Privacy Policy

This Website is owned and operated by House of Sharma Pvt. Ltd., a company incorporated under the Companies Act, 2013 and having its registered office at C-246, 247 & 248, Sector-2, UPSIDC Industrial Area, Talanagri, Ramghat Road, Aligarh, Uttar Pradesh – 202001, India (the “Company”, “we”, “us” or “our”). “The Sustainable Manufacturing Company” is a brand and trading name of the Company; it is not a separate legal entity.

The Company also maintains an office in the United Kingdom at Bloxham Mill, Barford Road, Oxfordshire, OX15 4FF, and serves customers located in the United Kingdom and the European Union.

The Website is an informational and promotional platform. It is used to describe the Company’s manufacturing capabilities, sectors served and sustainability initiatives, and to allow interested persons to contact the Company. The Website does not offer goods or services for sale online, does not host user accounts, and does not process payments.

This Policy is intended to comply, to the extent applicable to an informational website of this nature, with: (a) the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”) and the Information Technology Act, 2000 of India; (b) Regulation (EU) 2016/679 (the “EU GDPR”); and (c) the UK GDPR as supplemented by the Data Protection Act 2018 (the “UK GDPR”), in each case only where and to the extent such laws apply.

For the purposes of the DPDP Law the Company acts as a Data Fiduciary, and for the purposes of the EU GDPR and the UK GDPR the Company acts as a controller, in respect of the limited personal data described in this Policy.

In this Policy, unless the context requires otherwise:

1. “Personal Data” means any data about an individual who is identifiable by or in relation to such data and includes “personal data” as defined under the EU GDPR and the UK GDPR.

2. “Processing” means any operation performed on Personal Data, whether automated or not, including collection, recording, storage, use, disclosure or erasure.

3. “Data Principal” means the individual to whom the Personal Data relates, and includes a “data subject” under the EU GDPR and the UK GDPR.

4. “Applicable Data Protection Law” means the DPDP Law, the EU GDPR and the UK GDPR, in each case to the extent applicable to the relevant Processing.

The Website is informational in nature. The Company does not actively or systematically collect Personal Data through the Website, does not sell Personal Data, and does not use the Website for behavioural advertising, profiling or automated decision-making that produces legal or similarly significant effects.

The only Personal Data handled in connection with the Website is data that you voluntarily choose to provide, together with limited technical data generated automatically by the Website’s hosting platform, each as described below.

The Website is hosted on the Framer platform, operated by Framer B.V. and its affiliates (“Framer”). Framer and similar infrastructure providers may automatically log limited technical data (such as IP address, browser type, device information and pages visited) for the purposes of security, load balancing and basic analytics. The Website’s use of cookies and similar technologies is described in the Company’s Cookie Policy. Further information about Framer’s practices is available in Framer’s privacy statement at www.framer.com/legal/privacy-statement.

Where required by Applicable Data Protection Law, non-essential cookies will be set only with your consent, which you may manage or withdraw through your browser settings or any cookie controls made available on the Website. The Company does not control, and is not responsible for, the independent data practices of its hosting or infrastructure providers.

The Company Processes the limited Personal Data described above only for the following purposes:

1. to respond to and manage your enquiries and communications;

2. to send you updates or information that you have specifically requested, until you opt out;

3. to operate, maintain and secure the Website and protect against fraud, misuse and security incidents; and

4. to comply with applicable legal, regulatory and accounting obligations and to establish, exercise or defend legal claims.

The Company will not use your Personal Data for any new purpose that is incompatible with the purposes set out above without, where required, providing notice or obtaining your consent.

Where the DPDP Law applies, the Company Processes Personal Data on the basis of your consent (signified by your voluntary submission of information) or on the basis of certain legitimate uses permitted under that law.

Where the EU GDPR or the UK GDPR applies, the Company relies on one or more of the following lawful bases: (a) your consent under Article 6(1)(a); (b) the taking of steps at your request prior to entering into a contract under Article 6(1)(b); (c) the Company’s legitimate interests in responding to enquiries and operating a secure informational website under Article 6(1)(f); and (d) compliance with a legal obligation under Article 6(1)(c).

Where Processing is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of Processing carried out before withdrawal. Withdrawal may be as easy as the giving of consent.

The Company does not sell or rent Personal Data. The Company may share the limited Personal Data described in this Policy only:

1. with service providers and processors who support the operation of the Website (such as the hosting platform), bound by appropriate confidentiality and data-protection obligations;

2. with members of the Company’s group and its UK office, on a need-to-know basis, to respond to your enquiry;

3. where required to do so by law, regulation, court order or a lawful request by a competent authority; and

4. in connection with any reorganisation, merger or transfer of the Company’s business, subject to appropriate safeguards.

The Company is based in India and operates an office in the United Kingdom, and its hosting and infrastructure providers may store or process data in various countries. As a result, Personal Data may be transferred to, and processed in, countries other than your own.

Where Personal Data of individuals in the European Union or the United Kingdom is transferred to a country that has not been recognised as providing an adequate level of protection, the Company will rely on an appropriate safeguard recognised under the EU GDPR or the UK GDPR, such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Agreement (or UK Addendum), as applicable. Transfers under the DPDP Law are made in accordance with the requirements of that law.

The Company retains Personal Data only for as long as is necessary to fulfil the purposes for which it was provided, to respond to your enquiry, and to comply with legal, regulatory or accounting requirements, after which it is deleted or anonymised. As the Website does not actively collect data, retention is kept to a minimum.

The Company implements reasonable technical and organisational measures appropriate to the limited nature of the Personal Data handled, in order to protect it against unauthorised access, loss, misuse or alteration.

However, no method of transmission over the internet or electronic storage is completely secure. To the fullest extent permitted by law, the Company does not warrant or guarantee absolute security, and you provide Personal Data through the Website at your own risk. This clause does not limit any rights or remedies that cannot be excluded under Applicable Data Protection Law.

Subject to, and to the extent provided by, Applicable Data Protection Law, you may have the following rights in respect of your Personal Data:

1. to obtain confirmation of, and access to, the Personal Data the Company holds about you, and a summary of its Processing;

2. to request the correction, completion or updating of inaccurate or incomplete Personal Data;

3. to request the erasure of Personal Data where it is no longer necessary or where you withdraw consent;

4. under the EU GDPR and the UK GDPR, to restrict or object to certain Processing and, where applicable, to data portability;

5. to withdraw consent at any time where Processing is based on consent;

6. under the DPDP Law, to nominate another individual to exercise your rights in the event of your death or incapacity, and to readily available grievance redressal; and

7. to lodge a complaint with the relevant supervisory or regulatory authority, namely the Data Protection Board of India, the Information Commissioner’s Office in the United Kingdom, or your local data-protection authority in the European Union.

To exercise any of these rights, please contact the Grievance Officer using the details below. The Company may need to verify your identity before acting on a request and will respond within the timeframes required by Applicable Data Protection Law.

The Website is intended for business and professional audiences and is not directed at children. The Company does not knowingly collect Personal Data of children. Under the DPDP Law a child is an individual below eighteen (18) years of age, and processing of a child’s data requires verifiable consent of a parent or lawful guardian; under the EU GDPR and the UK GDPR the relevant age of consent for information-society services may be lower. If you believe a child has provided Personal Data through the Website, please contact the Grievance Officer and the Company will take appropriate steps to delete it.

The Website may contain links to third-party websites and social-media platforms. The Company does not control and is not responsible for the content or privacy practices of such third parties. You should review the privacy notices of those websites before providing them with any Personal Data.

Questions, requests and complaints relating to this Policy or to the Processing of your Personal Data may be addressed to the Grievance Officer: Grievance Officer, House of Sharma Pvt. Ltd., C-246, 247 & 248, Sector-2, UPSIDC Industrial Area, Talanagri, Ramghat Road, Aligarh, Uttar Pradesh – 202001, India. Email: info@tsmfgco.com.

The Grievance Officer is the point of contact for the purposes of the DPDP Law and for general data-protection queries under the EU GDPR and the UK GDPR.

The Company may update this Policy from time to time to reflect changes in its practices or in the law. Any updated version will be posted on the Website with a revised effective date, and your continued use of the Website after such posting constitutes acceptance of the updated Policy.

This Policy is governed by the laws of India. Subject to any mandatory rights of Data Principals and data subjects under Applicable Data Protection Law, the courts at Aligarh, Uttar Pradesh, India shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy. Nothing in this clause deprives an individual of the protection of, or the right to bring proceedings under, any mandatory provision of the data-protection law of their place of residence.