Privacy notice

Last updated: 15 October 2026. This notice explains how Vinner Labs ("we") handles personal data on vinnerlabs.com.

Who we are

Vinner Labs Private Limited is a manufacturer of specialty cosmetic ingredients, registered at Flat 1201, B-Block, Asian Sun City, Kothaguda, Hyderabad 500084, Telangana, India. For any privacy question or request, write to info@vinnerlabs.com or call +91 40 4089 0505.

What we collect, why, and on what legal basis

Under the UK GDPR and the EU GDPR, every use of personal data needs a legal basis. Ours are given with each item.

Contact-form submissions. When you request a sample, quote, spec sheet or regulatory information, we collect the details you enter: name, work email, company, region, the product concerned and your message. We use them solely to respond to your enquiry and to follow up on it. Submissions are delivered to us by Formspree Inc. (our form-processing provider), which processes the data on our behalf. Legal basis: taking steps at your request before a possible contract, and our legitimate interest in answering business enquiries (Article 6(1)(b) and (f)).

Cookieless analytics. We use Plausible Analytics for every visitor. It records aggregate page-view statistics without cookies, without persistent identifiers, and without tracking you across sites, and none of it identifies you. Legal basis: our legitimate interest in knowing which pages are useful (Article 6(1)(f)).

Analytics and marketing cookies, only with your consent. If you accept them, we use Google Analytics and Microsoft Clarity to understand how the site is used, and the LinkedIn Insight Tag and Google Ads to measure whether our advertising leads to enquiries and to show our advertising to past visitors. These tools collect online identifiers, pages visited, device and browser details, approximate location derived from your IP address, and how you interact with pages. Text typed into forms is masked from Clarity's session replays. Nothing runs before you choose, and you can withdraw at any time in Cookie settings. Legal basis: your consent (Article 6(1)(a)). Our cookie policy lists each cookie, its purpose and its lifetime.

Consent records. To show that we obtained consent, we keep a record of each cookie choice: a random consent ID, the categories chosen, the version of the notice and the time. It holds no IP address or other identifying detail. Legal basis: our legal obligation to be able to demonstrate consent (Article 6(1)(c), with Article 7(1)).

Server logs. Our hosting provider keeps short-lived technical logs (IP address, user agent, requested URL) for security and reliability. Legal basis: our legitimate interest in keeping the site secure (Article 6(1)(f)).

Partner lounge. The lounge for our distribution partners is by invitation only. For each invited partner we hold a work email address, company name and role, plus any documents exchanged there. Accounts and documents are stored with Supabase Inc., which processes them on our behalf. Legal basis: performing our agreement with the partner (Article 6(1)(b)).

Storage on your device

Some small values are always kept in your browser's own storage so the site works the way you left it: your cookie choice, your language, a per-visit country lookup used only to suggest a language, whether the opening animation has played, the last ingredient you opened (so the contact form can name it), your Finder view and, for lounge partners, the sign-in session. None of them identifies you or is shared with anyone. The cookie policy lists each one and how long it lasts.

What we don't do

We don't sell personal data. We don't set analytics or marketing cookies, or load the tools that set them, unless you have accepted them.

Retention

Enquiry correspondence is kept for as long as needed to serve the business relationship, and reviewed periodically. You can ask us to delete your correspondence at any time. Analytics data in Google Analytics is kept for no longer than 14 months. Consent records are kept for as long as we rely on the consent and for the period in which it could be challenged afterwards.

Your rights

Under the UK GDPR and the EU GDPR (and, depending on where you are, laws such as India's DPDP Act), you have the right to access, correct, export or delete personal data we hold about you, to restrict or object to its processing, and to withdraw consent at any time without affecting what happened before you withdrew. Email info@vinnerlabs.com and we will respond within one month.

You also have the right to complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in the country where you live or work. We would appreciate the chance to resolve your concern first.

International transfers

We are based in India. Our hosting, form and lounge providers, and the analytics and marketing providers you may consent to, process data in the EU and the United States. Where personal data from the UK or EU is transferred to a country without an adequacy decision, the transfer is protected by the European Commission's Standard Contractual Clauses (with the UK Addendum), or, for Google, Microsoft and LinkedIn, by their certification under the EU–US Data Privacy Framework and its UK Extension.

Changes

We'll update this notice when our practices change, and revise the date above.