Privacy Policy

Information you provide

When you create an account, place an order, or contact us, we collect: your name, email address, phone number, delivery address, and payment details. Payment data is processed by our secure gateways (SSLCommerz, Stripe, PayPal) and we never store your full card number.

Information collected automatically

When you browse our website, we automatically collect: IP address, browser type and version, pages visited, time spent on pages, referring URLs, and device identifiers. This is collected via cookies and similar technologies.

Information from third parties

If you log in via Google or Facebook, we receive basic profile information (name, email, profile picture) as permitted by your privacy settings on those platforms.

Order fulfillment

We use your name, address, phone, and email to process orders, arrange delivery, send tracking updates, and handle returns or refunds.

Account management

To create and manage your account, track loyalty points, handle password resets, and personalize your shopping experience.

Communications

To send order confirmations, shipping updates, and customer service responses. With your consent, to send promotional emails and SMS alerts about new arrivals, sales, and exclusive offers.

Improvement and analytics

To analyze website usage patterns, improve our product selection, optimize the shopping experience, and detect and prevent fraud.

Legal compliance

To comply with applicable laws in Bangladesh and the United States, resolve disputes, and enforce our Terms of Service.

Delivery partners

We share your name, phone, and delivery address with our courier partners (Pathao, Paperfly, Redx, Sundarban in BD; USPS, FedEx, UPS in the US) solely to fulfill your delivery.

Payment processors

Payment data is shared with SSLCommerz (Bangladesh), Stripe, and PayPal (US) to process your transactions securely.

Service providers

We work with trusted third parties for email delivery, analytics, cloud hosting, and customer support software. These providers are contractually bound to protect your data.

We never sell your data

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes — ever.

Encryption

All data transmitted between your browser and our servers is encrypted using 256-bit TLS/SSL. Payment transactions use bank-grade encryption via our certified gateways.

Access controls

Your personal data is accessible only to employees who need it to perform their job (e.g., customer service, order fulfillment). All staff are bound by confidentiality agreements.

Data retention

We retain your data for as long as your account is active or as required by law. Order records are kept for 7 years for tax and legal compliance. You can request deletion of non-legally-required data at any time.

Essential cookies

Required for the site to function: session cookies (cart contents, login state), CSRF protection tokens, and security cookies. These cannot be disabled.

Analytics cookies

We use Google Analytics to understand traffic patterns. These cookies collect anonymized data about page views, device type, and referral sources. You can opt out via Google's opt-out browser add-on.

Marketing cookies

With your consent, we may use cookies to show you relevant ads on other platforms (Meta Pixel, Google Ads). You can withdraw consent at any time in your account privacy settings.

Managing cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect site functionality such as remembering your cart or staying logged in.

Access and portability

You have the right to request a copy of all personal data we hold about you. We will provide it in a machine-readable format within 30 days.

Correction

You can update your name, address, and contact details at any time in My Account → Profile. For other corrections, contact info@oldmillcotton.com.

Deletion

You may request deletion of your account and personal data. We will comply within 30 days, subject to data we are legally required to retain (e.g., transaction records).

Marketing opt-out

Unsubscribe from marketing emails at any time via the unsubscribe link in any email, or toggle off marketing preferences in My Account → Notifications.

Complaint

If you believe your privacy rights have been violated, please contact us first at info@oldmillcotton.com. Bangladesh residents may also contact the Bangladesh Telecommunication Regulatory Commission (BTRC). US residents (California) may have additional rights under CCPA.

Age restriction

Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

Notification of changes

We may update this Privacy Policy periodically. When we make material changes, we will notify you by email (if you have an account) and by posting a prominent notice on our website at least 7 days before the changes take effect.

Continued use

Your continued use of our website after the effective date of any changes constitutes acceptance of the updated policy.