Privacy Policy

Information We Collect

To provide you with our comprehensive global B2B trade platform, Costita collects various types of information from our users. This may include personal and account information such as your name, business name, email address, phone number, and billing or shipping addresses. When engaging in trade activities, we collect transaction information, including details about the products you purchase, sample requests, logistics preferences, and payment processing details.

We also collect communication information whenever you correspond with our customer support team, submit inquiries for custom quotations, or interact with our representatives. Furthermore, technical information is collected automatically when you navigate our platform; this includes IP addresses, browser types, device identifiers, operating systems, and usage patterns that help us understand how our services are accessed and utilized.

How We Use Your Information

The information we collect is fundamental to delivering, maintaining, and continuously improving our services. Primarily, we utilize this data to manage your user accounts, process custom quotations, and seamlessly execute orders. This involves coordinating complex logistics, managing shipping preferences, and verifying user identities to maintain a secure trading environment.

Additionally, your information empowers our customer support team to respond effectively to your inquiries and resolve potential issues. We analyze usage patterns and website performance metrics to enhance the user experience, optimize our platform's functionality, and develop new features. Moreover, this data is essential for preventing fraudulent activities, enforcing our terms of service, complying with legal and regulatory obligations, and sending you important administrative or promotional communications regarding our services.

Cookies and Tracking Technologies

Costita employs cookies, web beacons, and similar tracking technologies to elevate your experience on our platform. These technologies allow us to remember your preferences (such as country and currency selection), keep you logged into your account securely via authenticated session tokens, and understand how you interact with our website.

We distinguish between strictly necessary cookies (essential for core platform functionality, security, and checkout) and optional performance analytics cookies (such as Google Analytics).

Information Sharing and Third Parties

Costita does not sell or rent your personal information to third parties. We share data only with authorized Data Processors and service providers strictly required to deliver our cross-border commerce services:

• Cloud & Storage Infrastructure: Secure cloud hosting and object storage providers (such as Amazon Web Services and DigitalOcean Spaces) located in compliant regional data centers.
• Analytics & Optimization: Diagnostic and aggregated performance tools (such as Google Analytics) operating with anonymized identifiers.
• Transactional Communications: Email and messaging service providers (such as EmailJS, SMTP relays, and transactional SMS gateways) for order confirmations, quotations, and account verifications.
• Payment Gateways & Banking Partners: PCI-DSS compliant payment gateways, SWIFT banking channels, and escrow/letter-of-credit processing institutions.
• Logistics, Freight & Customs Partners: International freight forwarders, shipping lines, couriers, and customs clearance brokers necessary to execute physical cross-border deliveries.

We may also disclose information when required by applicable law, court summons, or regulatory authorities, or to protect the vital security, property, or legal rights of Costita, our users, and the public.

International Data Transfers

As an international B2B commerce platform, Costita coordinates sourcing, manufacturing, and shipping across global borders. Consequently, your data may be transferred to, stored, and processed in jurisdictions other than your home country. We implement adequate contractual safeguards, data protection agreements, and encryption protocols with all international vendors to ensure your personal data is handled in accordance with this Privacy Policy and applicable data protection regulations.

Data Retention & Erasure Practices

We retain personal data only for as long as necessary to fulfill the specific purposes for which it was collected, or to satisfy legal, accounting, tax, or regulatory requirements. Our standard retention schedules include:

• Commercial Orders, Invoices & Customs Records: Retained for a minimum of 8 (eight) years in compliance with statutory obligations under the Indian Companies Act, 2013, GST regulations, and the Income Tax Act.
• Active User Accounts: Profile and account information is retained for the duration of your active business relationship with Costita.
• Inactive Accounts: Accounts with no login or transactional activity for 36 consecutive months are flagged for secure anonymization or erasure, following prior email notice.
• Inquiries & Customer Support Logs: Quotation requests, support correspondence, and communication logs are retained for up to 2 (two) years from resolution.

Once the retention period expires or upon valid request for erasure, data is permanently shredded from active databases and securely purged or cryptographically anonymized.

Security Measures & Technical Safeguards

Costita maintains technical and organizational measures designed to protect personal data against accidental loss, unauthorized access, alteration, or unlawful disclosure. These measures include:

• Encryption in Transit: Strong TLS/HTTPS encryption with HTTP Strict Transport Security (HSTS) and modern cipher suites across all endpoints.
• Authentication & Access Controls: JSON Web Tokens (JWT) stored in HTTP-Only, Secure, SameSite cookies, bcrypt password hashing with high salt rounds, and strict Role-Based Access Control (RBAC).
• Application Layer Defense: Automated input sanitization against Cross-Site Scripting (XSS), SQL injection prevention through parameterized ORM queries, and multi-tier rate limiting.
• Network & Perimeter Protection: Reverse-proxy shielding, blocking of malicious scanners, and isolated server environments.

Your Rights and Choices

Depending on your jurisdiction, you are entitled to exercise fundamental rights regarding your personal data:

• Right to Access: You may request confirmation of whether we process your personal data and a summary of the data held.
• Right to Correction & Updating: You have the right to correct inaccurate, outdated, or incomplete personal details.
• Right to Erasure: You may request the deletion of your personal data where it is no longer necessary for legal or contractual purposes.
• Right to Withdraw Consent: Where processing is grounded in consent, you may withdraw it at any time with ease.

DPDPA Compliance & Data Principal Rights

In accordance with the Digital Personal Data Protection Act, 2023 (DPDPA) of India, Costita operates as a Data Fiduciary. Users residing in India or whose digital personal data is processed within India enjoy specific statutory rights as Data Principals:

Grievance Redressal Mechanism & Officer

In compliance with DPDPA Section 8 & 12 and the Information Technology Act, Costita has appointed a designated Grievance Redressal Officer / Data Protection Officer (DPO) to address all privacy concerns, requests, and disputes:

Third-Party Links

Our platform may occasionally contain links to external, third-party websites or services that are not operated by Costita. We do not exercise control over these external sites and hold no responsibility for their content or privacy practices. We strongly encourage you to independently review the privacy policies of any third-party websites you visit, as your interactions with them are governed solely by their respective terms and policies.

Children's Privacy & Minor Protection

Costita's platform and services are exclusively intended for commercial entities and individuals aged 18 and older. We do not knowingly solicit or collect personal data from minors under 18 years of age.

In strict compliance with Section 9 of the DPDPA 2023, Costita does not conduct behavioral monitoring, profiling, or targeted advertising directed at children, nor do we undertake any processing that is likely to cause detrimental effects on the well-being of a child. If we discover inadvertent receipt of minor data without verifiable parental consent, we immediately delete such records.

Updates to this Policy

We reserve the right to periodically update or modify this Privacy Policy to reflect changes in our operational practices, regulatory requirements, or legal obligations under the DPDPA or international standards. When we make material changes, we will post the updated policy on this page and revise the “Last Updated” date. Continued use of the platform constitutes acceptance of the modified policy.