Plain-language summary: We collect only the data needed to run the marketplace, use it to provide services, verify users, prevent fraud and (with your choice) send marketing. We do not sell your data. We share it with other users as the service requires, trusted providers and authorities when legally required. You can access, correct, delete your data and withdraw consent by contacting our Grievance Officer.
1. Who We Are and Scope
1.1 [LEGAL ENTITY NAME] ("GTO", "we", "us", "our") operates www.myglobaltradeops.com (the "Site"), a global B2B trade-lead marketplace. We take your privacy seriously. This Statement explains how we collect, use, share, store and protect personal data when you visit or use the Site and our services. It is part of our Terms of Use.
1.2 Roles. For the Digital Personal Data Protection Act, 2023 ("DPDP Act"), GTO is the "Data Fiduciary". For the EU/UK GDPR, GTO is the "controller". For personal data of buyer contacts that a Member receives through the Service, the Member is independently responsible as controller/fiduciary for its own use. Our service providers act as processors/Data Processors.
1.3 This Statement applies to all users worldwide, with supplemental information for specific regions in Section 14.
1.4 Our commitments: we implement technical, physical and organisational safeguards; we collect the minimum personal data necessary; only trained, authorised personnel access personal data; and we do not disclose personal data to external parties except as described here, with your consent, or as required by law.
2. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, designation, company name, address, phone, email, website, social handles | You, at registration or enquiry |
| Business and trade data | Nature of business, products/services, trade requirements, Leads, quotations, import-export codes, company registration and tax numbers | You; public registers |
| Verification (KYC) data | Business licence, authorised-signatory ID proof, date of birth or nationality where legally required [VERIFY need] | You |
| Account data | Login ID, password (hashed), preferences, plan, credit balance | You; system |
| Transaction data | Invoices, billing address, GST details, payment status and gateway reference. We do not store full card numbers; payments are handled by PCI-DSS compliant gateways | You; payment gateway |
| Communications | Messages, support tickets, survey responses, call recordings where notified | You |
| Technical data | IP address, device and browser type, language, access times, referring URL, clickstream, cookie identifiers, approximate location | Automatically |
| Marketing data | Newsletter subscription, consent records, email engagement | You; our email tools |
2.1 Providing personal data is necessary for us to provide the requested services and perform our contract with you. If you do not supply it, we may be unable to provide the service.
2.2 We do not knowingly collect sensitive personal data (such as health, biometric or financial-account credentials) except as strictly needed for verification or payment, and we do not knowingly collect data of children under 18. Please contact us if you believe a child has provided data.
3. How and Why We Use Personal Data
We use personal data for the following purposes and on the following legal bases (consent, contract, legal obligation, legitimate interests, or "legitimate uses" under Section 7 of the DPDP Act):
| Purpose | Basis (India / GDPR) | Data used |
|---|---|---|
| Processing applications; creating and managing your account and plan | Contract / consent | Identity, account, KYC |
| Providing the Site and services, posting and matching Leads, enabling buyer-supplier connections | Contract / consent | Identity, trade, communications |
| Payments, invoicing, tax and accounting; collecting overdue amounts | Contract; legal obligation | Transaction |
| Verification, fraud prevention, security, AML and sanctions screening; protecting users | Legal obligation; legitimate interests | KYC, technical |
| Customer support; resolving disputes; legal claims | Contract; legitimate interests | Communications |
| Operations: analysis, research, auditing, improving the Site and developing features | Legitimate interests | Technical, usage |
| Marketing: newsletters, promotions, events and similar services of GTO and partners | Consent (opt-in where required) | Contact, marketing |
| Complying with law, regulators, courts | Legal obligation | All as required |
3.1 Direct marketing. We may contact you by email, SMS, phone, WhatsApp or other channels. You can opt out at any time through the unsubscribe link or by writing to us, free of charge. Where law requires explicit consent, we will send marketing only after obtaining it.
3.2 Identification data such as ID numbers, dates of birth and nationality are used only for verification, fraud prevention and legal compliance.
3.3 We do not sell personal data. We do not make decisions producing legal effects solely through automated processing without human involvement [CONFIRM if automated lead-matching or scoring is used].
4. Disclosure of Personal Data
We keep personal data confidential but may share it with:
Members/buyers/suppliers: when you post a Lead or enquiry, or contact details you choose to publish are shared with other users to facilitate the transaction; Members unlock buyer contact details under the Membership Agreement.
Service providers and processors under contract: hosting and cloud providers, payment gateways, email/SMS and CRM tools, analytics, customer-support, KYC, auditors and professional advisers.
Affiliates, business partners and event co-organisers, for the purposes in Section 3.
Authorities: courts, law enforcement, tax and regulatory authorities, where required by law, summons, subpoena or government request, or in good faith to protect rights, property or safety, prevent crime or fraud.
Successors: a buyer or successor in a merger, acquisition, reorganisation or sale of assets, who will be bound by this Statement.
Others with your consent.
4.1 Personal data collected for verification, such as ID numbers, will not be given to any other third party except as set out above and as required by law.
5. Cookies and Similar Technologies
5.1 Cookies are small text files stored on your device. Session cookies expire when you close the browser; persistent cookies remain until deleted or expired. We use them to keep you logged in, remember preferences, understand traffic and pages visited, improve services and measure marketing.
| Type | Purpose | Duration | Consent |
|---|---|---|---|
| Strictly necessary | Login, security, session, load balancing, payment flow | Session / [12 months] | Not required |
| Functional | Language, preferences, saved searches | [12 months] | Where required |
| Analytics | Traffic, pages visited, time spent ([e.g., Google Analytics]) | [Up to 24 months] | Opt-in |
| Advertising / marketing | Measuring campaigns, email pixels, serving relevant ads via third parties | [Up to 12 months] | Opt-in |
5.2 You can manage or delete cookies through your browser or our cookie banner/preferences. Blocking some cookies may affect features. See www.allaboutcookies.org. We use an email marketing provider whose pixels and cookies measure email effectiveness, and third-party advertisers that may place or read cookies on your browser using data that excludes your name, address, email or phone number. Please see those providers' policies for their practices.
6. International Data Transfers
6.1 GTO is based in India, and your data may be held on servers and processed by providers and affiliates in other countries, including outside India, the EEA and the UK. Under the DPDP Act, transfers are permitted except to countries restricted by the Government of India.
6.2 Where you are in the EEA/UK, we transfer personal data outside those regions only with appropriate safeguards, such as Standard Contractual Clauses (and the UK Addendum), adequacy decisions, or where necessary to perform our contract with you. Contact us for a copy of the safeguards.
6.3 Because the Site connects businesses worldwide, your Lead information may be seen by Members in many countries that may not offer the same level of data protection as yours.
7. Data Retention
We keep personal data only as long as necessary for the purposes described, or as required by law (for example, tax, accounting and anti-money-laundering rules), after which we delete or anonymise it. Details are in our Data Retention Policy.
8. Security
We use measures including encryption in transit (TLS) and at rest where appropriate, hashed passwords, role-based access with multi-factor authentication for staff, network and application security, logging, regular testing and staff training. See our Data Security Policy. No system is completely secure; please keep your credentials confidential and notify us immediately of any suspected compromise.
8.1 Breach notification. If a personal data breach occurs, we will notify the Data Protection Board of India, CERT-In, regulators and affected individuals as required by law (for example, CERT-In within 6 hours of noticing certain incidents and GDPR within 72 hours). [VERIFY]
9. Your Rights
9.1 Under the DPDP Act, you (the "Data Principal") have the right to: obtain a summary of personal data we process and the identities of those we have shared it with; correct, complete or update data; request erasure; withdraw consent at any time; nominate another person to exercise your rights in event of death or incapacity; and obtain grievance redressal.
9.2 Under the GDPR/UK GDPR, you may also have the right to access; rectification; erasure; restriction; objection (including to direct marketing); data portability; and not to be subject to solely automated decisions.
9.3 Residents of California and certain US states may have rights to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information.
9.4 To exercise rights, contact us at the details in Section 12. We will verify your identity and respond within [30 days] or as required by law. We may refuse requests as permitted by law (for example, where retention is legally required). Withdrawal of consent does not affect prior lawful processing but may limit our services.
9.5 You may lodge a complaint with us and, if unresolved, with the Data Protection Board of India or your local data protection authority.
10. Third-Party Links
The Site may link to external sites. We do not control and are not responsible for their content or privacy practices. Review their privacy statements before sharing data.
11. Children's Data
The Site is intended for business users aged 18 and over. We do not knowingly process the personal data of children. If we learn we have, we will delete it.
12. Grievance Officer / Data Protection Officer and Contact
Grievance Officer / Data Protection Officer: Email: support@myglobaltradeops.com | Marked With Subject: “Grievance Redressal” | Hours: [Mon-Fri, 10:00-18:00 IST.
We will acknowledge complaints within [48 hours] and resolve them within [30 days] or as required by law.
13. Changes to this Statement
We may update this Statement. We will post the updated version at www.myglobaltradeops.com/privacy with a new effective date and, for material changes, notify you by email or notice on the Site. Continued use after the effective date means you accept the update. If you do not agree with this Statement or the Terms of Use, please do not use the Site.
14. Regional Supplements
14.1 India: This Statement is intended to satisfy the IT Act, 2000 and the SPDI Rules, 2011 and the DPDP Act, 2023 and Rules. By providing data you consent to its processing as described, and you may withdraw consent as in Section 9.
14.2 EEA/UK: Our legal bases are in Section 3. You may object to processing based on legitimate interests.
14.3 California: We collected the categories listed in Section 2 in the last 12 months and disclosed them for business purposes to the recipients in Section 4. We do not sell or share personal information for cross-context behavioural advertising [CONFIRM], and do not discriminate for exercising rights.
14.4 Other regions (UAE, Singapore etc.): Local data-protection rights may apply; contact us to exercise them.