Bangladesh — under the Personal Data Protection Act, 2026 (PDPA)
Data Privacy Policy version 1.0
1.1 This Data Privacy Policy is subject to the laws of the People's Republic of Bangladesh, in particular the Personal Data Protection Act, 2026 (Act No. 63 of 2026) (the "PDPA"), read together with Article 43 of the Constitution of Bangladesh and any rules, regulations, or Standard Operating Procedures issued by the National Data Management Authority.
1.2 The purpose of our Data Privacy Policy is to provide clear insight into how GONSAVE, a project by Go N Save Pte Ltd (Company No. 202134799G, incorporated in Singapore), referred to as "GON$AVE," operating the Zaver application (the "App") — a technology tool that helps delivery riders track and understand their earnings — handles, collects, uses, discloses, and processes the Personal Data of riders, customers, business contacts, partners, employees, suppliers, and other individuals. GON$AVE provides Zaver as a technology service only; it is not a lender, does not make credit or lending decisions, and does not assume any credit risk.
1.3 By providing us with your personal data, you acknowledge and affirm that you have thoroughly read and comprehended this Data Privacy Policy. Where the PDPA requires your consent, you are consenting to the collection, use, processing, and disclosure of your Personal Data in accordance with the terms outlined in this Policy. Certain activities described below require a separate, specific consent, which we obtain in addition to your acceptance of this Policy (see Section 4).
1.4 Uploads containing third-party information. If information you provide to us — for example, an earnings statement or payment screenshot you upload — contains personal data of another person, you confirm that you are lawfully entitled to provide it. To reduce this risk, we limit our processing of uploaded statements to your own earnings information and apply measures to avoid collecting unrelated third-party details. You should upload only your own statements, and you must comply with the terms of the delivery platform that issued them.
1.5 We reserve the right to update this Data Privacy Policy to reflect changes in our services, technology, or legal and regulatory requirements. The current version is published on our website www.gonsave.co and within the Zaver App. We encourage you to revisit it regularly.
1.6 Acceptance within the App. When you log in to Zaver, you will be asked to review and accept this Data Privacy Policy and our Terms and Conditions before using the services. Acceptance of this Policy alone does not, by itself, constitute the separate specific consents described in Section 4; those are requested and recorded individually within the App.
2.1 Anonymization: The procedure of eliminating personally identifiable information to the extent that the remaining data no longer allows for the identification of any individual. Once anonymized, the information is no longer classified as personal data under the PDPA.
2.2 Collection: Any action or series of actions by which we acquire control or possession of Personal Data.
2.3 Data Processor: Any entity that processes personal data on our behalf and under our instructions, excluding our employees.
2.4 Data Fiduciary: The entity that, alone or jointly with others, determines the purposes and means of processing Personal Data. GON$AVE is the Data Fiduciary (data controller) for the Personal Data it processes to provide the Zaver App and related services. Where you authorise the disclosure of certain data to a Partner Financial Institution (Section 5.2), that institution acts as a separate and independent Data Fiduciary for the data it receives and for its own purposes.
2.5 Partner Financial Institution: A microfinance institution, bank, or lender with which you have, or are seeking, a financial relationship, and to which — only with your separate, explicit authorisation — a defined set of your income data and related signals may be disclosed so that it may assess or support that relationship. The specific institution is identified to you at the time your authorisation is requested.
2.6 Cookie: A compact file consisting of letters and numbers that you save on your browser, computer, or device's hard drive.
2.7 Customer / Rider: An individual who uses the Zaver App or who has otherwise contacted us in relation to the goods or services we offer.
2.8 Disclosure: Any action or series of actions by which we divulge, transfer, or otherwise provide personal data, under our control or in our possession, to any other organization.
2.9 Individuals (Data Subject): A natural person who can be identified, directly or indirectly, from Personal Data. The PDPA protects the Personal Data of such individuals.
2.10 Personal Data: Any information relating to an identified or identifiable living individual — for example, name, mobile number, email address, device identifier, images, approximate location, or earnings information linked to an individual.
2.11 Sensitive Personal Data: Categories requiring heightened protection under the PDPA, such as financial account information and government-issued identifiers. We limit our collection and use of sensitive data to what is necessary, useful, and proportionate to the purposes described in Section 3.
2.12 Processing: Any operation performed on Personal Data, including collection, recording, storage, retrieval, use, organization, modification, disclosure, transfer, anonymization, erasure, or destruction, whether by manual, automated, or artificial-intelligence-assisted means.
3.1 We collect only the personal data that is necessary, useful, and proportionate to provide the App and related services, to comply with legal obligations, or to fulfil the purposes for which you provide it. You own your personal data, and you decide whether to activate features that require us to retrieve additional information.
3.2 Individuals may provide personal data directly through the Zaver App, our website, email or telephone contact, or connected social media and messaging platforms (including Facebook and Facebook Messenger), or it may be generated automatically through use of the App.
3.3 The types of Personal Data we may collect include but are not limited to:
3.3.1 Identity and contact information: your name, mobile telephone number, email address, preferred language, and country.
3.3.2 Account and login identifiers: where you sign in using an email or phone one-time passcode, or via Facebook or Google, or by linking our Facebook Messenger page, the account identifiers used to authenticate you.
3.3.3 Earnings and financial information: where you activate the relevant feature and provide the required consent, earnings statements or payment screenshots you upload from delivery platforms (such as foodpanda, Grab, Pathao, or Uber), and the information extracted from them — including per-day earnings, bonuses, tips, and trip counts, and, where it appears on your statement, a partial (last-four-digit) payout account reference used only to help you confirm the statement is yours. You may also enter earnings and set income goals manually.
3.3.4 Activity and rewards information: your daily check-ins, points balance and history, reward redemptions, and your interactions with the App.
3.3.5 Weather submissions and approximate location: weather conditions and photographs you choose to submit, and approximate location used to show relevant local weather and zone information. This data is used only for the weather features and is not shared with any Partner Financial Institution.
3.3.6 Device and technical information: device identifiers (including an anonymous device identifier assigned before you log in), IP address, browser and application version, and web-push notification subscription details, used to operate and secure the App.
3.4 We will not collect sensitive categories of data beyond what is necessary for the purposes set out above, and only where you have provided the required consent or where the PDPA otherwise permits it.
3.5 Information about you may also be obtained from third parties whose websites, social media, or messaging platforms you use to access or connect to the App.
4.1 We will or may use or process your personal data for one or more of the following purposes:
4.1.1 To create and administer your Zaver account and to provide the App and related services.
4.1.2 To read, structure, and extract information from the earnings statements you upload — including through automated and artificial-intelligence-assisted processing — in order to calculate your earnings and to generate goals, daily targets, and feedback.
4.1.3 Only with your separate, explicit authorisation, to retrieve and structure your income and earnings data and to disclose a defined dataset (your verified income and earnings data and agreed income-stability signals) to a Partner Financial Institution so that it may assess or support your financial relationship with it. The Partner Financial Institution makes any credit or lending decision itself; GON$AVE does not make that decision and assumes no credit risk. You may withdraw this authorisation at any time (see Section 9).
4.1.4 To operate the rewards and points features, including awarding points and processing redemptions.
4.1.5 To provide weather and zone information and community features.
4.1.6 To communicate with you and send you notifications, including via web-push and, where you have connected it, Facebook Messenger.
4.1.7 To conduct research, analytics, and product development, using aggregated and anonymized data wherever possible.
4.1.8 To conduct security, fraud-prevention, and verification activities, and to protect the integrity of the App.
4.1.9 To comply with any applicable law, and to respond to lawful requests of governmental, regulatory, tax, or law-enforcement authorities in Bangladesh or elsewhere.
4.1.10 For marketing about our own products and services, where you have consented, subject to your right to opt out at any time.
4.1.11 To perform internal administrative, operational, and technological tasks that maintain and improve the quality and security of our services.
4.1.12 To store, host, or secure your personal data, whether within or outside Bangladesh (all collectively referred to as the "Purposes").
4.2 Separate, specific consents. Acceptance of this Policy does not by itself authorise the following activities, each of which is requested and recorded separately within the App: (a) activating the connectors or uploads that let us retrieve your financial and earnings data; (b) the generation of income and creditworthiness-related insights; (c) the disclosure of your data to a named Partner Financial Institution; (d) automated and artificial-intelligence-assisted processing of your data; and (e) processing or storage of your data outside Bangladesh. You may give or withhold each of these consents independently, and withdraw any of them at any time.
5.1 We may disclose your personal data, for one or more of the above Purposes, to the following categories of recipients, whether located within or outside Bangladesh: (a) our affiliated organizations and related corporations; and (b) Data Processors and service providers acting on our behalf under written contract, including cloud hosting and database providers, authentication and login providers, messaging and notification providers, providers that perform automated and artificial-intelligence-assisted processing of the statements and photographs you submit, weather-data providers, and information-technology, security, and analytics providers. A current list of our processors and the destinations of any international transfer is available on request and is summarised for you at the point of consent.
5.2 Disclosure to a Partner Financial Institution. Only after you provide separate, explicit authorisation, we disclose a defined dataset — your verified income and earnings data and agreed income-stability signals — to the Partner Financial Institution identified to you at that time. We do not disclose your full app data to that institution; for example, weather photographs, approximate location, social identifiers, IP address, and device data are not shared for this purpose. Once the Partner Financial Institution receives your data, it acts as a separate and independent Data Fiduciary (controller) for that data and for its own purposes (such as underwriting, credit assessment, and monitoring repayment capacity), and its handling of that data is governed by the laws of Bangladesh and by that institution's own privacy policy. You may exercise your data-protection rights directly against that institution in respect of the data it holds.
5.3 No sale of personal data. We do not sell your personal data, and we do not retain ownership of your identifiable personal data. Any fees payable between GON$AVE and its partners are for the provision of technology, verification, processing, and analytics services — not for the sale, transfer, or ownership of personal data. We retain only the right to use anonymized and aggregated data and the technical processing rights necessary to provide the services.
5.4 Where we engage a Data Processor, we remain responsible, as Data Fiduciary for the data we control, and require that processor, by written contract, to apply protections consistent with the PDPA and this Policy. We will use or disclose personal data for purposes not stated above only where we notify you and obtain your consent, unless the processing without consent is permitted by the PDPA or by law.
6.1 Safeguarding the security of your personal data is a paramount concern for us. We employ appropriate technical and organizational measures to prevent the loss, misuse, unauthorized access, disclosure, alteration, or destruction of personal data, and we restrict access to those who need it for the Purposes. Your information is stored on reputable cloud infrastructure and database services. Some of these services, and the processing described in this Policy, may take place outside Bangladesh (see Section 10).
6.2 Retention of operational data. We retain your personal data only for as long as necessary to provide the services and fulfil the purposes for which it was collected. When your operational data is no longer needed — for example, if you delete your earnings data or close your account — we destroy or anonymize it within a reasonable period, subject to Clause 6.3.
6.3 Retention of compliance records. Separately from your operational data, we retain certain records — such as consent records, processing registers, and audit logs — for the period required by applicable law and regulation, and we may retain limited data where necessary to comply with a legal, tax, or regulatory obligation, to resolve disputes, or to enforce our agreements. Deletion or anonymization of your operational data does not require deletion of these compliance records.
7.1 We use anonymization as a protective measure and use aggregated and anonymized data for research, analytics, and product improvement. Once anonymized, data can no longer identify you and is no longer Personal Data.
7.2 Consistent with Section 5, we do not share your identifiable Personal Data with third parties for their own purposes without your consent. Where you exercise your right under Section 9, we may anonymize the relevant data in our systems in place of retaining it as Personal Data.
8.1 As the data subject, you have the right to access and rectify any personal data we hold about you, in accordance with the PDPA. Your rights under the PDPA also include, subject to its conditions and exceptions, the right to data portability, the right to erasure, and the right to withdraw consent. The App also lets you view your statement history and delete your earnings data. To exercise these rights, please contact our Data Protection Officer at legal@gonsave.co
8.2 To facilitate your request, we require sufficient information to verify your identity and understand the nature and context of your inquiry.
8.3 We will respond to your request within the timeframe required by the PDPA, and will communicate any correction of your personal data within 30 days. Where we decline a correction, we will provide written justification, and you may require the data to be marked as objectionable and the Authority notified. We will transmit corrected personal data to any organization to which it was disclosed within the year preceding the correction, unless their legal or business purposes do not necessitate it.
8.4 Rights against a Partner Financial Institution. Where your data has already been disclosed to a Partner Financial Institution with your authorisation, that institution is an independent controller of the data it holds. You may need to exercise your access, correction, erasure, or withdrawal rights directly against that institution, and we will provide you with reasonable assistance to do so.
9.1 As the data subject, you may withdraw your consent for the collection, use, or disclosure of your personal data, in whole or in part, at any time — including your authorisation to share data with a Partner Financial Institution — through a simplified mechanism made available in the App or by contacting our Data Protection Officer at legal@gonsave.co
9.2 Upon withdrawal, we will inform you of the likely consequences and will stop the relevant processing without undue delay, and immediately where the processing is likely to cause you harm, in accordance with the PDPA, unless continued processing is required or permitted by law. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Where your data has already been disclosed to a Partner Financial Institution, withdrawing your authorisation stops further disclosure by us, but the institution may continue to hold and process the data it has already received under its own obligations (for example, where retention is required in connection with a loan or by regulation); you may exercise your rights directly against that institution as described in Clause 8.4.
10.1 Zaver is operated by a Singapore-incorporated entity, and some processing, storage, or support — including cloud hosting and the automated and artificial-intelligence-assisted processing of uploaded statements and photographs — may take place outside Bangladesh, including in jurisdictions such as Singapore and the United States. Where we transfer personal data across borders, we do so only where (a) you have consented, (b) the transfer is necessary to perform our contract with you, or (c) the receiving jurisdiction provides an adequate level of protection as recognised under the PDPA, and we apply appropriate contractual and technical safeguards. A summary of the categories of overseas recipients and the destinations of transfer is provided to you at the point of consent, and a current list is available on request.
10.2 Data residency. Where the PDPA or its implementing rules require certain categories of data to be stored within Bangladesh, we assess those requirements against the data and architecture used for Zaver and, where required, retain a copy within Bangladesh. We keep this assessment under review as the implementing rules develop, and we act on qualified local legal advice.
10.3 Large-scale transfers of sensitive data. For any large-scale transfer of sensitive personally identifiable data, we will comply with the applicable notification and heightened-oversight requirements under the PDPA before transfer. The Authority may suspend transfers to foreign recipients where applicable requirements are not met.
11.1 Where we collect business contact information provided to us in a business or professional capacity (such as name, designation, business telephone, or business email), we process it for the Purposes and in accordance with the PDPA and this Policy.
12.1 We may use the following cookies and similar technologies: (a) basic cookies for distinguishing you from other users of the App or website; (b) login cookies designed to recall your previous log-ins and keep you signed in; and (c) session cookies for monitoring your navigation and storing your chosen inputs. You may block or deactivate cookies in your browser settings.
13.1 Our role. GON$AVE provides Zaver as a technology service. It is not a lender, does not make credit or lending decisions, and does not assume any credit risk. Any decision to offer, approve, price, or decline a financial product is made solely by the relevant Partner Financial Institution, which is responsible for that decision.
13.2 Automated and AI-assisted processing. We use automated and artificial-intelligence-assisted processing to read and structure the earnings statements you upload and to generate related insights. This processing does not by itself produce a credit or lending decision; any such decision is made by a Partner Financial Institution. You may contact us with questions about how your data has been processed, and you may exercise your rights under Sections 8 and 9.
13.3 Adults only. The Zaver App is intended for use by delivery riders and other individuals aged 18 years or older, and is not directed to children. We do not knowingly collect the personal data of a child, and will take steps to delete it if we become aware that we have.
13.4 Data breach notification. If a personal data breach occurs that is likely to cause significant damage to a data subject, we will notify the Authority within the timeframe and in the manner prescribed by the PDPA and its regulations, and will notify affected data subjects where required.
13.5 Other consents. The consent you grant under this Policy is supplementary to, and does not override, any separate consent you provide. If the PDPA allows us to collect, use, or disclose personal data without your explicit consent, such legal authorization shall remain in effect.
14.1 The National Data Management Authority (also referred to as the Data Protection Authority) acts as the primary authority in Bangladesh for matters pertaining to the protection of personal data.
14.2 The National Data Management Authority is responsible for upholding the PDPA and issuing rules, regulations, and Standard Operating Procedures. If you are not satisfied with how we have handled your Personal Data, you may lodge a complaint with us in the first instance at legal@gonsave.co and, thereafter, with the Authority.
I acknowledge that I have read and understood this Data Privacy Policy, and consent to the collection, use, and disclosure of my information by Zaver for the purposes set out in it.