Privacy Policy
Last Updated:
1. Our Commitment to Your Privacy
This Privacy Policy describes how Omvin Expert Services, the firm operating the website Importexportindia.org ("we", "our", "us"), collects, uses, stores, shares, retains, and erases personal data of users ("you", "Client", or "Data Principal") in connection with our managed service for Import Export Code (IEC) and related import/export procedural assistance.
This Policy is issued in compliance with:
- The Digital Personal Data Protection Act, 2023 ("DPDP Act");
- The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
- The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020;
- Other applicable laws of India.
By accessing our website or availing our service, you confirm that you have read, understood, and consent to the practices described in this Policy.
2. Data Fiduciary Information
For the purposes of the DPDP Act, 2023, the entity responsible for determining the purpose and means of processing your personal data (the Data Fiduciary) is:
- Data Fiduciary: Omvin Expert Services (Firm)
- Website Operated: Importexportindia.org
- Registered Address: #4, Surajgarh Bypass Road, Chirawa, Rajasthan – 333026
- Email: contact@importexportindia.org
- Phone: 01203134445
- Grievance Officer Details: See Section 11 below
We expressly clarify that Omvin Expert Services is a private firm and is not affiliated with, endorsed by, or representing the Directorate General of Foreign Trade (DGFT), the Government of India, or any government department or authority.
3. Personal Data We Collect
To provide our managed service for IEC and related procedural assistance, we collect the following categories of personal data, only with your express consent:
(a) Identity and Contact Information
- Full name of the Client and/or authorised signatory
- Mobile number and email address
- Residential address of the authorised signatory (as required by DGFT for the IEC application)
(b) Business Information
- Constitution of business (Proprietorship / Partnership / LLP / Private Limited / Public Limited Company)
- Business name, business address, nature of business activity
- GST Registration Number (if applicable)
(c) Documents (Sensitive Personal Data or Information under Rule 3 of the SPDI Rules, 2011)
The following documents may be collected by the assigned independent expert strictly for the purpose of preparing and filing your IEC application on the DGFT portal:
- PAN card (of the individual / partners / directors, as applicable)
- Aadhaar — masked Aadhaar / Aadhaar Offline e-KYC XML / Virtual ID (VID) preferred
- Proof of business premises (electricity bill / utility bill / rent agreement / sale deed)
- Bank proof (cancelled cheque or bank statement)
- Constitution documents (Partnership Deed / LLP Agreement / Certificate of Incorporation / MOA / AOA, as applicable)
- GST registration certificate (if applicable)
- Board resolution / partner authorisation, where applicable
(d) Transaction and Communication Records
- Payment status, transaction reference, and invoice records
- Consent records — your form submission and your confirmation email reply
- Communication logs (email, WhatsApp, and platform messages)
What we do NOT collect: We do not collect debit/credit card numbers, CVV, banking passwords, UPI PIN, OTPs sent to your devices, or any other financial credentials at any stage. Payment is processed entirely through a licensed Payment Aggregator/Payment Gateway, and we receive only the transaction status and reference ID.
4. Purpose and Legal Basis for Processing
We process your personal data on the legal basis of your express, informed, and specific consent under Section 6 of the DPDP Act, 2023 and Rule 5 of the SPDI Rules, 2011, for the following specific and limited purposes:
- To understand your specific IEC / import-export procedural requirement;
- To assign a suitable independent third-party expert to assist with your matter;
- To enable the assigned expert to prepare and file your IEC application on the DGFT portal (https://dgft.gov.in) on your behalf, under your express authorisation;
- To facilitate communication and document exchange between you, us, and the assigned expert;
- To issue tax invoices and comply with our obligations under the Income Tax Act, 1961 and the Central Goods and Services Tax Act, 2017;
- To respond to grievances, refund requests, chargebacks, and regulatory enquiries;
- To comply with court orders, statutory directions, and lawful demands by competent authorities.
We do not use your data for advertising, marketing, profiling, automated decision-making, or sale to any third party.
5. Data Sharing and Disclosure
We do not sell, rent, or trade your personal data. We share personal data only with the following categories of recipients, on a strict need-to-know basis:
- Assigned Independent Expert (Data Processor): Only the documents and information strictly necessary for preparing and filing your IEC application on the DGFT portal. The expert is engaged under a written confidentiality undertaking and is bound to use your data solely for the assigned purpose. The assigned expert acts as a Data Processor on our behalf under Section 8(2) of the DPDP Act, 2023.
- DGFT Portal (https://dgft.gov.in): Where the assigned expert submits your IEC application on your behalf, under the authorisation granted by you in our Terms and Conditions.
- Payment Aggregator / Payment Gateway: For processing your service-fee payment only.
- Statutory, Regulatory, and Law-Enforcement Authorities: Where disclosure is required by law, court order, or lawful demand — including the Income Tax Department, GST authorities, the Data Protection Board of India, MeitY/CERT-In, consumer commissions, and law-enforcement agencies.
- Professional Advisors: Our chartered accountant, legal counsel, and auditors, under professional confidentiality obligations.
We have entered into written confidentiality and data-protection undertakings with our personnel and assigned experts to ensure your data is handled lawfully. However, once your data is submitted to the DGFT portal directly by the assigned expert as part of your IEC application, that submission is governed by DGFT's own data-handling framework, over which we have no control.
6. Data Storage, Security, and Retention
(a) Security Measures. Consistent with Rule 8 of the SPDI Rules, 2011, we implement the following reasonable security practices and procedures:
- TLS/SSL encryption for data in transit;
- Access-controlled, password-protected storage with role-based access;
- Restriction of access to authorised personnel and assigned experts on a strict need-to-know basis;
- Written confidentiality undertakings from all personnel and assigned experts;
- Periodic review of access logs and security configurations;
- Secure deletion of data upon expiry of the retention period.
(b) Retention Period.
- KYC documents (PAN, Aadhaar, business premises proof, bank proof, constitution documents): Retained in active systems only for the duration required to complete your IEC application, and deleted from our active systems within thirty (30) days of service completion.
- Consent records, invoices, transaction logs, and communication records: Retained for a period of eight (8) years as required under the Income Tax Act, 1961, the Central Goods and Services Tax Act, 2017, and for purposes of dispute resolution, chargeback defence, and regulatory enquiry.
- After the applicable retention period, data is permanently erased.
(c) Cross-Border Transfer. Personal data is primarily stored on servers located in India. To the extent that any data may be processed by service providers outside India (for example, hosting or analytics providers), such transfer shall be carried out only to countries that are not restricted by the Central Government of India under Section 16 of the DPDP Act, 2023, and under appropriate contractual safeguards.
(d) Data Breach Notification. In the event of a personal data breach affecting your data, we will notify you and the Data Protection Board of India in the manner and within the timelines prescribed under Section 8(6) of the DPDP Act, 2023 and the rules made thereunder. We will also report cybersecurity incidents to CERT-In where required under the Information Technology Act, 2000 and CERT-In directions.
7. Your Rights and Duties as a Data Principal
Under the DPDP Act, 2023, you have the following rights, which you may exercise by writing to our Grievance Officer (see Section 11):
- Right to Access (Section 11): To obtain a summary of personal data being processed by us and the identities of Data Processors with whom your data has been shared.
- Right to Correction, Completion, Updating, and Erasure (Section 12): To request correction of inaccurate or misleading data, completion of incomplete data, updating of outdated data, and erasure of personal data that is no longer necessary.
- Right of Grievance Redressal (Section 13): To have a readily available means of grievance redressal in respect of any act or omission regarding the processing of your data.
- Right to Nominate (Section 14): To nominate another individual who shall, in the event of your death or incapacity, be entitled to exercise your rights under the DPDP Act.
- Right to Withdraw Consent: You may withdraw your consent at any time by writing to contact@importexportindia.org. Withdrawal of consent shall not affect the lawfulness of processing carried out before withdrawal. Where withdrawal occurs during an ongoing service, it may result in termination of service, and any refund will be governed by our Refund Policy.
Under Section 15 of the DPDP Act, 2023, you also have the following duties:
- To comply with applicable laws while exercising rights under the Act;
- Not to impersonate another person while providing personal data;
- Not to suppress material information while providing personal data for any document/identity issued by the State;
- Not to register a false or frivolous grievance with us;
- To furnish only such information as is verifiably authentic, while exercising the right of correction or erasure.
8. Aadhaar Handling
We are not an Authentication User Agency (AUA), KYC User Agency (KUA), or any entity empanelled under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. We do not perform Aadhaar authentication.
Where Aadhaar information is required for your IEC application, you are encouraged to share:
- Masked Aadhaar (with the first 8 digits redacted), or
- Aadhaar Offline e-KYC XML, or
- Virtual ID (VID) generated from the UIDAI portal.
Aadhaar OTP authentication on the DGFT portal, where required during IEC application submission, is performed by you directly using the OTP sent to your registered mobile number. We do not store Aadhaar OTPs.
9. Cookies and Tracking Technologies
Our website uses essential cookies for session management, security, and limited analytics cookies to understand site usage and improve user experience. You may disable cookies through your browser settings; however, some functionality of the website may be affected.
We do not use advertising cookies and do not sell cookie data to any third party.
10. Children's Data
Our services are intended only for persons aged 18 years and above. We do not knowingly collect personal data of children (persons below 18 years of age). If we become aware that we have inadvertently collected personal data of a child without verifiable parental consent as required under Section 9 of the DPDP Act, 2023, we will erase such data promptly.
11. Grievance Redressal
For any concerns, queries, or grievances relating to this Privacy Policy or the processing of your personal data, please contact our Grievance Officer:
- Designation: Grievance Officer, Omvin Expert Services
- Email (Data & General): contact@importexportindia.org
- Email (Refunds & Accounts): accounts@importexportindia.org
- Phone: 01203134445
- Address: #4, Surajgarh Bypass Road, Chirawa, Rajasthan – 333026
We acknowledge grievances within three (3) working days of receipt, and endeavour to resolve them within thirty (30) days, in line with Rule 5(9) of the SPDI Rules, 2011 and Section 13 of the DPDP Act, 2023.
If you are not satisfied with our resolution, you may escalate to:
- The Data Protection Board of India, once notified and operational, for data-related grievances under the DPDP Act, 2023;
- The National Consumer Helpline (1915 / consumerhelpline.gov.in) or the appropriate District / State / National Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019, for service-related grievances;
- CERT-In or the Ministry of Electronics and Information Technology for cybersecurity-related grievances.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law, our services, or our data-handling practices. Material changes will be communicated by updating the "Last Updated" date at the top of this page and, where appropriate, by email to active Clients. Your continued use of our service after the effective date of any update constitutes acceptance of the revised Policy.
13. Governing Law and Jurisdiction
This Privacy Policy is governed by and shall be construed in accordance with the laws of India.
Subject to the consumer's statutory right under the Consumer Protection Act, 2019 to approach the District / State / National Consumer Disputes Redressal Commission having jurisdiction at the consumer's place of residence or work, the courts at Chirawa, Rajasthan shall have exclusive jurisdiction over all non-consumer disputes arising out of or in connection with this Privacy Policy.
