- Home
- Privacy Notice
Privacy Notice
Last updated: 12 October 2026
This notice explains what personal data we collect through aravaliexports.in, why, how long we keep it, who else sees it and what rights you have. If anything is unclear, write to our Grievance Officer (details at the end).
Who we are
"Aravali Exports", "we" and "us" mean Aravali Exports, a sole proprietorship owned by Satish Chand Yadav, with its principal place of business at 4, Yadav Block, Malgodam Road, Kanakpura, Jaipur, Rajasthan 302034, India (GSTIN 08AAEPY0619F1ZO, IEC 1303010003). We export natural stone from Jaipur to business buyers.
For the personal data described here we are the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 and the "controller" under the EU and UK GDPR and similar laws. We have no office, branch or appointed representative outside India.
The short version
- We collect what you type into our forms so we can answer you, price your project and call you back.
- We do not sell personal data, we do not use it for advertising, and this site runs no analytics, tracking or advertising code.
- We do not set cookies. A few items are saved in your own browser so the quote list and settings work (see Cookies and storage).
- You can ask us to show, correct or delete your data at any time, free of charge.
What we collect and why
| What | Which form | Why we need it | Legal basis |
|---|---|---|---|
| Name, company, work email, country | Quote, samples, sourcing, contact and data rights forms | To know who we are dealing with and to reply | India: data you give voluntarily for this purpose (DPDP Act s.7(a)). EU/UK: our legitimate interest in answering business enquiries (GDPR Art. 6(1)(f)), or steps you ask for before a contract if you buy in your own name (Art. 6(1)(b)) |
| Phone number, whether you prefer WhatsApp, best time to call, optional email and note | Request a callback | To call you back, or message you on WhatsApp if you ask us to | Same as above |
| Phone number (optional) | Quote and samples forms | To discuss your request by phone if you prefer | Same as above |
| Project details: stones, finishes, sizes, quantities, destination port, price terms, timing, notes | Quote form | To price the job | Same as above |
| Drawings and files you upload | Quote form | To price cut-to-size work accurately | Same as above |
| Postal address for samples | Samples form | To send samples once we have agreed them with you | Same as above |
| Description of the product you need | Sourcing form | To tell you whether we can source it | Same as above |
| Your choice to receive occasional updates | Quote, samples and sourcing forms, only if you tick the box | To email you about new stones and shipping | Your consent (DPDP Act s.6; GDPR Art. 6(1)(a)). You can withdraw it at any time |
| Your request and our reply | Data rights form, email | To act on your request and show that we did | India: legal duty once the DPDP Act applies. EU/UK: our duties under the GDPR (Art. 6(1)(c)) |
| The version of the form notice you saw, a reference number, the time you sent the form | Every form | To prove what you were told and keep track of your request | EU/UK: legitimate interest (Art. 6(1)(f)) |
| A one-way scrambled code made from your IP address (we cannot turn it back into the address) | Every form | To stop spam and repeated automated submissions | EU/UK: legitimate interest in security (Art. 6(1)(f)) |
| IP address, browser type, page requested, time | Every visit, in our host's standard web server logs | To deliver the site and keep it secure | EU/UK: legitimate interest in security (Art. 6(1)(f)) |
Fields we need are marked as required. Everything else is optional. Without a way to contact you we cannot answer.
If you order from us, we also keep the order, shipping and payment records Indian tax, customs and foreign exchange law requires. In the EU/UK our basis for this is our legitimate interest in meeting the laws that apply to us (Art. 6(1)(f)).
This site is for businesses. Every form that asks for your details asks you to confirm you are 18 or over and acting for a business, and we do not knowingly collect children's data. Please do not send us sensitive data such as health information, bank or card details, passwords or identity documents.
We do not make decisions about you by automated means and we do not build profiles of you.
Stored in your browser
Your quote list, a draft of the quote form while you fill it in, and your display settings are saved in your own browser so the site works as you expect. They stay on your device and reach us only if you send a form. The full list, and how to clear it, is on our Cookies and storage page.
Who else sees your data
We never sell or rent personal data, and we do not "share" it for cross-context behavioural advertising as US state laws use that term. Only these parties handle it:
| Who | What they do | Data | Where |
|---|---|---|---|
| Hostinger, our web host | Hosts the site, runs the form handler and stores submissions and uploads | Everything sent through the site, server logs | India |
| Hostinger Email (our mailbox info@aravaliexports.in) | Receives each submission as an email, sends our replies | Form submissions, uploads, our correspondence | Hostinger email data centre (we confirm the country on request) |
| WhatsApp (Meta), only if you tick "Contact me on WhatsApp" | Carries the messages between us | Your phone number and the messages | WhatsApp's own servers; WhatsApp's terms and privacy policy apply |
| Couriers, shipping lines, freight forwarders, customs brokers, inspection agencies and banks | Only once we have agreed samples or an order with you | The contact, address and shipment details each one needs | India, your country and the countries on the route |
| Government authorities, courts or regulators | Only where Indian law or a binding order requires it, or to establish or defend a legal claim | What the law or order requires | India |
Hostinger acts on our instructions under its terms of service and data processing terms.
We verify our website with Google Search Console through a setting on our domain name. It places no code on this site and receives nothing from your visit.
Where your data is stored and transfers
We are based in India, so data you send us comes to us in India. When you send it from another country, you are giving it directly to us; we then keep it with the providers listed above.
- EU and UK. Data you give directly to a business outside the EU or UK is not a "transfer" for which the GDPR requires extra safeguards (European Data Protection Board Guidelines 05/2021), but the GDPR still applies to how we handle it, and we follow it. If we ever pass your data on to a provider in a third country, we will use a transfer safeguard the GDPR recognises.
- India. Indian law allows personal data to go to any country the Government of India has not restricted.
- South Korea, Japan and others. The table above shows each recipient, the purpose, the data and the country. The retention periods below apply wherever the data is held.
How long we keep it
| Data | How long |
|---|---|
| Enquiries, callback requests, sample and sourcing requests that do not lead to an order, with any uploads | 24 months from when you sent them, then deleted from our server and our mailbox |
| Enquiries that become an order, and the order records | Up to 8 years after the end of the financial year of the order, because Indian GST, income-tax, customs and foreign exchange rules require us to keep business records for periods that can run that long |
| Your consent to receive updates | For as long as we send updates. If you withdraw, we stop within 10 working days and keep only a note of the withdrawal so we never email you again |
| Data rights requests and our replies | 24 months from our reply |
| The scrambled spam-check code | 2 days in the spam counter; up to 1 year in our form log, which holds no names, emails or messages |
| Our host's standard web server logs | For the period set by our host's standard log settings; we do not extend it |
If we must keep something longer because of a legal claim or a law, we keep only what is needed for as long as needed.
How we protect it
- The site works only over encrypted connections (HTTPS with HSTS) and loads nothing from third parties.
- Form submissions and uploads are stored in a private folder on the server that the website cannot serve to anyone.
- Uploads are limited to PDF, DWG, DXF, JPG and PNG, checked by type, given random names and never run.
- Our form log keeps no message content and no raw IP addresses.
- Our hosting account is protected by two-factor login, and only we can see enquiries.
No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires, including CERT-In in India and, once the DPDP Act's breach duties apply, the Data Protection Board of India.
Your rights
Wherever you are, you can ask us to:
- tell you what personal data we hold about you, how we use it and who we have shared it with
- correct, complete or update it
- delete it, unless a law requires us to keep it
- stop sending you updates, or withdraw any consent you gave
- send you a copy in a common electronic format
- stop or limit using it while a complaint is checked, or stop using it for our legitimate interests unless we have compelling grounds
- in India, nominate someone to use your rights if you die or cannot act yourself
Use the data rights form or email info@aravaliexports.in. It is free. We reply within 30 days, or sooner where the law of your country sets a shorter time (for example, 10 days for an access request under South Korean law). We may ask you to confirm your identity before we act, and we use what you give us for that only for that.
If you are not satisfied with our answer, you can complain to:
- India: the Data Protection Board of India, once it accepts complaints and after you have used our grievance process
- EU: the data protection authority in your country
- UK: the Information Commissioner's Office (ico.org.uk)
- Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca)
- South Korea: the Personal Information Protection Commission (pipc.go.kr)
- Japan: the Personal Information Protection Commission (ppc.go.jp)
- United Arab Emirates: the UAE Data Office
- Saudi Arabia: the Saudi Data and AI Authority (SDAIA)
- elsewhere: the data protection authority in your country
California and other US states. We do not sell or share personal information and do not use it for targeted advertising, so there is nothing to opt out of. A Global Privacy Control signal from your browser changes nothing because we track nothing.
Grievance Officer and contact
Satish Yadav, Proprietor Aravali Exports, 4, Yadav Block, Malgodam Road, Kanakpura, Jaipur, Rajasthan 302034, India Email: info@aravaliexports.in, Monday to Sunday, 10:00 to 17:00 IST
We acknowledge a grievance within 48 hours and resolve it within 30 days.
Changes to this notice
If we change how we use personal data, we update this page and the date at the top. If a change affects data we already hold, we tell the people concerned by email before it applies.