Privacy Policy

This Privacy Policy explains how Indus Hydraulic Power Trading LLC (“Indus Hydraulics”, “we”, “us”) collects, uses, and protects personal information through indushydraulics.com and our customer portal. We are the data controller for the personal data described below.

We collect personal information in the following situations:

• Account creation: name, business email, phone number, company name, role, and shipping/billing addresses you provide.
• Quotation requests: the part numbers, quantities, application context, and any attachments you submit through the RFQ flow or contact form.
• Contact form submissions: the fields you submit on the contact page, including inquiry type, company, industry, and message.
• Operational records: emails we exchange with you about quotes, deliveries, invoices, and warranty claims.
• Site usage: server logs (IP address, user agent, request timestamps), session cookies required for authentication, and basic analytics about which pages are viewed.

We do not knowingly collect personal data from individuals under 18 years of age.

We use personal information to:

• respond to RFQs and prepare Estimates;
• process orders, arrange delivery, and handle warranty claims;
• operate your customer portal account and remember preferences;
• send transactional emails (quote confirmations, status updates, invoices);
• send service-related notices about changes to our terms or platform;
• maintain financial and accounting records as required by UAE law;
• investigate and prevent fraud, abuse, or security incidents;
• improve the catalogue, search, and overall site experience.

We process personal data on the basis of (a) your explicit consent where applicable, (b) performance of the contract for goods or services you have requested, (c) compliance with legal and regulatory obligations under UAE law, and (d) our legitimate interests in operating and improving the business.

Personal data is stored in a Postgres database hosted on Supabase, with encryption at rest and in transit. Access is restricted to authorised staff using individual credentials, and is audit-logged where appropriate. Authentication is handled by Auth.js using secure, HTTP-only session cookies.

We do not sell personal data. We share information only as necessary with:

• Email service: Resend, for delivery of transactional emails (quote confirmations, password resets, contact-form alerts).
• Hosting and database: Vercel (web hosting) and Supabase (database, file storage), both bound by their respective data-processing agreements.
• Manufacturers and suppliers: when needed to fulfil an order, raise a warranty claim, or arrange technical support, we may share the minimum information required.
• Logistics partners: shipping and customs information when arranging delivery.
• Professional advisers and authorities: auditors, lawyers, banks, and government authorities where required by law or to protect our legal rights.

Some of our service providers (including Vercel, Supabase, and Resend) operate from data centres outside the United Arab Emirates. Where this is the case, transfers are governed by the providers' standard contractual safeguards.

We use a small number of strictly-necessary cookies, primarily for authentication and basic load balancing. We do not use third-party advertising or behavioural tracking cookies. You can disable cookies in your browser settings, but doing so will prevent sign-in to the customer portal.

We keep personal data for as long as your account is active and for a further period required to comply with UAE accounting and tax record-keeping obligations (currently five years from the relevant transaction). RFQ and quote records may be kept for longer where needed to honour ongoing warranty obligations. Server logs are retained for shorter operational windows (typically 30–90 days).

You have the right, subject to UAE law, to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of personal data, subject to legal retention requirements;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• complain to the relevant supervisory authority.

To exercise any of these rights, contact us at the address below. We may need to verify your identity before responding and will reply within 30 days.

In the unlikely event of a personal-data breach that is likely to affect you, we will notify the affected account holders without undue delay and outline the steps we are taking and any actions we recommend you take.

We may update this Privacy Policy as our practices evolve or as legal requirements change. The current version is always the one published at this URL with the effective date shown above. Material changes will be notified to active account holders by email.

For privacy questions, requests, or complaints, contact us at privacy@indushydraulics.me. For general enquiries, see the channels on our contact page.