Privacy notice
Version 1.2
This notice explains how Indus Strategic Partners Ltd ("ISP", "we") collects and uses personal data in connection with ISPCatalogue.com (the "Platform"). It applies to the individuals who act for a Supplier or Partner business in using the Platform - for example, the people whose names and contact details are provided during onboarding or registration. It also covers visitors to the Platform's public pages, such as the home page and the help centre.
1. Who we are
ISP is the controller of the personal data described in this notice. ISP is a company incorporated in England and Wales under company number 09129190, whose registered office is at 71-75 Shelton Street, London, England, WC2H 9JQ.
2. What personal data we collect
Depending on whether you are acting for a Supplier or a Partner, we may collect: names, job titles, email addresses and phone numbers of individuals at your business; login and account credentials; business registration and verification documents (for example IEC, GST, PAN, EPCH membership, certificates of incorporation, or equivalent); order, transaction and payment records; messages sent through the Platform where it offers messaging; and technical and usage data such as IP address and login activity.
When you visit the Platform's public pages (not the signed-in areas), we also collect website analytics: the page visited, how quickly it loaded, any error it showed, your browser and device type, and your approximate location (country and region). This does not identify you, and it uses no cookies or similar technologies. If you use Indi, ISP's automated help assistant, we collect the questions you ask it and the answers it gives you.
3. How we use your data, and our legal basis
We use personal data to: verify your business and the individuals acting for it during onboarding (necessary for our legitimate interests in running a trusted B2B platform, and in some cases a legal obligation); operate your account and process Orders (necessary to perform our contract with you); collect and remit payment (performance of contract); maintain the Platform's privacy and non-circumvention protections, including checking the text written on the Platform for contact details and attempts to deal outside it (legitimate interests); comply with Applicable Laws, including anti-money-laundering, sanctions and export-control checks (legal obligation); and, where you have agreed, send you product or platform updates (consent, which you may withdraw at any time).
We use website analytics to keep the public pages fast and working properly (legitimate interests).
We use Indi's questions and answers to answer you and to improve our Help centre (legitimate interests). Indi is automated: its answers come only from the Platform's published help articles, glossary and terms, not from your account, and it makes no decisions about you. Please don't share personal or confidential information with it. You can always email ISP instead.
4. Verifying your details
By accepting this notice, you consent to ISP verifying the information and documents you provide - including business registration, tax and export-council details - directly with the relevant registry, or through a third-party verification or KYB (know-your-business) provider engaged by ISP.
5. Where we store your data
Personal data collected through the Platform is stored in the United Kingdom.
6. International transfers
Where personal data is transferred between the United Kingdom and a Supplier's country (for example India or China), for example because an Order connects a UK-based Partner with a Supplier there, ISP will put an appropriate transfer mechanism in place, such as the UK's International Data Transfer Agreement or, where relevant, EU Standard Contractual Clauses.
7. Who we share your data with
We may share personal data with: service providers who support the Platform (such as hosting, email, verification/KYB, and payment providers), under contracts that protect your data; the counterparty to an Order, but only to the extent necessary to fulfil it and in line with clause 4 of the Platform Terms of Use (for example, a Partner's delivery details are shared with the freight forwarder delivering the Order, not with the Supplier; and once a Supplier confirms an Order, its business name and address appear on that Order's documents as the seller); Partners browsing the Platform, who see a Verified or Audited Supplier's trading name, brand story and logo; regulators, law enforcement or other authorities where required by law; and our professional advisers. We do not sell personal data.
Our hosting provider, Amazon Web Services, also provides the website analytics, and processes them in the United Kingdom. Indi's answers are produced by an AI model run for us by Amazon Web Services in the United Kingdom (London). Your questions are processed only to answer them and are not used to train the model.
8. How long we keep your data
We retain personal data for as long as your account is active, and for 7 years afterwards, to meet our legal, accounting, tax and dispute-resolution obligations.
Website analytics are kept for 30 days.
Indi's questions and answers are kept for 90 days, or deleted earlier if your account is removed.
9. Your rights
Under UK GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to our processing; receive data you provided in a portable format; and withdraw consent at any time where we rely on it. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you believe we have not handled your data properly.
10. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse.
11. Changes to this notice
We may update this notice from time to time. The current version is always available on the Platform, and material changes will be notified as required by Applicable Law.
12. Contact us
Email us at contact@ispcatalogue.com.