This privacy policy explains how CompoundList collects, uses, shares and protects personal data when you use compoundlist.com and our related services. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it, as well as other privacy laws that apply to our users.
1. Who is responsible for your data
CompoundList is the controller of your personal data under the GDPR and the data fiduciary under the DPDP Act. You can contact us about privacy at privacy@compoundlist.com. Our grievance officer is named on the grievance page.
2. The personal data we collect
Account data. Your name, email address, password (stored only as a secure hash), country, company name, job role and account type. We verify email addresses with a one time code. We do not collect mobile numbers for verification.
Profile and company data. For suppliers: company details, addresses, registration and tax identifiers, certificates, product listings, team members and documents you upload. For buyers: company details and preferences you choose to add.
Activity on the service. Requests for quote, quotes, messages, saved items, alerts, sample requests, reviews and reports you submit.
Billing data. Billing name and address, GSTIN or VAT number, invoices and payment status. Card and bank details are entered on the payment provider's page and are processed by the provider. We do not store full card numbers.
Technical and usage data. IP address, approximate country derived from it, device and browser type, pages viewed, search terms, referring pages and cookie identifiers. See our cookie policy.
Communications. Emails and contact form messages you send us, and records of emails we send you.
Business information in supplier profiles. Supplier profiles contain business information about companies. This can include names and business contact details of company representatives where they are publicly available for business purposes. See section 9.
3. Why we use your data and our legal bases
| Purpose | GDPR legal basis | DPDP Act basis |
|---|---|---|
| Creating and running your account, verifying your email | Contract | Consent, and use for the purpose you provided the data |
| Sharing requests for quote with suppliers and quotes with buyers, messaging | Contract | Consent |
| Supplier verification, fraud prevention and moderation of listings and messages | Legitimate interests, legal obligation | Legitimate uses permitted by law, consent |
| Billing, invoices and tax records | Contract, legal obligation | Compliance with law |
| Service emails, such as security alerts and RFQ notifications | Contract, legitimate interests | Consent |
| Newsletters and marketing emails | Consent, or legitimate interests for existing customers where allowed | Consent |
| Analytics to improve the service (Google Analytics 4, Microsoft Clarity) | Consent | Consent |
| Publishing supplier profiles that contain business information | Legitimate interests | Data made publicly available by the person concerned or under a legal obligation, which the Act does not cover |
| Responding to legal requests and enforcing our terms | Legal obligation, legitimate interests | Compliance with law |
Where we rely on consent you can withdraw it at any time, without affecting processing that took place before.
Our moderation systems score requests for quote and messages automatically to detect spam, scams and restricted substances. Flagged items are reviewed by a person before any action that significantly affects you, such as suspending an account.
4. Who we share data with
Other users. Supplier profiles and listings are public. When you post a request for quote, its content is shared with selected suppliers while your contact details stay masked until you accept a quote or share them. Messages are visible to the people in the conversation.
Service providers who process data for us under contract, including hosting and storage, email delivery, payment processing (such as Razorpay and Stripe), analytics (Google Analytics 4 and Microsoft Clarity, only with your consent) and customer support tools.
Authorities where the law requires it, or where we believe disclosure is necessary to prevent fraud, protect users or report suspected illegal trade in controlled substances.
Successors if our business is reorganised, merged or sold, subject to this policy.
We do not sell personal data.
5. International transfers
We serve users worldwide and our providers may process data in India, the European Union, the United States and other countries. When we transfer personal data from the EU or UK to a country without an adequacy decision, we use safeguards such as the European Commission's standard contractual clauses. Transfers from India follow the DPDP Act and any restrictions notified under it.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and profile data | While your account is active, then deleted or anonymised within 90 days of closure, except as below |
| Requests for quote, quotes and messages | While the account is active, and up to 3 years after the last activity for dispute and fraud handling |
| Invoices and payment records | As long as tax and accounting law requires, usually 8 years in India |
| Security and access logs | Up to 12 months |
| Moderation and abuse records | Up to 5 years after the case is closed |
| Marketing consent and unsubscribe records | As long as needed to respect your choice |
7. Security
We protect data with encryption in transit, hashed passwords, access controls based on staff roles, audit logs of administrative actions and regular backups. No system is perfectly secure. If a personal data breach affects you, we will notify you and the authorities as required by law.
8. Your rights
Under the GDPR you have the right to access your data, correct it, erase it, restrict or object to processing, receive it in a portable format, and withdraw consent. You can complain to the data protection authority in your country.
Under the DPDP Act you have the right to obtain information about the personal data we process and with whom it is shared, to correct, complete, update and erase it, to have your grievances redressed, and to nominate another person to exercise your rights in the event of death or incapacity. If our response does not resolve your grievance, you may approach the Data Protection Board of India.
To exercise any right, write to privacy@compoundlist.com from the email address linked to your account, or use the data export and account deletion options in your settings. We reply within one month, and sooner where the law requires. We may need to confirm your identity first.
9. Unclaimed supplier profiles
Some company profiles are listed before the company manages them, so that buyers can find suppliers. These profiles are labelled "Unclaimed profile", show products as price on request and are never presented as verified or paying members. They contain business information, not private personal information.
If you represent a listed company, you can claim the profile with your official business email address on the company's own website domain. Our team verifies the claim, activates the profile and tells you the result by email. If you are a person named in a profile and want your details removed or corrected, or a company that wants its profile removed, write to suppliers@compoundlist.com or privacy@compoundlist.com and we will act on valid requests promptly.
10. Children
The service is for business users and is not directed at anyone under 18. We do not knowingly collect personal data of children. If you believe a child has given us personal data, contact privacy@compoundlist.com and we will delete it.
11. Marketing emails
We send newsletters and marketing emails only where you have agreed or where the law allows it for existing customers. Every marketing email has an unsubscribe link. Service emails, such as verification codes and quote notifications, are part of the service and are sent from noreply@compoundlist.com.
12. Changes to this policy
We may update this policy. The current version is always on this page with its effective date. For material changes, we will tell registered users by email.
13. Contact
- Privacy questions and requests: privacy@compoundlist.com
- Grievance officer: Grievance Officer, CompoundList, compliance@compoundlist.com
- General support: support@compoundlist.com