Who we are
This website is run by Aashita Vedaherbs Private Limited (“Aashita Veda Herbs”, “we”, “us”), a private limited company incorporated in India, with its registered office at 92/97, Patel Marg, Mansarovar, Jaipur 302020, Rajasthan, India.
We decide why and how the personal data described here is used. Under India’s Digital Personal Data Protection Act, 2023 we are the Data Fiduciary; under the EU and UK General Data Protection Regulation we are the controller. You can reach us at veda@aashita.co.in.
What this policy covers
This policy covers the website and the emails we exchange with you about an order request. The website is a catalogue for businesses: you choose products and quantities, send us your company and shipping details, and we reply with a quote by email. You do not create an account, and nothing is paid on the website.
Once a quote or proforma invoice is accepted, the contract for that order also governs how trade documents are handled.
What we collect
Details you give us in the order request form
- your name, company name and work email address (required);
- destination country (required), destination port (optional) and the Incoterm you prefer;
- the products, quantities and packaging you ask about;
- anything you write in the notes box (optional);
- a phone or WhatsApp number, only if you give one and tick the box allowing us to contact you that way;
- a record that you agreed to this policy and the terms, and confirmed you are 18 or older and acting for a business.
Please do not put sensitive information in the notes box (for example health, financial or identity details). We do not need it to quote.
Details in emails
When you write to us, we receive your email address, your message and anything you attach.
Technical data
- Your IP address is used for a few minutes to limit how many requests one network can send, which protects the form from abuse. It is not stored with your order request.
- Our web server records standard request logs (IP address, time, page requested, browser type) to keep the site secure and working.
- If the bot check on the order form is switched on, it is provided by Cloudflare Turnstile, which processes your IP address and browser signals to tell people from automated scripts.
Stored in your browser
Your order request list is kept in your own browser until you send it, and we remember your cookie choice. The cookie policy lists every item.
What we do not collect
We do not take payment card or bank details on the website, we do not ask for passwords or identity documents, and we do not use analytics, advertising or social-media trackers.
Why we use it
- to prepare and send you a quote, and to answer your questions about it;
- if you go ahead, to prepare the proforma invoice, contract, shipping and export documents;
- to keep the trade and tax records Indian law requires;
- to protect the website and the form from spam, fraud and abuse.
We do not send newsletters or marketing, and we do not use your details to make automated decisions about you. If we ever want to send you marketing, we will ask first, separately.
Our legal basis
India. We process your personal data on the basis of the consent you give when you tick the box on the order form, for the purposes listed above, and for the uses the Digital Personal Data Protection Act, 2023 allows without consent, such as meeting a legal obligation.
EU and UK. We rely on:
- taking steps at your request before entering into a contract (Article 6(1)(b) GDPR), to quote;
- performing the contract, if an order is confirmed (Article 6(1)(b));
- compliance with legal obligations, for trade and tax records (Article 6(1)(c));
- our legitimate interests in running a secure business-to-business service and preventing abuse (Article 6(1)(f)).
You can withdraw consent at any time (see your rights). Withdrawing does not affect anything we did before, and we may still keep records the law requires us to keep.
International transfers
We are based in India, so your details are handled in India. Some service providers may process them in other countries. Where we transfer data outside India, we do so only to countries not restricted by the Government of India.
If you are in the EU or UK, sending us an order request means your details are transferred to India, which does not have an EU or UK adequacy decision. We make that transfer because it is necessary to take the pre-contractual steps you asked for and to perform the contract (Article 49(1)(b) GDPR). Where a service provider receives EU or UK data, we use the European Commission’s standard contractual clauses or the UK addendum.
How long we keep it
- Order requests that do not become an order, and the emails about them: 3 years from our last contact, as a record of trade enquiries, then deleted.
- Confirmed orders: the invoices, contracts and export documents for as long as Indian company, tax and foreign-trade law requires us to keep them, then deleted.
- Phone or WhatsApp number: deleted when you withdraw consent, otherwise with the order request.
- Rate-limit data: held in memory for no more than 15 minutes.
- In your browser: see the cookie policy.
How we protect it
We use reasonable security practices in line with the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including:
- encrypted connections (HTTPS) between your browser and the website;
- an application server and database that do not accept connections from the internet directly;
- access to order requests limited to signed-in staff, with hashed passwords and short sessions;
- strict security headers, and no third-party scripts other than the optional bot check on the order form.
No system is perfectly secure. If a personal data breach affects you, we will tell you and the authorities as the law requires.
Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and how we use it (access);
- correct, complete or update it;
- erase it, unless the law requires us to keep it;
- withdraw your consent, as easily as you gave it;
- in the EU and UK, restrict or object to processing, and receive your data in a portable format;
- in India, nominate another person to exercise your rights if you die or become unable to;
- deal with a complaint (grievance redressal).
If you are not satisfied with our answer, you can complain to the Data Protection Board of India, or to your local data protection authority in the EU or the Information Commissioner’s Office in the UK.
How to make a request, and our Grievance Officer
Email veda@aashita.co.in or use the data request page, which has a ready-made email. We reply within 30 days. We may ask you to confirm the request from the email address you used on the order request, so we do not give your data to someone else.
Grievance Officer
Grievance Officer, Aashita Vedaherbs Private Limited
92/97, Patel Marg, Mansarovar, Jaipur 302020, Rajasthan, India
veda@aashita.co.in
Children
This website is for businesses. It is not directed at anyone under 18, and the order form asks you to confirm that you are 18 or older and acting for a business. We do not knowingly collect personal data from children. If you think a child has sent us their details, write to veda@aashita.co.in and we will delete them.
Links to other websites
Some pages link to other websites, such as Google Maps for our address. Those sites have their own privacy policies, and we are not responsible for them.
Changes to this policy
We will update this page when our practices change and change the date at the top. If a change affects how we use details you have already sent us, we will tell you by email before it takes effect.
Contact
Aashita Vedaherbs Private Limited
92/97, Patel Marg, Mansarovar, Jaipur 302020, Rajasthan, India
veda@aashita.co.in