Privacy Policy

1. Scope

This policy applies to personal data processed by Onesta in connection with visitors to onestabd.com, business contacts at customers, suppliers, distributors, and partners, applicants for employment, and members of the public who contact us.

It does not apply to anonymous or aggregated data that cannot be used to identify an individual, or to personal data processed by independent third parties whose websites or services may be linked from this website.

2. Controller

The controller of personal data described in this policy is Onesta Food and Beverage Limited, with its registered head office in Dhaka, Bangladesh. For privacy enquiries, contact privacy@onestabd.com.

3. Categories of personal data

Depending on the interaction, Onesta may process the following categories of personal data:

• Identification data: name, job title, employer, business address.
• Contact data: business email, business telephone, postal address.
• Commercial data: order history, payment terms, communications, contracts.
• Recruitment data: curriculum vitae, education, employment history, references, right-to-work documentation, assessment notes.
• Technical data: IP address, device identifiers, browser type, operating system, referring pages, pages viewed, timestamps.
• Cookie and analytics data, as described in the Cookie Policy.
• Image or audio recordings where collected at facilities under signage, for security and food-safety verification.

4. Sources

Personal data is collected directly from the individual, generated through interaction with our website or facilities, received from referees or recruitment partners with the candidate's knowledge, or received from third-party business sources where lawful.

5. Purposes and lawful bases

Onesta processes personal data for the following purposes, on the lawful bases stated:

• To operate this website and respond to enquiries — based on legitimate interest in operating the business, and where required, consent.
• To manage commercial relationships, contracts, orders, deliveries, invoices, and payments — based on the performance of a contract and legitimate interest.
• To assess applications for employment and conduct recruitment — based on steps taken at the request of the candidate prior to entering a contract, and legitimate interest.
• To comply with legal, tax, accounting, and regulatory obligations — based on legal obligation.
• To protect personnel, visitors, property, and product integrity — based on legitimate interest.
• To investigate and respond to complaints, claims, and disputes — based on legitimate interest and legal obligation.
• To send commercial communications to business contacts about products and services — based on legitimate interest, with opt-out at any time.

6. Sharing

Onesta does not sell personal data. Personal data may be shared with the following categories of recipients, subject to appropriate safeguards:

• Service providers acting as processors, including hosting providers, email providers, IT support, payroll providers, and professional advisers.
• Banks, insurers, auditors, and tax authorities, where required for the operation of the business or compliance with law.
• Regulators, law-enforcement agencies, and courts, where required by law or to establish or defend legal rights.
• Acquirers or counterparties in a corporate transaction, subject to confidentiality.

7. International transfers

Some service providers may process personal data outside Bangladesh. Where this is the case, Onesta takes reasonable steps to ensure an adequate level of protection through contractual commitments and security controls. Personal data may be transferred to jurisdictions whose laws differ from those of Bangladesh.

8. Retention

Personal data is retained for the period necessary to fulfil the purpose for which it was collected, including to satisfy any legal, accounting, tax, or reporting requirements. Indicative retention periods are as follows:

• Website enquiry messages: up to 24 months from last contact.
• Customer and supplier records: for the duration of the relationship and for the period required by tax and commercial law thereafter.
• Recruitment records of unsuccessful candidates: up to 12 months, unless the candidate consents to a longer period.
• Cookies and analytics data: as set out in the Cookie Policy.

When retention periods expire, personal data is deleted or anonymised.

9. Security

Onesta applies technical and organisational measures appropriate to the risk of processing. Measures include access controls, role-based authorisation, encryption in transit for the website, monitoring, employee training, and contractual security commitments from service providers. No transmission over the internet or method of electronic storage is fully secure.

10. Rights of data subjects

Subject to local law, individuals may have the right to request access to their personal data, request correction of inaccurate data, request deletion, object to or restrict certain processing, and request portability of data they have provided. Where processing is based on consent, the individual may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Requests should be sent to privacy@onestabd.com. Onesta may need to verify the identity of the requester before acting on a request. Onesta will respond within the timeframe required by applicable law.

11. Children

This website is not directed at children. Onesta does not knowingly collect personal data from children. If a parent or guardian believes that a child has provided personal data through this website, they should contact privacy@onestabd.com so that the data can be reviewed and, where appropriate, deleted.

12. Cookies

This website uses cookies and similar technologies. The Cookie Policy describes the categories of cookies used, their purposes, and how to control them.

13. Third-party links

This website may contain links to third-party websites. Onesta is not responsible for the content or privacy practices of those websites. Visitors should review the privacy notices of those websites before providing personal data.

14. Automated decision-making

Onesta does not use automated decision-making, including profiling, that produces legal or similarly significant effects on individuals in connection with this website.

15. Changes

Onesta may amend this policy from time to time to reflect changes in operations, technology, or law. The policy published on this page replaces earlier privacy wording on the website. Material changes will be communicated through this website or by other appropriate means.

16. Contact

Privacy enquiries and requests should be addressed to privacy@onestabd.com or to the head office in Dhaka, Bangladesh.