PRIVACY POLICY

BLV Exports Limited
Registered in England & Wales
Registered office: Williamson Heights, 5 Southway Street, Wembley HA9 0JY
Website: www.blvexports.co.uk

Last updated: 24 August 2026
Effective date: 1 September 2026
Policy version: 1.0

1. Scope and Purpose

This Privacy Policy explains how BLV Exports Limited ("we", "us", "our", "Company") collects, uses, discloses, and protects your personal data when you:

• Visit our website (www.blvexports.co.uk)
• Enquire about our basmati rice products or logistics services
• Place orders or engage in supply chain activities with us
• Contact us by email, phone, post, or social media
• Attend trade shows, industry events, or webinars
• Subscribe to our newsletter or marketing communications

We are committed to complying with:

• UK General Data Protection Regulation (UK GDPR) (retained EU law)
• Data Protection Act 2018 (UK)
• EU General Data Protection Regulation (GDPR 2016/679) – as we trade internationally and may process EU residents' data
• Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) – for electronic marketing
• ePrivacy Directive 2002/58/EC – for non-UK EU operations

2. Who We Are (The Data Controller)

Company name: BLV Exports Limited
Registered address: Williamson Heights, 5 Southway Street, Wembley HA9 0JY
Website: www.blvexports.co.uk
Data Protection Lead / Privacy Contact:
Primary email: gvashistha@blvexports.co.uk
Secondary email: ngauba@blvexports.co.uk
Phone: +44 78334 42729
Post: Williamson Heights, 5 Southway Street, Wembley HA9 0JY
Opening hours: Monday – Saturday, 10:00 AM – 10:00 PM

Privacy enquiries and data protection requests are handled through the Privacy Contact details provided above.

3. Personal Data We Collect

Depending on your relationship with us, we may collect:

3.1 Identity and Contact Data

• Full name, job title, company name
• Business email address, direct phone number, business postal address
• Country of residence/business location
• Contact preferences (preferred communication channel)

3.2 Commercial and Transaction Data

• Enquiries about our basmati rice products (specifications, quality grades, quantities, delivery terms)
• Purchase orders, quotes, invoices, payment references
• Delivery addresses and logistics details
• Customs documentation and export/import records
• Customer/supplier account information (credit terms, payment history, account status)
• Trade show or event lead information (collected from sign-up sheets, badge scans)
• Correspondence relating to orders or disputes

3.3 Technical and Usage Data (Website Visitors)

• IP address and device identifiers
• Browser type and version, operating system
• Pages visited, time and date of visit, duration on site
• Referral URL (where you came from)
• Search queries on our site
• Cookie identifiers and similar tracking technologies (see Cookie Policy, Section 5)

3.4 Marketing and Preference Data

• Email address for newsletter subscriptions
• Marketing preferences (which products/topics interest you)
• Records of emails opened, links clicked (if enabled)

3.5 Special Category Data

We do not normally collect special category data (e.g., health, ethnicity, trade union membership, biometric information). If we ever need to collect such data (e.g., for health and safety at our premises or disability accommodation), we will:

• Inform you separately
• Obtain your explicit consent or rely on another lawful UK GDPR condition
• Implement enhanced security measures

4. Legal Basis for Processing Your Personal Data

We process your personal data only where we have a valid legal basis under UK GDPR and (where applicable) EU GDPR:

4.1 Performance of a Contract

When: You have placed an order, entered into a supply agreement, or requested a quote.
What we process: Identity, contact, commercial, transaction, and delivery data.
Why: To respond to your request, process your order, arrange delivery, issue invoices, manage payment, and provide customer support.

4.2 Legitimate Interests

When: We have a legitimate business need, balanced against your rights.
What we process: Contact data, transaction history, website usage, marketing preferences.
Examples:

• Improving our website and services (analytics, heat maps, user testing)
• Understanding customer demand and market trends
• Preventing fraud, chargebacks, or other financial crimes
• Exercising legal claims and defending disputes
• Contacting you about updates to our terms or policies
• Internal record-keeping, audit, and compliance reporting

Your rights: You can object to processing based on legitimate interests (see Section 7 below).

4.3 Legal Obligation

When: We are required by law to process your data.
What we process: Identity, contact, commercial, and transaction data.
Examples:

• Tax and customs: HMRC, VAT, customs duty declarations
• Export controls and sanctions: Compliance with UK Export Control Order, OFSI sanctions checks
• Anti-money laundering (AML): Customer due diligence under Money Laundering Regulations
• Modern Slavery Act 2015: Due diligence on suppliers and business partners
• Competition law: Responses to regulatory investigations
• Court orders or law enforcement requests

We will process the minimum data necessary and retain it only as long as legally required.

4.4 Consent

When: You have explicitly agreed to a specific use of your data.
What we process: Email address for newsletters, marketing communications, non-essential cookies.
Examples:

• "I would like to receive BLV Exports' monthly product updates and industry insights"
• Acceptance of performance/analytics cookies

You can withdraw consent at any time (see Section 7).

4.5 Vital Interests or Public Task

We may also process data to protect someone's life or to carry out a task in the public interest, though this is rare for a commercial import/export business.

5. How We Use Your Personal Data

5.1 Responding to Enquiries and Providing Product Information

• Answering questions about our basmati rice, sourcing, pricing, quality certifications
• Providing product specs, technical datasheets, samples
• Preparing tailored quotes and proposals

5.2 Processing Orders and Managing Supply Chain

• Recording and executing purchase orders
• Arranging logistics, freight forwarding, and insurance
• Coordinating with customs brokers and import/export agents
• Issuing invoices and managing payment
• Tracking shipments and delivery

5.3 Quality Assurance and Compliance

• Testing and certifying product quality (pesticide residues, aflatoxin, microbiology, allergens)
• Maintaining food safety records (FSMA, BRC, ISO certifications where applicable)
• Ensuring compliance with food labelling, traceability, and import regulations
• Responding to customer complaints, returns, or recall situations

5.4 Marketing and Business Development

• Sending industry news, product launches, or promotional offers (where you have opted in or we rely on legitimate interests)
• Inviting you to trade shows, webinars, or industry events
• Conducting customer satisfaction surveys or feedback requests
• Building sales pipelines and lead nurturing

5.5 Website and Service Improvement

• Analysing website traffic and user behaviour (Google Analytics)
• Identifying technical issues, security vulnerabilities, or site performance problems
• A/B testing landing pages or call-to-action buttons
• Improving search functionality and navigation
• Personalising your experience (remembering preferences, language settings)

5.6 Analytics and Business Intelligence

• Aggregating order data to forecast demand, manage inventory, and plan sourcing
• Benchmarking performance against market trends
• Identifying high-value customer segments or profitable regions
• Reporting to our board or stakeholders

5.7 Legal Compliance and Risk Management

• Responding to regulatory enquiries or audits
• Investigating suspected fraud, money laundering, or sanctions violations
• Defending legal disputes or claims
• Maintaining audit trails for compliance with food safety, customs, and tax regulations

5.8 Direct Contact and Communication

• Responding to support requests (email, phone, contact forms)
• Sending transactional emails (order confirmation, shipping updates, invoice, password reset)
• Notifying you of changes to our terms, policies, or services

6. Who We Share Your Personal Data With

6.1 Internal Sharing

• Sales and customer success teams: to manage your account and respond to enquiries
• Supply chain and logistics: to arrange delivery and manage orders
• Finance and accounting: to process invoices and payments, manage credit terms
• Compliance and legal: to conduct due diligence, respond to disputes
• IT and support teams: to resolve technical issues and maintain systems

6.2 External Service Providers and Data Processors

We may share personal data with third parties who process data on our behalf under a Data Processing Agreement (DPA):

• IT and hosting providers: AWS, Microsoft, or other cloud platforms (server hosting, email, CRM, backup)
• Analytics and tracking: Google Analytics (Google LLC; see Google Privacy Policy)
• Email and CRM platforms: e.g., HubSpot, Mailchimp (email marketing, customer relationship management)
• Payment processors: e.g., Stripe, PayPal (credit card processing, fraud detection)
• Logistics and freight partners: DHL, UPS, FedEx, customs brokers, freight forwarders (shipment tracking, delivery)
• Insurance brokers: for cargo insurance, liability, or product recall insurance
• Professional advisers: accountants, solicitors, audit firms (compliance, financial reporting, legal disputes)
• Marketing and advertising: Google Ads, LinkedIn (retargeting, analytics – subject to your consent)

All third parties are contractually bound to:

• Process data only in accordance with our instructions
• Implement appropriate technical and organisational security measures
• Not use your data for their own purposes (except as required by law)
• Assist us in responding to your rights requests

6.3 Regulators and Authorities

We may be required to disclose personal data to:

• HM Revenue & Customs (HMRC): for tax, customs, and VAT compliance
• UK Export Control Joint Unit: for sanctions screening and export control compliance
• Office of Financial Sanctions Implementation (OFSI): for sanction list checks
• Food Standards Agency (FSA): for food safety incidents or recalls
• National Crime Agency (NCA), police: for money laundering or fraud investigations
• Local authorities: for environmental or trading standards issues
• Courts or tribunals: in response to lawful court orders or legal proceedings

We will resist overly broad requests and disclose only what is legally required.

6.4 Business Transfers

If BLV Exports Limited is acquired, merged, or its assets sold, personal data may be transferred as part of that transaction. We will notify you and provide relevant privacy options if material changes occur.

6.5 Publicly Available Information

Certain business information (company name, registered address, directors' details) is publicly available via Companies House. This Privacy Policy does not restrict disclosure of information already in the public domain.

7. International Data Transfers

As a global import/export business, we operate internationally and may transfer personal data outside the UK and EU.

7.1 Transfers from the UK

Receiving countries: Basmati rice-producing regions (India, Pakistan) and international logistics hubs (USA, Asia, Middle East).

Where we transfer UK personal data to countries without an adequacy decision, we implement safeguards:

• UK International Data Transfer Addendum (IDTA): ensures standard protections when using EU Standard Contractual Clauses (SCCs) with non-UK adequacy countries
• Binding Corporate Rules (BCRs): if applicable within group entities
• Your explicit consent: in limited cases

7.2 Transfers under EU GDPR

If we process data of EU residents, transfers to non-adequacy countries must rely on:

• EU Standard Contractual Clauses (SCCs) – the primary mechanism following Schrems II
• Adequacy decisions (e.g., Switzerland, Israel where applicable)
• Derogations – consent, contract performance, or public interest (article 49)

We conduct Transfer Impact Assessments to ensure data is protected to an adequate standard even after transfer.

7.3 Transparency for Transfers

For significant transfers (e.g., to a basmati sourcing partner in India), we will provide additional information or obtain your consent if required. You can request details of our transfer mechanisms at gvashistha@blvexports.co.uk.

8. Data Retention

We retain personal data only for as long as necessary for the purposes outlined above and to comply with legal obligations.

8.1 Typical Retention Periods

8.2 Deletion and Anonymisation

When retention periods expire, we will:

• Delete personal data securely (see Section 11 – Security)
• Anonymise data for statistical or analysis purposes (where legally permitted)
• Retain anonymised data indefinitely for business intelligence

You can request early deletion (see Section 7 – Your Rights below).

9. Your Rights Under Data Protection Law

Subject to certain legal conditions, you have the following rights:

9.1 Right of Access (Data Subject Access Request – DSAR)

You can request a copy of all personal data we hold about you, plus details of:

• Categories of data collected
• Recipients of your data
• Retention periods
• Your rights under this policy

How to exercise: Email gvashistha@blvexports.co.uk with "DSAR" in the subject line.
Timeline: We will respond within 1 calendar month (extendable to 3 months for complex requests).
Fee: Usually free, unless your request is manifestly unfounded or repetitive.

9.2 Right to Rectification

You can request that we correct or update inaccurate or incomplete personal data.

Example: Wrong delivery address, outdated job title.
How to exercise: Email gvashistha@blvexports.co.uk with details of the inaccuracy.
Timeline: We will action this promptly and confirm within 1 month.

9.3 Right to Erasure ("Right to Be Forgotten")

You can request deletion of your personal data in certain circumstances:

• Data no longer necessary for the purpose collected
• You withdraw consent (if consent was the basis)
• You object to processing based on legitimate interests and no overriding interests exist
• Data processed unlawfully
• Legal obligation to erase

Limitations: We may not erase data if:

• We need it to perform a contract with you
• We have a legal obligation to retain it (e.g., tax, customs, AML records)
• It is necessary for legal defence or a court order

How to exercise: Email gvashistha@blvexports.co.uk with "Erasure Request" in the subject.
Timeline: Within 1 month, with explanation if we cannot fully comply.

9.4 Right to Restrict Processing

You can ask us to limit how we use your data (e.g., stop processing, but keep the data on file) if:

• You dispute the accuracy (whilst we verify)
• Processing is unlawful but you prefer restriction to erasure
• We no longer need the data, but you need us to keep it for legal defence
• You have objected and we are verifying whether our interests override yours

How to exercise: Email gvashistha@blvexports.co.uk with "Restrict Processing" in the subject.
Timeline: Within 1 month.

9.5 Right to Object

You can object to processing of your personal data on grounds of:

a) Direct Marketing (Always Free)

You can opt out of email marketing, phone calls, or postal mail at any time.

• How: Click "Unsubscribe" in every marketing email, email gvashistha@blvexports.co.uk, or reply "STOP" to SMS.
• Timeline: Immediate; we will honour your request within 10 business days.

b) Legitimate Interests

You can object to processing based on our legitimate interests (e.g., analytics, market research, internal reporting).

• How: Email gvashistha@blvexports.co.uk stating "Objection to Legitimate Interests Processing."
• Timeline: We will consider your objection within 1 month. We may continue processing if we demonstrate compelling legitimate interests (e.g., fraud prevention) that override yours.

9.6 Right to Data Portability

Where processing is based on consent or contract and is carried out by automated means, you can request your data in a portable, machine-readable format (e.g., CSV, JSON) so you can transfer it to another organisation.

Scope: Limited to data you have provided; does not include data inferred or derived from your information.
How to exercise: Email gvashistha@blvexports.co.uk with "Data Portability Request."
Timeline: Within 1 month.

9.7 Right to Withdraw Consent

Where we process your data based on your consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Example: You can unsubscribe from newsletters, or disable non-essential cookies.
How: Use any of the mechanisms above (email, cookie settings, unsubscribe link).
Timeline: Immediate.

9.8 Rights Related to Automated Decision-Making

We do not currently make decisions about you based solely on automated processing (e.g., credit scoring, profiling) that significantly affects you. If we do in future, you will have the right to:

• Obtain an explanation of the decision
• Express your point of view
• Challenge the decision

9.9 How to Exercise Your Rights

Contact our Privacy Lead:
Primary email: gvashistha@blvexports.co.uk
Secondary email: ngauba@blvexports.co.uk
Phone: +44 78334 42729
Post: Williamson Heights, 5 Southway Street, Wembley HA9 0JY
Subject line: "Data Subject Rights Request – [Type: DSAR / Rectification / Erasure / Restriction / Objection / Portability]"

What to include:

• Your full name and contact details
• Clear description of your request
• Any reference numbers (order ID, customer account, trade show badge number)
• Proof of identity (for security) if not already on file

We will acknowledge receipt and confirm the timeline for response.

10. Automated Decision-Making and Profiling

We do not currently:

• Use automated decision-making (algorithms) to make significant decisions about you (e.g., credit approvals, eligibility)
• Build detailed profiles about you based solely on automated processing
• Use your data for targeted advertising or price discrimination

If we introduce such processing in future, we will inform you separately and provide appropriate safeguards.

11. Security of Your Personal Data

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

11.1 Technical Measures

• Encryption in transit: TLS/SSL (HTTPS) for all website traffic
• Encryption at rest: Password-protected databases, encrypted file storage, secure cloud infrastructure (AWS, Microsoft Azure)
• Access controls: Role-based permissions, multi-factor authentication (MFA) for staff
• Firewalls and intrusion detection: Network-level protection
• Regular backups: Tested, offsite, encrypted backups

11.2 Organisational Measures

• Staff training: Annual privacy and data security training for all employees
• Data minimisation: Collecting only necessary data; regular deletion of outdated records
• Access restriction: Only authorised staff can access personal data (need-to-know basis)
• Data Processing Agreements (DPAs): All processors bound by written agreements
• Confidentiality clauses: Mandatory in employment contracts and third-party agreements
• Vendor assessments: Regular review of processor security practices

11.3 Incident Response

If there is a personal data breach (unauthorised access, loss, or corruption), we will:

1. Assess the risk to you and others
2. Notify you without undue delay if there is a high risk of harm (in accordance with UK GDPR Article 33)
3. Notify regulators (ICO, or EU DPA if required) within 72 hours of discovery
4. Provide remedial steps (e.g., password reset, credit monitoring)

Note: You will not be charged for remedial costs resulting from our failure to secure data.

11.4 Limitations

No system is 100% secure. Whilst we take all reasonable precautions, we cannot guarantee absolute security of data transmitted over the internet.

12. Children and Vulnerable People

Our services and website are not directed at children under 16. We do not knowingly collect personal data from children. If a child has provided their data, please contact us immediately, and we will delete it.

If you have concerns about data protection for vulnerable adults, contact our Privacy Lead at gvashistha@blvexports.co.uk.

13. Third-Party Links

Our website may contain links to third-party websites (logistics partners, industry associations, trade publications). We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing your data.

14. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

How we'll notify you:

• We will update the "Last updated" date at the top of this policy
• For significant changes (e.g., new processing purposes, expanded data sharing), we will email you or post a prominent notice on our website
• Continued use of our website after such notice constitutes acceptance of the updated policy

Archive: Previous versions of this policy are available on request.

15. Your Rights and Complaints

15.1 Contacting Us

BLV Exports Limited – Privacy Enquiries
Primary email: gvashistha@blvexports.co.uk
Secondary email: ngauba@blvexports.co.uk
Phone: +44 78334 42729
Post: Williamson Heights, 5 Southway Street, Wembley HA9 0JY
Opening hours: Monday – Saturday, 10:00 AM – 10:00 PM
Website: www.blvexports.co.uk

15.2 Supervisory Authorities

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with your relevant data protection authority:

UK:
Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: https://ico.org.uk/make-a-complaint/

EU (if you are an EU resident or the processing relates to EU services):
Your local Data Protection Authority (DPA). Find your authority here: https://edpb.ec.europa.eu/about-edpb/members_en

16. Data Protection Impact Assessments (DPIA)

For high-risk processing (e.g., large-scale profiling, international transfers of sensitive data), we conduct Data Protection Impact Assessments. These are available on request.

17. Legal Basis Summary Table

18. Appendices

Appendix A: Cookie List (See Section 5 – Cookie Policy)

See our separate Cookie Policy at www.blvexports.co.uk/cookie-policy for details of cookies in use, their purpose, and how to manage them.

Appendix B: Data Processing Addendum

We have a standard Data Processing Addendum (DPA) for organisations that use our services and are data controllers themselves. This includes UK IDTA and EU SCCs. Available on request at gvashistha@blvexports.co.uk.

Appendix C: Record of Processing Activities (ROPA)

We maintain a Record of Processing Activities (ROPA) documenting all personal data processing. This is available to EU/UK supervisory authorities upon request.

End of Privacy Policy

Version history:

• v1.0 (24 Aug 2026) – Initial publication
• [Update this as you make changes]