Privacy Policy

We only ask for what a request actually needs, and we say what each field is for at the point we ask for it.

• When you send an enquiry: your name, email address, the subject you chose and your message.
• When you apply for a role: your name, email address, phone number, covering letter and the CV file you attach.
• When you subscribe: your email address and which page you subscribed from.
• Automatically, on every visit: your IP address, browser and device type, the pages you opened and the site that referred you.

We do not ask for national identity numbers, financial details or health information anywhere on this website. If a form appears to request them, it is not ours — please tell us.

Your information is used to answer you and to run the site — nothing else:

• To reply to your enquiry and route it to the division that can deal with it.
• To assess a job application and contact you about it.
• To send the newsletter you asked for, until you unsubscribe.
• To keep the site secure — rate limiting, spam filtering and abuse investigation.
• To understand, in aggregate, which pages are useful and which are not.

We do not sell personal information, and we do not use your details to market unrelated products to you.

We keep enquiries for two years, so we have a record of what was asked and answered. Job applications are held for one year after the vacancy closes unless you ask us to keep you on file for longer. Newsletter subscriptions are held until you unsubscribe. Server logs are rotated after ninety days.

Where we are required by law or by an audit obligation to keep something for longer, we keep only that record and only for as long as the obligation runs.

Inside the group, an enquiry reaches the people who need to answer it and no one else. Outside the group, we share personal information only with:

• The service providers who host this website, deliver our email and filter spam, under contract and only for those purposes.
• Professional advisers, where we need advice on a matter that involves your information.
• A regulator, court or law-enforcement body, where we are legally required to.

Our providers may process data outside Bangladesh. Where they do, we require contractual protections equivalent to those in this policy.

This site sets a session cookie so forms can be submitted safely, and a security token that protects those forms from being submitted by someone else on your behalf. Both are strictly necessary and neither tracks you across other websites.

We use aggregate analytics to count page views and referrers. We do not run advertising trackers or social pixels on this site. Your browser's settings let you refuse cookies; the site will still work, but forms may not submit.

Traffic to this site is encrypted in transit. Access to submitted enquiries and applications is limited to named accounts, and every action on them is logged. Uploaded CVs are stored on private storage and are not publicly addressable.

No system is perfect. If we ever become aware of a breach that affects you, we will tell you what happened, what it means and what we are doing about it.

You can ask us to:

• Tell you what information we hold about you.
• Correct anything that is wrong or out of date.
• Delete your information, where we are not required to keep it.
• Stop sending you the newsletter — every issue carries an unsubscribe link.

We answer requests within thirty days. We may ask you to confirm your identity first, so that we do not disclose someone else's information to the wrong person.

When this policy changes we update the date at the top of the page. If a change materially affects how we use information you have already given us, we will say so prominently rather than quietly amend the text.

Write to the Data Protection contact at info@gemcongroup.com, call +88 02 41020596-00, or post to House 44, Road 16 (27 Old), Dhanmondi, Dhaka-1209, Bangladesh.

If you are not satisfied with our answer, tell us — we would rather hear it from you than read it somewhere else.