Privacy Policy

This Privacy Policy (the “Policy”) sets out the terms upon which Pacific Surfaces and its affiliated entities (collectively, “Pacific Surfaces,” “Company,” “we,” “us,” or “our”) collect, use, disclose, transfer, retain, and otherwise process Personal Data of individuals (each, a “Data Subject” or “you”) who access or interact with the website located at pacific-surfaces.com (the “Site”) or who otherwise engage with the Company in connection with the design, manufacture, distribution, sale, or marketing of quartz, granite, semi-precious-stone, and engineered-surface products (collectively, the “Services”).

This Policy is issued in accordance with applicable data-protection legislation, including, where applicable, the European Union General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the United Kingdom Data Protection Act 2018, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA”), the Digital Personal Data Protection Act, 2023 of India (“DPDP Act”), and any other privacy or data-protection law that may apply to a particular processing activity (collectively, the “Applicable Laws”).

By accessing the Site or submitting Personal Data to the Company, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, you must refrain from using the Site and from submitting Personal Data to us.

1. Definitions

In this Policy, unless the context otherwise requires:

• “Personal Data” means any information relating to an identified or identifiable natural person, including without limitation the categories of information enumerated in Clause 3 below;
• “Processing” means any operation or set of operations performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, restriction, erasure, or destruction;
• “Data Controller” means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;
• “Processor” means a natural or legal person which processes Personal Data on behalf of a Data Controller;
• “Services” has the meaning ascribed in the preamble above and includes the operation of the Site, the Visualizer tool, and all customer-facing activities of the Company.

2. Identity of the Data Controller

For the purposes of the Applicable Laws, Pacific Surfaces is the Data Controller of the Personal Data processed in connection with the Services, save where this Policy or another agreement expressly provides otherwise. Enquiries concerning this Policy or the Processing of your Personal Data may be addressed to the Company in accordance with Clause 16 below.

3. Categories of Personal Data Processed

3.1 Personal Data provided directly by the Data Subject

The Company processes the following categories of Personal Data which a Data Subject voluntarily submits through the Site, by electronic mail, by telephonic or messaging communication, or through any other channel of correspondence with the Company:

• Identity Data, including full name, salutation, designation, employer or trading name, and professional capacity (for example, architect, designer, fabricator, dealer, distributor, end-customer);
• Contact Data, including postal address, billing address, shipping address for the dispatch of samples, email address, telephone number, and WhatsApp number;
• Location Data, including city, postal code (PIN, ZIP, or equivalent), country, and any project location communicated to the Company;
• Commercial Data, including specifications, finishes, dimensions, quantities, applications, and any other detail relating to a project enquiry, quotation, or sample request;
• Communications Data, including the content of messages, briefs, applications, and any free-text submission;
• Employment Data submitted in connection with a career application, including curriculum vitae, cover letter, work history, educational qualifications, and references;
• User-Generated Content uploaded to the Visualizer feature of the Site, the Processing of which is governed by Clause 5 below.

3.2 Personal Data collected automatically

Upon a Data Subject's access to the Site, the Company and its Processors automatically record the following categories of Technical Data:

• Internet Protocol (IP) address (recorded in approximate form sufficient for inference of country or region);
• device, operating system, browser type and version, and viewport configuration;
• referring uniform resource locator (URL), session-level traffic source data, and campaign identifiers (including UTM parameters);
• pages and resources accessed, time spent on each, products viewed, filters applied, links clicked, and other usage metadata;
• diagnostic, error, and performance telemetry necessary to maintain the security, integrity, and availability of the Site.

4. Purposes of Processing and Lawful Bases

The Company processes Personal Data only for specified, explicit, and legitimate purposes, and only to the extent permitted by a lawful basis under the Applicable Laws. The principal purposes and corresponding lawful bases are as follows:

• Performance of a contract or pre-contractual steps (GDPR Article 6(1)(b)) — to respond to enquiries, prepare quotations, dispatch samples, evaluate job applications, and otherwise take steps requested by you;
• Legitimate interests (GDPR Article 6(1)(f)) — to operate, secure, and improve the Site and the Services; to measure the performance of our marketing campaigns; to manage business relationships with dealers, fabricators, suppliers, and partners; and to defend our legal rights. Such Processing is balanced against the rights and freedoms of Data Subjects;
• Consent (GDPR Article 6(1)(a) and Section 6 of the DPDP Act) — for non-essential cookies, direct marketing communications, and any other Processing for which consent is required by law. Such consent may be withdrawn at any time without affecting the lawfulness of Processing carried out before the withdrawal;
• Compliance with a legal obligation (GDPR Article 6(1)(c)) — to comply with applicable tax, customs, export-control, employment, and other statutory and regulatory requirements;
• Vital interests and public interest (GDPR Article 6(1)(d) and (e)) — only in limited circumstances where Processing is necessary to protect a person's life or to perform a task in the public interest.

The Company does not engage in any solely automated decision-making producing legal or similarly significant effects upon Data Subjects without human intervention.

5. Visualizer Feature: User-Generated Imagery

The Site offers a Visualizer feature which permits a Data Subject to upload a photograph of a room or surface (“Uploaded Imagery”) and to preview thereon the appearance of selected Pacific Surfaces slabs. The Company processes Uploaded Imagery solely for the purpose of performing the visualisation requested and only for the duration of the Data Subject's active session. The Company:

• does not use Uploaded Imagery to identify any natural person;
• does not use Uploaded Imagery to train, tune, or otherwise develop machine-learning models;
• does not disclose Uploaded Imagery to any third party unrelated to the rendering of the requested preview;
• does not retain a long-term copy of Uploaded Imagery beyond what is necessary to render the preview.

Data Subjects are advised to refrain from uploading photographs containing identifying features (such as faces, identification documents, or licence plates), the Processing of which is not required for the visualisation purpose and which fall outside the intended use of the feature.

6. Cookies and Similar Technologies

The Company uses cookies, browser local storage, pixels, web beacons, and similar technologies (collectively, “Tracking Technologies”) for the following purposes:

• Strictly necessary Tracking Technologies required to operate the Site, including those that retain Visualizer session state, favourites, and dealer-search inputs;
• Analytics Tracking Technologies that enable aggregated measurement of Site usage and feature performance;
• Advertising Tracking Technologies that enable conversion measurement, frequency capping, and audience attribution in respect of the Company's advertising campaigns on Meta and Google.

A Data Subject may control non-essential Tracking Technologies through the settings of their browser. Refusal of certain categories may impair Site functionality.

7. Engagement of Processors and Advertising Partners

The Company engages the following categories of Processors and service partners, each of which processes Personal Data on the Company's behalf pursuant to a written agreement incorporating obligations of confidentiality, security, and (where applicable) the standard contractual clauses published by the European Commission:

• Hosting and content-delivery providers — providing the infrastructure on which the Site is served;
• Content-management providers — storing the editorial content, product imagery, and dealer records that populate the Site;
• Google (in respect of Google Analytics, Google Ads, and Google Tag Manager) — providing aggregate analytics, conversion tracking, and advertising-measurement services;
• Meta Platforms (in respect of Facebook, Instagram, and WhatsApp Business) — providing advertising-measurement, conversion-tracking, audience-targeting, and business-messaging services. A Data Subject may manage advertising preferences within their Meta account at any time;
• Email and messaging service providers — facilitating transactional and marketing communications and the receipt of enquiries submitted through the Site;
• Payment processors and logistics providers — facilitating sample dispatch and commercial transactions effected through or in connection with the Site.

Each such Processor processes Personal Data subject to its own privacy notice, which Data Subjects are encouraged to consult.

8. Disclosures of Personal Data

The Company does not sell Personal Data within the meaning of the CCPA or any other Applicable Law. The Company may disclose Personal Data only in the following circumstances:

• to Processors and service partners as set out in Clause 7, acting upon documented instructions of the Company;
• to authorised dealers, fabricators, or distributors of Pacific Surfaces products, where a Data Subject has requested an introduction or referral through, inter alia, the Find A Dealer feature of the Site;
• to other entities within the Pacific Group, where such disclosure is necessary for the performance of the Services or for the operation of shared corporate functions;
• to law-enforcement authorities, courts, regulators, or other competent bodies, where required by law or where necessary to establish, exercise, or defend legal claims;
• to a successor entity in connection with a merger, acquisition, divestiture, restructuring, insolvency proceeding, or sale of all or part of the business or assets of the Company, subject to the recipient's undertaking to honour the terms of this Policy.

9. International Transfers of Personal Data

The Company operates internationally. Personal Data may accordingly be transferred to, stored in, and processed in jurisdictions other than the Data Subject's country of residence. Where such transfer is made from the European Economic Area, the United Kingdom, or any other jurisdiction imposing transfer restrictions, the Company implements one or more of the following safeguards: (i) the standard contractual clauses approved by the European Commission and, where applicable, the United Kingdom International Data Transfer Addendum; (ii) reliance on an adequacy decision of the relevant regulator; or (iii) such other lawful transfer mechanism as may be available.

10. Retention of Personal Data

The Company retains Personal Data only for so long as is necessary to fulfil the purposes for which it was collected, including any retention period required by law or imposed by audit, accounting, tax, or customs regulations. Indicative retention periods are as follows:

• enquiry, sample request, and quotation correspondence: retained for a reasonable period following the most recent interaction, reflecting the typical specification cycle of architectural and design projects;
• recruitment records: retained for the duration of the recruitment process and, with the Data Subject's consent, such further period as may be relevant for the consideration of future vacancies;
• newsletter and marketing subscription data: retained until the Data Subject withdraws consent or unsubscribes;
• transactional records (including invoices and export documentation): retained for the minimum period prescribed by applicable tax, customs, and commercial law;
• analytics data: retained in aggregated and/or pseudonymised form for trend analysis.

Upon expiry of the applicable retention period, the Company shall delete, destroy, or anonymise the relevant Personal Data in accordance with its data-disposal procedures.

11. Rights of Data Subjects

Subject to and in accordance with the Applicable Laws, a Data Subject may exercise the following rights with respect to their Personal Data:

• Right of access to confirmation as to whether Personal Data concerning the Data Subject is being processed and, if so, access to such Personal Data and information concerning the Processing;
• Right to rectification of inaccurate or incomplete Personal Data;
• Right to erasure of Personal Data, subject to applicable legal limitations;
• Right to restriction of Processing in the circumstances set out in Article 18 of the GDPR and equivalent provisions of other Applicable Laws;
• Right to object to Processing carried out on the basis of legitimate interests, and to Processing for the purposes of direct marketing, at any time and without giving reasons;
• Right to data portability in respect of Personal Data provided by the Data Subject and processed by automated means on the basis of consent or contract;
• Right to withdraw consent at any time where Processing is based on consent, without prejudice to the lawfulness of Processing carried out before such withdrawal;
• Right to lodge a complaint with the supervisory authority having jurisdiction over the Data Subject's habitual residence, place of work, or place of the alleged infringement.

A Data Subject wishing to exercise any of the foregoing rights may submit a written request to info@thepacific.group bearing the subject line “Privacy Request.” The Company may require reasonable evidence of identity prior to actioning a request and shall respond within the time period prescribed by the Applicable Laws (and in any event within thirty (30) days where no specific period applies).

12. Security of Processing

The Company implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks presented by the Processing, including, without limitation, encryption of Personal Data in transit by means of Transport Layer Security (TLS), access controls on the principle of least privilege, regular review of access rights, network monitoring of the hosting infrastructure, secure-development practices, and incident- response procedures. Notwithstanding the foregoing, no method of transmission over the internet or method of electronic storage is absolutely secure, and the Company cannot guarantee unconditional security.

13. Children

The Site is directed exclusively to a professional and adult audience, namely architects, designers, fabricators, dealers, distributors, and adult end-customers specifying or procuring surfaces for residential or commercial applications. The Company does not knowingly collect Personal Data from any person under the age of sixteen (16) years. Should it come to the Company's attention that Personal Data of a child has been collected without verified parental consent, such data shall be deleted without undue delay.

14. Links to Third-Party Properties

The Site may from time to time contain links to websites, applications, or other digital properties operated by third parties (including dealers, social-media platforms, press publications, and industry organisations). The Company is not responsible for the privacy practices of such third parties, and Data Subjects are advised to review the privacy notices of those properties prior to providing Personal Data to them.

15. Amendments to this Policy

The Company may amend this Policy from time to time to reflect changes in its Processing activities, applicable legislation, or the engagement of new Processors. The current version of the Policy is the version published on the Site under the heading “Currently in force.” Material amendments shall be communicated to Data Subjects by such means as the Company considers appropriate, including by means of a notice on the Site or by inclusion in marketing correspondence. Continued use of the Site following the publication of an amended Policy constitutes acceptance of such amendment.

16. Notices and Contact Details

Any notice, request, or other communication concerning this Policy or the Processing of Personal Data should be addressed to:

Pacific Surfaces
For the attention of: Data Protection
Email: info@thepacific.group
Telephone: +91 98940 33566

By accessing or using pacific-surfaces.com, a Data Subject acknowledges that they have read and understood this Policy in its entirety.