Privacy & Data Protection Policy

1. Platform Governance & Independent Charter

ComplaintPoint operates as an independent consumer dispute directory and enterprise quality resolution platform. We are not a government agency, commercial advertising network, or judicial court. Our objective is to provide a structured, neutral medium where grievances can be cataloged, audited, and resolved with mutual accountability.

This Privacy Policy explains how personal data, evidence documents, and corporate records are collected, managed, protected, and shared across ComplaintPoint's consumer portal and enterprise Complaint Management System (CMS).

2. Information We Collect

We collect information strictly necessary to authenticate claims, communicate status milestones, and transmit verifiable evidence to the named entity:

A. Complainant (Consumer) Information

• Contact Identifiers: Name, verified email address, and telephone number (used strictly for SMS/email tracking updates).
• Transaction Identifiers: Order numbers, tracking IDs, booking references, policy numbers, or account numbers associated with the dispute.
• Evidence Documents: Receipts, invoices, chat screenshots, warranty slips, and delivery notes uploaded to substantiate claims.
• Resolution Preference: Complainant requested remedy (e.g. monetary refund, replacement goods, service apology, or contract rectification).

B. Business Representative Information

• Corporate Credentials: Work email addresses with authorized company domains, company registration details, and designated resolution officer titles.
• Audit & Action Logs: Timestamps of case assignments, ticket actions, CAPA logs, and compliance dossier exports.

3. How Information Is Processed & Forwarded

We process collected data to deliver public accountability and facilitate bilateral resolution:

1. Case Notification & Verification: When a complaint is filed, our automated notification pipeline transmits the factual details to the named company's customer relations department or verified CMS liaison.
2. Resolution Mediation: Communication exchanged between the consumer and the company is recorded under the immutable case tracking ID (e.g., CP-84920194).
3. SLA & Quality Analytics: Aggregated, anonymized dispute volumes and resolution times are computed to calculate industry quality indexes and ISO 10002 compliance ratings.

4. Public Redaction & PII Masking Standards

While ComplaintPoint operates a public directory for company accountability, we maintain rigorous personal data masking standards to protect consumers from identity theft, spam, or harassment:

Complainants may also elect to file under verified pseudonyms on public activity listings, while still maintaining full direct resolution capability with the organization.

5. Enterprise Data & B2B CMS Data Processing

For organizations subscribing to our Enterprise Complaint Management System (CMS):

• Data Ownership: Organizations retain full intellectual property ownership of internal resolution notes, 5-Whys root cause analysis dossiers, and internal departmental assignments.
• Role-Based Access Control (RBAC): Access to sensitive case records is restricted according to permissions configured by the enterprise administrator.
• Confidentiality: Internal quality memos and draft corrective actions (CAPA) remain confidential to the organization's authorized workspace and are never published publicly.

6. Lawful Basis & User Rights (GDPR & Local Protections)

Under global privacy regulations (including GDPR, UK GDPR, and the Digital Security & Consumer Rights frameworks of Bangladesh), you have enforceable rights regarding your data:

• Right to Access: You may request a complete export of all personal details and grievances associated with your account.
• Right to Rectification: You may amend factual inaccuracies in your contact details or dispute submissions.
• Right to Erasure (Right to be Forgotten): Following successful case resolution or upon formal request, you may request the deletion of your personal account. In accordance with legal recordkeeping, resolved public metrics may remain in an anonymized, unlinked statistical format.
• Right to Object: You may object to any automated processing or opt out of notification emails at any time.

7. Data Retention, Encryption & ISO 27001 Security

ComplaintPoint employs enterprise-grade defense-in-depth security architecture:

• Encryption at Rest & in Transit: All data transmissions are protected using TLS 1.3 with AES-256 encryption. Database snapshots and evidence attachments are encrypted at rest with hardware security modules.
• Data Retention Windows: Active case evidence is preserved throughout the dispute lifecycle. Resolved dispute files are securely archived for 36 months to satisfy statutory consumer warranty and audit requirements before permanent purging.
• SOC 2 Type II & ISO 27001 Compliance: Annual third-party penetration testing and continuous vulnerability scanning ensure comprehensive system resilience.

8. Cookies & Local Browser Storage

ComplaintPoint uses essential cookies and local browser storage (localStorage) strictly to deliver platform functionality:

• Authentication Tokens: To maintain secure login sessions for consumer and business accounts.
• Language Preferences: To preserve your selected language (English or Bengali) across page transitions.
• Draft Preservation: To temporarily save complaint draft progress so your entries are not lost upon accidental browser refresh.

We do not utilize cross-site tracking cookies, canvas fingerprinting, or third-party behavioral surveillance scripts.

9. Data Protection Officer (DPO) Contact & Inquiries

If you have questions regarding this Privacy Policy, wish to exercise your data subject rights, or need to escalate a privacy concern, please contact our Data Protection Office: