Privacy Policy

Rangpur Old Cadets' Association (ROCA) is the alumni organisation of Cadet College Rangpur, Bangladesh. ROCA Connect is the official members-only digital platform operated by ROCA for membership management, events, communications, and organisational governance.

ROCA is the data controller for all personal data collected through this platform, as defined under the Personal Data Protection Ordinance 2025 of Bangladesh. The platform is administered by the ROCA Executive Committee under the elected President and General Secretary.

Identity & Membership

Contact Data

Professional & Social (Optional)

Financial & Technical

Direct Registration

When you register, you provide your name, cadet number, batch, mobile, and email. Registration requires OTP verification of both your mobile and email to confirm identity.

Profile Completion

After registration you may voluntarily add address, professional details, social links, and a profile photograph. None of these are mandatory.

Event Registration

When registering for events we collect attendee preferences, ticket type, transport and accommodation choices, and — where applicable — accompanying family member names. This is used solely for event management.

Payment Processing

Payments are processed through Payment Gateway. ROCA Connect receives only transaction confirmation references and payment status. No card number or bank account details are transmitted to or stored by ROCA Connect.

Automatic Technical Collection

Our servers automatically log your IP address, session token, and access timestamps for security purposes. This data is not shared externally.

Core Membership

Account creation and authentication (OTP, password reset, magic link); Member ID and Life Member ID card issuance; membership dues tracking; Life Membership upgrades.

Event Management

Registration, ticket generation, QR check-in at reception, payment processing, and attendance records.

Communications

Transactional SMS (OTP, event reminders, attendance confirmation) and transactional email (receipts, confirmations, account recovery). ROCA does not send marketing messages without your separate consent.

Member Directory

Your Cadet Name, batch, and house are shown in the members-only directory. Additional details are shown only if you have opted to make them visible.

Governance

Election nominations, committee assignments, batch representative records, and scholarship/welfare programme administration.

Platform Improvement

Aggregated, anonymised statistics (members by country, age distribution, batch data) used internally by the EC. This cannot identify any individual.

Legal & Security

Fraud prevention, account recovery, and compliance with lawful requests from Bangladesh regulatory or law enforcement authorities under the Cyber Security Ordinance 2025.

By registering on ROCA Connect and accepting this Privacy Policy, you expressly consent to the collection and processing of your personal data as described herein, consistent with the Personal Data Protection Ordinance 2025.

In limited circumstances ROCA may process data without consent where required by Bangladesh law, court order, or lawful direction from a competent authority. We will inform you where legally permitted to do so.

Withdrawing Consent

You may withdraw your consent at any time by contacting us or submitting a Data Deletion Request through your profile settings. Upon withdrawal, ROCA will cease processing your data except as required by law. Note that withdrawal may limit or terminate your access to ROCA Connect.

Where Your Data Is Stored

All personal data is stored on servers. Profile photographs, event images, and media files are stored on the ROCA Connect web server's storage. No personal data is transferred outside ROCA web server except as listed below.

Third-Party Services

Security Measures

Passwords are stored using bcrypt hashing (cost factor 12) and never in plain text. All sensitive operations require OTP verification. Sessions are encrypted and rotated on login. NID data is stored encrypted. HTTPS is enforced for all connections. Admin access to member data is restricted by role-based access control and is fully audit-logged.

Data Breach Notification

In the event of a breach affecting your personal data, ROCA will notify affected members and, where required by law, relevant Bangladesh authorities within the timeframes prescribed by the Personal Data Protection Ordinance 2025.

Within the Association

Authorised ROCA officials (Executive Committee members with admin roles) can access member records for membership management, event administration, and governance. All access is logged in the platform's audit system.

With Service Providers

Minimal data is shared with payment processors, email and SMS providers solely to deliver the services described in this policy. These providers act as data processors under contractual obligations not to use your data for any other purpose.

Legal Requirements

ROCA may disclose your data if required by court order, lawful direction from Bangladesh government authorities, or where necessary to prevent a threat to life, health, or safety.

Member Directory

The directory is accessible only to verified, logged-in ROCA Connect members. It is not publicly accessible. Fields shown are limited to those you have chosen to make visible.

ROCA retains data only as long as necessary for its stated purpose or as required by law.

When retention is no longer necessary, data is deleted or anonymised so that it can no longer be associated with any individual.

Under the Personal Data Protection Ordinance 2025 of Bangladesh, you have the following rights:

Contact us using the details below or via your profile settings. We respond within 30 days. We may request proof of identity before processing your request.

ROCA Connect does not use analytics cookies, advertising cookies, Google Analytics, tracking pixels, or any third-party behavioural tracking. The only cookies set are strictly necessary for authentication and security. Disabling them will prevent login.

ROCA Connect is intended exclusively for alumni of Cadet College Rangpur who have completed their cadet training. All registered members are adults (18 and over). ROCA Connect does not knowingly collect personal data from children under 18. If you believe a minor has registered, contact us immediately and we will remove the account.

Family member names collected during event registration are used solely for seating and gift allocation and are not retained beyond the event record retention period.

ROCA may update this Privacy Policy to reflect changes in our practices, technology, or Bangladesh law. For material changes, registered members will be notified by email and in-app notification at least 14 days before the changes take effect.

Continued use of ROCA Connect after the effective date constitutes acceptance. If you disagree, you may request account deletion before the effective date. Previous versions are available on request from the ROCA Secretariat.