AgriBuyingA CarbonPark product

Legal

Privacy policy

Last updated on 14 November 2026.

This privacy policy explains how CarbonPark Industries Private Limited (“AgriBuying”, “we”, “us”) collects, uses, shares and protects personal data when you visit www.agribuying.com, send us a requirement, contact us, or do business with us. It is written to meet the information requirements of the EU General Data Protection Regulation (GDPR), in particular Articles 13 and 14, and India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

AgriBuying is the managed procurement service of CarbonPark for business buyers of agricultural commodities and food ingredients from India. Our customers and contacts are mainly businesses, including buyers in the European Union, and the people who work for them.

1. Who is responsible for your data

The controller of your personal data (the “data fiduciary” under the DPDP Act) is:

  • CarbonPark Industries Private Limited
  • 1/123, Ravanapuram, Udumalpet, Tiruppur, Tamil Nadu, India – 642207
  • Email: contact@agribuying.com

For any question about this policy or your personal data, or to exercise your rights, email us at contact@agribuying.com.

2. The website, in short

  • This website is a static information site. It has no accounts, no online shop and no server that receives form data.
  • The Request a quote page writes your requirement into an email in your own email app, addressed to contact@agribuying.com. The page itself sends nothing and stores nothing: we receive your details only if you send that email.
  • The website does not set any cookies and does not store anything on your device.
  • It is hosted and delivered by Cloudflare, which processes technical data such as your IP address to deliver the site and keep it secure.
  • We use Cloudflare Web Analytics, a cookieless tool, to see aggregate page statistics. We do not use it to identify you.
  • If you email us, we receive the personal data in your email.

We will update this policy before introducing any feature that changes how we use personal data.

3. Personal data we may collect

Depending on how you interact with us, we may collect:

  • Identity and role: name and job title, and the company you work for.
  • Contact details: email address and, if you give them to us, a phone or messaging number, postal address and other business contact details.
  • Requirement and business information: the content of your messages and requirements, products of interest, specifications, quantities, destination, delivery terms, quotations, orders, contracts, invoices, payment, shipping, inspection and customs records.
  • Technical data: IP address, browser and device type, pages requested, referring page, date and time, and similar request log data, processed by our hosting provider when you visit the site.
  • Marketing preferences: whether you have agreed to receive marketing from us, or have opted out.

We do not ask for, and ask you not to send us, special categories of personal data (such as health, religious or political information).

Where the data comes from. Most data comes directly from you. We may also receive business contact details from your colleagues or employer (for example, when they name you as a contact for an order), from suppliers, laboratories, inspection, logistics, insurance, customs or banking partners in the course of an order, or from public business sources such as your company’s website or trade directories. Technical data comes from your browser when you visit the site.

4. Why we use your data and our legal basis

  • Answering requirements and enquiries, preparing quotations, and taking steps you request before a contract: necessary to take steps at your request before entering into a contract, or for a contract (Art. 6(1)(b) GDPR). Where you contact us on behalf of a company, our legitimate interest in dealing with that company (Art. 6(1)(f)).
  • Managing orders and contracts, including sourcing, testing, certificates, documents, transport, freight, insurance, customs, payment and after-sales support: contract (Art. 6(1)(b)) or, for contacts at our business customers and suppliers, legitimate interests in running our business (Art. 6(1)(f)).
  • Record keeping and business communications with customers, suppliers and partners: legitimate interests in managing business relationships (Art. 6(1)(f)).
  • Delivering the website securely and preventing abuse and attacks: legitimate interests in operating a secure website (Art. 6(1)(f)).
  • Aggregate website statistics (which pages are used): legitimate interests in understanding how the site is used (Art. 6(1)(f)), using a cookieless tool.
  • Keeping tax, accounting, export and customs records: legal obligation (Art. 6(1)(c)), and our legitimate interest in complying with non-EU laws that apply to us, including Indian law (Art. 6(1)(f)).
  • Sending promotional emails: your consent (Art. 6(1)(a)), or, where the law allows it for existing business customers, legitimate interests (Art. 6(1)(f)). See section 5.
  • Establishing, exercising or defending legal claims: legitimate interests (Art. 6(1)(f)).

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this balancing, and you have the right to object (see section 10).

5. Marketing (opt-in)

  • We will only send you promotional emails if you have given us your consent, or where the law permits it for existing business customers about our own similar services and you have not opted out.
  • Every promotional email will include a simple way to unsubscribe. You can also opt out at any time by emailing contact@agribuying.com.
  • Sending us a requirement or an enquiry does not sign you up for marketing.

6. Cookies and similar technologies

  • This website does not set any cookies and does not use local storage or similar technologies on your device.
  • Cloudflare Web Analytics, which we use for page statistics, does not use cookies or local storage and, according to Cloudflare, does not fingerprint individual visitors.
  • If we introduced cookies that are not strictly necessary, we would only set them after you have given your prior consent, as required by the EU ePrivacy rules.

7. Who we share your data with

We will not sell, rent or lease your personal data. We share personal data only where needed for the purposes above, with:

  • Cloudflare, Inc. (USA), our website hosting, content delivery, security and analytics provider, acting as our processor.
  • Our email, productivity and accounting software providers, acting as our processors.
  • Suppliers, processors, laboratories, inspection agencies and certifiers, transporters, freight forwarders and carriers, cargo insurers, customs brokers and authorities, banks and payment providers, where needed to quote for, manage or fulfil an order or contract. We share only what each needs for its part of the order.
  • Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
  • Public authorities, courts and regulators, when we are required by law to do so or to establish, exercise or defend legal claims.
  • A buyer or successor of all or part of our business, if this ever happens, subject to this policy.

Our processors may only use your data on our instructions and must keep it secure.

8. International transfers

  • To India. AgriBuying is run from India, so we access, store and process personal data there. The European Commission has not issued an adequacy decision for India. Where applicable, we use the European Commission’s Standard Contractual Clauses. For requirements and orders, the transfer is also necessary to take steps you request before a contract, or to perform a contract with you or in your interest (Art. 49(1)(b) and (c) GDPR). In India we handle personal data in line with the DPDP Act.
  • To the United States and other countries, via Cloudflare. Cloudflare is certified under the EU-U.S. Data Privacy Framework (and its UK extension and the Swiss-U.S. framework), and its data processing addendum incorporates the EU Standard Contractual Clauses.
  • To our partners in the countries an order involves, such as logistics, insurance, customs, banking and certification partners, where necessary to perform a contract (Art. 49(1)(b) and (c) GDPR).

You can ask us for more information about these safeguards by emailing contact@agribuying.com.

9. How long we keep your data

  • Requirements, enquiries and business correspondence: for as long as needed to deal with them and to manage any existing or potential business relationship, and afterwards for as long as reasonably needed for our records and to establish, exercise or defend legal claims.
  • Orders, contracts, invoices, accounting, tax, export and customs records: for the period required by applicable law. For example, Indian company law requires books of account and vouchers to be kept for at least eight financial years, and Indian GST law requires accounts and records to be kept for 72 months from the due date of the annual return.
  • Marketing preferences: while you are subscribed. If you unsubscribe or object, we keep a minimal record of that so that we do not contact you again.
  • Website request logs: held by Cloudflare for a limited period for delivery and security. Web Analytics statistics are aggregated.

When data is no longer needed, we delete it or anonymise it.

10. Your rights

Under the GDPR, and subject to the conditions and exceptions in the law, you have the right to:

  • access your personal data and receive a copy of it;
  • rectification of inaccurate or incomplete data;
  • erasure of your data;
  • restriction of how we use your data;
  • data portability, where we process data you gave us based on consent or contract and by automated means;
  • object at any time, on grounds relating to your particular situation, to processing based on legitimate interests;
  • object to direct marketing at any time;
  • withdraw your consent at any time, where we rely on consent, without affecting processing carried out before you withdrew it;
  • lodge a complaint with a supervisory authority, in particular in the EU or EEA member state where you live, where you work, or where the alleged infringement took place.

If you are in India, you also have the rights given by the DPDP Act, including to access a summary of your data, correction and erasure, grievance redressal, and nominating another person to exercise your rights.

To exercise any right, email contact@agribuying.com. We may need to verify your identity. We will respond within one month, which may be extended where the law allows. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

11. Do you have to give us your data?

You do not have to give us personal data to browse this website (although technical data is processed automatically to deliver it). If you want us to answer a requirement, provide a quotation or manage an order, we need your name, business contact details and the information needed for the order. Some data is required by law, for example for invoices and export documents.

12. Automated decisions and profiling

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

13. How we protect your data

  • encrypted connections (HTTPS) for this website and security protections provided by our hosting provider;
  • reputable service providers bound by data processing terms;
  • access to personal data limited to people who need it for their work;
  • keeping only the data we need, for only as long as we need it.

No method of transmission over the internet or electronic storage is completely secure. If a personal data breach occurs, we will act in line with our legal obligations, including notifying authorities and affected people where required.

14. Children

This website and our services are intended for businesses. They are not directed at children under 16, and we do not knowingly collect personal data from them.

15. Links to other websites

This website links to other websites, such as www.carbonpark.com. Those websites have their own privacy policies, and we are not responsible for how they handle your data.

16. Changes to this policy

We may change this policy from time to time by updating this page and the “last updated” date above. If we make significant changes, we will update this policy first and, where required by law, tell you directly or ask for your consent.

17. Your statutory rights

Nothing in this policy limits or excludes any rights you have under the GDPR, the DPDP Act or any other applicable data protection law, or any liability that cannot be limited or excluded by law.