1. Introduction

LAARKA OVERSEAS PRIVATE LIMITED (“we”, “us”, “our”, or the “Company”), trading as Laarka Overseas, is committed to protecting the privacy of every visitor and customer of https://www.laarkaoverseas.com/ (the “Website”). This Privacy Policy explains what personal data we collect, how we use and protect it, who we share it with, how long we keep it, the safeguards we apply to international transfers, and the rights available to you. By using the Website or purchasing our products or services, you acknowledge that you have read and understood this Policy.

Data Controller: LAARKA OVERSEAS PRIVATE LIMITED, 1406 A1, Trinity Paradise, SR No. 29, H No. 37/2, Diwa, Thane, Maharashtra – 400612, India.

Data Protection / Privacy Contact: info@laarkaoverseas.com.

2. Information We Collect

We may collect and process the following categories of personal data:

• Identity data: name, title, username, date of birth (where required).

• Contact data: billing address, delivery address, email address, telephone numbers.

• Transaction data: products purchased, order history, and payments to and from you.

• Business data (B2B): company name, role, tax/registration identifiers, and import/export documentation you provide.

• Technical data: IP address, browser type and version, time zone, operating system, and device identifiers.

• Usage data: information about how you use our Website, products, and services.

• Marketing data: your marketing preferences and communication choices.

We do not intentionally collect special-category / sensitive data (such as health, religion, biometric, or genetic data). Please do not submit such data unless we specifically request it for a lawful purpose.

3. How We Collect Your Data

• Directly from you when you submit an enquiry, request a quote, sample or product documents, place an order, complete a form, or contact us.

• Automatically through cookies and similar technologies (see our separate Cookie Policy).

• From third parties such as payment processors, logistics and customs partners, analytics providers, and public sources.

4. How We Use Your Data and Our Legal Basis

Where data-protection law requires a lawful basis (for example, the EU/UK GDPR), we rely on the bases set out below:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

5. Automated Decision-Making & Profiling

We DO NOT use solely automated decision-making (including profiling) that produces legal or similarly significant effects about you. If this practice changes in the future, we will provide the information and safeguards required by applicable law, including any right to request human review.

6. Disclosure of Your Data

We may share your personal data with the following categories of recipients:

• Service providers that process payments, host our Website, or provide IT, analytics, and customer-support services.

• Logistics, freight, courier, warehousing, and customs-clearance partners needed to fulfil and ship your order, domestically and internationally.

• Professional advisers, regulators, customs and tax authorities, and law-enforcement agencies where required by law.

• Prospective buyers or successors in the event of a sale, merger, or reorganisation of our business.

We do not sell your personal data. We require all third parties to respect the security of your personal data and to process it only on our instructions and in accordance with the law. Where a third party acts as our processor, we put appropriate written data-processing terms or agreements in place where required by applicable law.

7. International Data Transfers

As a business operating across international markets, your personal data may be transferred to, stored, or processed in countries outside your country of residence, including countries that may not provide an equivalent level of data protection. Where we transfer personal data internationally, we apply appropriate safeguards recognised under applicable law — such as an adequacy decision, Standard Contractual Clauses (or the UK International Data Transfer Agreement / Addendum), or other lawful transfer mechanisms — to keep your data protected. You may request a copy of the relevant safeguard by contacting us.

8. Cookies

Our Website uses cookies and similar technologies. For full details and how to manage them, see our separate Cookie Policy.

9. Data Retention

We keep personal data only as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax, or customs requirements. Indicative retention periods are: statutory, accounting, tax and transaction records — 8 years or such longer or shorter period as required by applicable law; enquiry and customer correspondence — 3 years after the last meaningful interaction; marketing contacts — until consent is withdrawn or 2 years after the last meaningful interaction, whichever occurs first where applicable; and technical or security records — up to 12 months unless a longer period is reasonably required for security, investigation, legal, or regulatory purposes. When data is no longer needed, we securely delete or anonymise it.

10. Data Security & Breach Notification

We maintain appropriate technical and organisational measures — such as access controls, encryption or tokenisation where appropriate, and logging and monitoring — to protect personal data against accidental loss, unauthorised access, alteration, or disclosure. We limit access to those with a genuine business need. If a personal-data breach occurs, we will assess it and, where we are legally required to do so, notify the relevant regulator and affected individuals within the timeframes set by applicable law.

11. Your Rights

Depending on your location, you may have rights to: access your data; request correction; request erasure; object to or restrict processing; request data portability; opt out of marketing; and withdraw consent. To exercise any right, use the contact details at the end of this Policy. We will respond within the period required by applicable law and will not discriminate against you for exercising your rights.

12. Region-Specific Rights

The following region-specific provisions apply only where the relevant law applies to us or to the individual concerned.

12.1 European Union & EEA — GDPR

If you are in the European Economic Area, your data is protected under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). You have all the rights in Section 11 and the right to lodge a complaint with your local Supervisory Authority. We have not appointed an EU Article 27 representative. If appointment becomes legally required for our activities, we will make the representative’s details available through this Policy or another appropriate notice.

12.2 United Kingdom — UK GDPR, DPA 2018 & DUAA 2025

If you are in the United Kingdom, your data is protected under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 (“DUAA”). Under the DUAA you have a right to complain directly to us about how we handle your data; we will acknowledge your complaint and respond without undue delay. You may also complain to the Information Commissioner’s Office (ICO). We have not appointed a UK representative. If appointment becomes legally required for our activities, we will make the representative’s details available through this Policy or another appropriate notice.

12.3 United States — California (CCPA/CPRA) and Other States

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to know the categories and specific pieces of personal information we collect, use, disclose, and (if applicable) sell or share; to request deletion; to correct inaccurate information; to limit the use of sensitive personal information; and to opt out of the “sale” or “sharing” of personal information. 

• Do Not Sell or Share: We DO NOT “sell” or “share” personal information as those terms are defined under California law. If our practices change and an opt-out mechanism becomes legally required, we will provide an appropriate “Do Not Sell or Share My Personal Information” method or link.

• Global Privacy Control (GPC): we honour recognised universal opt-out signals such as the Global Privacy Control where required.

• Authorised agent: you may use an authorised agent to submit requests, subject to verification.

• Appeals & non-discrimination: you may appeal a denied request, and we will not discriminate against you for exercising your rights.

Residents of other U.S. states with comprehensive privacy laws (for example, Virginia, Colorado, Connecticut, Texas, Oregon, and a growing number of others — around twenty states as of 2026) may have similar rights, including opt-out of targeted advertising, sale, and certain profiling. We extend the relevant rights to residents of states where such laws apply to us.

12.4 United Arab Emirates — PDPL

If you are in the UAE, your data is handled in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). The PDPL’s federal Implementing/Executive Regulations were still pending as of early 2026, and enforcement is expected to follow their publication; we nonetheless apply PDPL principles, including consent, data-subject rights, and breach handling. If you operate in the DIFC or ADGM free zones, those zones have their own data-protection laws, which may apply instead of the federal PDPL.

12.5 India — DPDP Act 2023 & DPDP Rules 2025

If you are in India, your data is handled in line with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified November 2025). We provide a clear, plain-language notice of the personal data we process and the purposes; we process personal data on the basis of your consent or other legitimate uses permitted by the Act; and you may withdraw consent as easily as you gave it. You have the right to access, correction, completion, updating, erasure, and grievance redressal. In the event of a personal-data breach, we will notify the Data Protection Board of India and affected individuals as required. You may contact our Grievance Officer (see Contact section); if unresolved, you may escalate to the Data Protection Board of India.

12.6 Other Regions (Optional)

Canada: PIPEDA; Australia: Privacy Act 1988; Singapore: PDPA 2012; Brazil: LGPD. These references apply only where the relevant law applies to our processing activities or to the individual concerned.

13. Children’s Privacy

Our Website and products are not directed at children under the age of 18, and we do not knowingly collect their personal data. Where the law requires verifiable parental consent for processing a child’s data, we obtain it. If you believe a child has provided us data, contact us so we can delete it.

14. Third-Party Links

Our Website may link to third-party websites. We are not responsible for their privacy practices; please read their policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top reflects the latest revision; material changes will be notified where required by law. We recommend reviewing this Policy at least annually and whenever your processing or the applicable laws change.

16. Contact Us & Grievance Officer

Company: LAARKA OVERSEAS PRIVATE LIMITED

Address: 1406 A1, Trinity Paradise, SR No. 29, H No. 37/2, Diwa, Thane, Maharashtra – 400612, India

Privacy / Data Protection Email: info@laarkaoverseas.com

Grievance Officer (India): Contact via info@laarkaoverseas.com

Phone: +91 8591934677