Privacy Policy

Last updated: 15 January 2026 · Effective from: 1 February 2026

1. Introduction and scope

Oreana Stone & Ceramic ("Oreana", "we", "us", "our") is the data controller responsible for the personal information collected through our website oreana.net, our sales and enquiry channels, our supplier and customer relationships, and our marketing communications.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and what rights you have under applicable data protection laws — including India's Digital Personal Data Protection Act 2023 (DPDPA), the European Union's General Data Protection Regulation (GDPR) where it applies, the UK Data Protection Act 2018, and the California Consumer Privacy Act (CCPA).

This policy applies to visitors to our website, customers, prospective customers, suppliers, business partners and job applicants. If you do not agree with any part of this policy, please do not use our website or provide us with your personal information.

2. Information we collect

We collect personal information in the following categories:

2.1 Information you provide directly

• Contact details — name, email address, telephone number, postal address, company name and role — collected when you contact us, request samples, submit an enquiry, sign up for our newsletter, apply for a job or attend one of our events.
• Project details — dimensions, drawings, timelines, delivery locations and technical requirements you share to help us prepare a quotation or specification.
• Commercial and payment information — company registration, tax IDs (GSTIN/VAT), bank details, purchase orders and invoices when you become a customer.
• Correspondence — the content of emails, chat conversations, phone-call summaries and any documents you share with us.

2.2 Information collected automatically

• Usage data — the pages you visit on our website, the time and date of visits, the referring URL, your interactions with our content, and other browser telemetry.
• Device information — IP address, browser type and version, operating system, device identifiers and approximate location derived from IP.
• Cookies and similar technologies — see the Cookies section below.

2.3 Information from third parties

Where you connect to our site via a third-party service (for example a professional network or a social login), we may receive information you have authorised that service to share with us. We also occasionally receive contact information from trade shows, business directories and mutual introductions.

3. How we use your information

We use your personal information for the following purposes:

• To respond to your enquiries, prepare quotations, ship samples and deliver our products and services.
• To manage our customer, supplier and partner relationships, including invoicing, warranty administration and after-sales support.
• To send you occasional marketing communications about products, events, journal articles and offers where you have consented (or where a soft opt-in applies under law).
• To improve our website and services by analysing how visitors interact with our content, running A/B tests and diagnosing performance issues.
• To comply with our legal, regulatory and tax obligations, and to defend against or pursue legal claims.
• To detect, prevent and respond to fraud, unauthorised access, abuse of our services and other security incidents.

4. Legal bases for processing (GDPR / DPDPA)

When applicable data protection law requires us to identify a specific legal basis, we rely on one or more of the following:

• Contract — where processing is necessary to enter into or perform a contract with you (e.g. delivering a purchase order).
• Consent — where you have given us explicit consent (e.g. subscribing to our newsletter). You can withdraw consent at any time.
• Legitimate interests — where processing is necessary for our legitimate business interests and is not outweighed by your rights (e.g. improving our website, direct marketing to existing customers about similar products).
• Legal obligation — where processing is necessary to comply with tax, accounting or other legal requirements.

5. Sharing and disclosure

We do not sell your personal information. We share it only with parties who help us operate our business, and only under strict contractual safeguards. Categories of recipients include:

• Service providers — hosting, IT support, courier and freight forwarders, payment processors, CRM and email delivery vendors, professional advisors (accountants, lawyers, auditors).
• Distributors and installation partners — where you request that we route your enquiry or delivery through a local partner.
• Regulators and authorities — where we are required by law, court order or in response to a valid legal process.
• Acquirers — in the event of a merger, acquisition or reorganisation, subject to the acquirer honouring this Privacy Policy.

6. Cookies and tracking

Our website uses cookies and similar technologies for three purposes:

• Strictly necessary cookies keep the site working (session state, security, remembering your cookie preferences).
• Analytics cookies (only if you consent) help us understand which pages are popular, how visitors move through the site, and where they encounter friction.
• Marketing cookies (only if you consent) allow us to measure the performance of our marketing campaigns and, in rare cases, retarget you with relevant advertising on other websites.

You control cookies through the notice we display on your first visit and through your browser settings. Rejecting analytics or marketing cookies does not degrade the site's functionality.

7. Data retention

We keep personal information only for as long as is necessary for the purposes described in this policy, or as required by law. Typical retention periods are:

• Enquiry data (name, email, message): 24 months from last contact.
• Customer and supplier records: 8 years for tax and accounting compliance (India Companies Act 2013).
• Warranty records: 10 years from the date of installation.
• Website analytics (aggregate): 26 months.
• Job application data: 12 months for unsuccessful candidates, unless you consent to a longer talent-pool period.

8. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your information ("right to be forgotten").
• Restrict or object to certain processing.
• Withdraw your consent at any time.
• Receive your data in a portable format.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, please contact us using the details below. We will respond within 30 days.

9. Security measures

We take the security of your personal information seriously. Our controls include: TLS 1.3 encryption for all data in transit; AES-256 encryption at rest for personal data stored in our databases; multi-factor authentication for internal access to customer data; role-based access controls; annual third-party penetration testing; and formal incident response procedures. Despite these safeguards, no system can be guaranteed 100% secure — we recommend using strong, unique passwords when creating any account with us.

10. International transfers

Oreana operates from India but works with customers and service providers around the world. When we transfer personal information outside your jurisdiction, we use appropriate legal safeguards — including EU Standard Contractual Clauses, adequacy decisions where they exist, and contractual data protection commitments with all our processors.

11. Children's data

Our website and services are not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a new "Last updated" date, and — where required — communicated to you by email. We encourage you to review this page periodically.

13. Contact us

If you have any questions about this policy or wish to exercise any of your rights, please contact:

Data Protection Officer
Oreana Stone & Ceramic
Asia International, N.H.No-48, B/H Acropolis Mall
Shamlaji Road, Himatnagar-383001, Gujarat, India
Email: [email protected] · Phone: +91 2772 247 770