Privacy Policy
Effective date: 6 May 2026Last updated: 6 May 2026
1. Who we are
This privacy policy applies to the website crystanor.com ("the Site"), operated by Crystanor, a business of HRD Group (collectively "Crystanor", "we", "us", "our").
Registered address: Gujarat, India
Contact for privacy queries: info@crystanor.com or kahan@crystanor.com
We act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and as the Data Controller under the EU General Data Protection Regulation (GDPR) and UK GDPR for personal data submitted through this Site.
2. What information we collect
We collect personal data only when you choose to submit it through our enquiry / Request a Quote form. The fields collected are:
- Contact details — full name, company name, country, email address, phone / WhatsApp number
- Business context — industry, intended application, required salt purity, estimated volume, packaging preference, delivery terms (e.g. FOB / CIF), destination port, additional specifications you choose to share
We do not ask for sensitive personal data, financial information, or identification documents through this Site. Please do not include such information in the "Additional Specifications" free-text field.
We collect no other personal data automatically beyond standard server logs maintained by our hosting providers (see §6).
3. Why we collect it (lawful basis)
We process the data you submit for the following purposes:
| Purpose | GDPR / UK GDPR basis | DPDP Act basis |
|---|---|---|
| Responding to your enquiry and preparing a quotation | Legitimate interests; pre-contractual steps at your request (Art. 6(1)(b), 6(1)(f)) | Performance of contract / specified purpose with consent |
| Internal record-keeping of sales enquiries | Legitimate interests (Art. 6(1)(f)) | Legitimate use |
| Compliance with applicable export and tax law if our discussions progress to a transaction | Legal obligation (Art. 6(1)(c)) | Legal obligation |
We do not use your information for marketing emails, newsletters, advertising, profiling, or automated decision-making. Submitting the enquiry form does not subscribe you to any list.
4. How long we keep your data
- Enquiries that do not progress to a transaction: we retain the submitted information for up to 24 months from your last contact with us, after which it is deleted, unless we are required to keep it longer for legal or accounting reasons.
- Enquiries that lead to a commercial relationship: the related records are retained for the duration of the relationship and for the period required under Indian law (typically up to 8 years under the Companies Act, 2013 and the Income-tax Act, 1961, whichever is longer).
You may request earlier deletion at any time (see §9).
5. Who we share it with
We do not sell, rent, or trade your personal data. We share it only with:
- Our internal sales, export, and operations team at Crystanor / HRD Group, on a need-to-know basis.
- Service providers ("Processors") who help us run the Site and email infrastructure, under written confidentiality obligations:
- Vercel Inc. (USA) — website hosting
- Amazon Web Services, Inc. (AWS Elastic Beanstalk, Europe (London) region) — backend / API hosting
- Amazon Web Services, Inc. (Amazon SES, Europe (London) region) — outbound transactional email
- Government authorities, courts, or regulators, only if we are legally required to disclose information (e.g. court order, tax investigation).
Where we engage logistics, banking, or trade-finance partners in connection with a confirmed order, your contact and shipping details may be shared with them strictly to fulfil that order.
6. International data transfers
Crystanor is based in India. Some of our service providers (Vercel, AWS) process data on servers outside India, including in the United States and the European Union / United Kingdom.
- For transfers from the EU/UK to India (and onward), we rely on the Standard Contractual Clauses adopted by the European Commission and, where applicable, the UK International Data Transfer Addendum, together with appropriate technical and organisational safeguards.
- For transfers under the DPDP Act, we transfer personal data only to jurisdictions not restricted by the Indian Government and ensure equivalent safeguards by contract.
A copy of the relevant safeguards can be requested by writing to info@crystanor.com or kahan@crystanor.com.
7. Cookies and tracking
The Site uses only strictly necessary cookies and similar technologies required for it to function (e.g. load balancing, basic security). We do not use advertising cookies, cross-site tracking, or third-party analytics that profile individual visitors.
If we add analytics in the future, we will update this policy and, where required, ask for your consent before any non-essential cookies are set.
8. How we protect your data
We apply reasonable technical and organisational measures appropriate to the sensitivity of the data, including:
- Encryption of data in transit (HTTPS/TLS) between your browser, our website, and our backend.
- Access controls limiting enquiry data to authorised members of our sales and export team.
- Use of reputable hosting and email providers with industry-standard security certifications.
- Periodic review of access and retention.
No transmission over the internet can be guaranteed 100% secure; we encourage you not to send sensitive personal or financial information through the enquiry form.
9. Your rights
Depending on where you are located, you may have some or all of the following rights in respect of your personal data:
- Access — to request a copy of the personal data we hold about you.
- Correction / rectification — to ask us to correct inaccurate or incomplete data.
- Erasure / deletion — to ask us to delete your data, subject to legal retention obligations.
- Restriction or objection — to limit or object to certain processing.
- Withdrawal of consent — where processing is based on your consent, you may withdraw it at any time without affecting prior lawful processing.
- Data portability — where applicable, to receive your data in a structured, commonly used format.
- Right to nominate (DPDP Act, India) — to nominate another individual to exercise your rights in the event of your death or incapacity.
- Right to lodge a complaint with the Data Protection Board of India, the UK Information Commissioner's Office (ICO), or your local supervisory authority in the EU.
To exercise any of these rights, contact info@crystanor.com or kahan@crystanor.com with your request and enough information for us to identify you. We respond within the timeframes required by applicable law (generally up to 30 days).
10. Children
The Site and our services are intended for business customers and not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted information, please contact us so we can delete it.
11. Changes to this policy
We may update this policy from time to time to reflect changes to our practices, services, or applicable law. Material changes will be highlighted on the Site. The "Last updated" date at the top indicates when the policy was last revised.
12. Contact us
For any questions, complaints, or requests relating to this privacy policy or your personal data:
- Email: info@crystanor.com or kahan@crystanor.com
- Postal: Crystanor, Gujarat, India
If you are not satisfied with our response, you may refer the matter to the relevant data protection authority in your jurisdiction.