Privacy Policy

1. Who we are

L’Or Champaca is a trading name of PRMC Naturals Pvt Ltd, a company registered in India with its registered office at Plot No. 13/B, Indrayani Nagar, Bhosari, Pune 411026, Maharashtra, India.

We decide why and how your personal data is used when you visit lorchampaca.com, request a sample or write to us. That makes us the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and the controller under the EU General Data Protection Regulation (GDPR) and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

For any question about this policy or your data, write to [email protected]. This address also receives grievances under the DPDP Act.

2. What we collect

When you request a sample or send an enquiry

• Your name, company, role and business email address
• Your country
• The materials, quantity and intended application you tell us about
• Anything else you choose to write in an email to us

When we send you a sample or fill an order

• Delivery address and a contact phone number
• Import, tax or customs details the courier or your authorities require

When you visit the website

Our hosting provider records technical data that every web request carries: IP address, browser and device type, the page requested and the time. We use it only to deliver the site and keep it secure.

We do not ask for sensitive data such as health, financial or identity documents through this website. Please do not send them.

3. How we use it, and on what basis

We use your data only for the purposes below. We do not sell it or use it for advertising.

The sample form does not add you to a mailing list. We send news about harvests or new materials only if you ask for it, and you can stop it at any time.

We do not make decisions about you by automated means alone, and we do not profile you.

4. Who we share it with

We share personal data only with the service providers and parties we need to do the work above:

• Google LLC, which receives and stores form submissions for us and provides our business tools
• Vercel Inc., which hosts this website
• Couriers, freight forwarders and customs brokers, to deliver samples and orders
• Our accountants, auditors and legal advisers, under a duty of confidentiality
• Government or regulatory authorities, where the law requires it

Each provider acts on our instructions and may use your data only to provide its service to us.

5. International transfers

We are based in India, and our service providers store data in India, the United States and other countries. When you send us a request from outside India, your data travels to us in India.

• From the EU, including France: we transfer data to India where needed to take the steps you asked for before a contract (GDPR Article 49(1)(b)). Our providers rely on the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.
• From the UAE: we transfer data where needed to perform your request or a contract with you, or with your consent, as the PDPL allows.
• From India: we do not transfer data to any country the Government of India has restricted under section 16 of the DPDP Act.

6. How long we keep it

• Enquiries that do not lead to business: up to 24 months after our last exchange, then deleted.
• Customer and order records: for as long as we work together, then for as long as Indian tax and company law requires, usually eight years.
• Website server logs: up to one year.
• If you withdraw consent or ask us to delete your data, we delete it within 30 days unless the law requires us to keep it.

7. Your rights

Wherever you are, you can ask us what data we hold about you, ask us to correct or delete it, and withdraw your consent at any time. Withdrawing consent is as easy as giving it: write to [email protected]. It does not affect anything we did before you withdrew it.

India (DPDP Act, 2023)

• Get a summary of your data and how we process it, and the names of those we shared it with
• Have your data corrected, completed, updated or erased
• Withdraw consent, after which we stop processing and erase the data
• Raise a grievance with us, and if it is not resolved, complain to the Data Protection Board of India
• Nominate a person to exercise your rights if you die or become unable to do so

European Union and France (GDPR)

• Access, rectification and erasure of your data
• Restriction of processing, and objection to processing based on our legitimate interests
• Data portability: a copy of the data you gave us in a common format
• Complaint to a supervisory authority: in France, the CNIL (cnil.fr), or the authority where you live or work
• In France, you can also leave instructions about what happens to your data after your death (Loi Informatique et Libertés, Article 85)

United Arab Emirates, including Dubai (PDPL)

• Information about how we process your data, and access to it
• Portability, correction and erasure
• Restriction of processing, and to stop processing
• Complaint to the UAE Data Office

We are not established in the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM). If you write to us from a company in either free zone, we handle your data to the same standard as above.

8. Making a request or complaint

Write to [email protected] with the subject “Privacy request”. Tell us what you would like us to do. We may ask you to confirm your identity before we act, so that we never give your data to someone else.

We reply within one month. Grievances under the DPDP Act are resolved within the period the DPDP Rules set, and never later than 90 days. There is no charge.

9. Cookies and third-party content

This website does not use analytics, advertising or tracking cookies, and it does not store anything on your device to follow you. That is why you see no cookie banner.

The map of our farm on the contact page comes from Google Maps. It loads only when you click “Show map”, and Google may then set cookies under its own privacy policy.

Links to Instagram, LinkedIn and YouTube take you to those platforms, where their own privacy policies apply.

10. Security

The website is served only over an encrypted connection (HTTPS). Access to enquiry data is limited to the people who answer it, and our providers protect it with access controls and encryption.

If a breach affects your data, we will tell you and the relevant authorities as the law requires, including the Data Protection Board of India and, for EU residents, the competent supervisory authority.

11. Children

This website is for businesses in the fragrance, cosmetic and natural ingredients trade. It is not directed at anyone under 18, and we do not knowingly collect their data. If you believe a child has sent us personal data, write to [email protected] and we will delete it.

12. Changes to this policy

We will update this page when our practices or the law change, and show the new date at the top. If a change affects how we use data you have already given us, we will tell you before it applies. See also our Terms of Use.