Privacy Policy

1. Introduction

Nishka Alliance LLP (LLPIN AAC-8293), registered at F-608, Tower-2, Central Grand Mall, Seawood, Navi Mumbai 400706, India ("Nishka Alliance", "we", "us", "our"), operates nishkaalliance.com. This Privacy Policy describes how we collect, use, retain, and protect personal data when you visit our website or interact with us through it.

We are committed to processing personal data lawfully, transparently, and in accordance with applicable data protection legislation.

2. Data controller

Nishka Alliance LLP is the data controller within the meaning of:

• Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR)
• The UK General Data Protection Regulation (UK GDPR) as retained in UK law
• The California Consumer Privacy Act 2018 (CCPA), as amended by the CPRA
• The Digital Personal Data Protection Act 2023 (India — DPDPA)

For all data protection enquiries and requests to exercise your rights, contact us at:
Email: info@nishkaalliance.com
Phone: +91 99900 98085
Post: Nishka Alliance LLP, F-608, Tower-2, Central Grand Mall, Seawood, Navi Mumbai 400706, India

3. Personal data we collect

3a. Data you provide directly

When you submit a contact form, sample request form, newsletter signup, or regulatory document request, we collect: name, email address, company name, phone number, job title, country, product interest, and the content of your message.

3b. Data collected automatically

When you visit nishkaalliance.com, we automatically receive: IP address, browser type and version, operating system, referring URL, pages visited, time and date of visit, time spent on pages, device type, and screen resolution. This data is processed for website security and performance monitoring.

3c. Cookie data

We use cookies as described in our Cookie Policy. Analytics cookies are only set with your explicit consent.

4. Legal basis for processing

We process personal data on the following legal bases:

• Consent — GDPR Article 6(1)(a): Newsletter subscriptions, analytics cookies, and marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
• Performance of a contract — GDPR Article 6(1)(b): Processing sample requests and responding to RFQs where a pre-contractual relationship exists.
• Legitimate interest — GDPR Article 6(1)(f): Responding to general business enquiries, website security, fraud prevention, and website improvement. We have assessed that our legitimate interests are not overridden by your interests or fundamental rights.
• India DPDPA 2023 — Section 4: Processing based on consent of the Data Principal, with purpose limitation and data minimisation applied.
• CCPA: We collect personal information in the categories of identifiers (name, email), internet or electronic network activity (browsing data), and professional or employment-related information (company, job title). We do not sell personal information.

5. Purposes of processing

We process personal data for the following purposes only:

• Responding to sample requests and technical enquiries
• Sending requested Technical Data Sheets, Safety Data Sheets, and regulatory documents
• Processing newsletter subscriptions (only with your explicit prior consent)
• Improving website functionality and user experience
• Website analytics (only with your explicit cookie consent)
• Maintaining website security and preventing fraudulent activity
• Complying with legal obligations applicable to Nishka Alliance LLP

6. Cookies and tracking

We use cookies as described in our Cookie Policy. Google Analytics 4 is loaded only after you provide explicit consent via our cookie consent banner. No analytics tracking occurs without your affirmative action. The consent cookie itself (nishka-cookie-consent) is strictly necessary and does not require consent.

7. Data recipients and third parties

We share personal data with the following third parties for the purposes described:

• Web3Forms (form processing service, USA) — processes form submissions on our behalf. Data is transmitted to Web3Forms servers for the sole purpose of forwarding enquiry data to our email inbox.
• Google Analytics (Google LLC, USA) — if you have consented to analytics cookies, anonymised usage data is processed by Google. Google Ireland Limited acts as data processor under standard contractual clauses.

We do not sell, rent, or trade your personal data to any third party. We do not share personal data with advertising networks. We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

8. International data transfers

Form submissions are processed through Web3Forms servers located in the United States. This transfer is necessary for the performance of our services and is conducted with appropriate safeguards as required by GDPR Chapter V. Where required, we rely on the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

Google Analytics data may be processed in the United States. Google LLC is certified under the EU-US Data Privacy Framework.

9. Data retention

10. Your rights under EU GDPR

If you are located in the European Economic Area, you have the following rights under the GDPR:

• Right of access (Article 15): Obtain confirmation of whether we process your personal data and a copy of that data.
• Right to rectification (Article 16): Request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17): Request deletion of your personal data ("right to be forgotten") where no overriding legal basis applies.
• Right to restriction of processing (Article 18): Request that we restrict processing of your personal data in certain circumstances.
• Right to data portability (Article 20): Receive your personal data in a structured, commonly used, machine-readable format.
• Right to object (Article 21): Object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Right to lodge a complaint: Lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.

11. Your rights under UK GDPR

If you are located in the United Kingdom, you have the same rights as listed under Section 10 (EU GDPR). The relevant supervisory authority is the Information Commissioner's Office (ICO). You may lodge a complaint at ico.org.uk.

12. Your rights under India DPDPA 2023

If you are located in India, you have the following rights under the Digital Personal Data Protection Act 2023:

• Right to access information (Section 11): Obtain a summary of your personal data being processed and the processing activities undertaken.
• Right to correction and erasure (Section 12): Request correction of inaccurate personal data and erasure of personal data that is no longer necessary for the purpose for which it was collected.
• Right of grievance redressal (Section 13): Have grievances addressed by Nishka Alliance LLP in a timely manner. Contact us at info@nishkaalliance.com.
• Right to nominate (Section 14): Nominate another individual to exercise your rights in the event of death or incapacity.

13. Your rights under CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: Know what categories of personal information we collect, the purposes of collection, and whether it is sold or disclosed.
• Right to delete: Request deletion of personal information we have collected about you, subject to certain exceptions.
• Right to opt out of sale: Opt out of the sale of personal information. We do not sell personal information.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.
• Right to correct: Request correction of inaccurate personal information.

To submit a CCPA request, contact us at info@nishkaalliance.com with the subject line "CCPA Privacy Request".

14. Children's privacy

Our website is directed at business professionals engaged in the procurement and formulation of cosmetic and personal care products. It is not intended for use by persons under 16 years of age. We do not knowingly collect personal data from individuals under 16. If you believe we have inadvertently collected such data, contact us immediately at info@nishkaalliance.com and we will delete it promptly.

15. Security measures

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• HTTPS/TLS encryption for all data transmitted to and from nishkaalliance.com
• Access controls limiting personal data access to authorised personnel only
• Regular review of data processing activities and security practices
• Use of reputable, security-assessed third-party processors (Web3Forms, Google Analytics)

No method of transmission over the internet is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

16. Changes to this policy

We may update this Privacy Policy periodically to reflect changes in our data processing practices, applicable law, or the services we offer. The "Last updated" date at the top of this page indicates when the policy was last revised. Where changes are material, we will take reasonable steps to inform you. We encourage you to review this page periodically.

17. Contact us

For any privacy-related enquiries, requests to exercise your data subject rights, or complaints, contact us:

We respond to all privacy enquiries within 30 days.