Privacy & Data Protection Policy

Document Version: 3.2 | Effective Date: March 2026

IMPEXSHIPS PRIVATE LIMITED ("we", "us", "our") operates a global B2B trade platform. This Privacy Policy is designed to clearly articulate how we collect, process, safeguard, and disseminate your personal and corporate data across our digital infrastructure, ensuring strict compliance with global data protection frameworks.

1. Categorization of Collected Data

To facilitate secure and verifiable B2B trade, we are required to collect specific datasets:

• Corporate Identity Data: Company registration numbers, GST/VAT identifiers, director profiles, and business incorporation certificates essential for KYB (Know Your Business) compliance.
• User Contact Data: Authorized representative names, corporate email addresses, billing addresses, warehouse delivery coordinates, and mobile numbers.
• Financial & Transactional Data: Encrypted payment mandates, bank account details for escrow payouts, and transaction histories. (Note: ImpexShips does not retain raw credit card PANs; these are tokenized via Razorpay).
• Operational Telemetry: IP addresses, browser fingerprints, session durations, and interaction metrics gathered via platform cookies to optimize user experience and detect anomalous activities.

2. Lawful Basis for Processing

We do not process data arbitrarily. Every data processing activity is rooted in a defined lawful basis:

• Contractual Necessity: To execute trade agreements, process payments, and coordinate logistics on your behalf.
• Legal Obligation: To comply with anti-money laundering (AML) laws, taxation reporting, and international trade embargo audits.
• Legitimate Interest: To enhance our proprietary matchmaking algorithms, improve platform security, and deploy targeted B2B marketing (subject to opt-out provisions).

3. Information Sharing and Disclosure

ImpexShips operates within a network of trusted partners. We may share your data with:

Logistics Partners: Freight forwarders, customs brokers, and courier agencies require your delivery coordinates and commercial invoice data to physically move cargo.

Payment Gateways: Entities like Razorpay require transactional and identity data to underwrite risk and process fund transfers securely.

Regulatory Authorities: We will disclose data to law enforcement, port authorities, or government bodies when compelled by subpoenas, court orders, or mandatory regulatory reporting.

4. Cryptographic Security & Retention

Our infrastructure employs military-grade TLS 1.3 encryption for data in transit and AES-256 encryption for data at rest. Access to backend administration panels is fortified by Multi-Factor Authentication (MFA) and granular Role-Based Access Control (RBAC).

We retain your data only for as long as your account is active, plus an additional period mandated by financial and corporate tax laws (typically 5 to 7 years post-account closure).

5. User Autonomy & Rights

You maintain sovereign control over your personal data. Subject to legal constraints, you possess the right to request access to your data export, demand rectification of inaccuracies, request erasure ("Right to be Forgotten"), and withdraw consent for marketing communications via the dashboard preferences panel.