This policy explains what personal data Orion Global Trade collects when you use this website or trade with us, why we hold it, who we share it with and how long we keep it. It applies to this website and to the correspondence, quotations and shipping documentation that follow from an enquiry.
We are the data fiduciary (the data controller, in European terms) for the data described here. Our registered office is at the address shown on our Contact page. Questions, requests and complaints about this policy go to sales@orionglobalexports.com.
The law this policy is written against
We are an Indian company, so our primary obligations are under the Digital Personal Data Protection Act, 2023 and the rules made under it, together with the Information Technology Act, 2000 and its rules on reasonable security practices.
Many of our buyers are in the European Union and the United Kingdom. Where we process the personal data of people in those territories in connection with offering goods to them, the General Data Protection Regulation and the UK GDPR also apply, and we honour the rights they give you. India has not been the subject of an EU adequacy decision, so transfers of personal data from the EEA or the UK to us rely on the Standard Contractual Clauses or on another Article 46 safeguard, and we will enter into those on request.
What we collect
When you send an enquiry
The enquiry form asks for your name, your company, your email address, your telephone number, the destination country and your message, and it records the product you were viewing. Everything on the form is information you choose to give us.
When we trade
Fulfilling an order generates further records that usually contain the names, job titles, work email addresses and telephone numbers of the people handling it on both sides: purchase orders, sales contracts, invoices, packing lists, bills of lading, letters of credit, certificates of origin and correspondence with banks, forwarders and inspection agencies.
When you browse
Our server keeps standard access logs (IP address, the page requested, the time, the referring page and the browser user agent) for security, abuse prevention and diagnosing faults. Cookies are covered separately in our Cookie Policy.
We do not knowingly collect personal data from children, and this site is not directed at them. We do not collect special category data, and you should not send it to us.
Why we use it, and on what basis
- To answer your enquiry and quote. Steps taken at your request before entering a contract. GDPR Article 6(1)(b); consent and the legitimate-use grounds under the DPDP Act.
- To perform the contract: producing documentation, arranging inspection, shipping and payment. GDPR Article 6(1)(b).
- To meet legal obligations: customs declarations, foreign exchange reporting, tax and statutory books of account. GDPR Article 6(1)(c).
- To keep the site and our business secure, and to keep a record of dealings in case of a dispute. Our legitimate interests. GDPR Article 6(1)(f).
- To send commercial updates where you have asked for them. Consent, which you can withdraw at any time.
We do not sell personal data, we do not share it with data brokers, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.
Who we share it with
Exporting goods is a documented process involving several parties, and your details appear on those documents where the transaction requires it. Depending on the shipment, that can include:
- freight forwarders, shipping lines, airlines and customs house agents;
- accredited testing laboratories and third-party inspection agencies;
- certifying authorities, including plant quarantine and chamber-of-commerce or DGFT certificate-of-origin services;
- our bank and yours, where payment runs through a letter of credit or a documentary collection;
- marine cargo insurers and, if a claim arises, surveyors;
- our IT, hosting and email providers, and our professional advisers.
We share the minimum each of them needs. We will also disclose data where we are legally required to, whether to customs, tax and regulatory authorities, or under a valid order of a court or other competent authority.
Where it goes
Trade documentation necessarily crosses borders: it travels to the destination country because that is where the goods are going. Where we transfer personal data out of the EEA or the UK we rely on the Standard Contractual Clauses or on the Article 49 derogation for transfers necessary to perform a contract with you. Our own systems and hosting are in India.
How long we keep it
- Enquiries that do not lead to business: up to 24 months, so we can pick up a conversation you return to, and then deleted.
- Transaction and shipping records: for as long as Indian law requires us to keep them. Books of account are retained for eight financial years under the Companies Act, 2013; GST records for six years under the CGST Act; export and foreign exchange records for the periods set by customs and FEMA regulations. We apply the longest applicable period.
- Server logs: a rolling period, normally not more than 12 months.
- Marketing consents: until you withdraw them, plus a suppression record so we do not contact you again by mistake.
Your rights
Under the DPDP Act you may ask us for a summary of the personal data we hold about you and how we process it, ask us to correct or complete it, ask us to erase it where we no longer need it, and nominate someone to exercise those rights if you die or become incapacitated. You may withdraw a consent you gave us as easily as you gave it.
If the GDPR or UK GDPR applies to our processing of your data, you also have the rights of access, rectification, erasure, restriction, portability and objection, including objection to processing based on legitimate interests.
To exercise any of these, write to sales@orionglobalexports.com. We will respond within the period the applicable law allows and may ask you to confirm your identity first. If you are not satisfied, you can complain to the Data Protection Board of India or, where the GDPR applies, to the supervisory authority in your country, and in the United Kingdom to the Information Commissioner’s Office.
Security
The site is served over HTTPS. Access to enquiry records and trade documentation is limited to the staff who need it. We keep our software patched, restrict administrative access, and log administrative activity. No system is perfectly secure, but if a breach occurs that is likely to affect you we will notify you and the relevant authority as the law requires.
Grievance officer
Complaints about how we have handled your personal data should be addressed to our grievance officer at sales@orionglobalexports.com, or by post to the address shown on our Contact page. You can also reach us on the number published on our Contact page. We acknowledge complaints promptly and aim to resolve them within the statutory period.
Changes
We update this policy when our practices or the law change. The effective date at the top of this page is the date of the current version. Material changes will be notified to buyers we are actively trading with.