This notice explains what personal data spicemodo.com collects, why, who receives it, and what rights you have. It is written to meet Article 13 of the UK and EU General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023, because we deal with buyers in all three jurisdictions.
1. Who we are
SpiceModo is a trading brand of Vasundhara Performance Solutions Pvt. Ltd. (CIN U74999TG2016PTC112235), a company registered in India at H.No. 10-2-309, Flat No. 201, Sudha Vaishnavi Residency, Street No. 4, West Maredpally, Hyderabad, Telangana 500026, India. We are the data controller for personal data collected through this website.
For any question about this notice or about your data, write to [email protected] or call +91 7337568989. We aim to respond within five working days and, where a formal request is made, within one month.
2. What we collect
2.1 Information you give us
Our enquiry form asks for your full name, company, email address and destination country, all of which are required, and a free-text message. Depending on the type of enquiry you select, it may also ask for products of interest, target volumes, end use, preferred Incoterm, indicative target price, destination port, timeline, SKUs, pack format, artwork status, and — for sample requests — a ship-to courier address.
Please do not send us special-category data (health, religion, political opinion, biometric or similar). We do not need it and do not want it.
2.2 Information collected automatically
If, and only if, you click Accept on the cookie banner, Google Analytics 4 collects usage data — pages viewed, approximate location derived from a truncated IP address, device and browser type, and how you arrived at the site. Until you accept, Google Consent Mode v2 runs with analytics and advertising storage set to denied and no analytics cookies are written.
Independently of consent, our hosting and security provider Cloudflare processes connection metadata — IP address, user agent, request timestamps — to route traffic and defend against attacks. This is technically necessary and cannot be switched off without making the site unavailable.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry, sending quotations, specifications, Certificates of Analysis and samples | Steps taken at your request prior to entering a contract (UK/EU GDPR Art. 6(1)(b)); for the individual contact at a corporate buyer, our legitimate interest in responding to a business enquiry (Art. 6(1)(f)) |
| Managing an ongoing supply relationship and export documentation | Performance of a contract (Art. 6(1)(b)); compliance with legal obligations under Indian export, customs and tax law (Art. 6(1)(c)) |
| Website analytics | Your consent (Art. 6(1)(a)), withdrawable at any time |
| Security, abuse prevention and keeping the site available | Our legitimate interest in protecting the service (Art. 6(1)(f)) |
Under India's DPDP Act, 2023 we process your data on the basis of the consent or legitimate use applicable to each purpose above.
We do not sell personal data, we do not share it with advertising networks, and we do not use it for automated decision-making or profiling.
4. Who receives it
- Formspree, Inc. (United States) — processes and delivers the enquiry form to our inbox.
- Google (Analytics 4) — analytics, only after you consent.
- Cloudflare, Inc. — content delivery, DNS and security for the site.
- Our email provider, for the correspondence that follows your enquiry.
- Logistics, laboratory, inspection and customs partners, where an actual shipment requires it — for example a courier needs the ship-to address on a sample pack, and an export document may carry a named consignee contact.
We may also disclose data where the law requires it, or to establish or defend a legal claim.
5. International transfers
We are based in India. If you contact us from the UK, the EEA or elsewhere, your data is transferred to India and to the service providers named above, some of which are in the United States.
For transfers out of the UK or EEA we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses as incorporated in our providers' terms, together with the safeguards those providers publish. You can ask us for details of the mechanism applying to a specific transfer.
6. How long we keep it
- Enquiries that do not lead to business — 24 months from our last contact with you, then deleted.
- Customer and shipment records — for as long as the relationship continues, and afterwards for the period Indian tax, customs and companies legislation requires us to retain export documentation.
- Analytics data — per the retention period configured in Google Analytics, which is capped at 14 months.
- Security logs — a short rolling window, per our provider's standard settings.
7. Your rights
Subject to the conditions in the applicable law, you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time — withdrawing consent does not affect processing already carried out.
To exercise any of these, email [email protected]. We will not charge you, and we will not treat you differently for asking.
To withdraw analytics consent, use the Decline option on the cookie banner, or clear this site's data in your browser and choose Decline when the banner reappears. See our Cookie Policy.
If you are unhappy with how we have handled your data you can complain to a supervisory authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EEA your national data protection authority, and in India the Data Protection Board of India. We would appreciate the chance to put things right first.
8. Security
The site is served exclusively over HTTPS with HSTS preloading, a strict Content Security Policy, and standard hardening headers. Enquiry data is transmitted over TLS. We keep access to enquiry correspondence limited to the people who need it to answer you. No system is perfectly secure, but we take this seriously and publish a coordinated disclosure policy at /security-policy.html.
9. Children
This is a business-to-business site. It is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, tell us and we will delete it.
10. Changes
If we change this notice we will update the effective date above. Material changes will be flagged on this page.