At WebmakerBD, we operate on the fundamental premise of Data Minimization by Design. As premier digital service providers building bespoke web platforms and cloud backends, we believe your personal data is yours alone. We only collect the minimal personal information strictly required to deliver high-performance software engineering, handle invoicing, and offer ongoing technical maintenance.

In accordance with Article 6 of the General Data Protection Regulation (GDPR), we collect and process information under legitimate commercial interests and contractual fulfillment:

Your information is processed strictly for legitimate operational purposes:

• Delivering custom software engineering and maintaining production application stability.
• Processing milestone invoices and maintaining financial audit trails as required by corporate tax law.
• Distributing security notices, maintenance alerts, and service performance reports.
• Defending against automated bot attacks, unauthorized staging intrusions, and malware exploits.

Zero Sale of Data: WebmakerBD does not monetize user analytics or client data. We do not participate in behavioral ad retargeting networks.

We use strictly essential technical cookies required for website operation:

• Essential Session Cookies: Required to preserve user authentication, CSRF security tokens, and responsive UI preferences.
• Performance Telemetry: Aggregated, privacy-friendly analytics with client IP addresses anonymized at the edge to evaluate page load metrics.

You may disable or block cookies at any time via your browser preferences without losing access to our core website pages.

To deliver resilient cloud solutions, we collaborate with certified enterprise subprocessors who maintain active SOC 2 Type II and ISO 27001 certifications:

• Amazon Web Services (AWS) & Google Cloud: Secure cloud compute, database hosting, and automated backup infrastructure.
• Cloudflare Inc.: Global edge network, DDoS mitigation, and SSL/TLS traffic encryption.
• Stripe Inc.: PCI-DSS Level 1 certified billing infrastructure. WebmakerBD never stores raw credit card numbers.

International transfers are safeguarded under European Commission Standard Contractual Clauses (SCCs).

WebmakerBD enforces defense-in-depth security across every application and database layer:

• Encryption Standards: Data in transit is secured using modern TLS 1.3 encryption with Perfect Forward Secrecy. Data at rest is encrypted with AES-256.
• Access Governance: Role-Based Access Control (RBAC) with mandatory hardware-backed Multi-Factor Authentication (MFA) for all engineering staff.
• Vulnerability Management: Automated weekly dependency vulnerability scans (CVE audits) and sanitized staging test environments.

We do not hold data longer than legally or contractually mandated:

• Transient Technical Logs: Edge server access logs and debugging traces are automatically rotated and purged after ninety (90) days.
• Project Inquiries: Unsuccessful project requests are securely erased after twelve (12) months.
• Commercial Accounting Records: Invoices and transaction records are retained for seven (7) years in accordance with statutory tax laws.

Regardless of your geographical location, WebmakerBD extends universal data rights to all clients:

1. Right to Access: Request a copy of all personal records we hold regarding your identity.
2. Right to Rectification: Request prompt correction of inaccurate or incomplete records.
3. Right to Erasure ("Right to Be Forgotten"): Request full deletion of your personal records, subject to statutory tax retention exemptions.
4. Right to Data Portability: Obtain your data in a structured, machine-readable JSON/CSV format.
5. Right to Non-Discrimination: Under the California Consumer Privacy Act (CCPA), you will never receive degraded service or price penalties for exercising your privacy rights.

To exercise any of your data rights or to submit an inquiry regarding our compliance architecture, please contact our designated Data Protection Officer: