1. Who we are
CompliFind (“we”, “us”) runs this website, an independent resource for BIS certification, CRS registration, Quality Control Orders and testing labs. We are the data controller (GDPR) and data fiduciary (India's Digital Personal Data Protection Act 2023, “DPDP Act”) for the personal data described here.
Contact for anything privacy-related, including our Grievance Officer under the DPDP Act: complifind@gmail.com.
2. What we collect
- Account data — name, email, username, password (stored only as a salted hash), or your Google account's name, email and picture if you sign in with Google.
- Profile data you choose to add — mobile number (country code and number), organisation, designation, company size, country, state and city.
- Onboarding answers — your role, what you are looking for and how you heard about us.
- Preferences and consents — notification settings, timezone, and a record of each consent you give or withdraw.
- Technical and security data — IP address, approximate location derived from it (country, region, city), browser, operating system and device type, recorded at sign-up, sign-in and account changes.
- Attribution data (only with analytics consent) — the page you first landed on, the referring site and campaign (UTM) tags.
- Enquiries — what you send through contact and consultation forms.
3. How we use it, and our legal basis
- To provide your account and the service — sign-in, dashboard, alerts you ask for. Basis: contract (GDPR Art. 6(1)(b)); DPDP: consent given at sign-up.
- To verify your email and keep accounts secure — one-time codes, detecting suspicious sign-ins and spam accounts. Basis: legitimate interests in security and fraud prevention (Art. 6(1)(f)); DPDP: legitimate use and consent.
- To tailor content — showing regulations, QCOs and labs that match your role, products and location. Basis: contract / consent.
- Newsletters and product news — only if you opted in. Basis: consent (Art. 6(1)(a)), withdrawable any time.
- Analytics and advertising measurement — only with cookie consent. Basis: consent.
- Legal obligations — keeping records we are required to keep and responding to lawful requests. Basis: Art. 6(1)(c).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Cookies
Essential cookies keep you signed in (complifind_public.*) and remember your cookie choice (bis_consent). They are always on because the site cannot work without them.
Analytics cookies (and our first-visit attribution cookie, bis_ft) and advertising cookies are only set after you allow them in the cookie banner. You can change your choice any time from “Cookie settings” in the footer or, when signed in, from Account › Privacy & data. We honour the Global Privacy Control browser signal as an opt-out of advertising cookies and of sharing.
5. Who we share it with
We do not sell your personal data, and we do not share it for cross-context behavioural advertising unless you allow advertising cookies.
We use service providers (processors) who act only on our instructions under written contracts:
- Hosting and database infrastructure
- Transactional email delivery (Resend)
- Google, if you choose to sign in with Google
- Image hosting (ImageKit)
- Google Analytics / Tag Manager, only with your consent
We may disclose data where required by law, to protect our rights or users' safety, or as part of a business transfer, in which case this policy continues to apply.
6. International transfers
We are based in India and some providers process data in other countries. When data about people in the EU/EEA or UK leaves those regions, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK Addendum). Transfers out of India follow the DPDP Act and any countries the Government of India restricts.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, profile and preferences | Until you delete your account |
| Sign-ups never confirmed by email code | Deleted after 7 days |
| Sign-in sessions | 30 days from last use, or until you sign out |
| One-time email codes | 10 minutes, stored only as a hash |
| Security and activity log | 12 months |
| Consent records | For the life of your account |
| Deletion record (email as a one-way hash, no other identifiers) | 3 years after deletion |
| Enquiries and consultation requests | Up to 3 years from last contact |
8. Your rights
Whatever country you are in, you can:
- Access and download your data — Account › Privacy & data › Download my data.
- Correct it — Account › Profile.
- Delete your account and data — Account › Privacy & data › Delete account. Deletion is immediate.
- Withdraw consent to emails or cookies at any time, as easily as you gave it.
- Object to or restrict processing, or ask a question we can't answer in-app, by emailing complifind@gmail.com.
EU/EEA and UK: you may complain to your data protection authority (in the UK, the ICO). India: you may nominate another person to exercise your rights if you die or become incapable, and, if our Grievance Officer doesn't resolve your complaint, approach the Data Protection Board of India. California: see the next section. We respond within 30 days (one month under the GDPR; 45 days under the CCPA) and will never treat you differently for using your rights.
9. Your Privacy Choices (California and other US states)
In the last 12 months we collected these categories of personal information: identifiers (name, email, username, IP address), professional information (organisation, designation), internet activity (pages and sign-in activity) and approximate geolocation. Sources, purposes and recipients are described above. We have not sold personal information and do not knowingly sell or share data of anyone under 16.
To opt out of sharing for targeted advertising: choose “Reject all” in the cookie banner (reopen it from “Cookie settings” in the footer), turn on Do Not Sell or Share in Account › Privacy & data, or enable Global Privacy Control in your browser. An authorised agent may make a request for you by email; we will verify both of you.
10. Children
CompliFind is a professional service for people aged 18 and over. We do not knowingly create accounts for children. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
Passwords and one-time codes are stored only as hashes, data travels over HTTPS, sessions can be reviewed and ended from Account › Security, and you are emailed when your password or email changes. No system is perfectly secure; if a breach affects you we will tell you and the relevant authorities as the law requires.
12. Changes to this policy
If we change this policy materially we will update the date above and, for signed-in users, ask you to review it before continuing. See also our Terms of Use.