Privacy Policy

1. Who We Are

Eva Excelsior ("Eva", "we", "us") operates a digital trade facilitation platform connecting exporters, importers and service providers. For the personal data described in this policy, Eva Excelsior is the data controller (data fiduciary under India's Digital Personal Data Protection Act, 2023).

2. Information We Collect

2.1 Information you provide

• Account details: name, email address, phone number, password (stored only as a salted hash).
• Business details: company name, legal entity type, GST, PAN, IEC, CIN, tax IDs, addresses and bank details.
• Verification (KYC) data: identity and business documents, and video-KYC recordings where you choose that option.
• Trade data: products, quotations, orders, shipments, invoices and trade documents you create or receive.
• Communications: inquiries, support requests and messages sent through the platform.

2.2 Information collected automatically

• Device and usage data: IP address, browser type, pages visited and actions taken.
• Cookies and similar technologies described in Section 7.
• Security logs used to detect fraud, abuse and unauthorised access.

2.3 Information from third parties

With your consent or where the law permits, we receive verification results from government and regulatory sources (for example GST, PAN, DGFT/IEC and sanctions-screening services), payment providers and logistics partners.

3. How We Use Your Information

• To create and secure your account and to verify your identity and business.
• To process orders, payments, payouts, shipments, inspections and trade documents.
• To comply with trade, tax, anti-money-laundering, sanctions and export-control obligations.
• To prevent fraud and keep the platform safe.
• To provide support, send service notices and, where you have opted in, product updates.
• To improve the platform through aggregated and anonymised analytics.

4. Legal Bases for Processing

We process personal data on the basis of your consent, to perform our contract with you, to comply with legal obligations, and for our legitimate interests in operating a secure and reliable trade platform. Where we rely on consent you may withdraw it at any time without affecting prior processing.

5. Who We Share Information With

We do not sell personal data. We share it only as needed with:

• Trading counterparties: the buyer or seller on an order sees the business and contact details needed to complete it.
• Service partners: shipping agencies, inspection agencies, banks and payment providers engaged for your transaction.
• Infrastructure providers: hosting, storage, email and SMS providers acting on our instructions.
• Authorities: regulators, customs, tax and law-enforcement bodies where required by law.

6. International Transfers

International trade involves sharing data across borders. Where personal data is transferred outside your country we use appropriate safeguards, such as contractual protections, and share only what is necessary for the transaction.

7. Cookies

We use essential cookies for sign-in, security and your language and currency preferences. Non-essential cookies are used only if you accept them in the cookie banner, and you can change your choice at any time.

Change my cookie preferences

8. Data Retention

We keep personal data for as long as your account is active and as long as needed to meet legal, tax, audit and trade-record requirements (typically up to eight years for transaction records). When data is no longer needed it is deleted or anonymised.

9. Security

We protect data with encryption in transit and at rest, role-based access control, short-lived sessions, parameterised database access, audit logging and regular security reviews. No system is perfectly secure; if a breach affecting your data occurs we will notify you and the relevant authority as the law requires.

10. Your Rights

Depending on where you live (including under the DPDP Act and the GDPR) you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate or incomplete data.
• Erase your data, subject to records we must keep by law.
• Object to or restrict certain processing, and withdraw consent.
• Nominate another person to exercise your rights, and lodge a grievance or complaint.

You can exercise most of these rights yourself in your account under Data Privacy (DPDP) and GDPR Rights, or by contacting us below.

11. Children

The platform is a business service intended for adults and registered businesses. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this policy from time to time. We will post the new version here with a new "last updated" date and notify you of material changes.

13. Contact and Grievances