Privacy Policy

1. Who we are

Smith's BD supplies coffee equipment, coffee products and related services in Bangladesh. You can contact us at HB Tower, Unit-401, House-1/A, Road 23, Gulshan-1, Dhaka-1212, by email at info@smithsbd.com, or by phone at +880 1601-110853.

2. Information we collect

Depending on what you do on the site, we collect account details, order and delivery details, information you enter in enquiry forms, and technical information needed to operate the website. The sections below explain these categories. You can browse and submit an order without creating an account.

The web server and request-limiting controls may process information such as your IP address, request time, requested page, referring page and browser details to deliver the site, diagnose problems and limit abuse.

3. Customer accounts

Accounts are optional; guest checkout remains available. If you create an account, we store your full name, email address, any phone number, delivery address and city or area you provide, and account creation and update times. You can view and update certain profile details while signed in.

For email-and-password accounts, passwords are processed using one-way hashing. We do not store your plain-text password. For Google Sign-In accounts, we store a unique Google account identifier. We also maintain a server-managed sign-in session.

For a new email-and-password account, we use your email address, a temporary verification code and related security information to verify that you can access the address before you set a password. The code is sent by email and is not stored in plain text in our application database.

If you request password recovery for an account with a password, we use your account email and temporary reset security information to provide a time-limited reset link. We record reset requests and use of those links for account security. Changing a password ends existing sign-in sessions and may trigger a security confirmation email. Google-only accounts are not given a local password by this process.

My Orders shows orders linked to your signed-in account. Earlier guest orders are not automatically linked because their email address matches your account. Changing your profile does not rewrite the customer or delivery information saved with a previous order.

4. Orders and checkout

When you submit an order request, we record your name, email address, phone number, selected Division, District, Area and Post Code, detailed delivery address, any company name or order notes you provide, and your payment preference. The order record also includes its reference, products, selected options, quantities, prices, delivery charge, total, status and relevant times. These details are saved with the order, so later profile changes do not change an earlier order's details.

Checkout offers cash on delivery, bank transfer and bKash as payment preferences. Selecting one does not make a payment. Our team may contact you to confirm the order and arrange payment. This website does not process these methods or card payments through an integrated online payment gateway.

5. Enquiries, quotations, rental, service and training

Contact forms collect your name, email address, phone number, subject and message. Product quotation forms also ask for an address, product and quantity. Rental and service forms ask for contact details, an address and information about the equipment, rental period or work requested. The rental and service forms display a company-name field, but the current submission does not send or save that field.

The barista training form asks for contact details, date of birth, address, preferred course time, participant count and course selections. It sends the date of birth to check that the applicant is at least 15, but does not save it in the application database. The address entered in that form is currently not sent or saved. We save the other submitted training details and the calculated total so staff can review and respond to the request.

We may send acknowledgement emails after contact, service, rental, training and product quotation requests are submitted. These messages relate to your request; they are not a marketing subscription.

6. Cookies and browser storage

The shopping cart is kept in your browser's local storage and may remain there across visits. An in-progress checkout and the most recent confirmed order receipt, including customer details, may be kept in session storage for the current tab or browser session. Session storage is generally cleared when that session ends, depending on browser behavior. The site also removes older locally stored receipt copies when the cart code loads.

If you sign in, the necessary smiths_session authentication cookie keeps your account session active. It is HttpOnly, uses SameSite=Lax protection, and is Secure when the site runs over production HTTPS. The server-managed session expires after approximately 30 days unless you log out or it ends earlier. Customer authentication tokens are not stored in local or session storage. This site does not use advertising or analytics cookies in the current implementation; third-party content may use its own cookies or similar technologies.

7. Google Sign-In

If you choose Google Sign-In, Google participates in authenticating you. We receive the identity details needed to create or access your Smith's account, including your email address, name where supplied, and a unique Google account identifier. Using Google Sign-In does not send your Smith's order history, delivery address or profile details to Google as part of this sign-in flow. Google's own policies govern its handling of information.

8. Third-party services, content and links

Some website content is supplied by other services. Loading it can send technical information, such as your IP address and browser details, to that service:

• CDNFonts supplies the Tempting font and can receive technical information such as your IP address and browser details. Inter and Fraunces are served directly from this website.
• Cloudinary supplies some product images. Other image hosts may also be used for catalogue images.
• Google Maps is embedded on the contact page. Loading it can send technical information to Google, which may use its own cookies or similar technologies under its policies. This map is separate from Google Sign-In.

Resend processes the recipient email address and information needed to deliver our operational messages, including order request and status notices, form and product quotation acknowledgements, email verification codes, password reset links and password-change notices. We use these emails for transactions and account security, not a newsletter or promotional mailing list. Our hosting provider, Railway, may process website and stored information as part of running the service.

WhatsApp, Facebook and Instagram are outbound links; they receive information if you choose to open them. A WhatsApp link may include an order reference or message prepared in your browser. The footer address link opens Google Maps, and the contact-page email button opens Gmail. These services handle information under their own policies when you use them.

9. How we use information

We use submitted information to create and manage accounts, authenticate customers, provide password recovery and security notices, validate and record order details, review and fulfil orders, show linked order history and status, arrange delivery and payment, send order and request updates, respond to enquiries, prepare quotations, and handle rental, service and training requests. We also use information to operate and secure the site, prevent abuse or duplicate submissions, support customers, and maintain business, accounting or legal records where applicable.

10. How information is shared

Authorised Smith's BD staff can access orders and submitted requests to handle them. Railway hosts the website and Resend delivers the operational emails described above; they may process information needed for those services. Where needed to fulfil an order, staff may share relevant contact and delivery details with delivery personnel or a delivery service. Information may also be disclosed where legally required. The third-party content and optional Google Sign-In described above involve separate interactions with those providers.

11. Retention

Account, order and request information may be retained for as long as reasonably required to operate the account, fulfil transactions, support customers, maintain business and security records, resolve disputes, and meet applicable accounting or legal requirements. No fixed retention period for those records is stated here. Customer sign-in sessions last approximately 30 days unless ended or invalidated earlier. Password reset links expire after 30 minutes and cannot be reused after a successful reset.

12. Security

We use technical and organisational safeguards designed to protect customer information. These include HTTPS in production, protected sign-in cookies, one-way password hashing, access controls and server-side validation. No system can guarantee absolute security. Please avoid entering unnecessary sensitive information in free-text fields.

13. Your account and information requests

When signed in, you can use My Profile to view and update certain profile details and My Orders to view orders linked to your account. These pages do not edit historical orders or provide a complete data export or deletion service.

For broader access, correction or deletion requests, contact info@smithsbd.com or +880 1601-110853. We may need to verify your identity before acting and may need to retain some information for transactions, accounting or legal obligations.

14. Children

The website is intended for people who can make business or purchasing enquiries. The training form checks that an applicant is at least 15. If you believe a child has submitted personal information without appropriate permission, contact us so we can review it.

15. Changes to this policy

We may update this policy when the site, our practices or applicable requirements change. The date at the top identifies the current version.