This policy explains how TariffWolf India Private Limited handles personal data when you use ECCN.help at https://eccn.help. ECCN.help is a service of TariffWolf. In this policy, "we", "us" and "our" mean TariffWolf, and "you" means anyone who uses ECCN.help or visits the site.
ECCN.help is not legal advice. It helps you research how your products are classified and whether a licence is needed, and it gives no official classification or licence determination. ECCN.help makes no automated decision about you that has a legal effect or a similarly significant effect. You must check every result yourself before you rely on it. Your classification, licensing and screening decisions, and your compliance with export control and sanctions laws, remain your responsibility.
Contents
- Who we are and what this policy covers
- Personal data we collect
- Why we use it and our lawful basis
- AI and automated decisions
- People and companies you screen
- Classification allowance and paid plans
- Emails we send
- Cookies and outside services in your browser
- Who receives your data
- International transfers
- How long we keep data
- Deleting your account
- Security
- Your rights
- What you must not submit
- Children
- Grievance officer
- Governing law and courts
- Changes to this policy
- Contact
1. Who we are and what this policy covers
TariffWolf India Private Limited (CIN U70200KA2026PTC220921) decides how and why your personal data is used on ECCN.help. That makes us the controller under the GDPR and the UK GDPR, and the data fiduciary under India's Digital Personal Data Protection Act, 2023. Our registered office is at Salarpuria Symbiosis, Wework Arekere Begurhobli, Bangalore South, Bangalore, Karnataka, 560076, India.
ECCN.help is an export control classification website for businesses. Once you sign up, you can describe your products, classify them against the U.S. Commerce Control List, check licence requirements, screen parties against U.S. sanctions and restricted-party lists, and use the reference tools.
We wrote this policy for India's Digital Personal Data Protection Act, 2023 (the DPDP Act), the Information Technology Act, 2000 and the rules made under it, the EU General Data Protection Regulation (GDPR), the UK GDPR, and U.S. state privacy laws. Which rights you have depends on the law that applies to you.
2. Personal data we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Your name, email address, account reference number and account status. Your password, which we hold only as a one-way hash. One-time codes, which we hold only as one-way hashes until they are used or expire. Sign-in times and counts of failed sign-in attempts. | You, when you sign up and sign in |
| Sign in with LinkedIn (optional) | Your name, email address and LinkedIn member identifier. We never receive your LinkedIn password, and we do not post anything to LinkedIn. We link a LinkedIn sign-in to an existing ECCN.help account only when LinkedIn has verified the email address. | LinkedIn, only if you choose this way to sign in |
| Sign-up survey | Your role, company, company size, what you classify, your expected monthly volume and how you heard about ECCN.help. | You, on the survey shown after you sign up |
| Items and results | Item names, descriptions and specifications you enter. Your answers during a classification. Results and reasons for control. Licence checks, including the destinations, end use and end-user details you enter. Classification reports you download. | You, and the results ECCN.help gives you |
| Screening | Names and details of the people or companies you screen, the results, and your decisions on possible matches. | You, and the results ECCN.help gives you |
| Classification allowance | A record of each classification you use, and of any addition to or reduction of your allowance with the reason and the name of the person who made it. | ECCN.help and the ECCN.help team |
| Enterprise enquiry | Your name, business email, the solution you are interested in and your message. Your IP address, which we store only in hashed form to stop abuse of the form. | You, on the form on the Enterprise page |
| Emails | Records of the emails we send you and whether they were delivered. Messages you send us. | ECCN.help, and you |
| Security and activity logs | IP addresses, timestamps and the actions taken in your account. | Recorded automatically when you use ECCN.help |
The ECCN.help team receives internal reports that include aggregate figures about ECCN.help and the names and email addresses of new accounts.
We also hold the name and email address of some business contacts who do not have an account, so that we can send them marketing emails about ECCN.help (section 7). If you are one of them, you have the rights in section 14 as well, including the right to ask where we got your details. Write to [email protected] to use it.
We do not collect card or bank details. Because ECCN.help uses no advertising or analytics tools (section 8), we get no personal data about you from advertising or analytics networks.
3. Why we use it and our lawful basis
| What we use it for | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, including LinkedIn sign-in if you choose it | Account, LinkedIn | Contract with you |
| Providing classification, licence checks, screening and the reference tools, and keeping your results in your account | Your own data in items and results and in screening | Contract with you |
| Running the screening and licence checks you ask for when they involve other people, such as the parties you screen and the end users you enter | Third parties' names and details in screening and licence checks | Legitimate interests, yours and ours, in carrying out the export control and sanctions checks you ask for. Where the law treats you as the controller of that data, we act on your instructions and you need your own lawful basis (section 5). |
| Learning who uses ECCN.help and what they need, from the sign-up survey | Sign-up survey | Legitimate interests |
| Keeping track of your classification allowance, and telling you and the ECCN.help team when it is used up so we can respond | Classification allowance, name and email | Contract with you; legitimate interests |
| Answering enterprise enquiries, stopping abuse of the enquiry form, and opening the Cal.com booking calendar with your name and email filled in | Enterprise enquiry | Steps you ask us to take before a contract; legitimate interests |
| Sending account emails | Account, classification allowance | Contract with you |
| Sending follow-up emails about your account | Account, activity | Legitimate interests (you can object, see section 7) |
| Sending marketing emails about ECCN.help | Name and email address | Legitimate interests, or your consent where the law requires it (you can unsubscribe at any time) |
| Showing the site's web fonts, which your browser loads from Google Fonts on every page (section 8) | Your IP address, which Google receives | Legitimate interests in showing the site as designed |
| Keeping ECCN.help secure, preventing abuse, fixing faults, and internal reports to the ECCN.help team | Security and activity logs, account, email records | Legitimate interests; legal obligations |
| Keeping export control records | Items and results, screening, licence checks | Legitimate interests in keeping records that you or we may need to show compliance with export control law or to deal with a legal claim; legal obligations where a law that applies to us requires the record |
| Responding to lawful requests from public authorities | Whatever the request lawfully covers | Legal obligations |
If the DPDP Act applies to you, we use your personal data with your consent or for a legitimate use that the Act allows. Where the DPDP Act or any other law that applies to you requires your consent for a use described in this policy, marketing emails included, we make that use only with your consent and only as far as it goes. Where we rely on consent, you can withdraw it at any time (section 14). Withdrawing it does not affect what we did before, and if the consent was needed to run your account, you may no longer be able to use ECCN.help.
4. AI and automated decisions
ECCN.help does not send your product data to any AI or language-model provider. We do not use anything you enter, or any result, to train AI.
Results are shown to you for review. They can be incomplete or wrong. No result is an automated decision about you with legal or similarly significant effect, and none is an official determination by any government.
5. People and companies you screen
When you screen a party, or enter end-user details in a licence check, you may enter the name and details of a person other than yourself. That is personal data of a third party. You must have a lawful basis under the laws that apply to you before you enter it. Section 3 sets out the basis we rely on.
We use screening data only to run the screening you ask for and to keep the record of it. We do not build profiles of the people screened, and we do not sell screening data or use it for marketing. It reaches others only in the cases set out in section 9, such as our service providers and public authorities where the law requires it. Where the law treats you as the controller of that data, we handle it on your instructions, subject to the records we must keep. Screening records are kept as export control records (section 11), including after an instruction to delete them where the law allows.
6. Classification allowance and paid plans
Every account has five classifications at present. We keep a record of each one you use and of any addition or reduction, with the reason and the person who made the change.
When you have used your allowance, we email you, and we send your name and email address to the ECCN.help team so that it can respond to you. To ask for more classifications or about paid plans, write to [email protected].
If we make paid plans available, they will come with their own separate terms. Payment takes place outside ECCN.help, and ECCN.help does not collect card or bank details.
7. Emails we send
| Type | What they are | Can you stop them? |
|---|---|---|
| Account emails | Sign-up and password reset codes, sign-in codes for team accounts, password-change notices, account deletion confirmation, and notices about your classification allowance. | No, not while you have an account. |
| Follow-up emails | A reminder before an unused sign-up code expires. A getting-started message if you have not classified anything yet. A message after a period of inactivity. | Yes. Write to [email protected] from your account email address and say you object. |
| Marketing emails | News and information about ECCN.help. | Yes. Use the unsubscribe link in any marketing email. |
Each follow-up email is sent at most once for the event that prompts it, and you will get no more than one a day.
We send marketing emails to account holders and to business contacts. Every one has an unsubscribe link and TariffWolf's postal address. Once you unsubscribe, we send you no later marketing emails, though account emails continue while you have an account.
8. Cookies and outside services in your browser
ECCN.help uses only strictly necessary cookies. There are two kinds:
- a session cookie that keeps you signed in, which ends after a period of inactivity and in any case after eight hours
- short-lived tokens that protect our forms from misuse
We use no advertising cookies, no analytics and no tracking pixels. The session cookie is what keeps you signed in, so if you block it you will not be able to stay signed in.
Two outside services also load in your browser. They are separate from our cookies, and section 3 gives the reason and lawful basis for each. Every page loads web fonts from Google Fonts, so Google receives your IP address when the fonts load. On the Enterprise page, after you send the enquiry form, a Cal.com booking calendar opens with your name and email filled in, so Cal.com receives them when it opens. Cal.com's own terms and cookies apply to the calendar, and any booking you make there is made with Cal.com.
9. Who receives your data
We do not sell personal data. We do not share it for advertising, and we do not give it to data brokers. We share it only with:
- service providers that work for us on hosting and infrastructure, content delivery and email delivery, which may use your data only to provide their services to us, under contract or their published terms
- LinkedIn, if you sign in with it; Cal.com, which receives your name and email when its booking calendar opens after you send the enquiry form; and Google, which receives your IP address when your browser loads Google Fonts (section 8). These companies provide parts of ECCN.help, and they also handle the data they receive under their own terms and privacy policies, which we do not control.
- public authorities, where the law, a court or an enforceable government request requires it, including for export control and sanctions enforcement
- a company that takes over TariffWolf or ECCN.help through a merger or acquisition, which will remain bound by this policy for the data it receives
- our professional advisers, such as lawyers and accountants, who must keep it confidential
You can write to [email protected] for a list of the categories of providers and the countries where they handle data.
10. International transfers
ECCN.help is hosted in the United States, and our administrators and developers can reach the data from other countries. If you are outside the United States, your personal data is transferred to the United States and to other countries where our providers operate. Those countries may protect personal data less than your own.
Where the law requires it, we put safeguards in place for these transfers, for example standard contractual clauses. Transfers of personal data of people in India are subject to any restriction the Government of India notifies under the DPDP Act.
11. How long we keep data
| Data | How long we keep it |
|---|---|
| Classification, screening and licence-check records, with their history | At least five years, consistent with the U.S. export recordkeeping requirements in 15 CFR Part 762, and longer if a legal hold, dispute or government enquiry needs it. This continues after you delete your account, and it can override a request to erase the data where the law allows. |
| Classification allowance records | For the life of your account, then for as long as we need them for disputes, tax and accounting. |
| Account data | While your account exists. After deletion we keep the account record, deactivated and with sign-in disabled, for the period that applies to it. Then we delete it or make it de-identified. |
| One-time codes | They cannot be used once they expire. |
| Security and activity logs, and email delivery records | For the period needed for operations and security. Then we delete them or they are rotated out. Backups are overwritten on a rolling basis. |
| Enterprise enquiries and other messages you send us | For as long as we need them to respond and follow up. |
| Any other personal data, such as sign-up survey answers and the details of business contacts who do not have an account | For as long as we need it for the purposes in section 3. Then we delete it or make it de-identified. If you unsubscribe from marketing emails, we keep a record of that so that we can honour it. |
12. Deleting your account
- Ask for deletion from inside your account.
- We email you a link to confirm and a link to cancel. Both work for 30 minutes.
- If you confirm, we deactivate your account and send you a final email. You can no longer sign in.
- If you cancel, your account is restored.
If the links expire before you use either of them, or you have any problem with your request, write to [email protected] from your account email address.
After the final email, you will receive no more account emails or follow-up emails. Marketing emails are a separate matter: to be sure they stop, use the unsubscribe link in any marketing email, or say so when you write to [email protected]. An unsubscribe applies to all later marketing emails.
Records covered by section 11 are kept for the periods set out there, and the rest of your personal data is deleted or de-identified when its retention period ends.
13. Security
We protect personal data with measures suited to the risk. We use encryption in transit. Passwords are stored only as one-way hashes. Each account's data is kept separate from other accounts. Only staff who need access have it, and staff and team accounts need an extra step to sign in. Sign-in and sign-up forms have a check against automated misuse, and we limit repeated attempts. We keep security logs.
No method of sending or storing data is perfectly secure, and we cannot promise that a breach will never happen. If a personal data breach occurs, we will notify you and the authorities as the law requires.
14. Your rights
Depending on the law that applies to you, you may have the right to:
- find out whether we hold personal data about you, get a copy of it and a summary of how we use it, and learn where we got it if it did not come from you
- have inaccurate or incomplete data corrected or brought up to date
- have your data erased, subject to the records we must keep (section 11); if you have an account, you can do this by deleting it (section 12)
- receive your data in a structured, commonly used format, where the law provides for portability
- object to, or ask us to restrict, use of your data based on our legitimate interests, including follow-up emails
- stop marketing emails at any time, using the unsubscribe link in any of them
- withdraw consent where we rely on it, without affecting what we did before
- nominate another person to exercise your rights if you die or become unable to act, where the DPDP Act applies
- have your grievance dealt with by our grievance officer (section 17)
- complain to a data protection authority, including the Data Protection Board of India
To use any of these rights, write to [email protected]. If you have an account, write from the email address on it. If you do not, write from the email address we hold for you, for example the one that receives our marketing emails or the one you gave on the enquiry form. We may need to verify your identity first. We will respond within the time the law allows. We will not discriminate against you for using your rights.
15. What you must not submit
Do not enter any of the following in ECCN.help:
- technical data controlled under the U.S. International Traffic in Arms Regulations (ITAR)
- classified information of any government
- export-controlled technical data whose transfer to ECCN.help or its providers would itself need an authorisation you do not hold
- confidential information of a third party that you do not have the right to share
ECCN.help is meant for ordinary product descriptions and published specifications. Submitting controlled technical data may itself be a deemed export. You are responsible for what you submit, and we may remove anything submitted in breach of this section.
16. Children
ECCN.help is for businesses and professionals. It is not for anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you think someone under 18 has given us personal data, write to [email protected] and we will delete it, subject to the law.
17. Grievance officer
Under the Information Technology Act, 2000, the rules made under it and the DPDP Act, we have appointed a grievance officer to deal with complaints about how we handle personal data. You can reach the grievance officer by email at [email protected], or by post at: Grievance Officer, TariffWolf India Private Limited, Salarpuria Symbiosis, Wework Arekere Begurhobli, Bangalore South, Bangalore, Karnataka, 560076, India.
We will acknowledge and resolve grievances within the time limits set by law.
18. Governing law and courts
This policy is governed by the laws of India. The courts at Bengaluru, Karnataka have exclusive jurisdiction over any matter arising from it. If a law that you cannot contract out of gives the courts or authorities where you live the right to hear the matter, that law still applies.
19. Changes to this policy
We may change this policy when ECCN.help, our service providers or the law changes. The date at the top shows the current version. If a change is material, we will tell you in advance by email to your account address or by a prominent notice on ECCN.help. If you keep using ECCN.help after a change takes effect, that shows you have been told of the updated policy, to the extent the law allows. Continued use does not count as your consent. Where the law requires your consent to a change, we will ask for it.
20. Contact
For questions about this policy, requests to use your rights, objections to follow-up emails and complaints, write to [email protected] or to TariffWolf India Private Limited, Salarpuria Symbiosis, Wework Arekere Begurhobli, Bangalore South, Bangalore, Karnataka, 560076, India.
For more classifications or paid plans, write to [email protected].