 Transparent copy.png)
1. What this page is for
Our Privacy Policy explains what we collect and why. This page covers the practical side: where your data lives, how long we keep it, which companies process it for us, and exactly how to use your rights. Both are part of how Project DHK Creative handles personal data.
2. Where your data lives
- Our application and database run on servers we control or rent from a hosting provider. Passwords and PINs are stored only as one-way hashes, so we cannot read them.
- Uploaded media such as profile photos, portfolio images, videos and performance clips is stored on our servers and in cloud file storage.
- Backups of the database and uploaded files are kept so we can recover from a failure. A deletion therefore reaches backups only when they are overwritten in the normal cycle. We will not restore deleted personal data from a backup except to recover from a failure, and we will re-apply deletions if we do.
- Email we send, and the replies we receive, pass through an email delivery provider and our mailbox.
3. How long we keep data
These are the periods we work to. We keep data longer only if the law requires it, if we need it to handle a dispute, fraud or a legal claim, or if you ask us to keep it.
| Data | How long |
|---|---|
| Account, profile and what you published | While your account is open. After you delete it, we remove or anonymise it within 30 days, apart from the items below. |
| Private messages | While both accounts exist. A message you sent may stay visible to the person who received it after you leave. |
| Gigs, applications and contracts | Up to 6 years after the work ends, to settle disputes and meet accounting rules. |
| Payments, escrow, wallet and credit records | For the period required by tax, accounting and financial regulation in Bangladesh, generally at least 6 years. |
| Wallflower performer applications | Selected performers: while they stay on our roster, then until you ask us to delete. Applications that were not selected: up to 24 months. |
| Guest spots and ticket records | Up to 24 months after the event, and payment records as above. |
| Event photos and recordings | For as long as they are useful to promote the community, unless you ask us to stop using you (see the Privacy Policy, section 5). |
| Optional DHK Creative account | Until you delete it. It is removed within 30 days of your request. |
| Verification codes | Minutes. They expire automatically. |
| Security and server logs | Up to 12 months. |
| Support emails | Up to 3 years after the conversation ends. |
4. How to make a request
You can ask us to do any of the following:
- Access or export a copy of your data;
- Correct something that is wrong. Most profile details you can change yourself in your settings or, if you have a DHK Creative account, on your account page;
- Delete your account and personal data;
- Hide your profile and photos from our public pages while keeping your account;
- Stop particular uses, such as marketing emails or use of your event photos;
- Withdraw consent you gave earlier.
How: email [email protected] from the address on your account, or use the contact form. Say which request you are making and which account, sign-up or event it relates to. If we cannot match you to the data from your message alone, we will ask a simple question or ask you to confirm through the account email. We do this to stop other people getting your data.
What happens next: we confirm we have your request promptly and aim to complete it within 30 days. If it is complex or we have many requests, we may take longer, and we will tell you why. There is no fee unless a request is clearly unfounded or excessive, in which case we may charge a reasonable fee or decline, and we will explain. If we decline all or part of your request, we will say why and how you can complain.
What we may keep: deleting your account does not remove records we are legally required to keep, such as payment records, or data we need to deal with a dispute, fraud or a legal claim. Content that others have already copied, shared or quoted, and messages you sent to other people, may remain.
5. Who processes data for us
These are the types of companies we use, and the named services as of the date above. They may process your data only on our instructions and under terms that require them to protect it.
| Purpose | Provider | Data involved |
|---|---|---|
| Ticketing and online checkout for events | Bhokto | Guest name, contact details, ticket quantity, payment status |
| Mobile payments | bKash, DGEPay | Payment reference and amount. Handled by the provider, not stored by us beyond the reference |
| Sign-in with a social account | Google, Facebook | Basic profile information you allow |
| Music embeds and artist data | Spotify | Artist and track information, and technical data your browser sends |
| File and media storage | Cloud object storage provider | Uploaded images, videos and documents |
| Hosting and infrastructure | Server and hosting provider | All data the Platform holds |
| Email delivery | Email service provider | Your email address and the messages we send you |
| Fonts, scripts and maps that our pages load | Font and script content delivery networks, map providers | Your IP address and browser details when a page loads |
We update this list when it changes. Ask us if you need the current legal name or location of a specific provider.
6. Security and incidents
- Connections to the Platform are encrypted.
- Passwords and PINs are hashed. We limit repeated PIN and code guesses, and lock PIN sign-in after repeated failures.
- Access to member data is limited to people who need it for their work, and administrator actions are tied to individual accounts.
- If a security incident affects your personal data in a way the law requires us to report, we will tell the relevant authority and the people affected without undue delay, and in any case within the time the law sets (for example, 72 hours to a supervisory authority under the GDPR where it applies).
7. Requests from authorities
We share personal data with a court, regulator or law enforcement body only when we have a valid legal basis, such as a court order or a lawful request under the laws of Bangladesh or another law that binds us. We check the request, share only what is needed, and tell the person concerned unless the law or the request forbids it.
8. Data of other people you give us
If you give us another person's details, for example when you book several guest spots or credit collaborators in a portfolio, you confirm that you have the right to do so and that they know. Tell them how to reach us if they have questions.
9. Complaints
If you think we have handled your data wrongly, please tell us first so we can put it right. You can also complain to the data protection authority where you live or work, or to the competent authority in Bangladesh. We will cooperate with them.