This page explains how Ecomsixx aligns with Bangladesh's Draft Data Protection Act (DPDP) and related regulations. For the full data-processing details, see our Privacy Policy.

1. Lawful basis for processing

Contractual necessity: your account, billing, and message-processing data.
Legitimate interest: fraud prevention, security logging, product improvement.
Consent: optional marketing communications, opt-in campaigns to your customers.

2. Data minimization

We collect only what's needed to deliver the service. Notable minimizations:

SMS delivery logs redact the OTP code from the stored message body.
Meta access tokens are encrypted at rest with AES-256-GCM.
Customer phone numbers in cross-shop analytics are hashed and salted.
Scraped website content is capped at 100 KB and replaced on re-scrape.

3. Cross-border transfer

Data is processed on infrastructure hosted outside Bangladesh (Convex - US region). All transfers are protected by TLS 1.2+ in transit and encryption at rest. Data is never sold, licensed, or made available to third parties for unrelated purposes.

4. Data subject rights

Your customers (data subjects) have the right to:

Know what data of theirs you hold
Request correction of inaccurate data
Request deletion ("right to be forgotten")
Object to processing for marketing purposes
Data portability (export in machine-readable format)

As a business using Ecomsixx, you are the data controller for your customer data - you handle these requests yourself. Ecomsixx (as data processor) will support you: request an export from the Contacts dashboard, or email privacy@ecomsixx.com for deletion / anonymization.

5. Data breach protocol

In the event of a data breach affecting your data, we will notify you within 72 hours of discovery with: what was accessed, what we're doing about it, and steps you should take.

6. Security controls

Per-tenant isolation on every database query (audited 2026-08-02)
HMAC-SHA256 webhook signature verification (Meta payloads)
AES-256-GCM encryption for access tokens at rest
CSPRNG for all session tokens and OTP codes
Sliding-window rate limiting on authentication and messaging endpoints
Security review before each significant release, with findings tracked to a fix

7. SMS + WhatsApp consent (TCPA-equivalent)

You are responsible for obtaining consent from your customers before sending reactivation SMS or marketing WhatsApp messages via Ecomsixx. Do not upload contact lists you do not have permission to message. Our platform includes opt-out language in all outbound campaign templates by default.

8. Contact

For data protection questions or to exercise your rights, email privacy@ecomsixx.com. We respond within 30 days.

DPDP Compliance Statement