Who we are

TRW & Co (Tahmidur Remura Wahid) is a law firm headquartered in Dhaka, Bangladesh. We decide why and how the personal data described in this notice is processed. The Personal Data Protection Act 2026 calls an organisation in this position a "data-fiduciary"; in UK and EU terms, we are the controller.

Our office is at House 410, Road 29, Mohakhali DOHS, Dhaka 1206, Bangladesh. You can reach us about anything in this notice by email at info@trw.co or by telephone on +880 1708 000660.

What this notice covers

This notice covers personal data we collect through trw.co and its sub-pages, including our legal tools, case-journey guides, insights, the contact and careers forms, the newsletter sign-up and the consultation booking system at trw.co/book.

Information we hold once you instruct us on a matter is also governed by our engagement terms and our professional duties. Third-party websites we link to have their own policies.

Information we collect

Depending on how you use the site, we may collect:

• Contact form: your name, email address, telephone number if you give it, the subject and content of your message, and the page you sent it from.
• Careers form: the same details, plus any organisation, country or link to a CV that you choose to include.
• Newsletter sign-up: your email address, any name you give, the topics you choose, the page you signed up on, and when you confirmed your subscription.

• Consultation booking: your name, email address, telephone number, city and country, a short outline of your matter, the consultation type, meeting mode and time you choose, and whether payment is pending, completed or refunded.
• Payments: if you pay online, you enter card or wallet details on the pages of SSLCommerz, a Bangladeshi payment gateway, not on trw.co. We receive confirmation of the payment, a transaction reference and the amount, but not your full card details.

• Correspondence: emails, calls and messages you send us, including through WhatsApp if you choose to use the click-to-chat links on our site.
• Technical information: like any website, our server receives your IP address, browser type, the pages you request and the time of each request. To limit spam, our forms keep a coded (hashed) form of your IP address for a short time.
• Tool preferences: some legal tools save settings in your own browser's storage. This stays on your device and is not sent to us.

Information you should not send us yet

Please do not send confidential or sensitive details of a dispute or transaction through the contact form or booking outline until we have checked for conflicts and confirmed in writing that we can act. The type of matter, the parties and your deadline are usually enough for us to respond.

How we use your information and why

The Personal Data Protection Act 2026 permits processing with your consent (section 5(1)-(2)) and, in the cases listed in section 5(3), without it: for example, to perform a contract with you, to take steps you ask for before a contract, or to establish legal rights or defend legal proceedings. We rely on these grounds as follows:

• Replying to enquiries and careers applications, and arranging consultations: steps you ask us to take, including the conflict checks our professional rules require before we can act.
• Running bookings, confirmations, reminders, reschedules, cancellations and refunds: performing the booking arrangement you make with us.

• Sending our newsletter: your consent, which you give by confirming your subscription and can withdraw at any time.
• Keeping the site secure, and preventing spam, fraud and misuse: delivering the pages and services you request, and the Act's provision for preventing and detecting crime (section 24(1)).
• Establishing, exercising or defending legal claims, or complying with a court order: where this becomes necessary (sections 5(3) and 24(1)).

Where UK or EU law applies, the equivalent bases are contract, consent, legal obligation and our legitimate interests in running a secure website and responding to people who contact us.

We do not use your personal data for automated decision-making that has legal or similarly significant effects on you, and we do not build advertising profiles.

Clients, confidentiality and privilege

We treat information about clients and prospective clients as confidential. The Bangladesh Bar Council's Canons of Professional Conduct and Etiquette also prevent an advocate from acting against a client or former client in a matter about which the advocate obtained confidential information through that relationship.

In addition, sections 126 to 129 of the Evidence Act 1872 protect from disclosure communications made to an advocate in the course and for the purpose of the advocate's employment, unless the client expressly consents, and subject to the exceptions in those sections, such as communications in furtherance of an illegal purpose. Section 127 applies the same protection to an advocate's interpreters, clerks and staff.

Who we share information with

We do not sell personal data. We share it only where needed, and only with:

• Service providers who help us run the site and our practice, such as hosting, email delivery and IT support, under instructions to protect the data.
• SSLCommerz, if you choose to pay online, to process the payment.
• Google, if you choose to load an embedded map (see our cookie policy).

• Courts, regulators, law enforcement or other authorities, where the law requires or permits it and we consider disclosure appropriate.
• Professional advisers, such as accountants or auditors, under duties of confidence.
• Other parties with your agreement, for example counsel or experts in another country when you ask us to involve them.

When pages load fonts from Google Fonts or images from Unsplash's delivery network, those providers receive your IP address. Our share buttons (LinkedIn, X, WhatsApp and email) and social links are plain links: nothing is sent to those services unless you click one, and their own terms then apply.

International transfers

Our audience is international, and some of our service providers may store or process data outside Bangladesh. The Personal Data Protection Act 2026 allows personal data to be transferred abroad on conditions, including where you consent, or where the transfer is part of a contract to which you are a party for the supply of goods or services (section 29(3)).

Transfers may go only to places that have the facilities for keeping personal data that regulations will specify (section 29(4)); those regulations have not yet been issued.

When we choose service providers, we take their security and contractual terms into account.

How long we keep information

We keep personal data only as long as we need it for the purpose it was collected for:

• Enquiries and careers applications that do not lead further: for as long as needed to respond, to deal with any follow-up, and to keep a record of conflict checks.
• Booking and payment records: for as long as needed to provide the consultation, deal with refunds and queries, and meet accounting and tax record-keeping obligations.
• Newsletter details: until you unsubscribe. We then keep a record that you have unsubscribed, so that we do not email you again.

• Client files: for the periods required by our professional obligations and relevant limitation periods.
• Server logs: only as long as needed for security and troubleshooting, unless needed to investigate an incident.

The Act requires records of personal data processing to be kept in a register (section 19), and regulations will set maximum retention periods (section 18). We will follow those regulations once issued. When information is no longer needed, we delete it or make it anonymous.

How we protect your information

We use technical and organisational measures appropriate to the nature of the data, including encrypted connections (HTTPS), restricted access to booking and enquiry records, and a dedicated payment gateway, so that card details are not handled on trw.co.

No system is completely secure. If a personal data breach is likely to cause you significant harm, the Personal Data Protection Act 2026 requires us to notify the Authority in the form, manner and time that regulations set (section 20). We will do so, and we will tell you where appropriate.

Your rights under Bangladesh law

The Personal Data Protection Act 2026 (Act 63 of 2026) gives you rights over your personal data, which you may exercise by applying to us in writing (section 10(1)). Subject to the conditions and exceptions in the Act, you can:

• Access the personal data we hold about you (section 11(1)) and receive a copy in a concise, understandable form, with a statement of who it has been shared with (section 11(3)-(4)).
• Ask for your data to be provided to you, or transferred, in the way regulations will specify (section 11(2)).
• Ask us to correct, complete or update inaccurate, incomplete or out-of-date data (section 12).

• Withdraw your consent, wholly or partly, at any time (section 13(1)).
• Ask us to erase your data, for example where it is no longer needed or was processed unlawfully, subject to exceptions such as legal obligations (section 13(2)-(3)).
• Ask us to stop processing that you believe is likely to harm you (section 13(5)).

Withdrawing consent does not affect processing already carried out while your consent was in place (section 13(4)). Our duty of confidentiality to clients, and the protection given to privileged communications, may limit what we can disclose in response to a request.

To make a request, email info@trw.co with enough detail for us to find your data. We may need to verify your identity first, because the Act requires us to consider the sensitivity of the data and the risk of fraud (section 10(3)). Detailed procedures and response times will be set by regulations under the Act, and we will follow them once issued.

Visitors from the United Kingdom and the European Union

Our website is published from Bangladesh. Whether the UK GDPR or the EU General Data Protection Regulation applies to a particular use of our site depends on the circumstances, including whether we offer services to people there (Article 3(2)). We do not take a fixed view on this, but we apply their core principles: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation and security.

Where those laws apply, you may also have rights to restrict processing, to object to processing based on legitimate interests, and to complain to your local supervisory authority, such as the Information Commissioner's Office in the UK or the data protection authority in your EU member state.

Newsletter and updates

We send our newsletter only to people who have signed up and then confirmed their subscription by clicking the link in our confirmation email (double opt-in). If you do not click the link, you will not be subscribed.

Our newsletters are plain-text emails with no tracking pixels, so we do not record whether you open them. Every newsletter includes an unsubscribe link and a List-Unsubscribe header, which many email programs show as an "Unsubscribe" button. You can also unsubscribe by emailing info@trw.co.

Children

Our website and services are intended for adults. We do not knowingly collect personal data from anyone under 18, the age the Personal Data Protection Act 2026 uses to define a child unless the government sets a different age (section 2).

If you believe a child has sent us personal data, please contact us and we will delete it unless we need it to protect the child or to meet a legal obligation.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first at info@trw.co.

Under the Personal Data Protection Act 2026, the regulator is the National Data Management Authority established under the National Data Management Act 2026. The Act's complaint and administrative-fine provisions (sections 31 to 35) come into force on a date the government will notify after the 18-month period following enactment, so the formal complaint route may not yet be available.

Visitors from the UK or EU may contact their local supervisory authority.

Changes to this notice

We will update this notice when our practices or the law change, including when regulations under the Personal Data Protection Act 2026 are issued. The date at the top of this page shows when it was last revised.

Contact us about this privacy policy

Questions about this privacy policy: write to info@trw.co or to TRW & Co, House 410, Road 29, Mohakhali DOHS, Dhaka 1206, Bangladesh.