Privacy policy

This website, crestonandco.com, is run by Creston & Company, trading as Creston & Co, a sole proprietorship registered in India. We are a sourcing agent: we find and audit manufacturers, arrange testing and inspection, and manage orders for importers.

Creston & Company decides how your personal data is used, so we are the "controller" under the EU and UK GDPR and the "data fiduciary" under India's Digital Personal Data Protection Act, 2023. You can reach us at info@crestonandco.com.

This policy covers this website and the enquiries that come through it. When you hire us, the signed agreement for that work may add to it.

Information you give us. When you fill in a form on this site, we receive what you enter:

• Sourcing review and contact forms: your name, work email, company, destination country, the product you buy, volume per order and your message.
• Free import report form: the industry, product, destination country, volume per order (if you choose one), your name and work email.
• Emails and WhatsApp messages you send us, with any files you attach.
• If you book a call through Calendly, the name, email and answers you give Calendly, which it passes to us.
• If you become a client: specifications, purchase orders, supplier and shipping documents, and the business contact details of the people we work with.

Information collected automatically. We use Google Analytics to understand which pages are read and how visitors find us. It records the pages you visit, the site that sent you, your approximate location (country and city, worked out from your IP address), your device and browser type, and how long you stay. Our hosting provider also keeps short-lived server logs (IP address, browser, the page requested and the time) to keep the site secure and working.

Information stored only in your browser. When you close or submit the free import report window, your browser stores one entry, creston-report-popup, so the window does not open by itself again. It never leaves your device.

We do not ask for payment card details, government ID numbers or any sensitive personal data on this website. Please do not send them to us through the forms.

We use your data only for the purposes below. For visitors in the EU, UK and similar regions, each purpose has a legal basis under the GDPR. For India, we process data you give us for the purpose you gave it, which the DPDP Act treats as consent or a legitimate use.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.

We do not sell or rent personal data, and we do not share it with anyone for their own marketing. We share it only with:

• The services that run this website: our hosting provider, our email provider (which delivers form submissions to our inbox), and Google, which provides Google Analytics.
• Services you choose to use: Calendly if you book a call, and WhatsApp (Meta) if you message us there. Their own privacy policies apply to what you give them.
• Parties in your order, with your agreement: manufacturers, laboratories, inspection companies, freight forwarders and customs brokers, and only the details each one needs to do its part.
• Authorities, when Indian law or a valid legal request requires it.
• A successor business, if Creston & Co is ever reorganised or transferred, under the same protections as this policy.

Every service provider we use processes your data on our instructions and is bound to keep it secure.

We are based in India, and some of our service providers store data in other countries, including the United States. When we move data out of the EU, UK or another region with transfer rules, we rely on the safeguards the law recognises, such as the European Commission's standard contractual clauses that these providers offer.

• Enquiries and report requests that do not lead to work: up to 24 months after our last contact, so we can pick up the conversation if you come back. Ask and we delete them sooner.
• Client and order records: for the length of our work together, then as long as Indian tax, GST and foreign trade law requires, usually up to eight years.
• Google Analytics data: no longer than 14 months, after which Google deletes it automatically.
• Server logs: kept by our hosting provider for a short period, usually no more than 30 days.
• The creston-report-popup entry in your browser stays until you clear your browser's site data.

This site uses only the cookies set by Google Analytics, plus the one browser storage entry for the report window. We do not use advertising or social media tracking cookies.

You can block or delete cookies in your browser settings, and you can stop Google Analytics on every site with Google's opt-out browser add-on. The site works fully without cookies.

Wherever you are, you can ask us to:

• Tell you what personal data we hold about you and give you a copy.
• Correct data that is wrong or incomplete.
• Delete your data, unless the law requires us to keep it.
• Stop or limit how we use it, including any marketing emails.
• Send your data to you or another business in a common format.
• Withdraw a consent you gave. This does not affect what we did before you withdrew it.

Email info@crestonandco.com with your request. We may ask you to confirm your identity, and we reply within 30 days. There is no charge.

EU and UK: you can complain to the data protection authority where you live or work. India: under the DPDP Act you can also nominate someone to exercise your rights if you die or become unable to, and if our Grievance Officer does not resolve your complaint you can take it to the Data Protection Board of India. Australia: you can complain to the Office of the Australian Information Commissioner. California and other US states: we do not sell or share personal data for cross-context advertising, and we will not treat you differently for using your rights.

The site is served only over an encrypted connection (HTTPS). Form submissions go straight to our business inbox, which is protected by a password and limited to the people who answer enquiries. Client files are shared with suppliers and partners only as far as each one needs them.

No system is completely secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

This website is for businesses. It is not meant for anyone under 18, and we do not knowingly collect data from children. If you think a child has sent us their data, email us and we will delete it.

Our articles link to government sites, laboratories, standards bodies and other sources. We are not responsible for how those sites handle your data, so please read their own policies.

In line with India's Information Technology Act, 2000, its rules on sensitive personal data, and the DPDP Act, 2023, Creston & Company has a Grievance Officer who handles questions and complaints about personal data.

Grievance Officer, Creston & Company. Email: info@crestonandco.com, with "Privacy" in the subject line. We acknowledge every complaint within two working days and aim to resolve it within 30 days.

We update this policy when the site or our services change. The date at the top shows the latest version. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.

Questions about this policy or your data: info@crestonandco.com, or WhatsApp +91 78029 27428.