Privacy Policy

Last updated: [OWNER TO CONFIRM: date of final version]

1. Who we are

This site is run by Astona, a coaching center in Bangladesh (“Astona”, “we”, “us”). This policy explains what personal information we collect through this website and student portal, why we collect it, who else sees it, how long we keep it and what choices you have.

Registered name and address: [OWNER TO CONFIRM: registered business name and registered address].

2. Who this policy is about

Most of our students are under 18. The admission form asks for a parent or guardian’s name and phone number, and applying means a parent or guardian agrees to this policy on the student’s behalf. [OWNER TO CONFIRM: wording for guardian consent and how we treat the data of children under 18, for example who may apply and what proof of guardianship, if any, we ask for.]

3. What we collect and why

3.1 Admission application

When you apply for a batch, the form collects:

• student’s full name, gender and date of birth;
• ID document type and ID number (birth registration, NID, passport or similar);
• a photograph of the student;
• student’s phone number and guardian’s name and phone number;
• email address (optional);
• institution, class or level, passing year (optional), roll number (optional);
• preferred branch (optional);
• the time you ticked the consent box.

Why: to review your application, confirm your identity, reserve a seat, create your student account, contact you and your guardian, and keep a record of who is enrolled.

3.2 Payments

We keep an invoice for each application and a record of each payment attempt: invoice number, amount, status, payment method, the gateway’s payment and transaction identifiers, and the gateway’s response. We never see or store your card number, mobile-banking account number, PIN or password. You enter those on the payment gateway’s own page. The gateway is not connected yet (bKash is planned). Until then payment is recorded by our staff at the office.

Why: to confirm that you paid, send a receipt and keep accounts.

3.3 Student account

When an application is approved or paid we create an account using your phone number as the login and a password. Passwords are stored only as a one-way hash, so staff cannot read them. We also keep your name, guardian details, institution, photo and the batches you are enrolled in, and the dates of enrolment.

Why: so you can log in, see your courses, notices, receipts and live classes.

3.4 SMS messages

We send SMS to your phone for: your first login details, one-time login codes (OTP), payment receipts, notice that a course was added to your account, a hint on how to log in, important (critical) notices, and a message when an application is not approved.

The text of messages that contain login credentials or OTP codes is never stored. For the other messages we keep a log with the phone number, message type, delivery status and an encrypted copy of the text. OTP codes are stored only as a hash and expire after 5 minutes.

Why: to let you sign in, tell you about payments and enrolment, and reach you with urgent information.

3.5 Live-class join log

When a student joins an online class through the portal we record which class, which student, the time, and a hashed (not readable) form of the internet address. Why: to see who attended and to investigate misuse of class links.

3.6 Staff activity (audit log)

When staff change important records (for example approving an application or changing a result) we record who did it, what they did, when, and a hashed form of their internet address. Why: security and accountability.

3.7 Contact form

The contact form collects your name, phone number, optional email, topic, optional course and your message, and a hashed form of your internet address for abuse prevention. Why: to answer your question.

3.8 Results and gallery

We publish a student’s name, photo or result on the public Results or Gallery pages only when the student or guardian has given written consent, and staff have verified the result. A record without confirmed consent is not shown. You may withdraw consent at any time by contacting us and we will remove the record from the public pages.

3.9 Cookies

The site sets the cookies WordPress needs to keep students and staff logged in. Visitors who are not logged in do not receive login cookies. We do not use analytics, advertising or tracking cookies. If we add any in future we will update this policy and ask for your consent where required. Fonts are hosted on our own server, not loaded from a third party.

4. Who else receives your information

We do not sell your personal information. We share it only with the service providers needed to run the site:

• Payment gateway: [OWNER TO CONFIRM: gateway name; bKash is planned and not yet connected]. It receives the amount and what is needed to take your payment. You enter payment details on its page.
• SMS gateway: [OWNER TO CONFIRM: provider; not yet chosen]. It receives the phone number and text of each SMS, including OTP and credential messages while they are being delivered.
• Cloudflare Turnstile: on forms where it is switched on (currently the Contact form), a Cloudflare check runs in your browser to block bots. Cloudflare receives technical information such as your internet address. If we also use Cloudflare to protect or speed up the site, it handles traffic to the site.
• Maps: the Contact page may show a map embedded from OpenStreetMap or Google Maps. Those providers can see your internet address when the map loads.
• Hosting provider: [OWNER TO CONFIRM: hosting company and server location]. It stores the site and database.

We may also disclose information when the law requires it. [OWNER TO CONFIRM: any other recipients, for example auditors or government bodies.]

5. How long we keep information

• Login codes (OTP): deleted automatically about an hour after they expire.
• Contact inquiries: inquiries marked handled or spam are deleted automatically 365 days after they were received. Inquiries nobody has handled are deleted after 730 days.
• Admission applications, enrolment, student account, payment and invoice records, SMS log, join log and audit log: [OWNER TO CONFIRM: how long each is kept and what is deleted or anonymised afterwards. The system does not delete these automatically today.]
• Result and gallery records: shown only while consent stands; removed from public pages on request.

6. How we protect your information

• ID numbers are encrypted in the database.
• Meeting links for live classes are encrypted, shown only to students enrolled in that batch through the portal, and never put in public pages.
• Student photos are re-saved without hidden metadata and kept in private storage outside the public web folder.
• Passwords are stored only as hashes. OTP codes are stored only as hashes.
• Internet addresses in logs are stored only as hashes.
• Access is limited by role: owner, staff and instructors see only what their work needs, and instructors only see their own batches.
• Important staff actions are written to an audit log.
• Login, OTP, contact and admission requests are rate-limited, and forms include bot protection, to reduce abuse.

No system is perfectly secure. If we learn of a breach that affects you we will tell you as the law requires. [OWNER TO CONFIRM: breach notification process.]

7. Your choices and rights

You (or your guardian, if you are under 18) may ask us to:

• show you the information we hold about you;
• correct information that is wrong;
• delete your information, or withdraw your consent for publishing your name, photo or result.

Send the request using the contact details below. We may need to confirm who you are first. Some records (for example payment records) may have to be kept for accounting or legal reasons. [OWNER TO CONFIRM: response time, for example 30 days, and which records are kept after a deletion request.] Bangladesh’s data-protection rules are still developing, so this policy may change as the law changes.

8. Refunds and other policies

Fees and refunds are covered in our Terms & Conditions. [OWNER TO CONFIRM: refund policy (open question OQ-06).]

9. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change is significant we will tell students by notice or SMS. [OWNER TO CONFIRM: how and when users are told.]

10. Governing law

[OWNER TO CONFIRM: governing law and the courts that handle disputes, as advised by the lawyer.]

11. Contact us

For questions or requests about your information, use the phone number, email and address on our Contact page. Those details are taken from the Settings page in the site’s admin area, so they stay up to date automatically. Data-protection contact: [OWNER TO CONFIRM: person or role and a dedicated email address].