Plain-language privacy for serious engineering work.

RenovaLabs ("we", "us", "our") is a cloud-native modernization and enterprise architecture firm incorporated and headquartered at Level 5, House 18, Road 1/A, Block J, Baridhara, Dhaka 1212, Bangladesh, with an operational presence in Singapore.

RenovaLabs is the data controller for personal information collected through our website (renovalabs.com), our inquiry and contact forms, and our professional engagement processes. Questions regarding this policy may be directed to us at the address in Section 10.

We collect only what is necessary for the stated purpose. The categories are:

Every data point we hold serves a defined purpose. We do not sell personal data. We do not use it for advertising. The purposes are:

• To respond to enquiries submitted via our contact form or calendar booking, and to schedule the requested 30-minute technical session.
• To scope, deliver, and manage modernization engagements under signed Statements of Work (SOW).
• To perform free 2-day security assessments, including penetration testing and gap analysis, on systems explicitly made available to us by the client organisation.
• To send you project updates, milestone reports, and sprint review summaries relevant to your active engagement.
• To fulfil our legal obligations, including compliance with Bangladesh PDPO 2025 requirements, applicable tax regulations, and contractual obligations.
• To improve our website and service delivery through anonymised analytics data.
• To contact you about new services or capabilities only where you have provided explicit consent or where a legitimate interest applies, and always with an opt-out mechanism.

Where applicable data protection law requires a lawful basis for processing personal data, we rely on the following:

We do not sell, rent, or trade personal data. We share data only in the following circumstances:

• Service Providers. We engage third-party tools for project management, analytics, cloud hosting, and communication. These processors access data only as necessary to perform their functions and are bound by data processing agreements.
• Professional Advisors. Lawyers, accountants, and auditors acting under duties of confidentiality, where required by regulatory or legal process.
• Legal Requirements. Where we are required to disclose information by applicable law, court order, or regulatory authority, we will comply and, where legally permitted, notify the affected party.
• Business Transfers. In the event of a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction. Affected parties will be notified in advance.

Client technical data, including codebases, architecture documents, and infrastructure configurations shared under an SOW, is never disclosed to any third party outside the delivery team assigned to that engagement, except where required by law.

RenovaLabs operates from Bangladesh with a presence in Singapore. If you are located in another jurisdiction, your personal data may be transferred to and processed in Bangladesh and/or Singapore.

Where such transfers involve personal data originating in regions with transfer restrictions, for example data governed by GDPR, we rely on appropriate safeguards including Standard Contractual Clauses or equivalent mechanisms to ensure an adequate level of protection is maintained.

We do not transfer client technical data outside the engagement team without explicit written authorisation from the client.

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law.

After the applicable retention period, data is securely deleted or anonymised so that it can no longer be linked to an individual.

Depending on your jurisdiction and applicable law, including the Bangladesh Personal Data Protection Ordinance 2025, GDPR, PDPA Singapore, or equivalent, you may hold some or all of the following rights in relation to your personal data:

• Access. The right to request a copy of the personal data we hold about you.
• Rectification. The right to have inaccurate or incomplete data corrected.
• Erasure. The right to request deletion of your personal data, subject to legal retention obligations.
• Restriction. The right to request that we limit processing of your data in certain circumstances.
• Portability. The right to receive your data in a structured, machine-readable format where technically feasible.
• Objection. The right to object to processing based on legitimate interests, including direct marketing. Marketing opt-outs are honoured immediately.
• Withdraw Consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a Complaint. You have the right to lodge a complaint with your national or regional data protection authority if you believe your rights have been violated.

Security is our core business. We apply the same rigour we bring to client engagements to the protection of data we hold internally. Our technical and organisational measures include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest across all systems holding personal or client data.
• Access controls and least-privilege principles. Only authorised team members assigned to a specific engagement access client technical data.
• Multi-factor authentication on all internal systems and third-party platforms used in delivery.
• Secure code repositories with audit logging and access reviews.
• Regular internal security reviews, including the same penetration testing and SAST/DAST methodologies we apply to client systems.
• Incident response procedures. In the event of a data breach affecting personal data, we will notify affected individuals and relevant authorities within the timeframes required by applicable law.

No data transmission over the internet is completely secure. However, we apply industry-best practices to minimise risk and respond swiftly to incidents.

For any questions about this policy, to exercise your rights, or to raise a concern about how your data is handled, contact us through any of the following:

This policy was last reviewed and updated on 13 May 2026. We may update it from time to time to reflect changes in our practices or legal obligations. Substantive changes will be communicated to active clients directly. The current version is always published on our website.