Privacy Policy — VAYALIL GLOBAL TRADING INC

1. Data Controller Identity

The data controller responsible for personal data processed through this website is:

Legal name: VAYALIL GLOBAL TRADING INC
Registered in: United States of America
Date of incorporation: September 2026
Director: THOMAS THOMAS VAYALIL
Address: 355 S Teller St, Suite 200, Lakewood, CO 80226, USA
Phone: +1 (313) 542-1301
Contact email: support@vayaliltrading.com
Website: vayaliltrading.com
Operating markets: USA · Spain · Portugal

For all data protection inquiries — including the exercise of rights under GDPR or CCPA — please contact us at support@vayaliltrading.com. We will respond within the legally required timeframes.

VAYALIL GLOBAL TRADING INC does not currently meet the thresholds requiring the mandatory appointment of a Data Protection Officer (DPO) under Article 37 GDPR. However, all data protection matters are handled directly by the management team and can be addressed through the contact above.

2. Scope of This Policy

This Privacy Policy applies when you:

Browse or use any functionality of this website.
Submit a contact or wholesale inquiry form.
Communicate with us via email or other available channels.
Enter into or discuss a B2B wholesale commercial agreement with us.

This website is intended exclusively for B2B wholesale purposes. We do not sell directly to end consumers. All data collected is used solely in the context of business-to-business commercial activities.

3. Categories of Personal Data Processed

Depending on your interaction with this website, we may process the following categories of personal data:

Identification data: full name, company name, job title.
Contact data: business email address, phone number, country.
Navigation and usage data: IP address, browser type, language, pages visited, time on site, referring URL, server logs.
Communication data: content of messages submitted via contact forms or email.
Commercial data: product categories of interest, estimated order volume, target market, and any information provided in the context of a wholesale inquiry.
Approximate geolocation data: derived from IP address, used to determine applicable legal jurisdiction and adapt content accordingly.

We do not collect special categories of personal data (as defined under Article 9 GDPR), such as racial or ethnic origin, political opinions, health data, or biometric data.

4. Purposes and Legal Bases (GDPR — EU/ES/PT)

We process personal data for the following purposes and on the following legal bases under Article 6 GDPR:

4.1 Website operation and security

Purpose: To ensure the correct display, technical administration, and security of this website.
Legal basis: Legitimate interests of the controller (Art. 6.1.f GDPR) in operating a secure and functional website.

4.2 Responding to wholesale inquiries

Purpose: To respond to contact form submissions and B2B wholesale requests.
Legal basis: Consent (Art. 6.1.a GDPR) when you initiate contact, and/or pre-contractual measures at your request (Art. 6.1.b GDPR).

4.3 Contract execution and commercial management

Purpose: To formalize and execute wholesale agreements, process orders, issue invoices, and manage the commercial relationship.
Legal basis: Contract performance (Art. 6.1.b GDPR) and compliance with legal accounting and tax obligations (Art. 6.1.c GDPR).

4.4 Statistical analysis and service improvement

Purpose: To analyze aggregated or pseudonymized usage data for website improvement and business strategy.
Legal basis: Legitimate interests (Art. 6.1.f GDPR), with data minimization and pseudonymization measures applied.

4.5 Fraud prevention and security

Purpose: To detect and prevent unauthorized access, misuse of services, or fraudulent activity.
Legal basis: Legitimate interests (Art. 6.1.f GDPR).

4.6 Legal compliance

Purpose: To comply with applicable fiscal, accounting, anti-money-laundering, and data protection obligations.
Legal basis: Legal obligation (Art. 6.1.c GDPR).

Where consent is the legal basis, you may withdraw it at any time without affecting the lawfulness of prior processing.

5. Data Retention Periods

Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, and in accordance with applicable legal requirements:

Wholesale inquiry data (no contract formed): Up to 24 months from the last interaction, after which data will be deleted or anonymized.
Commercial partner / contract data: For the duration of the commercial relationship, and thereafter for up to 6 years to comply with applicable statutes of limitation under US, Spanish, and Portuguese law.
Accounting and invoicing data: 6 years (Spain: Ley 58/2003 General Tributaria; Portugal: Art. 123 CIRC; USA: IRS requirements).
Navigation/server log data: Up to 12 months, used solely for security and technical purposes.
Technical cookies: Limited to what is strictly necessary for the website to function; they are not used for advertising or cross-site tracking.

In Spain, data subject to legal claims will be "blocked" (conserved in restricted access) during applicable prescription periods in accordance with LOPDGDD requirements, before permanent deletion.

6. Recipients and Data Transfers

Personal data may be shared with the following categories of recipients, only to the extent necessary and under appropriate legal safeguards:

Technology service providers: web hosting and email service providers acting as data processors under Art. 28 GDPR agreements, where applicable.
Professional advisors: legal counsel, accountants, and auditors where required.
Public authorities: when required by applicable law or regulatory order.

We do not sell personal data to third parties. We do not share personal data for behavioral advertising or marketing purposes with external parties.

7. International Data Transfers

Personal data collected from EU/EEA residents is primarily processed within the EEA. Where transfers to third countries are necessary (e.g., use of US-based technology providers), we ensure an adequate level of protection through one of the following mechanisms:

An adequacy decision by the European Commission; or
Standard Contractual Clauses (SCCs) approved by the European Commission; or
Other appropriate safeguards recognized under Chapter V GDPR.

Where a US-based hosting or email provider is used, transfers are carried out with appropriate safeguards under Chapter V GDPR.

8. Your Rights Under GDPR (EU/ES/PT)

If you are located in the EU, Spain, or Portugal, you have the following rights under Articles 15–22 GDPR:

Right of access: To obtain confirmation of whether we process your personal data and to receive a copy.
Right to rectification: To request correction of inaccurate or incomplete data.
Right to erasure ("right to be forgotten"): To request deletion of your data when it is no longer necessary, or where other grounds under Art. 17 GDPR apply.
Right to restriction of processing: To request that processing be limited in certain circumstances.
Right to data portability: To receive your data in a structured, machine-readable format and transmit it to another controller, where technically feasible.
Right to object: To object to processing based on legitimate interests, including direct marketing.
Right not to be subject to automated decision-making: Including profiling with significant legal or similar effects, except where permitted under Art. 22 GDPR.

To exercise any of these rights, contact us at support@vayaliltrading.com with proof of identity. We will respond within 30 days (extendable by two months for complex cases, with prior notice).

You also have the right to lodge a complaint with the competent supervisory authority:

Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es
Portugal: Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt

9. Your Rights Under CCPA/CPRA (California Residents)

If you are a California resident and the CCPA/CPRA applies to our processing of your data, you have the following rights:

Right to know: To request disclosure of the categories and specific pieces of personal information collected about you, the sources, business purposes, and third parties with whom it is shared.
Right to access and portability: To receive a copy of the personal information collected about you in the preceding 12 months, free of charge, in a portable format.
Right to deletion: To request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, security, pending transactions).
Right to correct: To request correction of inaccurate personal information.
Right to opt out of sale or sharing: VAYALIL GLOBAL TRADING INC does not sell or share personal information for cross-context behavioral advertising purposes. No opt-out mechanism is required for this purpose.
Right to limit use of sensitive personal information: We do not process sensitive personal information beyond what is permitted under Cal. Civ. Code § 1798.121.
Right to non-discrimination: You will not receive discriminatory treatment for exercising any of your CCPA rights.

To submit a verifiable consumer request, contact us at support@vayaliltrading.com. We will respond within 45 days (extendable by an additional 45 days with prior notice). Requests are free of charge (up to twice per 12-month period).

10. Minors

This website and its services are directed exclusively at businesses and professionals. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that personal data of a minor has been collected without appropriate consent, we will delete it immediately.

Under LOPDGDD (Spain), valid consent for minors requires parental consent for those under 14 years of age. Under Portuguese Law 58/2019, the minimum age for valid consent in information society services is 13 years. Given that this website is B2B only, these provisions are not expected to apply.

11. Cookies and Similar Technologies

This website may use cookies and similar technologies for the following purposes:

Strictly necessary cookies: Required for the technical operation of the website. No consent required. This site does not use advertising cookies, analytics cookies, or bot-challenge widgets.

Because only strictly necessary cookies are used, a cookie consent banner is not displayed.

12. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, disclosure, alteration, or destruction, in accordance with Article 32 GDPR. These measures include:

HTTPS/TLS encryption for all data in transit.
Hosting-level access controls and monitoring against unauthorized access.
Access control and authentication for internal systems.
Regular security reviews and incident response procedures.

In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours, and affected individuals where required under Art. 34 GDPR.

13. Policy Updates

This Privacy Policy may be updated to reflect changes in our data processing activities, applicable legislation, or service configuration. When changes are material or require renewed consent, we will notify you prominently (e.g., via website notice or email).

The date of the most recent update is displayed at the top of this page. Continued use of this website after the effective date of any update constitutes acceptance of the revised policy, to the extent permitted by law.

14. Contact

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact us:

Email: support@vayaliltrading.com
Entity: VAYALIL GLOBAL TRADING INC
Director: THOMAS THOMAS VAYALIL
Address: 355 S Teller St, Suite 200, Lakewood, CO 80226, USA
Phone: +1 (313) 542-1301
Website: vayaliltrading.com