Privacy & Cross-Border Data Protection Policy

1. Overview & Data Controller

Grademart Ecommerce Pvt Ltd ("GradeMart", "we", "us", or "our"), incorporated in Chennai, Tamil Nadu, India, operates the international B2B equipment export portal at shop.grademart.com and domestic platform grademart.in. This policy outlines how we collect, process, store, and safeguard corporate, personal, and procurement data across our 24 international storefronts.

2. Information We Collect

• B2B Procurement & Account Information: Contact person name, official corporate email address, direct telephone/WhatsApp number, institutional entity name, business tax identifiers (GSTIN for Indian buyers, VAT/Tax ID for international clients), and registered corporate address.
• Customs & International Shipping Logistics: Consignee name, destination port of entry, delivery address, Incoterms preference (CIF, DAP, EXW), and customs clearance broker details.
• Payment Reference Data: Transactions are processed securely via PCI-DSS Level 1 compliant gateways (Razorpay International Escrow and Zoho Payments) or direct SWIFT/wire transfers. GradeMart never stores, processes, or captures full credit card numbers, CVVs, or bank credentials on its edge servers.
• Technical Edge Metadata: Anonymized country routing header (Cloudflare cf-ipcountry), user agent, and timestamp used strictly to serve regional currencies and localized compliance disclosures.

3. Purpose of Processing

We use collected information solely for legitimate B2B commercial fulfillment:

• Issuing legally binding pro-forma invoices, Zero-Rated LUT export invoices, and Certificates of Origin.
• Facilitating international air/ocean freight logistics and tracking with certified freight forwarders.
• Transmitting official manufacturer warranties, serialized CE/FDA declarations of conformity, and device lot recall notices for medical defibrillators.
• Syncing quotation requests with our Zoho CRM v8 institutional lead pipeline.

4. International Data Transfers & Compliance (GDPR & DPDP)

As a cross-border distributor headquartered in India, data transmitted by buyers in the European Union, GCC, Southeast Asia, and the Americas is encrypted in transit using TLS 1.3 standards.

• DPDP Act (India, 2023): Data is processed under explicit digital consent for specified B2B contract performance.
• GDPR (EU/EEA): European institutional buyers benefit from Standard Contractual Clauses (SCCs) ensuring high-grade confidentiality.
• Zero Third-Party Brokerage: GradeMart does not rent, license, or sell customer databases to advertising networks or external data brokers.

5. Data Retention & Your Statutory Rights

Commercial invoices and customs export documentation are retained for a minimum of 7 years in accordance with Indian Central Board of Indirect Taxes and Customs (CBIC) and international trade laws.

You retain the right to request access to, correction of, or deletion of your corporate contact record (subject to statutory audit requirements) by contacting our compliance officer at [email protected].

6. Contact the Data Protection Desk

For questions regarding data security, corporate privacy, or regulatory disclosures: