Privacy policy

1. Who we are

Lagbe Foundation (“we”, “us”) is a non-profit, non-political organisation in Bangladesh; its registration with RJSC as a society is in progress. We run this website, the Lagbe Foundation sign-in service used by our apps such as Tuhur, and the payment service that processes donations. We are responsible for the personal information described in this policy.

We handle personal data in line with the laws of Bangladesh, including the Personal Data Protection Ordinance 2025, and with the principles of fairness, purpose limitation, data minimisation and security that it sets out.

2. What we collect

We only ask for information that is needed for the specific thing you are doing:

• Donations: your name (unless you give anonymously), phone number or email for your receipt, amount, fund or program, the payment reference, and the transaction ID and number or account you paid from. You pay in your own wallet or bank app; we never see or store your PIN.
• Volunteer registration: your name, contact details, district, skills, availability and, if you choose, a photo.
• Aid applications: the applicant’s name, contact details, address, household and income information, details of the support requested, and a scan of the National ID (NID) or birth certificate to verify identity. For education or medical support we may also ask for school or medical documents.
• Contact form and emails: your name, contact details and the content of your message.
• Lagbe Foundation account and sign-in: your name, email or phone number, a securely hashed password, and a record of which of our apps you have signed in to.
• Technical data: basic server logs such as IP address, browser type and time of request, kept for security and troubleshooting.

3. How we use it

• To process donations, send receipts and keep accurate accounting records.
• To review aid applications, visit and verify households, deliver support and follow up.
• To match volunteers with activities, contact them and issue volunteer certificates.
• To answer your messages and requests.
• To let you sign in to Lagbe Foundation apps with a single account.
• To protect our services against fraud, abuse and spam.
• To publish aggregated, anonymous figures, for example on our impact and transparency pages.

We do not sell, rent or trade personal information, and we do not use it for advertising.

4. Identity documents and sensitive information

NID scans, medical documents and household details submitted with aid applications are stored in private storage that is not publicly accessible. Only authorised staff and field coordinators handling the application can view them, and access requires signing in to our administration system.

We never publish an applicant’s name, photo or story without their clear consent. Stories on this website are shared with the permission of the people in them.

5. When we share information

We share personal information only when necessary:

• With payment providers (the bank or wallet company behind our Bangla QR, and the one you pay with) to complete and check your donation.
• With service providers that host our systems or send emails and SMS on our behalf, under confidentiality obligations.
• With our own apps (such as Tuhur) when you choose to sign in with your Lagbe Foundation account: they receive only your basic profile (name and email or phone), not your donations or applications.
• With authorities when required by Bangladeshi law or to protect someone’s safety.

6. Signing in to our apps

Lagbe Foundation runs a central sign-in service for apps run by the foundation. When an app asks you to sign in, you are sent to Lagbe Foundation to enter your credentials; the app receives a secure token, never your password. You can sign out of all apps at any time and ask us to revoke an app’s access.

7. Cookies

We use a small number of essential cookies: a session cookie that keeps you signed in and protects forms against forgery, and preference storage that remembers your language and light or dark theme. We do not use advertising or cross-site tracking cookies.

8. How long we keep it

• Donation and accounting records are kept for as long as required by Bangladeshi financial and tax rules, as the ledger must remain complete.
• Aid applications and their documents are kept while support is being provided and for a limited period afterwards for audit, after which identity documents are deleted.
• Volunteer records are kept while you are an active volunteer and for a reasonable period afterwards so we can confirm your service.
• Contact messages are kept only as long as needed to resolve your request.
• Server logs are deleted automatically after a short period.

9. How we protect it

Our website uses encrypted HTTPS connections. Passwords are hashed, staff access is role-based and limited to what each person needs, and administrative actions are logged. No system is perfectly secure, but if a breach affecting your data occurs we will inform you and the relevant authorities as required by law.

10. Your rights

You can ask us at any time to:

• Tell you what personal information we hold about you and give you a copy.
• Correct information that is inaccurate or incomplete.
• Delete your information, unless we must keep it by law (for example, financial records of a donation).
• Stop contacting you, or withdraw consent you have given, such as for sharing your story.

11. Children

Applications for education support are made by a parent or guardian on the child’s behalf. We do not knowingly collect information directly from children under 18 without a guardian’s involvement.

12. Changes to this policy

We may update this policy as our work or the law changes. The date at the top shows when it was last revised. Significant changes will be highlighted on this website.

13. Contact us

For any privacy question or to exercise your rights, email [email protected]. We aim to reply within 30 days. If you are not satisfied with our response, you may complain to the data protection authority of Bangladesh.