Privacy Policy
Saurashtra Freight Private Limited
Version 1.0 | Date: 8th November 2026
1. Who We Are and About This Policy
- Saurashtra Freight Private Limited (CIN: U63030MH2017PTC289608) (“SFPL”, “we”, “us” or “our”) operates a Container Freight Station, Empty Container Yard and warehousing facilities at Mundra and Kandla, Gujarat. Our registered office is at 65/C, 6th Floor, Mittal Tower, Nariman Point, Mumbai City, Maharashtra, India, 400021.
- SFPL is responsible for personal data processed through our website, digital services and facilities. This Policy is published in accordance with Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), which apply today. SFPL also acts as the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and will comply with each of their provisions as and when they come into force.
- This Policy explains what personal data we collect, why we use it, who we share it with, how long we keep it, and the rights available to you.
2. Key Terms
- Personal data – any data about an individual who is identifiable by or in relation to such data.
- Processing – any wholly or partly automated operation on digital personal data, such as collection, storage, use, sharing or erasure.
- Data Principal – the individual to whom the personal data relates (“you”).
- Board – the Data Protection Board of India.
3. Personal Data We Collect
- We collect only the personal data reasonably necessary to provide our services or respond to you. Depending on how you interact with us, this may include:
Information You Give Us:
- Contact Us form: name, organisation, e-mail ID, mobile number and the content of your enquiry.
- Customer Portal and Track Container: name, designation, organisation, e-mail ID, mobile number, user ID and password (stored only in encrypted/hashed form).
- Customer and supplier registration: name, designation, e-mail ID and mobile number of the contact person; identity proof such as PAN.
- Careers: name, e-mail ID, mobile number, date of birth and resume.
- Grievance and rights requests: name, e-mail ID, mobile number and details of your request.
Information Collected Automatically:
- When you visit our website, we may collect technical data such as IP address, browser type, device identifiers, date and time of access, pages visited and referring URL. We use it to run, secure and improve our website.
4. Why We Collect and Use Your Data
- We use your personal data only for the specific purposes set out below.
4.1.1 Contact Us
We use this information to:
- respond to your enquiry and route it to the right team; and
- keep a record of our communication for continuity of service.
4.1.2 Customer Portal, Track Container and Services
We use this information to:
- create and manage your account and verify your access;
- provide container tracking and our CFS, yard and warehousing services, including billing and collections; and
- send you service notices, such as container status or invoice updates.
4.1.3 Customer and Supplier Registration
We use this information to:
- onboard and verify customers and suppliers, and set up contact persons; and
- process payments and acknowledgement and manage commercial communication.
4.1.4 Careers
We use this information to:
- assess your suitability for roles and communicate with you during the hiring process.
4.1.5 Grievance Redressal
We use this information to:
- register, investigate and resolve your grievance or rights request and keep you informed.
4.1.6 Legal and Regulatory Compliance
We also use personal data to:
- meet our obligations as a customs custodian and under tax, company and other laws;
- respond to lawful requests from Customs, port and other authorities; and
- prevent fraud, ensure information security and protect our legal rights.
5. Legal Basis for Processing
- We process personal data on the basis of your consent, or for legitimate uses permitted under Section 7 of the DPDP Act. These include data you voluntarily provide for a specified purpose, such as availing our services, and compliance with legal obligations and orders, such as disclosures to Customs and other authorities.
6. Consent and Its Withdrawal
- Where we rely on consent, we ask for it through a clear action, such as ticking an unticked box, after showing you a short notice.
- You may withdraw consent at any time, as easily as you gave it, by writing to the Grievance Officer (Clause 15). Withdrawal does not affect processing done before it, or processing we must continue under law.
7. Who We Share Data With
- Service providers acting on our instructions, such as IT, cloud hosting, security and maintenance providers, under written contracts and safeguards;
- Transporters, shipping lines, customs brokers and consignees, to the extent needed to complete a cargo movement;
- Customs, port authorities, regulators, courts and government authorities, where required by law;
- Auditors, legal advisers, insurers and banks, for audit, legal, insurance and payment purposes; and
- Our group companies, including our holding company Kamigumi Co., Ltd., Japan, only where needed for group-level reporting, audit, compliance and IT support, and for coordinating logistics services you have requested.
- All service providers must process personal data only on our instructions and keep it secure. We remain responsible for processing done on our behalf.
8. Transfers Outside India
- Personal data may be transferred outside India to (a) Kamigumi Co., Ltd. in Japan, for the group purposes listed in Clause 7; and (b) our service providers that host or process data outside India, mainly in the United States (Google LLC for Analytics, Fonts and Maps, and the jsDelivr content delivery network). Such transfers are made only under contracts or terms that require the recipient to protect the data to the same standard as this Policy and the SPDI Rules and, once in force, only as permitted under Section 16 of the DPDP Act and not to any country restricted by the Central Government.
9. How Long We Keep Your Data
- We retain personal data only for as long as necessary for the purposes described in this Policy, considering the nature of the data, the purpose of processing, legal and regulatory requirements (including those under company, tax and customs laws).
- Retention periods. Unless a longer period is required by law:
• Website enquiries and contact-form data – 3 years from our last contact with you;
• CVs and job applications – 1 year from receipt, unless you join us;
• Customer portal and service data – for the contract period and thereafter as required under tax, customs and company laws (generally 8 years);
• Cookie consent records – 180 days;
• Marketing communications – until you withdraw consent.
After these periods, the data is deleted or anonymised. - System and security logs are maintained securely within India for a rolling period of 180 days, as required under the CERT-In Directions dated 28 April 2022 issued under Section 70B(6) of the Information Technology Act, 2000. From the date Rule 8 of the DPDP Rules, 2025 comes into force, such logs will be kept for at least one year.
10. How We Protect Your Data
- We take appropriate technical and organisational measures to protect your personal data in line with the SPDI Rules and, as they come into force, the DPDP Act and Rules, including encryption, access controls, logging and monitoring, backups, and confidentiality obligations on our staff and service providers.
11. Personal Data Breach
- If a personal data breach occurs, we will take immediate steps to contain it and limit its impact. Cyber security incidents will be reported to CERT-In within 6 hours of noticing them, as required under the CERT-In Directions, 2022. From the date the relevant DPDP provisions come into force, we will also inform affected Data Principals and the Data Protection Board of India without delay, and submit a detailed report to the Board within 72 hours, as required under Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, 2025.
12. Cookies
- We use cookies to make our website work, keep it secure and understand how it is used. When you first visit, a cookie banner lets you accept all cookies, accept only necessary cookies or manage your preferences.
- Types of cookies. We use the following categories of cookies:
- (a) Strictly necessary cookies – required to operate the website and our online services, such as session management, load balancing and security. These cannot be switched off.
- (b) Analytics cookies – help us understand how visitors use the website, such as pages visited and time spent, so that we can improve it. These are set only with your consent.
- (c) Functional cookies – remember your choices, such as cookie preferences, where used. These are set only with your consent.
- Third-party services. Our website uses the following third-party services, which may receive your IP address, browser and device information when you visit: Google Analytics, Google Fonts, Google Maps (provided by Google LLC); and jsDelivr (a content delivery network that serves website code). These providers process such data under their own privacy policies, and the data may be processed outside India in accordance with Clause 8.
- Managing cookies. You may change or withdraw your cookie consent at any time through the
Cookie settings
link on our website, in the manner described in Clause 6. You may also block or delete cookies through your browser settings; however, blocking strictly necessary cookies may affect how the website works.
13. Children and Persons with Disability
- Our services are not designed for persons under 18 years of age. We do not knowingly collect their personal data without verifiable consent of a parent or lawful guardian, and we do not track, behaviourally monitor or target advertising at children. The same safeguard applies to persons with disability who have a lawful guardian.
- If you believe a child has shared personal data with us, please contact the Grievance Officer (Clause 15).
14. Your Rights
- Under the DPDP Act, you have the right to:
- Access – a summary of your personal data we hold, how we process it, and with whom it has been shared;
- Correction and erasure – have inaccurate or incomplete data corrected, and data no longer needed erased, unless the law requires us to keep it;
- Withdraw consent – as described in Clause 6;
- Grievance redressal – have your concerns about our handling of your data addressed; and
- Nominate – nominate another person to exercise your rights in the event of your death or incapacity.
- You can exercise these rights by writing to the Grievance Officer. We may ask for information to verify your identity.
- If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India.
- Please give us accurate information and do not file false or frivolous complaints, as required under Section 15 of the DPDP Act.
15. Grievance Officer and Contact
- For any question, request or grievance about this Policy or your personal data, please contact:
16. Changes to This Policy
- We may update this Policy to reflect changes in our processing or in the law. The updated Policy will be published on this page with a revised version number and date at the top of this Policy and will apply from that date. Where a change requires fresh consent, we will ask for it.
17. Governing Law
- This Policy is governed by the laws of India. Subject to the jurisdiction of the Data Protection Board of India and the Appellate Tribunal under the DPDP Act, the courts at Mumbai will have jurisdiction.
