What we do with what you send us.

This notice covers vardhman-impex.com and the enquiries that reach Vardhman Impex through it. It is written from the site’s own code rather than from a template, so what follows is what the software actually does.

This is a trade site. Everything it asks for is business contact information from people buying furniture wholesale, and it is not directed at children.

Who holds it

Vardhman Impex

Where

G 793 A, Phase IV, Boranada Industrial Area
Jodhpur, Rajasthan 342012
India

Write to us

rishi@vardhman-impex.com

From you directly: only what you type into a form. There is no account on this site, no password and no payment, so none of those exist to be collected. Separately from anything you send us, Google Analytics measures the pages you read — that is clause 07, and it is kept apart from everything in this one.

Contact form

Company name, country, business email, website (optional), business type, and your message.

A design’s panel

Business email, quantity and an optional note — sent together with that design’s own reference, name, collection, material, finish and dimensions, so our reply never has to begin by asking which piece you meant.

Catalogue request

Company name, country, website, business email and business type.

Container planner

Your email, the designs you selected, the quantities, and the volume they come to. Available only behind the trade gate.

The server that receives a form also sees the IP address the request came from, as any web server does. What it does with that is in the next clause.

It becomes an email. The form posts to our own endpoint, which escapes every value, truncates any single field at 4,000 characters and sends the result to rishi@vardhman-impex.com. Your own address goes into the Reply-To header so that a reply comes straight back to you. That is the entire journey — there is no database behind this site, no CRM, and no third-party form service in the path.

To stop a script emptying our mail quota, the endpoint counts requests per IP address in a sixty-second window. That count lives in the server’s memory for the length of the window and is never written to disk.

We use what you send to answer you and to carry on the trade conversation that may follow. We do not use it for marketing — there is no mailing list on this site to add you to.

For an enquiry, it is straightforward. You wrote to a business asking it to reply, and we process what you sent in order to do that. Where the GDPR or the UK GDPR applies to you, that is our legitimate interest in answering a business enquiry you began; where you go on to order, it is the performance of that contract. Either way you can ask us to stop, and clause 09 says how.

For analytics, we are not going to claim more than is true. No consent is asked for and none is recorded, so nothing on this site rests on your having given it. That is a deliberate choice by the business rather than an oversight in the code, and it is the first of the things clause 11 says a lawyer should look at.

Your enquiry stays in our mailbox. We have not set a fixed deletion schedule for it, and we would rather say so plainly than publish a number we do not keep to. Ask us to delete it and we delete the thread it lives in.

Two things expire on their own: the trade access cookie described below, after eight hours, and the rate-limit count above, after sixty seconds. Three things run to somebody else’s schedule rather than ours — the server request logs our host keeps, the mailbox’s own storage, and whatever Google Analytics retains, which is set in the analytics account and not in this site.

Two kinds, and it is worth being exact about which is which.

Analytics

Google Analytics sets its own cookies in your browser on every visit, to tell one visit apart from the next. Clause 07 describes what it measures with them.

vi_private_access

Set only if you hold a trade access code and enter it at the private catalogue gate. It contains an expiry timestamp and a signature over that timestamp — no name, no email, nothing that identifies you. HttpOnly, so no script can read it; SameSite=Lax; sent only over HTTPS in production; and it expires eight hours after it is issued, or the moment you sign out.

Nothing else on this site writes a cookie, and nothing writes to your browser’s local storage.

You have not been shown a cookie banner, and there is no consent mechanism anywhere on this site. We are telling you that rather than dressing it up: the analytics cookies are set when the page loads, not after you agree to anything, and there is no control here for you to refuse them with. What does work is your own browser — blocking third-party cookies, or any tracker-blocking extension or browser, stops Google Analytics on this site entirely, and the site itself carries on working without it.

This site loads Google Analytics 4. At a general level it records which pages are visited and in what order, roughly where in the world the visit came from, the kind of device and browser used, and where the visit arrived from — a search result, another site, or a link typed directly.

We read it to see which collections are being looked at and which journal notes are worth writing more of. We do not use it to identify anyone, we do not connect it to an enquiry, and the contents of a form are never sent to it.

Google processes that data on its own terms as a third party, not as a silent extension of us, and it may be processed outside India — including in the United States. How long Google keeps it is set in the analytics account rather than in this site’s code, so this notice does not state a period it cannot verify.

Four, each because of something the site actually does. Beyond them there is no advertising network, no lead broker, no CRM, no chat widget and no third-party form service — there is no code in this site that could reach one.

Google Workspace

Our email. The forms send through an authenticated SMTP account on it, so an enquiry is stored on Google’s systems from the moment it arrives, and stays there in the mailbox.

Google Analytics

A separate Google product, described in the clause above. It never receives the contents of an enquiry.

Vercel

Serves this site. It sees the requests that reach it, including your IP address, in the ordinary course of delivering pages.

Meta

Only if you press a WhatsApp button. That opens a chat in your own WhatsApp, on Meta’s service and under Meta’s terms. We never send anything to WhatsApp on your behalf.

We are an Indian exporter with buyers in Europe, the United Kingdom and elsewhere, and these are global services: your data may be processed outside India, including in the United States.

Write to rishi@vardhman-impex.com and ask. In practice that means one of four things: a copy of what you sent us, a correction to it, deletion of it, or an instruction to stop writing to you.

We need to be able to tell that the enquiry is yours, which for a business address is usually just a reply from it. We answer these on the same schedule as everything else — within two working days. You can also reach us by post at the works, or by telephone on +91 93521 87266.

Analytics is the one thing we cannot switch off for you, because it is not held under your name for us to find — clause 06 is honest about that, and the control that does work is in your own browser.

Depending on where you are, the law may also give you the right to complain to a data protection authority. Nothing here is meant to stand between you and that.

When the practices described here change, this notice changes with them and the date at the top of the page moves. We do not keep an archive of previous versions.

This notice was written by reading the site’s code, so it is an accurate description of what the software does. It is not legal advice, and it has not been reviewed by a lawyer.

Before it is relied on as a compliance document, Vardhman Impex should have it checked against the law that applies to its buyers — the GDPR in Europe, the UK GDPR, India’s Digital Personal Data Protection Act — and add whatever that review requires. The obvious place to start is the one this page has already been plain about: analytics cookies are set without asking, and several of those regimes expect them to be asked about first.

We would rather say that here than let a template imply an assurance nobody has given.