In short
We are a business-to-business service: we help exporters identify and contact companies that already import what they make. We only contact individuals in a business capacity about products their company already imports. We do not sell personal data. Opt-out from one exporter applies across the whole platform, permanently.
1. Who we are
Outerstep is operated by CommerciaX Infotech Pvt Ltd, which is the controller for the personal data described in this notice. Contact us at hello@outerstep.com.
2. Data about our customers
If you are an exporter using Outerstep, we hold:
- Account and company data: name, work email, phone, title, company legal name, country, and business address.
- What you sell: product catalog specifications, capacity, certificates, past exported HS codes.
- Activity: communications and sessions through the platform, interaction data, invoices, and receipts, messages sent and received through the service, responses and results.
- Agreement records: the contracts you enter into with us, the riders, agreements with buyers that take place through us, and confirmation that an agreement has been concluded.
- Payment details: held by our payment processor (Stripe); we receive confirmation of payment, last four digits of the card used, and tax details.
We use this information to deliver the service, match you with buyers, verify who you are, communicate with you, process payments, and keep records of what happens.
3. Data about business contacts
If you have received an email from us on behalf of an exporter, we hold your work email address, your name and title, and your company's details, all of them sourced from public sources or company websites, relevant to your purchasing decisions.
We contact you in a business capacity, about a product your company already imports, because that is the basis on which exporters decide to reach out with an offer. We do not use consumer data or send unsolicited consumer marketing to personal email addresses.
If you reply, your messages will be shared with the relevant exporter you are replying to and processed to understand what you are looking for and negotiate terms. If you do not reply, we discontinue communication after the sequence concludes, and if you opt out, we never contact you again.
4. Why we are allowed to
- Contract: for customer accounts, because we need it to provide the service you signed up for.
- Legitimate interests: for business contact data, in providing targeted introduction information relevant to the recipient's role. Which we weigh against your privacy rights: we contact you on professional matters only, in connection to products your company already imports, and we stop if you opt out.
- Legal obligation: where we must keep records for tax, accounting or compliance.
6. How long we keep it
- Customer account and deal records: for the life of the account and 7 years following, as required for tax, accounting and dispute resolution purposes.
- Agreement records: seven years from the end of the contract term or commercial relationship with us was signed.
- Business contact data: while the relevant company remains relevant to a customer campaign, and otherwise deleted.
- Opt-out suppression lists: permanently, in minimal form (hashed email) so that if you decide you do not want to be contacted by Outerstep again, we remember we do not contact you again.
7. Your rights
Subject to the law that applies to you, you can ask for a copy of your personal data, correct it, delete it, restrict how we use it, or object to our use of it. You can also object to legitimate-interests processing at any time.
Email hello@outerstep.com and we will respond within one month. There is no charge.
8. Opting out
Every message we send includes an unsubscribe link. Replying to ask us to stop works just as well, and you do not have to provide a reason.
An opt-out is platform-wide: No exporter using Outerstep can reach you through us afterwards, across the whole platform, permanently.
9. Security
Data is encrypted in transit and at rest. Cloud resources are located in secure data centers with appropriate certifications. Access is restricted to staff who need it, and authenticated sessions are logged with user identity and timestamps.
No system is perfectly secure. If a incident affects your data and poses a risk to you, we will notify you.
10. International transfers
We operate from India and our providers operate in various countries. Customers and commercial contacts agree to this contact being processed in and transferred to the jurisdictions necessary to deliver the service and subject to safeguards.
11. Changes
We may update this notice. The version and effective date at the top of this page tell you which is current. If a change materially affects how we use your data, we will notify you either directly or by a notice on your account.
12. Contact
If you have questions about data or wish to make a complaint: hello@outerstep.com. You also have the right to complain to your local data protection authority. For platform terms, see our Terms of Use.