Legal

Privacy Policy

What we collect through the enquiry forms, who processes it, how long we keep it, and how to exercise your rights under the DPDP Act and the GDPR.

01

Who we are

Orkay Tiles ("Orkay", "we", "us"), a partnership firm with its registered office at Shop No. 62, 63, 64, Shakti Chamber-1, 8A National Highway, Morbi-363642, Gujarat, India, is the Data Fiduciary (and, for visitors in the EEA and UK, the data controller) for personal data collected through orkaytiles.com and its enquiry channels.

This policy explains what we collect, why, who else sees it, how long we hold it, and how to exercise your rights. It covers this website only. It does not cover a dealer relationship once it is governed by a signed agreement, which carries its own terms.

02

What we collect

Enquiry form: your name, company, email address, phone number, country, the message you write, and your consent choices recorded with the wording shown to you and a timestamp.

Technical data: your IP address and standard request information reach our hosting and security layers as an unavoidable part of serving the page, and are used to deliver the site and to defend it against abuse.

Analytics: only if you accept analytics cookies. Nothing analytical loads before you accept. See the Cookie Policy for what is set and for how long.

WhatsApp: the WhatsApp buttons on this site open a conversation in your own WhatsApp client. If you use one, your number and message reach us, and the conversation is carried by WhatsApp under Meta’s own privacy terms, not ours.

03

Why we use it, and on what legal basis

To answer your enquiry, prepare a quotation and correspond about an order — because you asked us to, and to take steps at your request before entering a contract.

To send you new launches and offers — only where you have separately opted in. You can withdraw that consent at any time, and withdrawing it is as easy as giving it.

To keep the site available and secure, and to keep records we are required to keep — our legitimate interests, and compliance with Indian law.

We do not sell personal data. We do not use your data to make automated decisions that produce legal or similarly significant effects.

04

Who else processes it

GoHighLevel — our CRM. Enquiries are routed there so our export and domestic desks can respond.

Amazon Web Services — hosting, database and file storage, in the AWS Asia Pacific (Mumbai) region.

Cloudflare — DNS, content delivery and protection against attack.

Each is engaged to provide a service to us and is not permitted to use your data for its own purposes. We disclose data to a public authority only where the law requires it.

05

Where it is stored, and international transfers

Your data is stored in India, in the AWS Mumbai region. Our CRM provider may process data outside India in the course of providing its service.

India has not received an adequacy decision from the European Commission. Where personal data is transferred from the EEA or the UK to us in India, that transfer is made under the European Commission’s Standard Contractual Clauses (and the UK Addendum where the UK GDPR applies), together with the technical and organisational measures described below. You may request a copy of the relevant safeguards using the contact details at the end of this policy.

06

How long we keep it

Enquiries and quotation correspondence: 3 years from our last contact with you.

Marketing consent records: for as long as you remain subscribed, and 3 years after you unsubscribe, so we can evidence that consent was given and withdrawn.

Analytics: as set out in the Cookie Policy.

Where we are required to keep a record for longer, we keep it and stop using it for anything else.

07

Your rights under the DPDP Act, 2023

If you are in India, you may ask us for: information about the personal data we hold about you and how it is being processed; correction, completion or updating of inaccurate or incomplete data; erasure of data we no longer need; and redress of a grievance. You may also nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

You may withdraw any consent you have given at any time. Withdrawal does not affect processing already carried out on that consent, and where the law requires us to keep a record we will keep it.

To exercise any of these, write to our Grievance Officer using the details below. We acknowledge within 72 hours and aim to resolve within 7 working days. If we need longer we will tell you why and give you a date.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

08

Additional rights for visitors in the EEA and the UK

Where the GDPR or UK GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing carried out on the basis of our legitimate interests. Where processing rests on consent, you may withdraw it at any time.

We respond within one month, extendable by two further months for complex requests, and we will tell you if we need that extension.

You have the right to lodge a complaint with your local supervisory authority. Doing so does not affect any other remedy available to you.

09

Children

This is a business-to-business site and is not directed at children. We do not knowingly collect the personal data of anyone under 18. We do not carry out behavioural monitoring of, or direct advertising at, children. If you believe a child has given us personal data, tell our Grievance Officer and we will delete it.

10

How we protect it

Traffic to this site is encrypted in transit. Administrative access requires an individual login with a hashed password and an expiring session, is rate-limited against repeated failures, and every read and write is authorised on the server rather than merely hidden in the interface.

Our database is not reachable from a visitor’s browser. Uploaded files are validated by content, not by their claimed type. Access to production data is limited to the people who need it.

No method of transmission or storage is completely secure. If a personal data breach occurs we will notify the Data Protection Board of India and affected individuals as the DPDP Act and Rules require, and the relevant supervisory authority where the GDPR applies.

11

Grievance Officer and how to contact us

The Grievance Officer, Orkay Tiles, Shop No. 62, 63, 64, Shakti Chamber-1, 8A National Highway, Morbi-363642, Gujarat, India.

Email: grievance@orkaytiles.com · Telephone: +91 97120 54222

For general privacy questions you may also write to info@orkaytiles.com. Please tell us which right you are exercising so we can deal with it quickly, and be aware that we may need to verify your identity before we act.

12

Changes to this policy

We publish any change on this page and update the date at the top. Where a change materially affects how we use data you have already given us, we will tell you directly before it takes effect.

Questions about this policy: info@orkaytiles.com.

Cookie PolicyCookie PolicyTerms and ConditionsTerms and ConditionsDisclaimerDisclaimer