Jamuna Bank eKYC - Privacy Policy

1. Introduction

This Privacy Policy (hereinafter referred to as "Agreement" or "Privacy Policy") explains how we, Jamuna Bank PLC eKYC(hereinafter referred to as "Jamuna Bank PLC", "we", "us", or "our"), collect, process, and use information of our Users who are individuals accessing or using the eKYC Service for account opening and verification purposes.

Your explicit consent to the collection, processing, storage, verification, and sharing of your personal and biometric data for eKYC and regulatory compliance purposes is obtained when you sign up for, access, or use the eKYC services provided by us.

We use your personal data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

This Agreement describes our policies and procedures on the collection, use, and disclosure of your information when you use the Jamuna Bank eKYC service and tells you about your privacy rights and how the law protects you.

2. Interpretation and Definitions

2.1 Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or plural.

2.2 Definitions

For the purposes of this Privacy Policy:

Account means a unique bank account created through the eKYC process to access Jamuna Bank PLC services.
Application means the eKYC mobile application provided by Jamuna Bank PLC, downloaded by you on any electronic device for the purpose of account opening and identity verification.
eKYC means Electronic Know Your Customer, a digital process for customer identification and verification.
Biometric Data refers to facial recognition data, liveness detection videos, and other biometric information collected during the verification process.
Country refers to the People's Republic of Bangladesh.
Device means any device that can access the eKYC service, such as a smartphone or digital tablet with camera functionality.
Personal Data means any information relating to an identified or identifiable individual, including but not limited to name, NID, address, photographs, and biometric data.
Service refers to the eKYC mobile application and all related account opening services.
Service Provider means any natural or legal person who processes data on behalf of the Bank, including third-party vendors for OCR, biometric verification, and notification services.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.

3. Information We Collect

3.1 Personal Information

During the eKYC process, we collect the following personal information:

Full name, date of birth, and gender
National ID Card (NID) and images Father's name and mother's name
Father's name and mother's name
Contact information (mobile number, email address, residential address)
Occupation, source of income, and monthly income details
Nominee information (name, relationship, NID, contact details)
Digital signature captured through the application
Utility bills or address proof documents

3.2 Biometric Data

We collect and process biometric data solely for customer identity verification, fraud prevention, regulatory compliance, and secure customer onboarding purposes:

Facial photographs taken through the device camera
Liveness detection videos to prevent fraud and ensure the authenticity of identity verification
Face matching data comparing your live photo with your NID

3.3 Document Images

We collect images of the following documents:

National ID Card (front and back)
Utility bills (electricity, gas, or water bill) for address verification
Nominee's NID or other identification documents
Any other supporting documents required for account opening

3.4 Usage Data

Usage Data is collected automatically when using the Service. This may include:

Your device's Internet Protocol (IP) address
Device type, model, and operating system version
Unique device identifiers
Browser type and version (if applicable)
Pages visited within the application
Time and date of access
Time spent on specific screens
Application performance and crash data
Other diagnostic and usage information

4. App Permissions and Usage

To provide the eKYC service effectively and securely, our application requires the following permissions. We only access these features with your explicit consent:

📷 Camera Permission

Why we need it:

To capture clear photos of your National ID Card for Optical Character Recognition (OCR) and verification
To take your live photograph for facial biometric verification and matching with your ID document
To perform liveness detection through video recording, ensuring you are a real person and not a photo or video replay
To capture your digital signature for account opening documents
To photograph utility bills or other address proof documents

How we use it: Camera access is used only when you explicitly initiate document capture or facial verification. Images are encrypted and transmitted securely to our servers for processing and verification.

🎤 Microphone Permission

Why we need it:

To record short video clips during liveness detection, which helps verify that you are physically present during the verification process
To enhance fraud prevention by detecting potential replay attacks or spoofing attempts
To comply with regulatory requirements for secure customer onboarding

How we use it: Microphone access is used only during the liveness detection phase of identity verification. Audio data is processed for verification purposes and is not stored permanently unless required by regulatory compliance.

🖼️ Photo Library / Storage Permission

Why we need it:

To allow you to select and upload existing photos of your documents from your device gallery
To upload pre-captured images of utility bills or address proof documents
To provide flexibility in submitting required documents without requiring real-time camera capture
To temporarily save captured images before submission (optional)

How we use it: Storage access is used only when you choose to upload documents from your gallery. We do not access or scan other files or photos on your device. Selected images are encrypted during transmission and storage.

🔔 Notification Permission (Firebase Cloud Messaging)

Why we need it:

To send you One-Time Passwords (OTP) for mobile number and identity verification
To notify you about the status of your eKYC application (approved, rejected, pending, requires action)
To send important updates regarding your account opening process
To alert you about security-related activities or required document submissions
To communicate time-sensitive information about regulatory compliance or additional verification needs

How we use it: We use Firebase Cloud Messaging (FCM) to deliver push notifications. We only send notifications relevant to your eKYC application and account. You can manage notification preferences in your device settings at any time.

🌐 Internet / Network Permission

Why we need it:

To communicate with Jamuna Bank servers for data submission and verification
To upload documents and biometric data securely
To retrieve real-time application status updates
To validate information with government databases and third-party verification services

How we use it: All data transmitted over the internet is encrypted using industry-standard protocols (TLS/SSL) to ensure security and privacy.

Important: You can enable or disable these permissions at any time through your device settings. However, disabling certain permissions may prevent you from completing the eKYC process or using specific features of the application.

5. How We Use Your Information

We use the collected information for the following purposes:

Account Opening and Verification: To process your eKYC application and open a bank account in your name
Identity Verification: To verify your identity using biometric data, document verification, and liveness detection
Regulatory Compliance: To comply with Bangladesh Bank & BFIU eKYC Guidelines, AML/CFT regulations, the Money Laundering Prevention Act, 2012, Anti-Terrorism Act, applicable Bangladesh Bank circulars/guidelines, Cyber Security Ordinance, 2025, and Personal Data Protection Ordinance, 2025 (as amended in 2026), and other applicable laws and regulatory requirements.
Fraud Prevention: To detect and prevent fraudulent activities, identity theft, and account misuse
Communication: To send OTPs, application status updates, and important notices via SMS, email, or push notifications
Service Improvement: To analyze usage patterns and improve the eKYC application and customer experience
Customer Support: To assist you with technical issues, application queries, or account-related questions
Record Keeping: To maintain records as required by banking regulations and internal audit requirements

6. Data Security

We take the security of your personal information seriously and implement comprehensive security measures:

Encryption: All sensitive data, including biometric information and documents, is encrypted during transmission (using TLS/SSL) and storage (using AES-256 encryption)
Secure Servers: Data is stored on secure servers with restricted access, located in compliance with data localization requirements
Access Controls: Only authorized personnel with a legitimate need can access your personal information, subject to strict confidentiality obligations
Authentication: Multi-factor authentication and secure login mechanisms protect access to our systems
Regular Audits: We conduct periodic security audits, vulnerability assessments, and penetration testing
Monitoring: Real-time monitoring systems detect and respond to potential security threats
Employee Training: Our staff receives regular training on data protection and privacy best practices
Third-Party Security: All service providers are required to maintain equivalent security standards through contractual agreements

Note: While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to using industry-best practices to protect your data.

6.1 Data Breach and Incident Response

In the event of any actual or suspected data breach, unauthorized access, disclosure, loss, or compromise of personal data, Jamuna Bank PLC shall take appropriate containment, investigation, mitigation, and notification measures in accordance with applicable laws, regulatory requirements, and internal incident response procedures.

7. Data Sharing and Disclosure

We may share your information in the following circumstances:

Regulatory Authorities: With Bangladesh Bank, Credit Information Bureau (CIB), and other regulatory bodies as required by law
Law Enforcement: With government agencies, law enforcement, or judicial authorities when legally obligated or to prevent criminal activity
Service Providers: With trusted third-party vendors who assist us with:
- OCR (Optical Character Recognition) services for document processing
- Biometric verification and liveness detection services
- Firebase Cloud Messaging for push notifications
- Cloud storage and hosting services
- Data analytics and application performance monitoring
All service providers are bound by strict confidentiality agreements and are prohibited from using your data for any purpose other than providing services to us.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections
Consent: With your explicit consent for any other purpose not listed above

We will never sell, rent, or trade your personal information to third parties for marketing purposes.

8. Data Retention

We retain your personal information for the following periods:

Active Accounts: For the duration of your relationship with Jamuna Bank PLC
Regulatory Requirements: As mandated by Bangladesh Bank and other regulatory authorities Typically 5 years after closure of accounts or for such longer period as may be required under Bangladesh Bank regulations, AML/CFT obligations, audit requirements, court orders, or applicable law)
Legal Obligations: For as long as required to comply with legal, tax, audit, or regulatory obligations
Incomplete Applications: Incomplete or rejected applications may be retained for 2 years for reference and fraud prevention

After the retention period expires, we securely delete or anonymize your information in accordance with our data retention and deletion policy.

9. Your Rights

Under applicable data protection laws, you have the following rights:

Right to Access: You can request a copy of the personal information we hold about you
Right to Correction: You can request correction of inaccurate or incomplete information
Right to Deletion: You can request deletion of your data, subject to legal and regulatory retention requirements
Right to Object: You can object to certain types of data processing
Right to Withdraw Consent: You can withdraw consent for optional data processing activities
Right to Data Portability: You can request your data in a structured, machine-readable format Right to Lodge a Complaint: You can file a complaint with relevant data protection authorities

To exercise these rights, please contact us using the details in Section 12.

10. Links to Other Websites

Our eKYC application may contain links to third-party websites, services, or resources (such as regulatory bodies, verification services, or informational pages). These third-party sites have their own privacy policies, and we have no control over their content or practices.

We strongly advise you to review the privacy policy of any third-party site you visit. We are not responsible for the privacy practices or content of external websites.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

Post the updated Privacy Policy in the application and on our website
Update the "Last Updated" date at the top of this policy
Notify you via push notification, email, or in-app message for material changes
Provide a reasonable notice period before significant changes take effect

Your continued use of the eKYC service after changes are posted constitutes acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

12. Children's Privacy

The Jamuna Bank eKYC service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected data from a child under 18, we will take immediate steps to delete such information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Jamuna Bank PLC
Jamuna Bank Tower,
Plot# 14, Bir Uttam A. K. Khandaker Road,
Block# C, Gulshan-1,
Dhaka, Bangladesh.

For eKYC Privacy Inquiries:
eKYC email: ekyc@jamunabank.com.bd

Customer Care:
Phone: 16742
General Email: info@jamunabankbd.com
Website: www.jamunabankbd.com

Office Hours:
Sunday to Thursday: 9:00 AM - 5:00 PM (Bangladesh Time)
Customer Care Hotline: 24/7