{"id":3,"date":"2026-09-13T03:12:02","date_gmt":"2026-09-13T03:12:02","guid":{"rendered":"https:\/\/avas.org.bd\/?page_id=3"},"modified":"2026-09-13T14:08:41","modified_gmt":"2026-09-13T08:08:41","slug":"privacy-policy-data","status":"publish","type":"page","link":"https:\/\/avas.org.bd\/bn\/privacy-policy-data\/","title":{"rendered":"Privacy Policy (Data)"},"content":{"rendered":"\n

Privacy Policy<\/h2>\n\n\n\n

Privacy Policy for visitors to avas.org.bd<\/em><\/p>\n\n\n\n

Applies to<\/strong><\/td>avas.org.bd and any official AVAS sub-domains or web forms<\/td><\/tr>
Document status<\/strong><\/td>Draft for internal review and Executive Committee \/ Executive Director approval before publication<\/td><\/tr>
Version<\/strong><\/td>1.0 <\/td><\/tr>
Effective date<\/strong><\/td>01 July 2026<\/td><\/tr>
Next scheduled review<\/strong><\/td>30 June 2028<\/td><\/tr>
Policy owner<\/strong><\/td>Data Protection and Cyber Security Focal Person, in coordination with the Executive Director and Senior Management Team<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

1. Introduction<\/h3>\n\n\n\n

The Association of Voluntary Actions for Society (“AVAS”, “we”, “us”, “our”) is a women-founded, women-led, non-governmental, non-profit, rights-based and community-based organization established on 1 June 1998 and headquartered in Barishal, Bangladesh. AVAS is committed to protecting the privacy and personal data of everyone who interacts with us, including visitors to our website, partners, donors, job applicants and members of the public.<\/p>\n\n\n\n

This Website Privacy Policy explains what information AVAS collects through avas.org.bd, why we collect it, how we use, store, share and protect it, and what choices and rights you have. It does not replace or override AVAS’s internal data governance instruments, including the AVAS Digital Data Security Guideline (approved 6 September 2025), the AVAS Data Sharing Policy, and AVAS’s project-level Data Sharing Agreements and safeguarding, PSEA, and Complaint Response Mechanism (CRM) policies, which continue to govern how AVAS handles data collected through its programmes and field operations.<\/p>\n\n\n\n

[AVAS TO CONFIRM: Confirm the exact scope of the current website (e.g. static informational site, online donation page, newsletter sign-up, job application portal, volunteer registration, CRM\/complaints intake form) so that Sections 4\u20138 below can be finalized to match only the features that actually exist on avas.org.bd.]<\/em><\/p>\n\n\n\n

2. Who We Are<\/h3>\n\n\n\n
Legal \/ official name<\/strong><\/td>Association of Voluntary Actions for Society (AVAS)<\/td><\/tr>
Registered address<\/strong><\/td>AVAS Bhaban, Amirkutir Lane, Alekanda, Barishal-8200, Bangladesh<\/td><\/tr>
General email<\/strong><\/td>info@avas.org.bd<\/td><\/tr>
Website<\/strong><\/td>https:\/\/avas.org.bd<\/td><\/tr>
Data Protection and Cyber Security Focal Person<\/strong><\/td>Md. Zohurul Hasan Talukdar, Director Fundraising & Organization Development
(assignment effective 1 January 2026); contact details in Section 18<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

<\/p>\n\n\n\n

AVAS is registered with the Department of Social Services, the NGO Affairs Bureau, the Department of Women Affairs and the Department of Youth Development in Bangladesh. Registration numbers and validity dates are available on request.<\/p>\n\n\n\n

3. Scope of This Policy<\/h3>\n\n\n\n

This Policy applies to personal information collected through AVAS’s public website. It applies to:<\/p>\n\n\n\n

    \n
  • Visitors browsing avas.org.bd;<\/li>\n\n\n\n
  • Individuals who contact AVAS through a website contact form or listed email address;<\/li>\n\n\n\n
  • Individuals who subscribe to AVAS newsletters or updates, where such a feature exists;<\/li>\n\n\n\n
  • Donors who make or attempt to make an online donation through the website, where such a feature exists;<\/li>\n\n\n\n
  • Job or volunteer applicants who apply through the website;<\/li>\n\n\n\n
  • Partners, donors and researchers who request organizational information through the website.<\/li>\n<\/ul>\n\n\n\n

    This Policy does not cover how AVAS collects, uses or protects personal data of programme participants, beneficiaries or communities gathered through field-level assessments, surveys, case management, or safeguarding\/CRM processes. That data is governed by AVAS’s internal Digital Data Security Guideline, Data Sharing Policy, project-specific Data Sharing Agreements (e.g. with donors, consortium partners such as COAST Foundation, or Start Fund Bangladesh), and relevant safeguarding instruments, which apply a stricter, need-based and consent-based standard of protection.<\/p>\n\n\n\n

    4. Information We Collect<\/h3>\n\n\n\n

    4.1 Information you provide directly<\/h4>\n\n\n\n

    Depending on which features of the website you use, we may collect:<\/p>\n\n\n\n

      \n
    • Your name, email address, phone number and message content, when you use a contact form or email AVAS directly;<\/li>\n\n\n\n
    • Your name, contact details, CV\/resume and application materials, if you apply for a job, internship or volunteer opportunity through the website;<\/li>\n\n\n\n
    • Your name, contact and payment-related details, if you make an online donation (payment card details are processed by our payment processor and are not stored by AVAS itself \u2014 see Section 8);<\/li>\n\n\n\n
    • Your email address, if you subscribe to a newsletter or mailing list;<\/li>\n\n\n\n
    • Any other information you choose to submit through a web form, such as an information request, partnership inquiry, or feedback\/complaint.<\/li>\n<\/ul>\n\n\n\n

      4.2 Information collected automatically<\/h4>\n\n\n\n

      Like most websites, avas.org.bd may automatically collect limited technical information when you visit, such as your IP address, browser type, device type, pages visited, and the date and time of your visit. This information is typically collected through cookies or similar technologies (see Section 7) and is used in aggregate form to understand website usage and improve our services.<\/p>\n\n\n\n

      [AVAS TO CONFIRM: Confirm whether the website currently uses any analytics tool (e.g. Google Analytics), advertising\/marketing pixels, or a cookie-consent banner, so this sub-section and Section 7 can name the actual tool(s) in use, or state clearly that no such tool is currently deployed.]<\/em><\/p>\n\n\n\n

      4.3 Sensitive personal information<\/h4>\n\n\n\n

      AVAS does not seek to collect sensitive personal information (such as health status, religious or political affiliation, or safeguarding-related disclosures) through the general website. If you choose to disclose sensitive information \u2014 for example, in a complaint, feedback message, or job application \u2014 AVAS will treat it as “Sensitive Data” under the AVAS Digital Data Security Guideline and will handle it under strict need-based access controls, and, where it relates to a safeguarding or protection concern, under AVAS’s Safeguarding, PSEA and Complaint Response Mechanism procedures rather than routine website administration.<\/p>\n\n\n\n

      5. How We Use Your Information<\/h3>\n\n\n\n

      AVAS uses the information described in Section 4 only for the purpose for which it was provided, including to:<\/p>\n\n\n\n

        \n
      • Respond to your inquiries, requests for information, or complaints;<\/li>\n\n\n\n
      • Process and administer job, internship or volunteer applications;<\/li>\n\n\n\n
      • Process donations and issue donation acknowledgements or receipts, where applicable;<\/li>\n\n\n\n
      • Send newsletters or programme updates to subscribers who have opted in;<\/li>\n\n\n\n
      • Maintain the security, functionality and performance of the website;<\/li>\n\n\n\n
      • Meet legal, donor-compliance, audit and reporting obligations;<\/li>\n\n\n\n
      • Support due-diligence and organizational transparency processes with partners and donors.<\/li>\n<\/ul>\n\n\n\n

        AVAS does not use website visitor information for automated decision-making that produces legal or similarly significant effects on individuals, and does not sell personal information to any third party.<\/p>\n\n\n\n

        6. Legal Basis for Processing<\/h3>\n\n\n\n

        AVAS processes personal information collected through the website on one or more of the following bases:<\/p>\n\n\n\n

          \n
        • Your consent, for example when you voluntarily submit a contact form, subscribe to a newsletter, or apply for a role;<\/li>\n\n\n\n
        • The legitimate interests of AVAS in operating an accountable, secure and functional website and in maintaining relationships with donors, partners and applicants;<\/li>\n\n\n\n
        • Compliance with a legal obligation, for example under the Bangladesh Digital Security Act 2018, the Right to Information Act 2009, or a lawful request from a competent authority;<\/li>\n\n\n\n
        • Performance of a contract, for example where information is needed to process a donation, employment application, or partnership agreement.<\/li>\n<\/ul>\n\n\n\n

          Where AVAS processes personal data of individuals located in the European Union or other jurisdictions with comparable data protection frameworks (for example, certain donors or partners), AVAS applies the relevant principles of the EU General Data Protection Regulation (GDPR) so far as they are applicable to that specific relationship, consistent with AVAS’s Data Sharing Policy.<\/p>\n\n\n\n

          7. Cookies and Similar Technologies<\/h3>\n\n\n\n

          Cookies are small text files placed on your device to help a website function and to collect usage statistics. AVAS’s website may use:<\/p>\n\n\n\n

            \n
          • Strictly necessary cookies, required for the website to operate correctly;<\/li>\n\n\n\n
          • Analytics\/performance cookies, used to understand how visitors use the site, in aggregated and anonymized form where possible.<\/li>\n<\/ul>\n\n\n\n

            You can control or disable cookies through your browser settings. Disabling cookies may affect some website functionality.<\/p>\n\n\n\n

            [AVAS TO CONFIRM: Confirm the specific categories and names of cookies actually set by avas.org.bd (and by any embedded third-party content, e.g. YouTube videos, social media plug-ins, donation widgets) so that this section can list them precisely, and confirm whether a cookie-consent banner should be added to the website to accompany this Policy.]<\/em><\/p>\n\n\n\n

            8. How We Share Your Information<\/h3>\n\n\n\n

            AVAS treats personal information collected via the website as internal or sensitive data under the AVAS Digital Data Security Guideline and does not share it beyond AVAS except in the following circumstances, consistent with the AVAS Data Sharing Policy:<\/p>\n\n\n\n

              \n
            • With AVAS staff, volunteers or consultants who need the information to perform their role, on a need-based access basis;<\/li>\n\n\n\n
            • With trusted service providers who process data on AVAS’s behalf under a written agreement (for example, a payment processor for online donations, an email or web-hosting provider), and only to the extent necessary to provide that service;<\/li>\n\n\n\n
            • With donors, government authorities, or oversight bodies where AVAS is legally or contractually required to report or disclose information, with documentation retained as required by the Data Sharing Policy;<\/li>\n\n\n\n
            • With named partner organizations under a signed Data Sharing Agreement (DSA), where information sharing is necessary for a specific, defined project purpose \u2014 following the same due-diligence and purpose-limitation approach AVAS has applied in prior DSAs, such as its agreement with COAST Foundation on behalf of Start Fund Bangladesh;<\/li>\n\n\n\n
            • Where you have given your informed consent for a specific disclosure.<\/li>\n<\/ul>\n\n\n\n

              AVAS does not sell, rent or trade personal information collected through the website to third parties for marketing purposes. Any sharing of sensitive or personal information beyond the categories above requires written management approval and, where applicable, a signed Data Sharing Agreement, in line with AVAS’s internal procedures.<\/p>\n\n\n\n

              [AVAS TO CONFIRM: Confirm the identity of any third-party processors currently used for the website (hosting provider, email service, payment gateway, form\/CRM tool) so each can be named, or generically described with an undertaking that a current list is available on request.]<\/em><\/p>\n\n\n\n

              9. International Data Transfers<\/h3>\n\n\n\n

              AVAS is based in Bangladesh and stores information primarily on servers designated for that purpose under the AVAS Digital Data Security Guideline. Where information is shared with an international donor, partner or service provider located outside Bangladesh, AVAS takes reasonable steps to ensure that such transfers are covered by an appropriate agreement (such as a Data Sharing Agreement) and are consistent with applicable data protection standards, including GDPR principles where relevant.<\/p>\n\n\n\n

              10. How We Protect Your Information<\/h3>\n\n\n\n

              AVAS protects information collected through the website in line with its organization-wide Digital Data Security Guideline (approved by the Executive Director, effective 6 September 2025), which applies to all permanent, temporary and contracted staff, volunteers, consultants and partners, and to all digital devices, software and databases used by AVAS. Key safeguards include:<\/p>\n\n\n\n

                \n
              • Data classification into General, Internal and Sensitive categories, with sensitive personal data (such as personal identity, financial, or complaint\/safeguarding-related information) subject to the strictest controls;<\/li>\n\n\n\n
              • Need-based access control \u2014 only authorized and responsible staff may access data, and access is revoked immediately on staff transfer or separation;<\/li>\n\n\n\n
              • A strict prohibition on sharing user IDs or passwords, and a requirement for strong passwords (minimum 8 characters, mixed case, numbers and symbols), changed regularly, never reused across platforms, with two-factor authentication used where possible;<\/li>\n\n\n\n
              • Device and hardware security \u2014 data may only be stored on AVAS-approved devices; laptops and mobile devices must be screen-locked and password-protected; lost or stolen devices must be reported immediately; use of unknown USB or external storage devices is prohibited;<\/li>\n\n\n\n
              • Use of only authorized, licensed software, with regular updates and security patches, and a prohibition on downloading unknown or suspicious applications;<\/li>\n\n\n\n
              • Email and online safety measures, including a prohibition on opening suspicious emails, links or attachments, and mandatory reporting of phishing, malware or scam attempts to AVAS’s IT\/management function;<\/li>\n\n\n\n
              • Encrypted storage of sensitive data where feasible, regular online and offline back-ups, and a prohibition on sharing data with third parties without authorization;<\/li>\n\n\n\n
              • Use of secure, approved platforms only for any cloud storage of AVAS data;<\/li>\n\n\n\n
              • A documented Data Incident Management process, under which any suspected breach or data-loss event must be reported immediately, investigated, and followed by corrective and preventive action;<\/li>\n\n\n\n
              • Regular staff training and orientation on data protection and cyber security, and periodic review and update of the guideline itself.<\/li>\n<\/ul>\n\n\n\n

                Since 1 January 2026, AVAS has designated a dedicated Data Protection and Cyber Security Focal Person, reporting to the Executive Director and Senior Management Team, responsible for monitoring compliance, coordinating incident response, delivering training, and advising on data-related risk across the organization, including in relation to the website.<\/p>\n\n\n\n

                While AVAS applies these safeguards, no method of transmission over the internet or electronic storage is completely secure, and AVAS cannot guarantee absolute security of information transmitted through the website.<\/p>\n\n\n\n

                11. Data Retention<\/h3>\n\n\n\n

                AVAS retains personal information collected through the website only for as long as necessary to fulfil the purpose for which it was collected, to meet legal, audit or donor-reporting requirements, or to resolve any dispute or complaint, after which it is securely deleted or anonymized.<\/p>\n\n\n\n

                [AVAS TO CONFIRM: Confirm specific retention periods for each website data category (e.g. contact-form messages, newsletter subscriptions, job applications, donation records) so this section can state concrete timeframes rather than a general principle.]<\/em><\/p>\n\n\n\n

                12. Your Rights<\/h3>\n\n\n\n

                Subject to applicable Bangladeshi law and AVAS’s internal policies, you may:<\/p>\n\n\n\n

                  \n
                • Ask AVAS what personal information we hold about you and how it is used;<\/li>\n\n\n\n
                • Ask AVAS to correct inaccurate or incomplete information;<\/li>\n\n\n\n
                • Withdraw consent at any time (for example, unsubscribe from a newsletter), without affecting the lawfulness of processing carried out before withdrawal;<\/li>\n\n\n\n
                • Ask AVAS to delete personal information we hold about you, where this is not inconsistent with a legal, contractual or donor-reporting obligation;<\/li>\n\n\n\n
                • Raise a concern or complaint about how your information has been handled.<\/li>\n<\/ul>\n\n\n\n

                  To exercise any of these rights, please contact AVAS using the details in Section 18. AVAS will respond within a reasonable time.<\/p>\n\n\n\n

                  13. Children and Minors<\/h3>\n\n\n\n

                  The AVAS website is intended for use by adults, including donors, partners, job applicants, researchers and members of the public. AVAS does not knowingly collect personal information directly from children through the general website. Any information about children collected through AVAS’s programmes (for example, under child-protection or education projects) is gathered and protected under AVAS’s Child Protection Policy, Safeguarding Policy and PSEA Policy, not under this website Privacy Policy.<\/p>\n\n\n\n

                  14. Data Incidents and Complaints<\/h3>\n\n\n\n

                  If you believe your personal information has been mishandled, or if you wish to report a suspected data breach involving AVAS, you may contact the Data Protection and Cyber Security Focal Person or AVAS’s general email (Section 18). All suspected incidents are logged, investigated and addressed under AVAS’s internal Data Incident Management procedure, which requires prompt reporting, an initial assessment of harm, corrective action, and follow-up review to prevent recurrence.<\/p>\n\n\n\n

                  If your concern relates to safeguarding, sexual exploitation and abuse, or a similar protection issue, it will be handled confidentially and with a survivor-centred approach under AVAS’s Complaint Response Mechanism (CRM), Safeguarding Policy and PSEA Policy.<\/p>\n\n\n\n

                  15. Links to Other Websites<\/h3>\n\n\n\n

                  The AVAS website may contain links to third-party websites, including donor, partner or social media platforms. AVAS is not responsible for the privacy practices or content of external websites, and encourages visitors to review the privacy policy of any third-party site they visit.<\/p>\n\n\n\n

                  16. Changes to This Policy<\/h3>\n\n\n\n

                  AVAS may update this Policy from time to time to reflect changes in the law, donor requirements, or AVAS’s own practices. Material changes will be reflected by an updated “Effective date” at the top of this Policy. We encourage you to review this Policy periodically.<\/p>\n\n\n\n

                  17. Legal and Institutional Framework<\/h3>\n\n\n\n

                  This Policy is designed to be consistent with:<\/p>\n\n\n\n

                    \n
                  • The Digital Security Act 2018 (Bangladesh);<\/li>\n\n\n\n
                  • The Right to Information Act 2009 (Bangladesh);<\/li>\n\n\n\n
                  • The EU General Data Protection Regulation (GDPR), where applicable to specific relationships with EU-based donors or partners;<\/li>\n\n\n\n
                  • Relevant UN and Inter-Agency Standing Committee (IASC) Data Responsibility guidance, which AVAS also draws on for humanitarian data-sharing arrangements (e.g. Information Sharing Protocols and Data Sharing Agreements used in Start Fund Bangladesh-supported projects);<\/li>\n\n\n\n
                  • AVAS’s own Digital Data Security Guideline (2025) and Data Sharing Policy.<\/li>\n<\/ul>\n\n\n\n

                    [AVAS TO CONFIRM: The AVAS Data Sharing Policy referenced throughout this document is currently in draft form. Confirm its Executive Committee \/ Executive Director approval status before this Website Privacy Policy is published, and align the two documents’ effective dates and review cycles.]<\/em><\/p>\n\n\n\n

                    18. Contact Us<\/h3>\n\n\n\n

                    If you have questions, requests, or concerns about this Policy or about how AVAS handles your personal information, please contact:<\/p>\n\n\n\n

                    Data Protection and Cyber Security Focal Person<\/strong><\/td>Md. Zohurul Hasan Talukdar<\/td><\/tr>
                    General organizational email<\/strong><\/td>zohurul2002@avas.org.bd<\/td><\/tr>
                    Postal address<\/strong><\/td>AVAS Bhaban, Amirkutir Lane, Alekanda, Barishal-8200, Bangladesh<\/td><\/tr>
                    Website<\/strong><\/td>https:\/\/avas.org.bd<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

                    AVAS \u2014 Empowering Communities, Advancing Equity and Building Resilience.
                    Motto: Be with us, we are with the people.<\/em><\/p>\n\n\n\n

                    <\/p>\n","protected":false},"excerpt":{"rendered":"

                    Privacy Policy Privacy Policy for visitors to avas.org.bd Applies to avas.org.bd and any official AVAS sub-domains or web forms Document status Draft for internal review and Executive Committee \/ Executive Director approval before publication Version 1.0 Effective date 01 July 2026 Next scheduled review 30 June 2028 Policy owner Data Protection and Cyber Security Focal…<\/p>","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/avas.org.bd\/bn\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/avas.org.bd\/bn\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/avas.org.bd\/bn\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/avas.org.bd\/bn\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/avas.org.bd\/bn\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":5,"href":"https:\/\/avas.org.bd\/bn\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":71,"href":"https:\/\/avas.org.bd\/bn\/wp-json\/wp\/v2\/pages\/3\/revisions\/71"}],"wp:attachment":[{"href":"https:\/\/avas.org.bd\/bn\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}