Growlink Trading Corporation ("GTC", "we", "us", "our") supplies laboratory consumables, reagents, and scientific instruments to research institutions, universities, government laboratories, hospitals, diagnostic laboratories, and biotechnology companies across India.
This policy explains what personal data we collect through growlink.co and through the quotation and procurement correspondence that follows, how we use it, and what rights you have over it. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), GTC is the Data Fiduciary in respect of the data described here, and you are the Data Principal.
This policy applies only to growlink.co. It does not apply to third-party websites we link to, including manufacturer and brand websites, whose privacy practices are their own.
We deliberately collect as little as possible. We do not require you to create an account, and we do not process payments through this website.
| Category | What it includes | How it reaches us |
|---|---|---|
| Contact details | Your name, institution or company name, email address, and phone or WhatsApp number if you choose to provide it | Quote request form; direct email; WhatsApp |
| Requirement details | The products, catalogue numbers, quantities, protocols, or experimental context you describe to us | Quote request form; direct email; WhatsApp |
| Procurement details | Purchase order references, institutional registration details, GeM or tender identifiers, delivery addresses, and consignee contacts | Correspondence during an active order |
| Correspondence records | The content and history of emails, WhatsApp messages, and quotations exchanged with you | Ongoing communication |
What we do not collect through this website: payment card or bank details, government identity numbers (Aadhaar, PAN) unless separately and specifically requested for a tender or GeM submission you have initiated, health or patient data, biometric data, or precise location data.
A note on how the quote form works. The quote request form on this site does not transmit data to a GTC server or store it in a database. It opens your own email application with the details you entered pre-filled, so that you send the message yourself from your own email account. That means the information reaches us only when you press send, and it reaches us as an ordinary email.
Under Section 4 of the DPDP Act, personal data may be processed only for a lawful purpose for which you have given consent, or for certain legitimate uses. We process your data for the following purposes only:
We do not use your data for automated decision-making or profiling, and we do not use it for advertising.
By submitting a quote request, emailing us, or messaging us on WhatsApp, you consent to our processing your data for the purposes listed in Section 3. That consent is specific to those purposes. If we ever wish to use your data for a materially different purpose, we will ask you again first.
You may withdraw your consent at any time by writing to info@growlink.co. Withdrawal takes effect for future processing; it does not undo processing already carried out lawfully, and it does not remove records we are required to retain for tax, statutory, or contractual reasons (see Section 6). If you withdraw consent while an order is in progress, we may be unable to complete that order.
We do not sell, rent, or trade your personal data. We do not share it for advertising or marketing purposes.
We share the minimum necessary data with the following categories of recipient, strictly to fulfil the purposes in Section 3:
Cross-border transfers. Some manufacturers and principals whose products we source are located outside India, and correspondence with them may involve transferring your name, institution, and requirement details abroad. The DPDP Act permits such transfers except to territories specifically restricted by the Central Government; we do not transfer personal data to any restricted territory.
| Record type | Retention period | Reason |
|---|---|---|
| Quote enquiries that do not become orders | 24 months from last contact | To answer follow-up enquiries and re-quote on request |
| Order, invoice, and tax records | 8 years from the end of the relevant financial year | Statutory retention under GST and income tax law |
| Tender and GeM submission records | As required by the tender authority, typically 5–7 years | Audit and procurement compliance |
| Warranty, AMC, and service records | Duration of the warranty or contract, plus 3 years | To support service claims |
| General correspondence | 24 months from last contact | Continuity of service |
When a retention period ends, we delete the data or irreversibly anonymise it. Where a record is subject to more than one period, the longer applies.
As a Data Principal you have the following rights, which you may exercise by writing to our Grievance Officer (Section 13):
We will acknowledge a request within 7 working days and respond substantively within 30 days. We may ask you to verify your identity before acting on a request. There is no charge for exercising these rights.
Your duties. The DPDP Act (§15) also requires Data Principals not to raise false or frivolous complaints and not to furnish false particulars or impersonate another person when exercising these rights.
We apply reasonable security safeguards proportionate to the limited data we hold, as required by Section 8(5) of the DPDP Act and Section 43A of the Information Technology Act, 2000. These include:
No system is completely secure. While we take reasonable measures, we cannot guarantee absolute security of data transmitted over the internet, and any transmission is at your own risk.
As published, growlink.co sets no cookies, runs no analytics or tracking scripts, uses no advertising or social media pixels, and does not fingerprint or profile visitors. Nothing on this site tracks you across other websites.
If we later add analytics, we will update this policy, state what is collected and by whom, and present a consent mechanism before any non-essential tracking is set. India does not currently have a standalone cookie law, but consent-first is the standard we intend to hold to.
This website is intended for research, procurement, and purchasing professionals, and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18. Section 9 of the DPDP Act requires verifiable parental consent before processing a child's data; because we do not seek to process children's data at all, we ask that minors do not submit information through this site. If you believe a child has submitted personal data to us, write to info@growlink.co and we will delete it.
Where a submission relates to institutional or government procurement — including GeM listings, tender responses, or purchase orders from a public institution — any registration details, purchase order references, indent numbers, or officer contact details supplied are used solely to prepare and execute that specific quotation, bid, or order.
We do not aggregate institutional procurement data into any commercial dataset, and we do not share one institution's requirements, pricing, or consumption pattern with another customer. Where a tender authority or procurement platform requires disclosure of information as part of a bidding process, that disclosure is governed by the rules of that process.
If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal without delay, in the form and manner required under the DPDP Act and the rules made under it. Our notification will describe the nature and extent of the breach, its likely consequences, the measures we have taken, and the steps you can take to protect yourself.
In accordance with Section 13 of the DPDP Act and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the following officer is designated to receive and resolve complaints about this policy or our handling of your data:
If you are not satisfied with our response, or we fail to respond within the stated period, you may escalate your complaint to the Data Protection Board of India established under the DPDP Act, in the manner prescribed by that Board.
We may update this policy as our practices, the site, or the law change. The version number and effective date at the top of this page will always reflect the current version. Material changes affecting how we use data you have already given us will be notified to you by email where we hold your address. Continuing to use the site or to correspond with us after a change takes effect indicates acceptance of the updated policy.
Questions about this policy, or requests to exercise your rights, can be sent to info@growlink.co.
See also our Terms of Service, which govern quotations, orders, and the use of products supplied by GTC.