Corporate Privacy Policy and
Supply Chain Data Protection

1. Corporate Structure and Data Controllers

To comply with global data protection laws, including the European General Data Protection Regulation (GDPR), the primary Data Controller for information processed via this platform is Baytex (Bangladesh), headquartered in Mirpur, Dhaka.

The Karvast Advisory Partnership (Sweden)

Baytex operates through a formalized commercial partnership with Karvast Advisory, an independent corporate entity registered in Umeå, Sweden. Karvast Advisory manages all European legal consultations, client liaisons, and contract execution. Baytex (Bangladesh) directly processes and manages the data required for factory allocation and production.

While the entities maintain separate legal identities, they operate under unified data protection agreements.

2. The Corporate Information We Collect

We only collect the operational data necessary to execute manufacturing agreements and provide accurate costing.

• Production Data: Information submitted during the sourcing process, including tech packs, Bills of Materials (BOMs), target MOQs, and brand contact details.
• Website Analytics: We use privacy-first analytics tools that do not utilize invasive tracking cookies or IP logging to monitor website interaction.

3. How We Protect Your IP and Production Data

We do not sell, rent, or trade corporate data. Your information is used exclusively to execute supply chain operations and calculate production costs. We share your data under the following strict parameters:

• With Karvast Advisory (Sweden): Data is securely routed to our Swedish partner strictly to facilitate European contract execution and direct client communication.
• With Our Partner Factories (Bangladesh): To secure production capacity and calculate FOB pricing, we must share project specifications with our closed network of 5 to 8 vetted factories. All tech packs and design files are anonymized prior to factory distribution. Factory identities are protected, and your brand's intellectual property is shielded by strict Non-Circumvention, Non-Disclosure Agreements (NCNDA).
• Mandatory Legal Compliance: We will disclose commercial data if required to comply with international trade laws, customs audits, or binding legal mandates.

4. International Data Transfers and Retention

As an international supply chain operator, we transfer, store, and process corporate data across two primary jurisdictions: Bangladesh (production operations) and Sweden (European management).

By submitting your tech packs and corporate data, you consent to this international transfer. All transfers between Baytex (Bangladesh) and Karvast Advisory (Sweden) are governed by strict data processing agreements fully aligned with GDPR standards.

Data Retention

We retain your commercial data and production files only for the duration of our active supply chain operations, or as legally required to satisfy international tax and trade obligations.

5. Your Privacy Rights Under GDPR

Corporate residents of the European Economic Area (EEA), the United Kingdom, or regions with equivalent data protection laws retain specific rights over their data:

• Right to Access: Request a complete copy of the corporate data and production files we hold.
• Right to Rectification: Request immediate corrections to any inaccurate commercial data.
• Right to Erasure: Request the deletion of your data, provided it does not violate active manufacturing contracts or legal retention mandates.
• Right to Restrict Processing: Request a halt to the processing of your data.

To exercise any of these rights, please contact the appropriate office using the details below.