Privacy Policy

1. Who we are

This website, www.indileaf.co ("the Site"), is operated by Indileaf Ventures LLP, based in Gujarat, India ("Indileaf", "we", "us"). We supply unmanufactured tobacco leaf, lamina, high-nicotine scrap, dust and stems (a by-product of processing) to manufacturers and importers worldwide. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we act as the Data Fiduciary for personal data collected through the Site. Where the EU or UK GDPR applies, we act as the controller.

For any privacy matter, write to contact@indileaf.co or call +91 80001 50037.

2. Who this Site is for

The Site is for business buyers and trade visitors. We do not offer products to consumers and we do not knowingly collect data from anyone under 18. If you believe a person under 18 has sent us information, tell us and we will delete it.

3. What we collect, why, and on what basis

We collect only what helps us answer a business enquiry or deliver what you asked for. The table shows each source, what it collects, why, and the basis we rely on.

Source	Data	Purpose	Basis
Business enquiry form	Name, company, job title, business email, phone or WhatsApp number, country, type of business, products of interest, quantity, specification needs, shipping and payment preferences, message	Reply to your enquiry, prepare a quotation, assess whether we can supply	Your consent; for EU and UK visitors, steps before a contract and our legitimate interest in answering you
Sample request form	The above, plus delivery company, delivery address, postal code, country, courier account reference, import-permit note	Process and ship a sample, prepare the documents that travel with it	As above
Downloads	Name, company, business email, and country where requested	Release the document you asked for; follow up about your interest where you agreed	Your consent, which you can withdraw at any time
Email updates	Business email, name, company	Send market updates, only if you opted in	Consent, given separately and never pre-ticked
Email, phone and WhatsApp	Your number or address, name, message content, any files you send	Respond and continue the conversation you started	Consent; our legitimate interest in answering you
Cookies and analytics	IP address (shortened where the tool allows), device and browser type, pages viewed, referrer, approximate location	Keep the Site working and understand which pages are useful	Consent for non-essential cookies; essential cookies need none
Buyer onboarding, outside the Site forms	Business and trade-compliance information needed to open an account	Legal and trade-compliance checks	Legal obligation; legitimate interest

We do not intentionally collect sensitive categories of data. Please do not put bank, card or government ID details into a form or message. If a transaction needs them, we will agree a secure channel with you first.

4. Email and business communications

We use your email address to reply to what you asked for, and we may send related follow-up about the same request. We send marketing or market updates only if you opted in, and every such email carries an unsubscribe link. You can withdraw consent at any time by writing to us (see section 11). We do not buy email lists and we do not send promotional material to consumers.

5. WhatsApp

If you click a WhatsApp link or message us there, the conversation runs on WhatsApp's own service under its own terms and privacy notice. We see your number and what you send, and we use it only to handle your enquiry. We do not add you to broadcast lists unless you agree. WhatsApp may process data outside India and the EU. If you prefer not to use it, the enquiry form and email work equally well.

6. Cookies and analytics

Essential cookies keep the Site and its forms working and help with spam protection. They need no consent.
Analytics cookies are used only if you accept them. We use them to see which pages are read, with IP addresses shortened where the tool allows.
No advertising or retargeting cookies. We do not use the Site to track you across other websites.

You can change your choice at any time through your browser settings, which let you block or delete cookies. Blocking essential cookies may stop some forms from working.

7. Who we share data with

Service providers that host the Site and run our email, enquiry handling and spam protection, acting on our instructions.
Couriers, freight forwarders, customs agents and banks, limited to what is needed to ship a sample or an order.
Professional advisers such as lawyers and auditors, under confidentiality.
Authorities, where the law requires, for example customs, tax or a court order.

We do not sell personal data, and we do not share it with other exporters or marketers.

8. Transfers outside India

We are based in India. Our service providers may store data in other countries. The DPDP Act permits transfers except to countries the Government restricts. For EU and UK visitors, where we transfer data to a country without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses where applicable. Ask us at contact@indileaf.co if you want to know more about the safeguards in place.

9. How long we keep data

We keep personal data only as long as it is needed for the purpose it was collected for, or as the law requires. Typical periods are shown below.

Data	Typical retention
Enquiry or sample request that does not become an order	Up to 24 months after our last contact with you
Customers: orders, invoices, shipping and export documents	For the periods Indian tax, GST, customs and company law require
Email update subscribers	Until you unsubscribe, plus a suppression record so we do not email you again
Download records	Up to 24 months, or until you withdraw consent
Analytics data	Aggregated and kept for a limited period set in the analytics tool
Email and WhatsApp threads	Same as the related enquiry or order

After the period, we delete or anonymise the data.

10. Security

We use reasonable safeguards: encrypted connections (HTTPS), access limited to people who need it, and service providers with security controls. No system is perfectly secure. If a breach affects your data, we will notify you and the Data Protection Board of India as the law requires.

11. Your rights and how to use them

Under the DPDP Act

You may ask for a summary of your data and how it is processed; ask us to correct, complete or update it; ask us to erase it; withdraw your consent at any time; nominate another person to exercise these rights on your behalf if you die or cannot act; and complain about how we handle your data.

Under the GDPR, if you are in the EU or UK

You may also ask for access, rectification, erasure, restriction of or objection to processing, and data portability. You may withdraw consent without affecting earlier processing, and you may complain to your local supervisory authority.

How to use a right

Write to contact@indileaf.co. We may ask you to verify who you are. We aim to respond within 30 days.

12. Grievance contact

For questions or complaints about how we handle personal data, contact the Grievance Officer, Indileaf Ventures LLP, at contact@indileaf.co, +91 80001 50037, or by post to Indileaf Ventures LLP, Gujarat, India.

If we do not resolve your complaint, you may approach the Data Protection Board of India, or your local data protection authority if you are in the EU or UK.

13. Visitors from the EU and UK

Where the GDPR applies to us, the basis for each use of data is set out in section 3, your rights are in section 11, and transfers are covered in section 8. Contact us at contact@indileaf.co for any request relating to EU or UK data protection law.

14. Third-party links

The Site may link to other sites, for example WhatsApp, LinkedIn or maps. We are not responsible for their privacy practices.

15. Changes to this policy

We may update this policy. The date at the top shows the latest version. Material changes will be flagged on the Site, or by email to people who have given us their address. See also our terms of use.