Privacy Policy
A. Privacy Policy
This Privacy Policy explains how we collect, use, share and protect personal data when you use the GMS website and applications (the “Platform”).
1. Who we are
The Platform is operated by Utshahi Enterprises Limited (“GMS”, “we”, “us”). For privacy questions contact support@ghorduar.com. We act as the data controller (data fiduciary) for the personal data described below, except where we process data on behalf of a PMCA, in which case we act as a processor.
1.1 Roles for identity-verification (KYC) data
Where you submit identity documents (photographs of the front and back of your National ID, and a selfie) together with your identity details, they are used only to verify your identity. The reviewer depends on your role: a Landlord reviews a tenant, the PMCA administrator reviews a landlord or another administrator, and GMS reviews the first administrator of a PMCA and Property Agents. For tenant and landlord verification, GMS holds the documents on behalf of the PMCA and/or Landlord and does not use them for its own purposes. During review, the documents can be viewed on screen only by the reviewer and GMS system administrators; they cannot be downloaded, and every view is watermarked with the GMS ID and name of the person viewing, so any copy that leaves the Platform can be traced to them. When the KYC submission is approved, the document images are closed and are no longer displayed to anyone in GMS. Your identity details (name, NID number, date of birth and address) remain part of your record, because they appear on your Rental Deed and police report.
2. Scope
This policy applies to all users of the Platform: property-management companies/associations (PMCAs) and their administrators, landlords, tenants, and visitors to our website. It covers personal data of Bangladeshi data subjects and is intended to align with the Personal Data Protection Ordinance 2025 and its amendments.
3. The personal data we collect
3.1 Account data: name, email address, mobile number, password (stored only in hashed form), and role (PMCA admin, landlord, tenant).
3.2 Identity / KYC data (sensitive): National ID or passport number, date of birth, parent/guardian names, present and permanent address, photograph/selfie, and supporting documents you upload. These are collected for identity verification and, as described in 1.1 and section 8, the document images are closed once the KYC is approved.
3.3 Property & tenancy data: property and unit details, ownership records, tenancy terms, rent and service-charge amounts, agreements and amendments.
3.4 Payment-record & proof data: declared payments, payment method, dates, and any uploaded proof (e.g. bKash or bank transfer screenshots). For subscriptions, the proof of payment submitted by a PMCA.
3.5 Communications: in-app chats, notices, notifications and support messages.
3.6 Police-report data: information compiled for tenant verification/police reporting where you use that feature.
3.7 Technical & usage data: IP address, device/browser information, log files, and cookies (see the Cookie Policy).
3.8 Visitor data: when a resident invites a visitor, or a visitor checks in at a building gate, we collect the visitor’s name, mobile number, purpose of visit, the host and unit visited, arrival and departure times, a photograph where the building takes one at the gate, and the approximate location of the visitor’s phone at check-in (only if the visitor allows location access). This is used only for the building’s security and visitor records.
4. Why we use your data and our legal basis
4.1 To provide the Platform and the tenancy/management features you request — performance of a contract.
4.2 To verify identity and prepare KYC/police-verification records — your explicit consent and, where applicable, compliance with a legal obligation.
4.3 To record and display payments between the correct parties — performance of a contract and legitimate interests.
4.4 To operate subscriptions and confirm proof of payment — performance of a contract.
4.5 To secure the Platform, prevent fraud, and keep audit logs — legitimate interests and legal obligation.
4.6 To communicate with you about your account and service notices — performance of a contract / legitimate interests.
Sensitive data (NID/passport, photographs) is processed only with your explicit, informed and revocable consent, or where otherwise permitted by law.
5. How information is shared between roles
GMS is a multi-party platform. Data is shared only along the relationships you create, and on a need-to-know basis:
5.1 A tenant’s tenancy and KYC information is visible to the landlord of that unit and, where applicable, to the PMCA administering the property.
5.2 Rent payment information is private between the tenant and the landlord; the PMCA does not see rent. Service and common charges are visible to the PMCA where it administers them.
5.3 PMCA administrators see information for the properties, units, landlords and tenancies within their organisation only.
5.4 Visitor data is visible to the resident who invited or received the visitor and to the administrators of that building’s PMCA, and is not shared with anyone else except as described in section 6.
6. Disclosure to third parties
6.1 Service providers who host and operate the Platform (e.g. hosting, email delivery) under confidentiality obligations and only as needed.
6.2 Police / government authorities, where you use the police-verification feature or where disclosure is required by law.
6.3 Professional advisers, or in connection with a merger or restructuring, subject to this policy.
We do not sell your personal data, and we do not use it for third-party advertising.
7. Cross-border transfer & data residency
The Platform is hosted by Namecheap, Inc. on servers located in the United States. Personal data is therefore stored outside Bangladesh. We protect it with the measures described in section 9 and under our hosting provider’s security and confidentiality obligations, consistent with applicable law. Note for review: the Personal Data Protection (Amendment) Ordinance 2026 may require a synchronised real-time copy of certain data to be held within Bangladesh; this is being assessed.
8. How long we keep data
We keep your personal data while your account is active. After an account is closed, identity-document images and account data are deleted within 60 days. Records needed for legal, tax, audit or dispute purposes — payments and receipts, Rental Deeds, police-report submissions and audit logs — are kept for as long as the law requires, and then deleted or anonymised. Visitor data is kept for 12 months for the building’s security records, and then deleted.
Identity documents: when uploaded, each image is reduced in size and stripped of hidden photo data such as location. Once the KYC submission is approved, the images are closed and no longer displayed to anyone in GMS, but the files themselves are kept, securely and out of public reach, while your account exists, so that a verification can be evidenced if questioned. The images are deleted within 60 days after the account is closed. (Property Agents: the Terms of Sales explain how an Agent’s selfie is handled after approval.)
9. How we protect data
We use appropriate technical and organisational measures, including encryption in transit (HTTPS), hashed passwords, role-based access controls, server-side visibility rules, and audit logging of sensitive actions. No system is perfectly secure, but we work to protect data proportionately to its sensitivity.
10. Your rights
Subject to applicable law, you may: access the personal data we hold about you; request correction of inaccurate data; withdraw consent (where processing is based on consent); request deletion; object to or restrict certain processing; and lodge a complaint with the national data-protection authority. To exercise these rights, contact us using the details in section 1.
11. Cookies
We use cookies and similar technologies as described in our Cookie Policy.
12. Children
The Platform is intended for use by adults (property owners, tenants and managers). We do not knowingly collect data from children, and we do not profile or target advertising to minors.
13. Changes to this policy
We may update this policy from time to time. We will post the updated version with a new “Last updated” date and, where appropriate, notify you in the Platform.
14. Contact
Questions or requests: support@ghorduar.com.