Compliance

GDPR & Your Data Protection Rights

Last updated:

ORCAB works with partners, supporters and volunteers internationally, including in Europe. This page explains how the EU General Data Protection Regulation (GDPR) — and the equivalent UK GDPR — relates to personal data we receive through this website, and how you can exercise your rights.

1. When the GDPR applies

ORCAB is based in Bangladesh. The GDPR can apply to organisations outside the EU when they process personal data of people in the EU in connection with offering them services or monitoring their behaviour. Wherever the GDPR applies to our handling of your data, we will respect the rights described on this page. We also apply the same standards as a matter of good practice to all visitors, wherever they are located.

2. Principles we follow

In line with Article 5 GDPR, we aim to ensure that personal data is:

  • processed lawfully, fairly and transparently;
  • collected for specified purposes and not used in ways incompatible with them;
  • adequate, relevant and limited to what is necessary;
  • accurate and kept up to date;
  • kept no longer than necessary;
  • kept secure against unauthorised access, loss or damage.

We rely on the following legal bases. Full details of each purpose are set out in our Privacy Policy.

Consent — Art. 6(1)(a)
Volunteer updates by email/SMS and use of photos/videos. You can withdraw consent at any time.
Steps before an agreement — Art. 6(1)(b)
Processing your volunteer application at your request.
Legitimate interests — Art. 6(1)(f)
Responding to enquiries, protecting the website from spam and abuse, and keeping it secure.
Explicit consent — Art. 9(2)(a)
Health information you choose to provide in the volunteer form.

4. Your rights

Right of access Art. 15

Ask for a copy of the personal data we hold about you.

Right to rectification Art. 16

Ask us to correct inaccurate or incomplete data.

Right to erasure Art. 17

Ask us to delete your data where there is no good reason to keep it.

Right to restriction Art. 18

Ask us to pause the use of your data in certain circumstances.

Right to data portability Art. 20

Receive data you gave us in a structured, machine-readable format.

Right to object Art. 21

Object to processing based on our legitimate interests.

Withdraw consent Art. 7(3)

Withdraw any consent you have given, at any time.

Lodge a complaint Art. 77

Complain to a data protection supervisory authority.

5. How to make a request

  1. Email info@orcabbd.org with the subject line “Data protection request”, or write to us at our Dhaka office.
  2. Tell us which right you wish to exercise and give enough detail for us to find your data (for example, the email address you used on the volunteer form).
  3. We may ask you to confirm your identity before acting on the request, to protect your data from others.

There is normally no fee. Under the GDPR, requests should be answered within one month of receipt; this can be extended by up to two further months for complex requests, in which case we will tell you why.

6. International transfers

Personal data you send us from the EU/EEA or UK is transferred to Bangladesh, where ORCAB is based. The European Commission has not issued an adequacy decision for Bangladesh, which means Bangladeshi law has not been assessed as providing equivalent protection. Where you submit information to us directly — for example through the contact or volunteer forms — the transfer takes place at your request and is necessary to respond to you or process your application (Art. 49(1)(b) GDPR). Some service providers we use (such as Google) may also process data outside the EU under their own transfer safeguards.

7. Complaints

If you have a concern, please contact us first so that we can try to resolve it. You also have the right to lodge a complaint with the data protection supervisory authority in the EU/EEA country where you live or work, or where you believe an infringement occurred. A list of authorities is available from the European Data Protection Board. In the UK, the authority is the Information Commissioner’s Office.