Privacy policy

Husnora is an online beauty and cosmetics retailer operating in Bangladesh, selling skincare, makeup and fragrance through this website. In this policy, “we”, “us” and “our” mean Husnora.

We are the controller of the personal information described here — we decide what is collected and why. If you have any question about this policy, or want to exercise a right under it, write to privacy@husnora.com.

This policy covers this website and any Husnora application connected to it, including sign-in through Facebook and Google. It does not cover other companies’ websites that we link to; those have their own policies.

We collect only what a shop needs to sell you something and deliver it. Here is the complete register.

Information you give us

Account

Name, email address, password, phone number, and a profile picture if your sign-in provider supplies one.

To create and secure your account and let you sign back in.

Delivery

Recipient name, phone number, division, district, full address, and any delivery note you add. Saved addresses stay in your address book until you remove them.

To take the order, calculate the delivery fee, and hand the parcel to a courier.

Orders

The products, shades and quantities you buy, order totals, any coupon used, and the status history of the order.

To fulfil the order, handle returns and cancellations, and keep accurate business records.

Reviews

Your rating, review title and text, and the name shown on your account.

To publish reviews on the product page. Reviews are public — do not put private details in them.

Newsletter

Your email address and where you subscribed from.

To send the marketing emails you asked for, until you unsubscribe.

Messages

Anything you send us by email or messaging, including the contents of your message.

To answer you and to keep a record of the conversation.

Information we collect automatically

Session

A random identifier stored in a cookie so your cart and wishlist survive between visits, and a sign-in session cookie once you log in.

To keep your cart and your session working. See section 05.

Technical

IP address, browser type and device information contained in ordinary web-server request logs, plus error diagnostics.

To keep the site running, prevent abuse, and investigate faults.

On your device

A list of product IDs you recently viewed, and your light or dark theme choice, stored in your browser's local storage.

To show your recently viewed items and remember your theme. This list stays on your device and is not stored against your account.

Information from other companies

If you sign in with Facebook or Google, we receive your name, email address and profile picture from them. If you pay a courier on delivery, the courier confirms to us that the parcel was delivered and paid for. That is the extent of it.

We do not buy personal information from data brokers, and we do not build advertising profiles about you.

• To take and deliver orders. Confirming what you bought, calculating delivery, passing the address to a courier, and telling you where the parcel is.
• To run your account. Signing you in, showing your order history, address book and wishlist.
• To support you. Answering questions, handling cancellations, returns and complaints.
• To improve the shop. Understanding which products sell and where the site is failing people, using aggregated figures rather than individual profiles.
• To keep things safe. Detecting fraudulent orders, coupon abuse and attacks on the site.
• To market to you. Sending the newsletter, but only if you asked for it. See section 08.
• To meet legal duties. Keeping tax and accounting records and responding to lawful requests.

Where the EU or UK GDPR, or a similar law, applies to you, we rely on these legal bases: performance of a contract (taking and delivering your order); our legitimate interests (running, securing and improving the shop); your consent (marketing email, which you can withdraw at any time); and legal obligation (tax and accounting records).

We do not use your personal information to make decisions about you by automated means alone.

Orders on this site are paid by cash on delivery. You hand the amount to the courier when the parcel reaches you.

Because of this, we never ask for, receive, or store your card number, CVV, bank account, or mobile wallet PIN — that information never enters this site at all.

We do record that an order was paid, when, and for how much, because we have to keep accurate sales records. If we ever add an online payment method, the payment provider will handle your payment details directly under their own privacy policy, and we will update this policy before that method goes live.

We use a small number of cookies, and all of them are necessary for the shop to work. We do not run advertising or cross-site tracking cookies on this site.

Cart session

husnora_cart_sid — a random identifier, no personal information in it.

Keeps items in your cart if you are not signed in. Expires after 30 days.

Wishlist session

husnora_wishlist_sid — a random identifier.

Keeps your wishlist if you are not signed in. Expires after 30 days.

Sign-in

Session and security cookies set when you log in.

Keeps you signed in and protects the sign-in form against forgery.

Your browser’s local storage also holds the products you recently viewed and your theme choice. You can clear both by clearing site data in your browser; nothing on your account depends on them.

You can block or delete cookies in your browser settings. If you block the cookies above, the cart, wishlist and sign-in will stop working.

We do not sell your personal information, and we do not share it with anyone for their own marketing. We share it only with the parties below, only for the purpose given, and only as much as they need.

Couriers

Recipient name, phone number, delivery address, order number, and the amount to collect.

So the parcel can be delivered and the cash collected.

Hosting

Our website host and our database provider store the data described in this policy on our behalf.

To run the site and hold your account and order records securely.

Media hosting

Images shown on the site are served by our media provider.

To deliver product photography quickly.

Sign-in providers

Facebook and Google, if you choose to sign in with them.

To verify who you are. See section 07.

Professional advisers

Accountants and lawyers, where genuinely needed.

To meet our tax, accounting and legal obligations.

Authorities

Law enforcement or regulators.

Only where we are legally required to, or to establish or defend a legal claim.

If our business is ever sold or merged, your information may transfer with it. We will tell you before that happens and the buyer will remain bound by this policy.

You can create an account or sign in using Facebook Login or Google Sign-In. This is optional — you can always use an email address and password instead.

What we receive

When you sign in this way, we ask the provider only for your basic public profile and email address. In practice we store your name, your email address, and the URL of your profile picture, plus a note of which provider you used.

What we do not receive

• Your Facebook or Google password. We never see it.
• Your friends list, contacts, photos, messages or posts.
• Permission to post anything to your account. We never publish on your behalf.

How we use it

Only to identify you, create your account, and sign you back in. We do not send your shopping or order information back to Facebook or Google, and we do not use their advertising or tracking tools on this site.

Disconnecting

You can remove Husnora’s access at any time in your Facebook settings, under Settings › Apps and Websites, or in your Google account under Third-party apps with account access. Removing access stops future sign-ins; to remove the data we already hold, follow section 12.

We send marketing email only to people who asked for it. Every marketing email has an unsubscribe link, and unsubscribing takes effect immediately.

Separately from marketing, we send messages you cannot opt out of while you have an open order — order confirmations, delivery updates and replies to your questions. These are part of the service, not marketing.

We may contact you by phone or messaging about a specific order, for example to confirm your address before dispatch.

Account

For as long as your account is open.

Deleted, or irreversibly anonymised, after you ask us to close it.

Orders

Kept for as long as tax and accounting law requires after the order.

We cannot delete order records early, but we can disconnect them from your account. See section 12.

Reviews

Until you or we remove them.

On account deletion, a review is either removed or detached from your name at your choice.

Newsletter

Until you unsubscribe.

We keep a record that you unsubscribed so we do not email you again by mistake.

Carts and logs

Guest carts and wishlists expire after 30 days of inactivity; server logs are kept for a short period.

To keep the site working and to investigate faults and abuse.

• Passwords are stored only as a salted hash. Nobody at Husnora can read your password, and we will never ask you for it.
• The site is served over HTTPS, so traffic between you and us is encrypted.
• Access to customer and order data is restricted to staff accounts that need it, and administrator areas require a separate permission level.
• Our database is hosted by a managed provider with access controls and backups.

No system is perfectly secure. If a breach ever affects your personal information, we will tell you and the relevant authority without undue delay, and explain what happened and what to do about it.

You can ask us at any time to:

• Show you the personal information we hold about you, and give you a copy.
• Correct anything that is wrong or out of date.
• Delete your data — see the next section.
• Stop sending you marketing, without affecting your orders.
• Restrict or object to a particular use of your information.
• Send your data to you or another provider in a portable format.

Much of this you can do yourself: your account page holds your address book and order history, and every marketing email has an unsubscribe link.

To make a request, email privacy@husnora.com from the address on your account. We answer within 30 days. We may need to confirm who you are first, so that nobody else can request your data. Exercising these rights is free, and we will not treat you differently for using them.

If you are not satisfied with our answer, you may complain to your local data protection authority.

This shop is meant for adults. We do not knowingly collect personal information from anyone under 13, and accounts are intended for people aged 18 or over, or for younger people with a parent or guardian’s involvement.

If you believe a child has given us personal information, email privacy@husnora.com and we will delete it.

We operate from Bangladesh. The providers that host our site, database and images may store or process data on servers outside Bangladesh, including in the European Union, the United Kingdom, Singapore and the United States.

Where data leaves your country, we rely on our providers’ contractual safeguards, such as standard contractual clauses, and we require them to protect it to the standard set out in this policy.

We update this policy when what we do with your information changes. The date at the top always shows the current version.

If a change materially affects your rights — for example if we started sharing data with a new kind of partner — we will tell you before it takes effect, by email where we have your address, or with a notice on this site.

For anything about privacy, your data, or this policy, write to us. A real person reads these.

Privacy

privacy@husnora.com

Data requests, deletion requests, and questions about this policy.

Orders

hello@husnora.com

Anything about a specific order, delivery or return.

Response time

Within 5 working days for an acknowledgement, 30 days for a full answer.

Sooner where we can.