Privacy Policy

1. Controller

KlarHarvest Foods Private Limited ("KlarHarvest", "we"), registered office: 101, Sai Pushp, 663, Vijayrajnagar, Jewel Circle, Bhavnagar, Gujarat, India - 364003. E-mail: info@klarharvest.com · Phone: +91 97371 01599

Representative in the EU (Art. 27 GDPR): [Name, address, e-mail - to be appointed; confirm with counsel whether the Art. 27(2) exemption applies.]

We take the protection of your personal data seriously. This policy explains which data we process when you visit this website, contact us, request samples or quotes, or use our client portal, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Indian data-protection law (Digital Personal Data Protection Act, 2023).

2. Data we process, purposes and legal bases

2.1 Visiting the website (server log files)

When you access this website, the hosting provider automatically records: IP address (shortened/anonymized where technically possible), date and time, requested page, referrer URL, browser type and version, operating system. This data is required to deliver the website securely and to detect abuse. Legal basis: Art. 6 (1) (f) GDPR - legitimate interest in secure, stable operation. Retention: 14 days, unless required longer for security incidents.

Hosting: [Provider name, location of servers - ideally within the EU; state provider and data-processing agreement].

2.2 Contact form, quote and sample requests

When you use the contact form or e-mail us, we process the data you provide: company, name, e-mail, phone (optional), country, product and quantity interest, destination, message, uploaded specification files, and - if requested - the delivery address for samples. Purpose: answering your inquiry, preparing a quote, dispatching samples, and the subsequent business relationship. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures at your request) and Art. 6 (1) (f) GDPR (legitimate interest in business communication). Retention: for the duration of the business relationship and statutory retention periods for commercial correspondence 6-10 years under applicable law; inquiries that do not lead to a business relationship are deleted after 12 months.

Form processing: [form plugin / service used, hosting location, data-processing agreement].

2.3 E-mail and WhatsApp Business

Communication by e-mail is processed via [e-mail provider, location]. If you contact us via WhatsApp Business, the communication is processed by WhatsApp Ireland Ltd. / Meta Platforms; metadata may be transferred to servers outside the EU in accordance with WhatsApp's own privacy policy. We use WhatsApp Business only for communication initiated by you. Legal basis: Art. 6 (1) (b) and (f) GDPR. [Confirm WhatsApp Business usage terms and consent wording with counsel.]

2.4 Client portal and lot records (QR codes)

For customers, we operate a client portal with one page per order (status, documents, photos, videos, tracking). Access is via a non-public link; we process the names and e-mail addresses of the customer's contact persons to provide the link and notifications. Lot record pages reached via QR codes on product bags contain product and laboratory data only and no personal data of the buyer. Legal basis: Art. 6 (1) (b) GDPR. Retention: for the shelf life of the lot plus statutory retention periods.

2.5 Cookies and consent

This website uses technically necessary cookies (e.g., for consent storage and language selection), which require no consent (§ 25 (2) TDDDG / Art. 6 (1) (f) GDPR). Optional cookies or similar technologies (analytics, embedded content) are set only with your consent via our consent banner, which you can withdraw at any time via [link to consent settings]. Legal basis for optional cookies: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

2.6 Web analytics [only if used]

[If used:] We use [tool - e.g., a privacy-focused, cookieless analytics tool or Matomo self-hosted / Google Analytics 4 with IP anonymization] to measure website usage. [State: provider, location, data processed, retention, consent basis, opt-out.] Legal basis: Art. 6 (1) (a) GDPR (consent). [If no analytics is used, state: "This website does not use web analytics tools."]

2.7 Embedded content and external services

[Video embeds (e.g., loading videos hosted on …), map embeds, fonts:] Fonts are self-hosted; no connection to external font providers is made. [Videos:] Videos are embedded in privacy-enhanced mode / hosted on [provider, location] and loaded only after your consent. [Adjust to the actual build.]

2.8 Business customers, orders and payments

In the course of orders we process the contact and contract data of our customers' employees (name, role, business e-mail, phone), order and shipment data, and payment data (bank details for invoicing; no card data). Purpose: contract performance, export documentation, customs and tax obligations. Legal basis: Art. 6 (1) (b) and (c) GDPR. Recipients: freight forwarders, customs brokers, laboratories (lot data only), banks, authorities as required by law. Retention: statutory commercial and tax retention periods.

2.9 Newsletter / market reports [only if used]

[If a newsletter is offered:] Subscription only with your express consent (double opt-in); unsubscribe at any time via the link in each e-mail. Provider: [name, location]. Legal basis: Art. 6 (1) (a) GDPR.

3. Transfers to third countries - important

KlarHarvest is established in India. Personal data you provide (e.g., via the contact form or in the course of a business relationship) is therefore processed in India, which is not subject to an EU adequacy decision. To protect your data we rely on: [to be determined with counsel - typically (a) the necessity for the performance of a contract or pre-contractual measures at your request, Art. 49 (1) (b) GDPR, for inquiry and order handling; and/or (b) Standard Contractual Clauses (Art. 46 (2) (c) GDPR) between the EU-facing processing (hosting, forms) and KlarHarvest; and (c) appropriate technical and organizational measures]. Where service providers in other third countries are used (e.g., WhatsApp/Meta), transfers are based on the EU-US Data Privacy Framework or Standard Contractual Clauses as stated by the respective provider.

4. Recipients and processors

Hosting provider, form/e-mail providers, consent-management tool, [analytics provider], freight forwarders and customs brokers (for shipment data), laboratories (lot data), banks, and authorities where legally required. Processors are bound by data-processing agreements (Art. 28 GDPR).

5. Retention

We keep personal data only as long as necessary for the purposes stated and for statutory retention periods (commercial and tax law, typically 6-10 years for business correspondence and accounting records). Inquiry data without a business relationship: 12 months. Server logs: 14 days.

6. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7 (3)). To exercise your rights, contact us at info@klarharvest.com [or the EU representative]. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence or place of work; for Germany, the competent authority depends on the federal state [link to the list of German data-protection authorities].

7. Security

We use TLS encryption for this website and appropriate technical and organizational measures to protect your data against loss, misuse and unauthorized access.

8. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Changes

We update this policy when our processing, the tools we use or the legal requirements change. The current version is always available on this page.

Internal checklist before publishing: (1) EU representative appointed or exemption confirmed; (2) transfer mechanism for India decided with counsel; (3) every tool named with provider, location and DPA; (4) consent banner configured to match section 2.5-2.7; (5) German version aligned word-for-word in substance; (6) retention periods confirmed with the CA/Steuerberater.