Privacy Policy

1. Who we are

Trazir is a compliance and traceability platform for the ready-made garment industry, operated from Dhaka, Bangladesh. For questions about this policy or about data we hold, contact contact@trazir.com. We aim to respond within two business days.

2. Two different roles

This matters, because it decides who you should ask about what.

• For our website and our own customer records we are the controller: we decide what is collected and why. That is the subject of this policy.
• For supply-chain data a customer uploads into their workspace — factory records, audit reports, orders, test certificates, worker-related documents — we are a processor. That data belongs to the customer, we act on their instructions, and if you are a supplier or worker whose information appears in it, your request should go to the customer who uploaded it. We will help them respond.

3. What we collect

When you contact us

The contact form stores exactly what you type into it:

• Enquiry type, name and email address (required)
• Company and phone number (optional)
• Your message
• The time of submission and whether our notification email was delivered
• The identifiers described under When you browse the site below, so we can see which pages you read before getting in touch

We use this to reply to you, to keep a record of the conversation, and to understand what brought you to us so we can answer usefully. We do not add you to a newsletter and we do not sell or share it for marketing.

This links your name to your earlier browsing. Until you submit the form, your visits are recorded against a random identifier that says nothing about who you are. Submitting it connects that identifier — and the pages it visited before and after — to the name and email you gave us. If you would rather that did not happen, email us instead of using the form, or turn off tracking for this browser before submitting. You can also ask us to unlink it at any time.

When you create an account

Your name, email address, username, hashed password, role and the workspace (tenant) you belong to, plus records of your activity inside the product that exist so the product works and so account actions can be audited.

When you browse the site or use the product

We record page visits to understand how the platform is used and how people find it:

Location is derived from your IP address at city level. It is an estimate, not a precise position, and it does not use your device's location services. Traffic we identify as automated (crawlers and bots) is flagged and excluded from our reporting.

Files you upload

Documents uploaded into a workspace — audit reports, certificates, invoices, packing lists, images — are stored so the platform can extract and structure them. Some contain personal data about third parties, such as named auditors or factory staff. We handle those as a processor (section 2) and do not use them for any purpose beyond running the service for the customer who uploaded them.

4. Why we are allowed to process it

Where the GDPR applies, we rely on:

• Contract — to provide the platform to account holders and to reply to enquiries you send us.
• Legitimate interests — to keep the service secure, prevent abuse, and understand how the platform is used, balanced against your interests.
• Legal obligation — where we must retain records.
• Consent — where we ask for it, which you can withdraw at any time.

5. Who we share it with

We do not sell personal data. We use a small number of service providers who process data on our behalf under contract:

Content you send to ASCO is passed to the model provider to generate an answer. We do not permit it to be used to train third-party models. We may also disclose data where we are legally required to, or to protect our rights or the safety of others.

6. International transfers

Trazir is operated from Bangladesh and our providers operate globally, so your data may be processed outside your own country, including outside the European Economic Area. Where we transfer personal data out of the EEA we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses.

7. How long we keep it

• Contact enquiries — up to 24 months after the conversation ends, unless you ask us to delete them sooner.
• Account data — for as long as the account is active, then deleted or anonymised within 90 days of closure, except where we must retain it.
• Customer workspace content — for the term of the customer's agreement, then per their instructions.
• Analytics records — in identifiable form for 14 months. After that a nightly job strips the IP address, the visitor and session identifiers, any username, the user agent and the city and coordinates, leaving only what cannot be traced to a person: the page, the day, the traffic source, the device type and the country. The link between a contact enquiry and earlier browsing expires with those identifiers.

8. Cookies and local storage

We do not run third-party advertising or cross-site tracking cookies. We use browser storage for things the product cannot work without — keeping you signed in, remembering your theme, and holding the session and visitor identifiers described in section 3. Blocking them will sign you out and may break parts of the platform.

Turning analytics off. Visiting any page with ?trazir_no_track=1 — for example this one — stops this browser being recorded at all. The choice is stored in your browser and sticks until you clear your site data or visit with ?trazir_no_track=0. Nothing else on the site changes, and the page will look exactly the same either way. If your browser blocks site storage the preference cannot be saved, but for the same reason you are already much harder to recognise between visits; email contact@trazir.com if you want your records removed.

9. Security

Data is encrypted in transit. Passwords are stored hashed, never in readable form. Access to a workspace's data is scoped to that workspace and enforced on every request, and administrative access to production systems is limited to those who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority where the law requires it.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent. To exercise any of these, email contact@trazir.com. We will respond within one month. If the data is in a customer's workspace, see section 2 — we will route your request to them and assist.

If you are in the EEA or UK and you are not satisfied with our response, you may complain to your local data protection supervisory authority.

11. Children

Trazir is a business platform and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it.

12. Changes to this policy

We will update this page when our processing changes, and revise the date at the top. For material changes affecting account holders, we will notify you directly.

See also our Terms & Conditions, or get in touch.