Privacy Policy

1.1Who is responsible for your data

EICRA Soft Limited, registered in Bangladesh under RJSC number E67073(4565)/07, at JCX Business Tower, Plot 1136/A, Japan Street, Block I, Level 5, Suite G, Bashundhara R/A, Dhaka 1229, Bangladesh, is responsible for the personal data described in this policy. Telephone +880 1917 746550. Written enquiries go through the contact page.

1.2Services this policy covers

This policy applies to the eicra.com website and to every service we supply: the AI Services menu in full, and EOR and workforce services.

1.3Controller or processor

The role we play depends on the activity, and it changes what you can ask us directly.

2.1What we collect and where it comes from

We do not ask for special-category data (health, biometrics, religion, political opinion, trade union membership) and do not want it in an automation unless it is expressly scoped, contracted and safeguarded first. If your source data contains it, tell us at scoping so it can be excluded or protected.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not make decisions producing legal or similarly significant effects on a person by automated means without a human checkpoint.

4.1Your data is never used to train models

Client data is used only to deliver the agreed services. It is never used to train, fine-tune, evaluate or improve any model for EICRA or for a third party. Where a model provider offers a setting that excludes customer data from provider training, we enable it and record that in the scope.

4.2Model providers

Delivery may use third-party AI model providers. The scope names them before work starts, so you know which company processes your data before you agree to anything. Where the architecture allows, the workflow runs on credentials in your own name, which means your contract with that provider governs the processing directly.

4.3Prompts, outputs and logs

• Prompts and outputs are logged so a failure can be explained after the fact and an auditor can trace a decision.
• Logs are kept for the period stated in the scope, normally ninety days, unless a longer audit period is agreed in writing.
• Logs are access-controlled and visible only to the named delivery team and to you.
• Where a workflow can run without personal data in the prompt, it is built that way — masking, tokenising or referencing a record ID instead of the record.

4.4Human oversight

Every production AI system we deliver includes a human checkpoint wherever a mistake would affect a person, a payment or a legal position, together with a confidence threshold, an exception queue and an alert to a named reviewer. If you instruct us in writing to remove that checkpoint, the instruction is recorded in the scope and responsibility for unreviewed output passes to you.

4.5What we will not build

• Automated decisions with legal or similarly significant effect on a person without a human checkpoint and a route to human review.
• Systems that profile individuals for advertising or scoring without a lawful basis and a documented assessment.
• Scraping or enrichment of personal data from sources a person would not expect.
• Anything processing special-category or children’s data without express scoping, contract and safeguards.

The sub-processor list is provided at signing. No new sub-processor is added without prior written notice and your right to object. We do not sell or rent personal data to anyone.

Bangladesh has not been granted an adequacy decision by the UK or the EU. That is precisely why we execute the instruments above rather than relying on adequacy, and it is a fair question to ask any offshore supplier.

7.1Retention periods

7.2Security measures

• Least-privilege access through named accounts; no shared logins.
• Credentials held in your own vaults and accounts wherever the architecture allows.
• Our access removed at handover or on termination.
• Encryption in transit, and at rest where the platform supports it.
• Confidentiality obligations on every person who works on your engagement.
• Breach notification to you without undue delay after we become aware, with the facts known at that time.

7.3Return and deletion

On termination, or on your written request at any time, client data held for delivery is returned or deleted, subject to retention required by law or by a legitimate legal hold. Backups are overwritten on their normal cycle rather than surgically edited, and remain protected until then.

8.1What you can ask for

• Access — a copy of the personal data we hold about you.
• Correction — fix data that is wrong or incomplete.
• Deletion — erase data we no longer have a basis to keep.
• Restriction — pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where consent is the basis, withdraw it at any time without affecting past processing.
• Complain — to your national data protection authority, or in Bangladesh to the competent authority.

Where we act as processor for a client, requests about that client’s data go to the client as controller. Tell us anyway and we will pass it on and support the response.

8.2How to make a request

Send the request through the contact page or by telephone on +880 1917 746550, stating what you want and enough detail for us to find your records. We reply within thirty days. If the request is complex we will say so and give a revised date rather than go quiet. There is no charge unless a request is manifestly excessive or repetitive.

9.1Cookies

This site uses cookies that are necessary for it to work — session handling, security and remembering your preferences. Where enabled, it also uses analytics cookies to count visits and see which pages are read. Analytics data is aggregated and is not used to build advertising profiles or sold to anyone.

You can block or delete cookies in your browser settings. Blocking essential cookies will stop parts of the site from working. Where a consent banner is shown, your choice is stored and can be changed at any time.

9.2Links to other sites

Pages here may link to other websites, including model providers and platform documentation. We are not responsible for their privacy practices; read their policies before giving them data.

9.3Changes to this policy

We may update this policy and will publish the revised version on this page with a new effective date and version number. Material changes affecting an active engagement are notified to the client contact in writing rather than left to be discovered.

9.4Contact