Privacy Policy

cncspares.in is a business-to-business marketplace for CNC spare parts, run entirely by request-for-quote: there is no shopping cart, no checkout and no customer account, so we never see payment-card numbers. The only personal data we handle is what you choose to send when you ask for a quote. This notice explains what we collect, why the law allows us to keep it, who ever sees it, how long we retain it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

In DPDP terms, cncspares.in is the data fiduciary — we decide why and how your personal data is processed.

• From the RFQ form: your name, company, email address and phone number; machine model (optional); the urgency you select; and the part numbers and quantities you request.
• In your browser: a local-storage list under the key “cncspares:rfq-cart” — the parts and quantities you add while browsing, so a draft request survives navigation. It stays on your device and is sent only when you submit the form.
• Cookies: exactly one exists on this site — “admin_session”, an httpOnly, signed session cookie that is set only when a member of staff signs in to the admin area and expires after 7 days. Ordinary visitors are issued no cookies.
• On the server, briefly: when you submit an RFQ, your IP address is read from the request and held in server memory for about a minute to rate-limit repeated submissions — it is never written to the database.
• Never collected: no analytics, no advertising pixels, no session recording, no fingerprinting, no profiling — and no payment details, because there is nothing here to pay through.

One purpose: fulfil your quote. We use your details to check part numbers against your machine, source the part across our supplier network, and return a line-item quote — normally within 24–48 hours — then to answer follow-ups, communicate about any order placed on that quote, and honour its warranty terms.

Under the DPDP Act, personal data may be processed on the basis of consent and certain legitimate uses. You give consent when you deliberately submit the RFQ form, and everything we do falls within what a reasonable person would expect from a B2B quote request — quoting, supply and ordinary business records. We do not profile you, run automated decision-making on your data, or use your contact details for marketing.

• Our supplier network — only the sourcing requirements of your request (part numbers, quantities, machine context), only to source and price your quote, and never for a supplier's own marketing.
• Our operator inbox — when email notifications are enabled, a copy of your RFQ is forwarded to the person who answers requests through an email delivery service (FormSubmit or an equivalent transactional provider). The copy contains what you submitted so the quote can be actioned quickly.
• Service providers acting for us — the infrastructure that hosts this site and its database processes personal data only on our instructions.
• The law — where a lawful order or legal obligation requires disclosure.

We do not sell personal data. We do not share it for advertising, and nothing on this site is built to follow you across other websites.

• RFQ leads and their quote history: 24 months from your last interaction on that quote request — long enough to follow up, honour quotes and warranties, and keep ordinary business records.
• Your draft parts list: held only in your browser until you submit or clear the RFQ form (or clear your site data); it never reaches our servers before you press Submit.
• Admin sign-in session: 7 days from sign-in, then the cookie expires and staff must sign in again.
• When a period ends, the record is deleted or irreversibly anonymised — not warehoused for some unspecified future use.

• In transit — every page and form submission travels over HTTPS.
• Input — every RFQ is re-validated on the server against the same schema that drives the form, with request-size caps and per-minute rate limits, so malformed or abusive submissions are rejected before storage.
• At rest — your details live in a server-side database with no public read path. Staff view them only through a password-gated admin area that middleware checks on every request, using an httpOnly, signed session cookie that page scripts cannot read.
• Honest limit — no transmission or storage method is perfectly secure. We shrink the surface by never collecting payment details or browsing histories in the first place.

• Access — ask what personal data we hold about you and how it has been processed, and request a copy.
• Correction & erasure — have incomplete or inaccurate data fixed, and data we no longer need for the purpose you gave it erased.
• Withdrawal — withdraw any consent you have given; where that makes a quote impossible to continue, we will say so plainly.
• Nomination — appoint another individual to exercise these rights for you, as the Act allows.
• Grievance redressal — complain about any handling of your data through the channel in the card at the bottom of this page.

We may ask you to verify your identity first — the Act permits reasonable verification — and we respond within the timeframes it sets. Exercising a right will not stop us quoting or doing business with you.

This is a B2B service for businesses and their adult staff. It is not directed at children, and we do not knowingly process a child's personal data. If you believe a child has sent us an RFQ, use the grievance channel below and we will erase it.

We update this page when our practices change; the effective date at the top always describes the version you are reading, and material changes are called out here before they take effect where the DPDP Act requires it.