Privacy Policy
FindSuppliersIndia helps buyers find out whether a product can be sourced from India. This policy explains what information we collect when you use the site, why we collect it, who we share it with, and the choices you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Who we are
FindSuppliersIndia is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS] ("we", "us"). We are the data controller (a "Data Fiduciary" under the DPDP Act) for the personal data described here. You can reach us about privacy at [[email protected]].
What we collect
Information you give us
When you request a report, we collect:
- Your work email address, so we can send you the report.
- The product you describe and the requirements text (material, size, finish, packaging, certifications) you review and edit.
- Your expected order volume and the country you import into. These determine which tariff and compliance checks apply.
We don't ask for your name, phone number, company details or payment information, and you don't need an account. Please don't include personal information about yourself or anyone else in the product or requirements fields.
Information collected automatically
- IP address. Our network provider, Cloudflare, tells us which country your IP address belongs to, and we use that to pre-fill the "Importing to" field. You can change it. We also use your IP address to limit how often requests can be made, to prevent abuse. We don't store your IP address in our database.
- Bot-protection signals. Before your request is accepted, Cloudflare Turnstile checks that it comes from a person. To do this, it processes your IP address and technical details about your browser and device.
- Server logs. Our hosting providers may keep standard access logs, including IP addresses, browser type and the pages requested, for security and troubleshooting.
How we use it
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Draft your RFQ and prepare your feasibility report | Product description, requirements, volume, destination country | Taking steps at your request (Art. 6(1)(b)) |
| Email you the report and any follow-up about that request | Email address, report reference | Taking steps at your request (Art. 6(1)(b)) |
| Pre-fill your importing country | IP address | Legitimate interests: a faster form (Art. 6(1)(f)) |
| Prevent spam, abuse and automated submissions | IP address, bot-protection signals | Legitimate interests: security (Art. 6(1)(f)) |
| Check report quality and improve our product coverage | Product descriptions and requirements | Legitimate interests: service quality (Art. 6(1)(f)) |
Under the DPDP Act, we process your data for the purpose you gave it to us (getting your report), and you can withdraw consent at any time as described below.
We don't sell your personal data. We don't use it for advertising. We don't add you to a marketing list.
AI and human review
We use AI services to draft your RFQ from the product name and to match your product to a customs (HS) classification. Only the product description is sent to these services. Your email address is not. Reports are built from public trade, tariff and compliance datasets. Before any report email is sent, a member of our team reviews it. Reports are estimates, not supplier quotations, and no decision with legal or similarly significant effect is made about you automatically.
Who we share it with
We share personal data only with service providers that process it on our behalf and under our instructions:
| Provider | What they do | Data involved |
|---|---|---|
| Cloudflare | Network security, bot protection (Turnstile) and country lookup | IP address, browser and device signals, request data |
| Resend | Sending emails | Email address, report contents |
| OpenRouter and the AI model provider it routes to | Drafting RFQ text | Product description |
| TypeSafe | Product classification | Product description |
| [DATABASE PROVIDER] | Database hosting | All request data above |
| [HOSTING PROVIDER] | Website and server hosting | Server logs |
| Google Fonts | Serving the site's typefaces | IP address, browser details |
We do not share your email address or requirements with manufacturers or suppliers. We may also disclose data if the law requires it, or to protect our rights, users or the public.
International transfers
Some of these providers process data outside your country, including in the United States and India. Where GDPR applies, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses to protect these transfers. [CONFIRM WITH EACH PROVIDER'S DATA PROCESSING AGREEMENT]
How long we keep it
- Report requests, including your email address and product details, are kept for [24 months] after your last request, then deleted or anonymised.
- IP addresses used for rate limiting are held only in server memory and are never written to our database.
- Server logs kept by our hosting providers follow their own retention periods, typically [30 days].
We delete your data sooner if you ask us to (see below).
Your rights
Depending on where you live, you have the right to:
- Access the personal data we hold about you and get a summary of how it's processed.
- Correct inaccurate or incomplete data.
- Delete your data.
- Object to or restrict processing based on legitimate interests.
- Data portability: receive your data in a machine-readable format.
- Withdraw consent at any time, without affecting processing that already happened.
- Nominate someone to exercise your rights if you die or become incapacitated (DPDP Act).
To use any of these rights, email [[email protected]] from the address you used and include your report reference if you have it. We'll respond within 30 days.
You can also complain to a regulator. In the EU, that's your local data protection authority. In the UK, it's the Information Commissioner's Office. In India, it's the Data Protection Board of India. We'd appreciate the chance to resolve your concern first.
Cookies
We don't use cookies for analytics or advertising, and we don't run tracking scripts. Cloudflare Turnstile may use strictly necessary technologies to tell people and bots apart. Those are needed to accept your request, so they don't require consent.
Children
This service is for businesses. It isn't directed at anyone under 18, and we don't knowingly collect data from children. If you think a child has given us personal data, contact us and we'll delete it.
Security
We protect your data with encryption in transit, access controls that limit it to staff who need it, and providers with recognised security practices. No system is completely secure. If a breach affects your personal data, we'll notify you and the relevant authorities as the law requires.
Changes to this policy
If we change this policy, we'll update the date at the top. For significant changes, we'll give notice on this page before they take effect.
Contact and grievance officer
For privacy questions, requests or complaints, including as our Grievance Officer under Indian law, contact:
[NAME / ROLE]
[COMPANY LEGAL NAME], [REGISTERED ADDRESS]
[[email protected]]