Merchants are responsible for ensuring that their own marketing communications comply with applicable consent, notice, and opt-out requirements.
9. Data retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.
Retention periods depend on factors including:
- The duration of an account or customer relationship;
- The nature and sensitivity of the information;
- The purposes for which the information was collected;
- Contractual commitments;
- Security and fraud-prevention requirements;
- Backup and disaster-recovery processes;
- Tax, accounting, and legal requirements;
- Applicable limitation periods;
- Pending or anticipated disputes.
When information is no longer required, we may delete, anonymize, aggregate, or securely isolate it.
Information deleted from active systems may remain temporarily in encrypted backups until those backups are overwritten or expire under our retention schedule.
When a merchant deletes its DokanDao account, merchant-controlled customer data will be handled according to the merchant's instructions, the merchant agreement, our retention schedule, and applicable law.
10. International data transfers
DokanDao and its service providers may process or store personal information in Bangladesh and other countries.
Those countries may have privacy laws that differ from the laws of your location.
Where required, we use appropriate safeguards for international transfers, which may include:
- Contractual data-protection clauses;
- Data-processing agreements;
- Access restrictions;
- Encryption and security controls;
- Transfer-risk assessments;
- Other legally recognized safeguards.
Information may also be transferred when necessary to perform a contract, comply with law, protect important interests, or with your consent where applicable.
11. Security
We use administrative, technical, and organizational measures designed to protect personal information.
Depending on the nature of the information and Services, these measures may include:
- Encryption in transit;
- Encryption at rest where appropriate;
- Authentication and access controls;
- Role-based permissions;
- Network and infrastructure protections;
- Logging and monitoring;
- Vulnerability management;
- Backup and recovery procedures;
- Employee and contractor confidentiality requirements;
- Incident-response procedures;
- Reviews of service providers;
- Separation of merchant data through logical access controls.
No system can be guaranteed to be completely secure. Users are responsible for protecting their passwords, authentication credentials, devices, and account access.
Please contact us immediately at support@dokandao.com if you believe an account or personal information has been compromised.
12. Your privacy rights
Depending on applicable law and the circumstances, you may have the right to:
- Confirm whether your personal information is being processed;
- Access personal information held about you;
- Correct inaccurate or incomplete information;
- Request deletion of your information;
- Withdraw consent;
- Object to certain processing;
- Restrict certain processing;
- Request a portable copy of certain information;
- Opt out of direct marketing;
- Opt out of certain targeted advertising, sharing, or sales;
- Request information about recipients of your data;
- Challenge certain decisions based solely on automated processing;
- Submit a complaint to an appropriate authority;
- Receive equal service without unlawful discrimination for exercising a privacy right.
These rights are not absolute. A request may be denied or limited where an exception applies, such as when information must be retained for security, legal compliance, fraud prevention, contractual obligations, or legal claims.
How to submit a request
You may submit a request by:
- Emailing privacy@dokandao.com; or
- Emailing us with the subject line Data Deletion Request or Privacy Request, including your name, account email, business or storefront name, and a description of the request.
Please describe your request and identify the account, storefront, order, or interaction involved.
We may need to verify your identity before completing a request. We will only request information reasonably necessary for verification.
Requests involving a merchant
When DokanDao processes information on behalf of a merchant, we may direct your request to the relevant merchant or ask the merchant to authorize the requested action.
For example, a customer seeking deletion of information associated with a particular storefront may need to contact that merchant because the merchant controls the customer relationship and may have independent legal obligations to retain order records.
13. Account and data deletion
Business-account owners may request account deletion through:
- The account settings available in the Services;
- An email to privacy@dokandao.com with the subject line Data Deletion Request;
- Disconnecting connected social media accounts from account settings, where supported.
Before deleting an account, we may require:
- Identity verification;
- Confirmation from an authorized account owner;
- Payment of outstanding balances;
- Resolution of active disputes or security issues;
- Export or transfer of merchant data;
- Completion of legal retention obligations.
Deleting an account may permanently remove storefronts, products, customer records, configurations, and other business information. Merchants should export any information they are legally required to retain before requesting deletion.
For Facebook, Instagram, WhatsApp, or other Meta-related data, include the connected page or account details in your deletion request. After verification, DokanDao will remove stored access tokens and stop accessing connected Meta data unless you reconnect the account.
14. Automated decision-making
DokanDao may use automated tools to support activities such as:
- Fraud detection;
- Spam and abuse prevention;
- Security-risk identification;
- Product or content recommendations;
- Business analytics;
- Customer-support assistance;
- Artificial-intelligence-generated content.
Unless clearly disclosed, DokanDao does not intend to make decisions producing significant legal or similarly substantial effects solely through automated processing without appropriate human involvement.
Where applicable law provides a right to challenge such a decision, you may contact us at privacy@dokandao.com.
15. Children's privacy
The Services are intended for businesses and individuals legally capable of entering into binding transactions.
DokanDao is not directed to children under the minimum age permitted by applicable law, and we do not knowingly collect personal information directly from children for account-registration or targeted-advertising purposes.
Merchants must not use DokanDao to unlawfully collect, profile, advertise to, or otherwise process children's personal information.
If you believe a child has provided personal information improperly, contact us at privacy@dokandao.com. We will investigate and take appropriate action.
16. Merchant responsibilities
Merchants using DokanDao are responsible for:
- Providing their customers with an accurate privacy notice;
- Collecting personal information lawfully;
- Obtaining any necessary consent;
- Using customer information only for disclosed and permitted purposes;
- Configuring account permissions appropriately;
- Protecting account credentials;
- Responding to customer privacy requests;
- Complying with marketing and communications laws;
- Evaluating third-party integrations;
- Retaining or deleting business records as required;
- Informing DokanDao of any suspected compromise affecting the Services.
DokanDao's Privacy Policy does not replace a merchant's own privacy policy.
17. Third-party websites and services
The Services may contain links to websites, applications, payment services, social networks, courier services, or other services operated by third parties.
DokanDao does not control the privacy or security practices of those third parties. Their own terms and privacy policies govern their processing activities.
Users should review those policies before providing information to a third party.
18. Changes to this Privacy Policy
We may update this Privacy Policy to reflect:
- Changes to our Services;
- New features or integrations;
- Changes in our data-processing practices;
- Security developments;
- Legal or regulatory requirements;
- Organizational changes.
When we make changes, we will update the “Last updated” date.
If a change materially affects how we use personal information, we may provide additional notice through the Services, by email, or through another appropriate channel.
Your continued use of the Services after the effective date of an updated Privacy Policy constitutes acknowledgement of the updated policy, but it does not replace consent where consent is legally required.
19. Complaints
Please contact us first if you have a concern about our privacy practices. We will review the concern and attempt to resolve it appropriately.
You may also have the right to complain to the relevant data-protection, consumer-protection, or regulatory authority in your jurisdiction.
20. Contact us
For questions, privacy requests, complaints, or concerns about this Privacy Policy, contact:
DokanDao
Doing business as DokanDao
Registered address: Dhaka, Bangladesh
Email: privacy@dokandao.com
Security reports: support@dokandao.com
Website: https://dokandao.com