Our commitment to safeguarding your personal data, privacy rights, and transaction security.
Effective Date: August 29, 2026
Last Updated: August 29, 2026
At NestaMart BD (“NestaMart”, “we”, “our”, or “us”), we respect your privacy and are committed to protecting the personal information entrusted to us.
This Privacy Policy explains how we collect, use, store, disclose, retain, and protect personal information when you visit or use https://www.nestamartbd.com (the “Website”), create an account, place an order, contact us, use our customer support features, subscribe to communications, or otherwise interact with our services.
This Policy is intended to provide transparent information about our data practices and is designed with applicable laws and regulations of Bangladesh in mind, including the Personal Data Protection Act, 2026, the Consumer Rights Protection Act, 2009, the Digital Commerce Operation Guidelines, 2021, and other applicable laws, regulations, and regulatory requirements.
> Important: This Privacy Policy describes NestaMart's current data practices. We may update it when our services, technology, vendors, or applicable legal requirements change.
---
NestaMart BD operates the e-commerce website https://www.nestamartbd.com.
For privacy-related questions, requests, corrections, or complaints, please contact:
Privacy & Customer Support
Email: [support@nestamartbd.com](mailto:support@nestamartbd.com)
Website: https://www.nestamartbd.com
---
We collect only information that is reasonably necessary for operating our store, providing customer services, processing orders, maintaining security, improving our services, and meeting legal or operational obligations.
When you create a NestaMart account, we may collect:
If you use Google Sign-In, authentication may involve receiving basic account information provided through Google, such as your name and email address.
We do not receive or store your Google password.
---
NestaMart supports guest checkout. You may place an order without creating a permanent customer account.
For a guest order, we may collect:
Guest checkout information may still be retained as part of the order record or for security, accounting, dispute resolution, fraud prevention, and legal purposes even when no customer account exists.
---
When you place an order, we collect information necessary to fulfill the purchase, including:
This information enables us to process, package, dispatch, deliver, support, and maintain records of your order.
---
NestaMart may support Cash on Delivery and advance payment methods, including manual bKash payment workflows.
Where you submit a bKash payment for an order, we may process information such as:
We do not ask you to provide your bKash PIN, password, or security credentials to NestaMart.
Unless explicitly stated otherwise at checkout, NestaMart does not directly store full payment-card numbers, CVV/security codes, or banking passwords.
---
When you submit a product review or other customer-generated content, we may collect:
Reviews may be publicly displayed on relevant product pages after moderation.
Please do not include sensitive personal information, passwords, financial credentials, government identification numbers, or other confidential information in publicly visible reviews.
---
If you subscribe to our newsletter or promotional communications, we may collect:
You can unsubscribe from promotional email communications using the unsubscribe mechanism included in those communications.
Transactional communications relating to your orders, account security, authentication, payments, or service requests are not considered optional marketing communications.
---
When you contact us through customer support, contact forms, email, WhatsApp, or other available support channels, we may collect information necessary to respond to you, including:
We use this information to investigate issues, provide support, resolve disputes, and improve our customer service.
---
When you use the Website, certain technical and usage information may be collected automatically.
This may include:
NestaMart currently operates a first-party analytics system that records events such as page views, product views, add-to-cart actions, wishlist interactions, checkout steps, purchases, cancellations, and related events.
---
NestaMart may use cookies, browser storage, session identifiers, and similar technologies to provide essential website functionality and improve security and user experience.
These technologies may be used for purposes such as:
Some cookies or browser identifiers may be necessary for the Website to function correctly.
Where applicable, non-essential technologies may be controlled through available browser or website settings.
---
For security, analytics, and guest-checkout protection, NestaMart may assign identifiers to visitors who are not logged into an account.
These may include:
Guest checkout security systems may also associate activity using normalized phone information, IP information, device identifiers, or other security signals.
Our guest-order security records are designed to expire automatically after a limited period and currently use a 24-hour TTL retention period for the dedicated guest order-history records.
These mechanisms are primarily intended to prevent automated abuse, repeated fraudulent orders, spam, and attempts to circumvent checkout security.
---
To protect customers, couriers, and NestaMart from fraudulent or abusive activity, we may process information for fraud-prevention and security purposes.
Depending on the circumstances, this may include:
We may normalize certain identifiers, such as phone numbers, email addresses, and delivery addresses, so that substantially identical information can be recognized consistently for security purposes.
NestaMart may generate an internal fraud/risk score based on multiple signals.
This score may be used to determine whether an order can proceed using standard Cash on Delivery or whether additional payment verification, advance payment, or manual review may be required.
For example, higher-risk transactions may result in:
The purpose of this processing is to prevent fraudulent orders, courier losses, payment abuse, account abuse, and automated attacks.
Our fraud architecture distinguishes between risk assessment and payment-policy enforcement and stores relevant order-time security snapshots for operational and audit purposes.
Where legally applicable, you may contact us to request clarification or review regarding a decision that materially affects your transaction.
---
We may use personal information for the following purposes:
Where permitted and where appropriate authorization or consent is required, we may use information to:
We may process information when necessary to:
---
Depending on the nature of the information and the purpose of processing, NestaMart may process personal information on one or more legally permitted grounds, including:
Where processing depends on consent, you may withdraw that consent subject to applicable legal or operational limitations.
Withdrawal of consent does not necessarily affect processing that was lawfully carried out before withdrawal.
---
NestaMart may provide an AI-powered customer assistance feature to help users with questions relating to the Website, products, orders, delivery, and customer support.
Depending on the feature being used, information provided during an AI interaction may include:
AI conversations may be stored for service continuity, troubleshooting, customer support, security auditing, quality improvement, and system optimization.
The customer and administrative AI channels are architecturally separated so that customer-facing AI functionality is not intended to provide customers access to administrative information or administrative operations.
You should not provide passwords, OTPs, payment PINs, authentication secrets, or other highly confidential credentials to an AI assistant.
---
Depending on NestaMart's currently configured infrastructure, AI requests may be processed using one or more configured AI providers or locally hosted AI infrastructure.
Where a third-party AI provider is used, relevant information may be transmitted to that provider only to the extent reasonably necessary to provide the requested AI functionality.
NestaMart may change AI infrastructure or providers as the service evolves. Where such changes materially affect privacy practices, this Privacy Policy may be updated.
---
NestaMart uses first-party analytics to understand how customers interact with the Website.
Our analytics system may record:
Raw first-party analytics events are currently configured to automatically expire after 60 days.
Aggregated or derived business intelligence may be retained for longer where necessary for business analysis, security, accounting, or operational purposes.
---
Search queries may be recorded to understand what customers are looking for and to identify product or catalog gaps.
This may include:
Raw search-demand records are currently configured to automatically expire after 90 days.
---
To operate the store, NestaMart may send transactional communications through approved service providers, including:
These communications may include:
Transactional communications may be necessary to complete or administer your requested service and therefore may continue even if you unsubscribe from marketing communications.
---
To deliver your purchases, we may share relevant information with courier and logistics providers.
Depending on the delivery method, this may include:
NestaMart's current architecture supports courier integrations including SteadFast and Pathao for order dispatch and delivery-status synchronization.
Courier companies may process information according to their own privacy policies and applicable laws.
---
We may use trusted third-party service providers to operate parts of our business infrastructure.
These may include providers supporting:
Our current application architecture includes services such as MongoDB Atlas, Cloudinary, Resend, BulkSMSBD, Telegram Bot API, courier APIs, Google authentication, and Meta server-side measurement infrastructure.
We expect service providers to process information only for legitimate operational purposes relevant to the services they provide and subject to applicable contractual, security, and legal requirements.
---
For internal order-management purposes, certain order information may be transmitted through NestaMart's authorized Telegram notification channel.
This may be used to alert authorized staff about new orders and operational events.
These notifications are intended for internal business operations and are not intended to be publicly accessible.
---
NestaMart may use server-side or other marketing measurement technologies to understand the effectiveness of advertising campaigns and customer acquisition.
Where applicable, information may be shared with advertising or measurement platforms in accordance with their applicable policies and the configuration of our systems.
We do not sell your personal information to advertising companies.
We also do not intentionally use personal information to create targeted advertising directed specifically at children.
---
We may disclose personal information to the following categories of recipients where reasonably necessary:
| Recipient Category | Typical Purpose |
| ----------------------------------------- | --------------------------------------------------- |
| Courier providers | Delivery and tracking |
| Email providers | Transactional and promotional email |
| SMS providers | OTP and order notifications |
| Payment providers | Payment processing or verification |
| Hosting/database providers | Secure infrastructure and storage |
| AI providers | AI customer-support functionality |
| Analytics/measurement providers | Business and campaign measurement |
| Customer support providers | Support and issue resolution |
| Security/fraud services | Fraud prevention and abuse protection |
| Government or law-enforcement authorities | Where legally required or authorized |
| Professional advisers | Legal, accounting, compliance, or business purposes |
We do not sell personal information as a commercial product.
---
Some technology or service providers used by NestaMart may process information outside Bangladesh or in jurisdictions different from where you reside.
Where personal information is transferred internationally, we intend to apply reasonable contractual, technical, organizational, and legal safeguards appropriate to the nature of the information and applicable requirements.
Certain categories of personal information may be subject to additional requirements concerning cross-border transfer or storage under applicable law.
---
We retain information only for as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining business and financial records, preventing fraud, resolving disputes, enforcing agreements, and complying with legal obligations.
Some current retention controls include:
| Data Type | Current Retention Approach |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- |
| Guest security/order-attempt records | Automatically expire after approximately 24 hours |
| Raw first-party analytics events | Automatically expire after 60 days |
| Raw search-demand logs | Automatically expire after 90 days |
| Customer account information | Retained while the account remains active and as otherwise necessary for legitimate/legal purposes |
| Order and transaction records | Retained as reasonably necessary for fulfillment, accounting, disputes, fraud prevention, legal, and operational purposes |
| Support and AI conversations | Retained as reasonably necessary for service, support, security, quality, and operational purposes |
Deletion or expiration of a particular record does not necessarily remove information that must be retained separately for legal, accounting, security, fraud-prevention, or dispute-resolution purposes.
---
We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, misuse, and destruction.
Our security architecture includes measures such as:
NestaMart's security architecture also maintains audit records of significant administrative/security events and incorporates Cloudflare edge security and WAF controls.
However, no internet-based system can be guaranteed to be completely secure.
---
If we become aware of a security incident involving personal information, we will assess the incident and take reasonable steps to contain, investigate, remediate, and address it in accordance with applicable law and regulatory requirements.
Where notification is legally required, we will provide notifications through appropriate channels and within the timeframe required by applicable law or regulatory direction.
---
Subject to applicable law and any lawful exceptions, you may have rights regarding your personal information, including rights to:
The Personal Data Protection Act, 2026 establishes data-subject rights including mechanisms relating to access and portability and provides a broader framework for transparency, retention, security, and data processing.
---
To submit a privacy-related request, contact:
Email: [support@nestamartbd.com](mailto:support@nestamartbd.com)
Please include:
For security reasons, we may need to verify your identity before fulfilling certain requests.
We may deny or limit a request where permitted or required by applicable law, including where fulfilling the request could compromise fraud-prevention systems, security, another person's rights, legal obligations, or necessary business records.
---
NestaMart is an e-commerce service intended for adults and other legally capable customers purchasing products, including products intended for babies and children.
The fact that products are designed for children does not mean that the Website is directed at children.
We do not knowingly request children to create customer accounts or provide personal information independently.
Where personal information relating to a child is required for a transaction or service, we expect it to be provided by a parent, legal guardian, or other person legally authorized to do so, where required by applicable law.
The Personal Data Protection Act, 2026 includes specific protections concerning the processing of children's personal data and parental or lawful-representative consent.
If you believe that a child has provided personal information to us inappropriately, please contact us so that we can review the situation and take appropriate action.
---
Where technically and legally possible, you may request deletion of your NestaMart account.
Deleting an account does not necessarily require us to delete all historical information immediately.
Certain information may need to be retained for:
Where retention is no longer required, relevant personal information may be deleted, anonymized, or otherwise de-identified.
---
You may choose not to receive promotional communications from us by:
Unsubscribing from promotional communications will not necessarily stop necessary transactional communications relating to your account or orders.
---
The Website may contain links or integrations to third-party websites, applications, social-media platforms, payment services, courier portals, or other external services.
This Privacy Policy applies to NestaMart's own services and does not govern the privacy practices of independent third parties.
You should review the relevant third party's privacy policy before providing personal information directly to them.
---
When you interact with NestaMart through publicly accessible social-media platforms, comments, reviews, or other public channels, information you choose to publish may be visible to other users.
Do not post sensitive personal information in public comments or reviews.
---
If NestaMart is involved in a merger, acquisition, restructuring, sale of assets, investment transaction, or similar business transaction, personal information may be transferred as part of the relevant business assets, subject to applicable law and appropriate privacy protections.
---
We may update this Privacy Policy from time to time to reflect:
When we make material changes, we may update the “Last Updated” date and, where appropriate, provide additional notice through the website or another reasonable communication channel.
---
This Privacy Policy shall be interpreted in accordance with the applicable laws and regulations of the People's Republic of Bangladesh, subject to any mandatory rights or protections that may apply to you under applicable law.
---
If you have any questions, concerns, complaints, or requests concerning this Privacy Policy or the processing of your personal information, please contact:
NestaMart BD
Privacy & Customer Support
Email: [support@nestamartbd.com](mailto:support@nestamartbd.com)
Website: https://www.nestamartbd.com
We encourage customers to contact us first so that we can investigate and address privacy concerns appropriately.
---
For convenience, the key principles of this Privacy Policy are:
> We collect information to operate our store, fulfill orders, provide support, maintain security, prevent fraud, and improve our services.
> We do not sell your personal information.
> We use security, fraud-prevention, and analytics technologies to protect and improve the NestaMart experience.
> Some information may be shared with service providers such as couriers, email/SMS providers, payment services, hosting providers, analytics services, and AI infrastructure when necessary to provide our services.
> You may have rights to access, correct, delete, restrict, or otherwise control your personal information, subject to applicable law.
> You can contact us at [support@nestamartbd.com](mailto:support@nestamartbd.com) for privacy-related requests or concerns.
---
© 2026 NestaMart BD. All rights reserved.
Our dedicated baby care team is available 24/7 on WhatsApp for instant assistance.