Privacy Policy

Who we are

This policy covers 1121basmati.com, a website operated by HAS Rice Pakistan (Haroon Abdul Sattar Trading), Suite 904, Indigo Business Centre, Alamgir Road, BYJCHS, Karachi, Pakistan. For privacy questions, contact exports@hasrice.com.

What we collect

We collect personal data in two situations: when you submit a quote request, and when you browse the site.

Quote request form data

• Full name, company, email, phone number (with country code), destination country
• Processing type, incoterm, destination port, quantity, packaging, payment terms, delivery timeline (optional)
• Additional details you type in the notes field
• Source page (the URL you submitted from)
• Google click ID (gclid) if you arrived from a Google Ads campaign
• IP address and coarse geolocation (country, city) extracted from Cloudflare request headers at the time of submission
• User agent string and referrer URL

Analytics and operational data

• Standard Google Analytics 4 measurement cookies (see cookie policy)
• Server access logs retained by Cloudflare Pages (IP, timestamp, path, user agent) for up to 30 days

Why we collect it

We use the data you submit for the purpose you submitted it: responding to your quote request and, if a commercial relationship begins, executing and documenting the shipment. Specifically:

• Responding to your RFQ. We read your submission, prepare a written quote, and reply by email and optionally WhatsApp within 24 business hours.
• Commercial execution. If you accept a quote, the data flows into proforma invoices, L/C references, shipping documents, certificate of origin, and halal certificates.
• Lead quality scoring. We assign an internal priority score (HOT / WARM / standard) based on quantity, destination, and source, which drives how fast a sales rep picks it up.
• Marketing attribution. The gclid and source page tell us which marketing channel produced the lead, so we can allocate ad spend.
• Analytics. Aggregated Google Analytics data tells us which pages convert, which countries buyers visit from, and which processing types draw interest.

Lawful basis (GDPR Article 6)

• Article 6(1)(b) contract. Processing your quote request and subsequent order is necessary to take steps at your request prior to entering a contract.
• Article 6(1)(f) legitimate interests. Spam prevention (honeypot field, submission timestamp check), lead scoring, marketing attribution, and traffic analytics.
• Article 6(1)(a) consent. Where applicable, for non-essential analytics cookies. You can dismiss the cookie notice to opt out of analytics; essential cookies required for the form to work remain active.

Who we share it with

We share data only as needed to fulfill your order:

• Shipping partners and freight forwarders. Your company name, destination port, and order volume appear on commercial invoices and shipping documents visible to carriers and port agents.
• Pre-shipment inspection bodies. SGS, Bureau Veritas, or Intertek when an inspection is booked.
• Banks handling L/C documents. Your company name and address appear on the L/C and bill-of-lading document set.
• Google LLC. Via Google Analytics 4. Data is processed in the United States under Google's standard contractual clauses. No personally-identifying data (name, email) is passed to GA4; only event parameters (processing_type, incoterm, country, source_page).
• Cloudflare Inc. Our hosting and form-submission endpoint. IP addresses transit Cloudflare infrastructure.

We do not sell data to anyone. We do not share your data with third-party marketing networks beyond the Google Analytics relationship above.

Where data is stored

• Quote requests: Google Workspace (Sheets) account based in Pakistan. Cross-border transfer to Google servers (US and EU) under Google's standard contractual clauses.
• Email correspondence: Google Workspace (Gmail) on our exports@hasrice.com address.
• Analytics: Google Analytics 4, US-based.
• Server logs: Cloudflare edge network.

How long we keep it

• Quote requests and correspondence: 24 months from last contact, then archived or deleted on request.
• Executed order records: 7 years (Pakistani tax and customs record-keeping requirements).
• Google Analytics data: default 14 months.
• Cloudflare server logs: up to 30 days.

Your rights

If you are in the EU, UK, or a jurisdiction with comparable privacy law, you have the right to:

• Access the data we hold on you
• Correct inaccurate data
• Delete your data (subject to our 7-year retention obligation for executed orders)
• Object to processing based on legitimate interests
• Data portability (receive your data in a machine-readable format)
• Withdraw consent for analytics cookies at any time
• Lodge a complaint with a supervisory authority (for EU residents, your national DPA)

To exercise any of these rights, email exports@hasrice.com with the subject "Privacy request". We respond within 30 days.

Security

Form submissions travel over TLS (HTTPS). The lead-capture endpoint runs on Cloudflare Workers with standard DDoS protection. Sheets and email are protected by Google Workspace's 2FA and enterprise access controls. We do not store credit card or banking data on our systems; payment documentation moves through authenticated banking channels directly between your bank and ours.

Children

1121basmati.com is a B2B trade site aimed at rice importers and distributors. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted data, email us and we will delete it.

Changes to this policy

If we change how we handle data, we will update this page and the "Last updated" date above. Material changes will be announced by email to anyone who submitted an RFQ in the preceding 12 months.

Contact