Privacy policy

Who we are

T Roselle is an independent retailer in Bangladesh importing beauty, skincare and fragrance products from the United States. We decide what personal data is collected through this site and why, which makes us the data controller for it. Our contact details are at the foot of this page.

What we collect, and why

We hold four kinds of information, and nothing else.

• Messages you send us. Your name, email address, phone number if you give one, and what you wrote. We hold this so we can answer you. You tick a box to confirm that before sending, and we record which version of this policy you agreed to.
• Order details. If you place an order through Messenger, WhatsApp or the phone, we record your name, phone number, delivery address and what you bought, so we can deliver it, answer questions about it, and keep the accounting records we are required to keep.
• A hashed IP address. When you use the contact form we store a one-way, salted hash of your IP address — never the address itself. It exists solely to enforce a limit of three messages per hour, which is what stops the form being used to flood us. The hash cannot be reversed into an address.
• Basic request information. Your browser’s user-agent string and the page you came from, truncated, stored alongside a contact message. It helps us tell an automated submission from a person.

What we do not collect

There is no shopping cart on this website and no payment page, so we never see or store card numbers, mobile-wallet PINs or banking credentials. We do not run analytics that profile you, advertising pixels, or any third-party tracker. We do not build advertising profiles and we do not sell or rent your details to anyone, ever.

Cookies

If you are browsing as a customer, this site sets no cookies at all — there is nothing to accept or dismiss. The only cookie we set is a session cookie for signed-in staff, so that a member of staff stays signed in; it may be refreshed on any page they visit while signed in. It is strictly necessary for the staff area to function and is never used for tracking.

Why we are allowed to hold it

For messages, because you gave us your consent and asked us to reply. For orders, because we need the information to perform the contract of sale you entered into with us, and because we are required to keep sales records. For the hashed IP, because we have a legitimate interest in keeping the site usable and free from abuse — an interest we have deliberately balanced against your privacy by hashing rather than storing the address.

Who else sees it

Only the people and services that have to.

• Our own delivery staff, in and around our area, who are given the name, address and phone number needed to bring an order to you.
• Our courier partner, for deliveries further afield, who is given the same three details and nothing more.
• Nobody, if you collect in person — your address never leaves us at all.
• Supabase, which hosts our database and file storage, and Vercel, which serves this website. Both process data on our instructions and neither uses it for their own purposes.
• Cloudflare, whose Turnstile service verifies that a contact form submission comes from a person rather than a script.
• A regulator, court or law enforcement body, where we are legally required to disclose something.

Some of these services store data outside Bangladesh. Where that happens, we use providers that commit contractually to protecting it to a standard at least equivalent to this policy.

How long we keep it

• Messages filed as spam: 30 days, then deleted automatically.
• Archived contact messages: 24 months, then deleted automatically.
• Order and customer records: at least 6 years, because tax and accounting rules require us to keep them that long.
• Staff activity logs: 24 months, then deleted automatically.

The deletions above run on a nightly schedule inside our database, not by anyone remembering to do it, and each run is recorded so we can show that it happened. You can also ask us to remove your details sooner — see below.

What you can ask us to do

Write to complaints@troselle.com and we will respond within 72 hours. You can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your details;
• stop sending you marketing messages, which you can also do by replying “stop”.

One honest limit on deletion: if you have placed an order, we cannot erase the order record, because we are required to keep sales and tax records. What we can and will do in that case is remove your name, phone number, email address and delivery address from it, so the accounting entry survives and you are no longer identifiable in our system. We will tell you plainly which of the two we have done.

One further limit: our nightly encrypted backups still hold whatever was in the database when they were taken, so a deleted detail can remain in them until that copy expires automatically 400 days later. Backups are only ever opened to recover from a disaster, never to look someone up.

How we protect it

The site is served over HTTPS only. The database enforces access rules at row level, so the public site is technically incapable of reading customer or order data — it is not a matter of the website choosing not to ask. Staff access requires an individual account, every change is recorded against the person who made it, and sign-in attempts are rate limited. No system is perfect; if we ever discover a breach affecting your data we will tell you what happened, what it means for you, and what we have done about it.

Children

This site is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe we hold a child’s details, tell us and we will delete them.

The law this sits under

Bangladesh does not yet have a comprehensive data protection act in force. Rather than treat that as permission to do less, we have written this policy to the standard of established international data-protection practice, which also covers you if you are reading this from the EU or UK. The instruments that do apply to us include:

• Cyber Protection Ordinance 2025 — Current cyber-offense regime. Succeeded the Cyber Security Act 2023, which itself repealed the Digital Security Act 2018.
• Information and Communication Technology Act 2006 (as amended) — Electronic records, electronic signatures and residual offense provisions.
• Consumer Rights Protection Act 2009 — Prohibits misleading claims about goods, the sale of adulterated or counterfeit products, refusal to issue a receipt, and sale above the displayed price.
• Digital Commerce Operation Guidelines 2021 — Mandatory seller disclosure, delivery timelines, advance-payment handling and refund windows for online sellers.
• Sale of Goods Act 1930 and Contract Act 1872 — The underlying contract of sale and implied conditions as to description and quality.
• Value Added Tax and Supplementary Duty Act 2012 — VAT treatment of supplies and the requirement to state tax treatment in displayed prices.
• Customs Act 2023 and the prevailing Import Policy Order — Lawful importation, duty-paid status and documentation for imported cosmetics.

Changes

When this policy changes we update the version number and effective date at the top. Material changes will be announced on the site. Previous versions are available on request, so you can always see what you agreed to.

Related: terms of use and our authenticity disclaimer.