Privacy policy, Velumic Industries Private Limited

First published 18 October 2026 · last updated 2 November 2026

1. Who we are

Velumic Industries Private Limited (“Velumic Industries”, “we”, “us”) is a company incorporated in India (CIN U47714UP2026PTC246839). We decide why and how the personal data described here is used, so under India’s Digital Personal Data Protection Act, 2023 we are the “Data Fiduciary”. This policy covers the Velumic Industries pages of velumic.co and the group home page, and all the personal data described in section 3, whether you give it to us or we find it in public sources. It does not cover the pages of the other Velumic companies.

2. Visiting this website

This website sets no cookies and uses no analytics, advertising trackers or third-party scripts. Its fonts are served from the site itself. The site is hosted by GitHub (GitHub Pages), which records visitors’ IP addresses in its server logs for security, under GitHub’s own privacy statement. We do not receive or use those logs.

3. What we hold, where it comes from, and why

Most of what we hold is about companies. It includes personal data where a company’s details name a person: the people who write to us, sign for a company, own or run it, or read a business address. For each kind of contact below we say what we hold, where it comes from and what we use it for. We do not ask anyone for identity documents, payment card details or health information, and we do not sell personal data. We record a company’s GST number to verify it on the public GST portal; for a sole proprietor that number contains their PAN.

3.1 When you contact us

What: your name, business email address or phone number, company, role and country, and the content of your enquiry (such as product, specification, quantity, destination and end use). If you message us from one of our advertisements, Meta tells us which one, and if you phone us, we note the call. From: you, by email, phone, WhatsApp (including from our Click-to-WhatsApp advertisements), Facebook, Instagram or Messenger. Why: to reply, to prepare a quotation, to keep a record of the enquiry, to check the companies and the destination named in it against official sanctions lists, as the law expects of an exporter, and, if a message looks like a fraud attempt, to keep it as evidence and report it (section 3.7). You gave the data to us for this purpose, which the Act allows (section 7(a)); we use it for nothing else. We send occasional updates only if you say yes when we ask you separately.

3.2 If you buy from us

What: the identity of your company and the people who sign for it; its directors, owners and anyone else who controls it, with their nationality where a registry shows it, or your signed declaration of who owns the company where it does not; notes of our video call with you; for larger orders, a credit report on the company; the destination and end use of the goods; samples, contract, payment, shipping, delivery and claim records; and the name on any bank account you ask us to use, which we confirm by calling a number we already hold. From: you, public company registries, your website, business networks such as LinkedIn, trade-show listings, a credit agency, and the banks and logistics providers on the deal. Why: to decide whether we can lawfully deal with you, to check these names against official sanctions lists before we quote and again during the deal, to perform the contract and get paid, and to keep the accounts, tax, customs and foreign-exchange records the law requires.

3.3 If you supply goods or services to us

What: business contact details of manufacturers and of the people we deal with there; catalogues, prices and samples; notes and photographs from a factory visit or video tour; an independent audit or inspection report where one is made; the directors, owners and controllers of the company, with their nationality where a registry shows it, or the company’s signed declaration of who owns it; the company’s GST number; purchase orders and payments; and bank details, which we confirm with a cancelled cheque or bank letter, a small test payment that shows the account holder’s name (a “penny-drop” test), and a call to a number from an independent public source, such as the GST or company register or the supplier’s website. The same applies to logistics providers, customs brokers, inspectors, surveyors, insurers and banks we work with. From: public directories (such as the Council for Leather Exports member directory, IndiaMART, TradeIndia and GST-verified listings), trade-fair exhibitor lists, references, public company registries, and you. Why: to find manufacturers for our buyers, to ask for catalogues, prices and samples, to check the companies and the people who own or run them against official sanctions lists before we sign or pay, and to place, follow and pay orders.

3.4 Ship brokering

What: the names and business contact details of the principals and brokers in a bunker or tanker enquiry, the vessel’s name and IMO number, and the registered owner, manager and operator of the vessel. From: the parties, public AIS and port data, and public ship and company registers (such as Equasis and IMO GISIS). Why: to pass offers between the parties as brokers only, to record what was agreed, and to check the parties and the vessel against official sanctions lists first.

3.5 Businesses we email first

See section 8.

3.6 If you ask us for work

What: your message and anything you attach, such as a CV. From: you. Why: to reply and to consider you for work with us. We keep it for 6 months after our reply, then delete it, unless you agree that we keep it longer.

3.7 If we suspect a fraud

What: the messages, email headers, documents and bank details used in a suspected fraud attempt, such as a request to change bank details or a message that matches a known scam. From: the sender, and our own records. Why: to protect our company, our customers and suppliers, to keep the evidence, and to report the fraud to the police (through the national cybercrime portal or helpline 1930) and to our bank, which may try to recall a payment. We keep the evidence until the matter is closed and for 24 months after, then delete it, unless the police or a court need it longer.

What: your name and account ID on the platform, your comment or message, any email you send to our ops@velumic.co desk, and our reply. From: you, when you comment on or message our Facebook, Instagram or Threads pages, Messenger or WhatsApp, or email the desk. Why: to answer you. The platform tells our desk that something new has arrived, and the desk then reads it from the platform (WhatsApp sends the message with the notice) and answers. Replies are written by an AI assistant that runs on our own computer, and routine replies (a welcome, how to send an enquiry, where to find information on this website) may be sent automatically, without a person reading them first. Our first reply to you, and any reply when you ask, says that it comes from Velumic Industries’ AI assistant. The assistant never gives prices, quotations, payment terms, bank details or delivery dates, and never agrees to anything on our behalf: those messages, complaints and anything else that needs a person go to a director, who replies personally. You can ask for a person at any time, and you can ask us to stop replying. The text of your message is not sent to any other AI service. If your message becomes an enquiry, we keep it as an enquiry (section 3.1).

4. Our AI assistant and our directors

Our directors, and our AI assistant (Claude, provided by Anthropic), read the data described here (except the comments and messages in section 3.8). They draft our replies and records, and prepare the checks. A director reads and approves anything we send that commits us, such as a quotation. No decision about you is made by the AI assistant alone. Comments and messages on our pages and to our desk are answered by a separate AI assistant that runs on our own computer (section 3.8).

5. Who else processes it, and where

These companies process personal data for us, each under its own terms:

Namecheap: email hosting for our velumic.co addresses (United States).
Anthropic: our AI assistant (United States).
Meta Platforms: WhatsApp, Facebook, Instagram, Threads and Messenger, when you contact us there (United States and Ireland).
ngrok: the secure connection that carries a platform’s “new message” notice to our desk; for WhatsApp the notice contains the message itself (United States).
GitHub: hosting of this website and of our private business records (United States).

When we start the emails described in section 8, Google (the email service) and Cloudflare (the web domain) will also process data for them (United States, and the providers’ other locations). We will update this page when they do.

We share the details a deal needs with a counterparty, such as a manufacturer, logistics provider, courier, inspector or bank (for example a product specification and quantity, or the consignee on shipping documents), and with authorities (customs, tax authorities and banks reporting to the Reserve Bank of India) where Indian law requires it, and with the police when we report a fraud (section 3.7). Our chartered accountant sees our accounts and the deal records behind them to audit and certify them, as the law requires. We do not share your contact details with a counterparty without telling you first. Because of the providers above, your data is processed outside India, mainly in the United States and the European Union.

6. How long we keep it

Enquiries, and supplier and brokering contacts we did not do business with: 24 months after our last contact, then deleted.
Deals (buyers, suppliers, service providers and fixtures): for as long as the law requires us to keep accounts, tax, customs and foreign-exchange records, then deleted.
Businesses we email first, and the research lists we build: 12 months after our last email or after the list was made, then deleted (section 8).
If you ask us to stop: we stop contacting you at once and record that you asked. Your other records are then kept or deleted as above, unless you also ask us to delete them (section 7). For the emails in section 8, once the rest is deleted we keep only a scrambled (hashed) form of the address and its domain, so that we never email them again.
Comments, messages and our replies (section 3.8): up to 12 months, then deleted, unless the message became an enquiry (kept as above); if you ask us to stop replying, we keep only a scrambled (hashed) form of your platform ID or address, so that we do not reply again.
Your requests to us (section 7): 12 months after we close them.
Where Indian law requires us to keep a record of our processing for a minimum period, we keep it for that period (at present, one year).

7. Your rights

You may ask us to:

tell you what personal data we hold about you, what we use it for, and who we have shared it with;
correct, complete or update it;
delete it, unless the law requires us to keep it (we will say what we keep and why);
stop using it where you agreed to its use. Withdrawing is as easy as agreeing: reply STOP, or write to us;
stop contacting you, at any time;
deal with a complaint (a grievance) about how we handled your data.

Naming someone to act for you. You may nominate another person to exercise these rights for you if you die or become unable to act. Write to us with their name and contact details; we keep a record of the nomination and confirm when we have recorded it.

If you are in the United Kingdom or the European Union you may also ask us to restrict how we use your data, and you may object to our use of it.

8. Businesses we email first

We send short business emails to companies in the United Kingdom, France and the United Arab Emirates that may buy goods from India.

What we hold: the company name, a general business address such as sales@ or info@ (never a personal address), the country, the company’s registration number, the products that may interest the company, where we found the address, the dates we wrote and any reply.
Where it comes from: public business sources: the company’s own website, public company registers, business directories, trade-fair exhibitor lists and professional networks.
Checks before we write: the company’s name is checked against official sanctions lists when the list is made and again before each email. For specialty petroleum, the company, its owners and the people who control it are checked first. If a name looks like a listed one, a director checks the company’s officers and the people with significant control in the public company register, and decides; until then we do not write.
Why, and our legal basis: to offer our sourcing and export services to businesses, and to make the checks above. We email only general business addresses, never an individual’s own address. We rely on our legitimate interests (Article 6(1)(f) of the UK GDPR, and of the EU GDPR for France). For the United Kingdom we have weighed them, in a written assessment, against the interests of the people who may read the address. In the United Kingdom we email only limited companies, public limited companies and LLPs. We write to each company at most three times and never send prices.
How long: 12 months after our last email to that address, then deleted. If you ask us to stop, we stop at once; once the rest is deleted, we keep only a scrambled (hashed) form of the address and its domain, so that we never email them again. If you reply and we start working together, your enquiry is then handled as described in sections 3 to 7.
Who will process it: Google, which will provide the email service; Cloudflare, which will provide the web domain; our AI assistant (section 4); and our directors in India. Your data will therefore be processed outside the United Kingdom and the European Union.
Your rights: those in section 7. An objection to our emails always stops them: reply STOP, or write to ops@velumic.co. We answer every request within one month.

9. How to ask, and how to complain

Write to ops@velumic.co, for the attention of the Grievance contact, Velumic Industries, or reply to any message from us. To protect your data, we answer only to the email address or phone number the data belongs to, or we reply there first to confirm the request came from you. We never ask for identity documents. We keep a record of each request and our answer.

We acknowledge every request within 2 business days and answer within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India. In the United Kingdom you may complain to the Information Commissioner’s Office, and in the European Union to the data protection authority of your country, such as the CNIL in France.

10. Children

Our services are for businesses. We do not knowingly collect personal data from anyone under 18. If we learn that we hold a child’s data, we delete it.

11. Security and breaches

We limit access to personal data to the people who need it and keep it in access-controlled systems. If a breach affects your personal data, we will tell you and the Data Protection Board of India without delay, and, where your country’s law requires it, its data protection authority, and, where Indian law requires it, CERT-In (India’s national computer emergency response team). We keep a record of each incident, without copying the data that was exposed.

12. Changes to this policy

When this policy changes, we update the date at the top of this page.

13. Contact

Velumic Industries Private Limited (CIN U47714UP2026PTC246839), ops@velumic.co