1. Data Controller
The data controller responsible for your personal data is:
SpineFit Medical Pvt Ltd
India
Email: [email protected]
Phone: +91 73873 87662
2. Personal Data We Collect
We collect the following categories of personal data when you interact with our website, fill in a form, or contact us:
- Identity data: full name
- Contact data: email address, phone number
- Location data: country, state, city, postal/PIN code
- Usage data: pages visited, time on site (via analytics, where enabled)
- Marketing preferences: whether you opted in to receive offers
We do not collect sensitive special-category data (health records, biometrics, financial data beyond what is required to complete a purchase).
3. How We Use Your Data (Lawful Basis)
We process your personal data on the following legal bases under GDPR Article 6:
- Consent (Art. 6(1)(a)) — When you tick the GDPR consent box on our forms, we use your data to send product information, personalised offers, and demo invitations. You may withdraw consent at any time (see Section 7).
- Legitimate interests (Art. 6(1)(f)) — To respond to enquiries, prevent fraud, and improve our website experience.
- Contract performance (Art. 6(1)(b)) — When you place an order or reservation, we process your data to fulfil that agreement.
- Legal obligation (Art. 6(1)(c)) — Where required by applicable law (e.g., keeping records for tax purposes).
4. How We Share Your Data
We do not sell your personal data. We may share it only with:
- Service providers: hosting and content delivery (our cloud server provider and Cloudflare), database (Supabase), email/CRM tools — all under data processing agreements.
- Logistics partners: only your name and delivery address when fulfilling an order.
- Analytics providers: aggregated, anonymised usage data (Google Analytics 4, if configured).
- Legal authorities: if required by law or court order.
5. International Transfers
SpineFit Medical is based in India. When we transfer personal data from the European Economic Area (EEA) to India or other third countries, we rely on standard contractual clauses (SCCs) approved by the European Commission, or other appropriate safeguards under GDPR Chapter V.
6. Retention Period
We retain your personal data for as long as necessary to fulfil the purpose for which it was collected:
- Enquiry / lead data: up to 24 months from last contact, unless you request earlier deletion.
- Order data: up to 7 years for accounting and tax obligations.
- Marketing consent records: until you withdraw consent plus 1 year for audit purposes.
7. Your Rights Under GDPR
As an EEA resident, you have the following rights:
- Right of access (Art. 15) — Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16) — Ask us to correct inaccurate data.
- Right to erasure / "right to be forgotten" (Art. 17) — Ask us to delete your data where there is no compelling reason for continued processing.
- Right to restriction of processing (Art. 18) — Ask us to pause processing your data in certain circumstances.
- Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — Object to processing based on legitimate interests or for direct marketing.
- Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
8. Cookies
We use essential cookies required for the website to function, and optional analytics/marketing cookies where you have consented via our cookie banner. You can update your preferences at any time using the cookie settings link in the footer.
9. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
10. Right to Lodge a Complaint
If you believe we have processed your personal data in breach of GDPR, you have the right to lodge a complaint with the supervisory authority in your country of residence. In the EU, you can find your local authority at edpb.europa.eu.
11. Changes to This Notice
We may update this notice from time to time. Significant changes will be communicated via email (if we hold your contact details) or a prominent notice on the website. The "last updated" date at the top indicates when this version was published.
12. Contact
For any data protection queries, contact our team at:
[email protected]
+91 73873 87662