Privacy Policy

Pure Naturals ("Pure Naturals", "we", "us", "our") respects your privacy and is committed to protecting personal data we process in the course of our business.

This Policy explains what data we collect, how we use it, the lawful basis we rely on, how long we keep it, and your rights — under the EU General Data Protection Regulation (GDPR) and the Indian Digital Personal Data Protection Act 2023 (DPDP Act).

1. Who we are

Data Controller / Data Fiduciary contact: contact@purenaturalsglobal.com

Designated grievance officer (DPDP Act §10): Garima Nahar, contact@purenaturalsglobal.com

For EU data subjects, we do not maintain an EU establishment and have no statutory obligation to appoint an EU representative under GDPR Art. 27. You may contact us directly at the address above.

2. What data we collect

We collect personal data in three contexts:

2.1 When you contact us (RFQ form, email, phone)

• Name, company name, work email address, country, phone number (if you provide it)
• Information you write in free-text fields (product enquiry, volumes, specs, certifications needed)

2.2 When you visit our website

• We use Cloudflare Web Analytics, a privacy-first analytics tool that does not use cookies and does not collect personally identifiable information. It records anonymised aggregates: pages viewed, country (derived from IP, then discarded), referring site, device class.
• We do not use Google Analytics, advertising pixels, or cross-site tracking.

2.3 When we contact you (outbound B2B prospecting)

• Your name, job title, company, and business email — sourced from publicly available business directories (LinkedIn, company websites, trade registries).
• We process this data on the lawful basis of legitimate interests (GDPR Art. 6(1)(f) — direct business-to-business marketing to identifiable role-holders, relevant to their professional function, with clear opt-out).

3. Why we use your data (purposes & lawful bases)

Purpose	Lawful basis (GDPR)	Lawful basis (DPDP Act)
Respond to your RFQ or enquiry	Art. 6(1)(b) — performance of pre-contract steps at your request	§4(1)(a) — consent / legitimate use
Send Certificates of Analysis, samples, quotes	Art. 6(1)(b) — performance of contract / pre-contract	§4(1)(a)
B2B outbound prospecting to business contacts	Art. 6(1)(f) — legitimate interests	§4(2) — legitimate use for business communication
Comply with tax, customs, AML, and trade-record obligations	Art. 6(1)(c) — legal obligation	§4(1)(c) — compliance with law
Improve our website (anonymised analytics)	Art. 6(1)(f) — legitimate interests	§4(1)(a)

We do not sell your data, and we do not use it for automated decision-making or profiling.

4. How long we keep it

• Active enquiries / open quotes: until the enquiry is closed plus 12 months
• Customer trade records (invoices, COAs, shipping): 8 years (statutory minimum under Indian tax & customs law)
• Outbound prospecting database: 24 months from last contact, then deletion. If you reply asking to be removed, we delete within 30 days.
• Analytics aggregates: 12 months
• Backup copies: 90 days after deletion from primary systems

5. Who we share it with

We share your data only with:

• Email & productivity providers processing on our behalf — Google LLC (Google Workspace) under their EU Standard Contractual Clauses
• Form processor — Formspree Inc. (US), processing form submissions before forwarding to us
• Sequencer / CRM — Smartlead.ai, HubSpot — for outbound contact management
• Couriers — DHL Express, FedEx, registered shipping lines — only when you've ordered samples or product
• Government authorities when legally compelled (tax, customs, sanctions screening)
• Professional advisers under confidentiality (auditor, legal counsel) — only when relevant

We do not sell or rent data to anyone.

6. International transfers

Because our infrastructure is global, your data may be processed in:

• India (our primary place of business)
• European Economic Area (Workspace data residency)
• United States (Formspree, Smartlead, HubSpot — where applicable)

Transfers from the EEA to India rely on the European Commission's adequacy decision where applicable, or Standard Contractual Clauses (SCCs) with our vendors. From the EEA to the US, our US vendors are signatories to the EU–US Data Privacy Framework or operate under SCCs with supplementary measures.

7. Your rights

Under GDPR (if you are in the EU/EEA/UK), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict or object to processing — including a free, unconditional right to object to direct marketing at any time
• Data portability
• Lodge a complaint with your national supervisory authority

Under the DPDP Act (if you are a Data Principal in India), you have the right to:

• Access summary of personal data and processing
• Correction and erasure
• Grievance redressal via our grievance officer
• Nominate another individual to exercise your rights on your behalf in the event of death or incapacity

To exercise any right above, email contact@purenaturalsglobal.com with the subject line "Privacy Request". We respond within 30 days.

8. Opting out of our outbound emails

Every outbound prospecting email from us includes a one-click unsubscribe link in the footer. Clicking it permanently removes you from our database within 7 days. You can also simply reply with "unsubscribe" or "remove" — same result.

We do not send marketing emails to consumer addresses, and we do not buy email lists.

9. Security

We protect data with:

• TLS encryption in transit
• Encryption at rest on Google Workspace, Cloudflare, and vendor systems
• Two-factor authentication on all internal accounts
• Access on a least-privilege basis
• Regular review of vendor security postures

In the unlikely event of a personal-data breach affecting your rights, we will notify the relevant authority within 72 hours (GDPR Art. 33 / DPDP §8(6)) and notify affected individuals where required.

10. Cookies

We do not use tracking cookies. Cloudflare Web Analytics, which we use, does not set cookies. Our website uses one cookie only if you submit the contact form (anti-spam, expires after the session ends).

11. Children

Our services are exclusively B2B. We do not knowingly process data of anyone under 18. If you believe a child has provided us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as our practices or the law evolves. We post the updated version here with a new "Last updated" date. Material changes are also notified by email to active customers.

13. Contact

Questions, complaints, or rights requests:

Grievance officer (DPDP Act §10): Garima Nahar — contact@purenaturalsglobal.com

For EU/EEA complaints, you can also contact your local Data Protection Authority. A directory is available at edpb.europa.eu/about-edpb/about-edpb/members_en

For India complaints, you can approach the Data Protection Board of India once it is operational under the DPDP Act.