Privacy Policy

Last Updated: 12 September 2026

At KiddoHugs, we respect the privacy of our customers and visitors and aim to handle personal information responsibly, transparently and securely.

This Privacy Policy explains what information we may collect, why we use it, when it may be shared, how long it may be retained, the choices and rights available to you, and how you may contact us about privacy matters.

This Privacy Policy should be read together with our Terms & Conditions, Shipping & Delivery Policy and Return, Exchange & Refund Policy.

Nothing in this Policy is intended to remove or restrict any privacy or data-protection right that cannot lawfully be excluded.

1. About KiddoHugs and This Policy

KiddoHugs is an online retail brand serving customers in Bangladesh.

This Privacy Policy applies to personal information processed through our website, customer accounts, checkout, orders, customer support, delivery activities, returns and refunds, marketing communications and related online services.

Where a third-party service has its own privacy policy, its own terms may also apply to information processed directly through that service.

2. Who May Place Orders

Our website and purchasing services are intended for persons aged 18 or over.

Products intended for children should be purchased by an adult parent or legal guardian, or by another adult acting with the authorization of the child’s parent or legal guardian.

A person under 18 should not independently create a customer account, place an order or submit personal information to KiddoHugs for purchasing purposes.

3. Information You Provide to Us

Depending on how you interact with KiddoHugs, we may collect information such as:

• your full name;
• delivery address;
• city or district;
• valid and active mobile number;
• email address, where provided;
• account information;
• order details and purchase history;
• information contained in order notes, where provided;
• communications sent through our contact form, email, telephone, WhatsApp or other support channels;
• information required to process a return, exchange, complaint or refund; and
• other information you choose to provide when communicating with us.

We ask customers to provide accurate and current information where it is necessary to fulfil an order or provide support.

4. Order and Delivery Information

When you place an order, we use the information reasonably necessary to process, verify, fulfil and deliver that order.

This may include your name, delivery address, phone number, order contents, delivery instructions, Order ID, shipment or tracking information and relevant order status.

We may also maintain records relating to unsuccessful deliveries, redelivery requests or refused Cash on Delivery orders where reasonably necessary for order management, fraud prevention or future-order verification.

5. Customer Account Information

If you create or use a customer account, our website may process account identifiers, contact information, saved address information, order history and authentication-related information necessary to operate the account.

You are responsible for keeping your account access details confidential and for notifying us if you reasonably believe that your account has been accessed without authorization.

6. Information Collected Through Customer Support

When you contact KiddoHugs for assistance, we may process the information you provide in order to understand and respond to your enquiry.

For order-related support, we may request your Order ID and the registered phone number used when placing the order.

For damaged, defective, incorrect or missing-item claims, we may also process photographs, courier labels, packaging information or other evidence reasonably necessary to investigate the claim.

Please do not send sensitive or unrelated personal information that is not necessary for your request.

7. Information Collected Automatically

When you visit or use our website, certain technical information may be collected automatically by the website, hosting infrastructure or technologies used to operate, protect and improve the service.

Depending on the technology in use, this may include information such as:

• IP address;
• browser or device information;
• operating-system or device characteristics;
• pages or features visited;
• timestamps and technical logs;
• referral or campaign information;
• cookie or similar technology identifiers; and
• information relating to website security, errors or suspicious activity.

The exact information available may vary according to the technology and service providers being used.

8. How We Use Personal Information

KiddoHugs may process personal information for purposes including:

• receiving and processing orders;
• verifying customer and delivery information;
• fulfilling and delivering products;
• providing order confirmation, tracking and service communications;
• providing customer support;
• processing cancellations, returns, exchanges and refunds;
• preventing or investigating fraud, abuse or suspicious activity;
• maintaining and securing our website and systems;
• complying with legal, accounting or regulatory obligations;
• maintaining appropriate business and transaction records;
• improving our operational processes and customer experience;
• measuring advertising or campaign effectiveness where permitted; and
• sending optional marketing communications where the customer has provided the necessary consent or another lawful basis applies.

We will not intentionally use personal information for a materially incompatible purpose without an appropriate legal basis or additional notice where required.

9. Lawful Basis for Processing

Different processing activities may rely on different lawful grounds.

For example, information necessary to process and deliver an order may be processed because it is necessary to take steps requested by the customer or to perform the transaction with the customer.

Other processing may be necessary to comply with applicable law, establish or defend legal rights, protect legitimate operational or security interests where legally permitted, or act on consent provided by the customer.

Optional marketing and non-essential tracking activities will be handled separately from information that is necessary to fulfil an order.

Bangladesh’s Personal Data Protection Act allows processing without separate consent in certain circumstances including performance of a contract or steps requested in connection with a contract, subject to the law’s safeguards.

10. Cash on Delivery and Refund Information

KiddoHugs currently operates primarily through Cash on Delivery.

For an eligible COD refund, we may request the information reasonably necessary to send the refund through bank transfer or bKash.

This may include the relevant account or mobile number and information needed to verify that the refund is being sent to the correct recipient.

KiddoHugs will not request your account password, card PIN or OTP in order to process a refund.

11. Future Online Payments

KiddoHugs does not currently operate a general online-payment gateway.

If an online-payment service is introduced in the future, the payment provider may process payment information directly according to its own security procedures and privacy terms.

KiddoHugs will update this Privacy Policy where necessary before or when materially different payment-data processing is introduced.

We do not intend to represent that KiddoHugs stores full card credentials unless that is factually true and lawfully required.

12. Courier and Delivery Providers

KiddoHugs currently uses Steadfast Courier for delivery services.

To fulfil and track a shipment, we may provide the courier with information reasonably necessary for delivery, such as the recipient’s name, phone number, delivery address and shipment or order information.

Courier systems may generate tracking, delivery-attempt, delivery-status or related operational information.

A courier or logistics provider may process relevant information under its own legal and privacy obligations.

13. Hosting, Email and Technical Service Providers

We may use hosting, infrastructure, email, security and other technical service providers to operate the website and communicate with customers.

Because our current business email is operated through our hosting/cPanel environment and the precise underlying email infrastructure may change, we do not identify an unsupported provider name in this Policy.

These providers may process limited personal or technical information where necessary to provide the relevant service.

Where KiddoHugs engages a processor to handle personal data on its behalf, reasonable steps should be taken to ensure appropriate data-protection obligations are followed. Bangladesh’s 2026 Act places responsibility on the data fiduciary to take reasonable measures regarding processors acting on its behalf.

14. WhatsApp, Messenger and Meta Services

If you contact us through WhatsApp, Messenger or another Meta service, the information you submit through that platform may also be processed by Meta or the relevant platform according to its own privacy terms.

KiddoHugs may use those channels to respond to support enquiries, communicate about an order or provide another service requested by the customer.

We recommend avoiding unnecessary sensitive information in social-messaging conversations.

15. Meta Pixel and Related Advertising Technologies

KiddoHugs uses or may use Meta Pixel and related Meta advertising technologies for purposes such as advertising measurement, campaign attribution, understanding the effectiveness of advertisements and building or measuring relevant audiences.

Depending on implementation and customer consent settings, these technologies may collect or receive information relating to website activity, device or browser information, pages visited and purchase or conversion events.

Meta describes its Business Tools as technologies through which partners may send information about activity on websites and purchases.

Where consent is legally required for non-essential advertising or tracking technologies, we intend to use appropriate consent controls before such technology is activated for that visitor.

16. Cookies and Similar Technologies

Our website may use cookies or similar technologies for purposes such as:

• essential website functionality;
• account or session operation;
• security;
• cart and checkout functionality;
• remembering appropriate preferences;
• measuring website or campaign performance; and
• advertising technologies such as Meta Pixel, where enabled.

Strictly necessary technologies may be required for the website to function correctly.

Non-essential advertising or tracking technologies should be subject to applicable consent choices where required.

17. Marketing Email and SMS

Marketing email or SMS from KiddoHugs will be optional.

Where consent is used, the marketing option should not be pre-selected by default, and a customer should be able to place an order without agreeing to promotional marketing.

A customer may withdraw marketing consent or unsubscribe from future promotional communications.

Withdrawing from marketing does not prevent KiddoHugs from sending necessary transactional or service communications, such as order confirmation, shipping, delivery, security, support or refund-related messages.

Under Bangladesh’s 2026 data-protection law, consent must be voluntary, specific, clear and withdrawable, and customers may withdraw consent in accordance with the applicable procedure.

18. Fraud Prevention, Security and Order Verification

We may process relevant order, delivery, technical or support information where reasonably necessary to prevent, detect or investigate suspected fraud, abuse, unauthorized activity or security threats.

This may include reviewing repeated refused COD orders, unusual order patterns, materially false claims, altered evidence, suspicious access or other activity reasonably requiring verification.

Fraud-prevention measures will not be used merely to prevent a genuine customer from exercising a lawful privacy or consumer right.

19. When We May Share Information

KiddoHugs may disclose personal information where reasonably necessary to:

• fulfil and deliver an order;
• operate the website or communications infrastructure;
• provide customer support;
• process an eligible refund;
• use approved advertising or marketing technologies;
• prevent fraud or protect website security;
• comply with applicable law, court orders or lawful government requests;
• establish, exercise or defend legal rights; or
• complete a lawful business reorganisation, transfer or similar transaction where appropriate safeguards apply.

We aim to limit information disclosed to what is reasonably relevant for the applicable purpose.

20. International or Cross-Border Processing

Some third-party technologies or infrastructure providers, including global communications or advertising platforms, may process or store information outside Bangladesh.

Where personal information is transferred internationally, KiddoHugs will aim to use a lawful basis and appropriate safeguards required by applicable law.

We do not claim that all personal information is stored exclusively within Bangladesh.

Bangladesh’s Personal Data Protection Act permits certain international transfers subject to statutory conditions, including applicable consent, contractual-service grounds and destination safeguards.

21. Data Retention

KiddoHugs will not intentionally retain personal information longer than reasonably necessary for the purpose for which it was collected, subject to legal, accounting, fraud-prevention, dispute-resolution or regulatory requirements.

Retention may vary depending on the category of information.

For example:

• active order information may be retained as necessary to fulfil and support the order;
• transaction and business records may be retained where required for accounting, tax, compliance or dispute purposes;
• customer-support records may be retained for a reasonable period where needed to manage the enquiry or related dispute;
• marketing-preference information may be retained while consent remains active, together with limited suppression information where needed to respect an opt-out;
• security or technical logs may be retained for an appropriate operational period; and
• privacy-request and processing records may be retained where applicable law requires records to be maintained.

Where information is no longer reasonably required, it may be deleted, anonymized or otherwise handled according to applicable requirements.

The 2026 Act requires personal data not to be retained beyond the applicable purpose-based period, while separately requiring certain processing records to be maintained for at least five years unless another provision specifies otherwise. These are not the same as a requirement to keep every customer data field for five years.

22. Data Security

KiddoHugs will take reasonable technical and organizational measures appropriate to the nature and risk of the personal information being processed.

These measures may include access controls, website and account security measures, secure technical infrastructure, restricted access, appropriate authentication, backups, encryption or other safeguards where appropriate.

However, no website, internet transmission or electronic storage system can be guaranteed to be completely secure.

Customers should also protect their account credentials and should never send passwords, PINs or OTPs to anyone claiming they are needed for a KiddoHugs refund.

Bangladesh’s 2026 Act requires appropriate technical and organizational safeguards designed to protect security, accuracy and confidentiality and to reduce unauthorized access, destruction, loss, misuse or disclosure.

23. Personal Data Breaches

If KiddoHugs becomes aware of a personal-data security incident, we will assess the circumstances and take reasonable steps to contain, investigate and address the issue.

Where applicable law requires notification to a competent authority or other affected party, we will follow the applicable legal procedure.

The 2026 Act requires authority notification where a breach is likely to cause significant harm, subject to procedures and timelines prescribed under the law.

24. Your Privacy Rights

Subject to applicable law and the circumstances of the request, you may have rights including the ability to:

• request access to personal information processed about you;
• request a copy or information about relevant processing;
• request correction, completion or updating of inaccurate or incomplete information;
• withdraw consent where processing depends on consent;
• object to certain processing where applicable;
• request deletion where the legal conditions for deletion are satisfied;
• request portability where applicable; and
• receive information about relevant recipients, retention or cross-border processing where required by law.

These rights are subject to lawful limitations, including circumstances where information must be retained to comply with legal obligations or protect other lawful rights.

Bangladesh’s Act provides access and copy-related rights, correction/update rights and consent-withdrawal/deletion mechanisms, and states that the statutory rights in that chapter cannot be removed through contract or notice.

25. Exercising Your Privacy Rights

To make a privacy-related request, contact:

privacy@kiddohugs.com

Please provide enough information for us to understand the request and reasonably verify that the request relates to you.

We may request proportionate verification before disclosing, correcting or deleting personal information in order to protect customers from fraudulent or unauthorized privacy requests.

We will respond and take action within applicable legal requirements and any procedures or timelines prescribed by law.

Using your privacy rights will not, by itself, affect your ability to make a genuine complaint or exercise another lawful consumer right.

26. Children’s Privacy

KiddoHugs sells products intended for children, but our purchasing services are intended for adults aged 18 or over.

We do not intentionally collect a child’s name, date of birth, school information, photographs, health information or other child-specific personal information as part of ordinary ordering and delivery activities.

An adult customer normally provides the adult purchaser or recipient information necessary to complete the order.

If a parent or legal guardian voluntarily provides information relating to a child in a support enquiry, we will aim to use only the information reasonably necessary for that purpose and handle it with appropriate care.

If we become aware that child-specific personal information has been submitted without an appropriate basis, we may take reasonable steps to delete, restrict or otherwise handle that information as required.

Bangladesh’s 2026 Act defines a child as a person under 18 and provides a guardian-consent framework for processing children’s personal data.

27. Sensitive Personal Information

KiddoHugs does not normally require customers to provide sensitive personal information such as health information, biometric data, political or religious beliefs, criminal-history information or similar information in order to purchase ordinary retail products.

Please do not send such information unless it is genuinely necessary for a specific lawful purpose and we have requested or clearly explained why it is required.

If sensitive personal information must be processed in an exceptional case, additional legal requirements may apply.

28. Third-Party Websites and Services

Our website or communications may contain links to third-party websites, social platforms or services.

KiddoHugs does not control every privacy practice of independent third parties.

Customers should review the privacy information provided by the relevant third party before providing information directly through that service.

29. Business Changes

If KiddoHugs undergoes a lawful reorganisation, merger, acquisition, sale of relevant business assets or similar transaction in the future, personal information may form part of the information transferred where reasonably necessary and legally permitted.

Any such transfer will remain subject to applicable privacy and data-protection requirements.

30. Changes to This Privacy Policy

KiddoHugs may update this Privacy Policy when its technology, services, payment methods, service providers, legal obligations or personal-data practices materially change.

The latest version and Last Updated date will be published on the website.

Where a change materially affects how personal information is used, we will provide additional notice or obtain additional consent where applicable law requires it.

31. Contact Us About Privacy

For questions, requests or concerns about this Privacy Policy or the way KiddoHugs handles personal information, contact:

Privacy Contact

Email: privacy@kiddohugs.com

For ordinary order or customer-service enquiries, please continue to use:

support@kiddohugs.com

Our general business contact details are available on our Contact Us page.