Your Privacy, Our Priority

1. Introduction & Scope

1.1 Our Commitment

We are committed to protecting your privacy and being transparent about our data practices. This policy complies with:

• India's Digital Personal Data Protection Act, 2023 (DPDPA)
• General Data Protection Regulation (GDPR) principles for international customers
• Information Technology Act, 2000 with relevant rules and amendments
• Food Safety and Standards Authority of India (FSSAI) regulations
• Industry best practices for e-commerce data protection

1.2 Key Definitions

2. Information We Collect

2.1 Personal Information You Provide

2.2 Information Collected Automatically

2.3 Information from Third Parties

We may receive information about you from:

• Payment Processors: Transaction status, payment confirmation (Razorpay, PayPal)
• Logistics Partners: Delivery status, proof of delivery (Delhivery, Blue Dart, etc.)
• Social Media: When you interact with our social media pages or use social login
• Marketing Partners: Aggregated demographic information for analytics
• Business Partners: For gift orders or corporate purchases

3. How We Use Your Information

3.1 Specific Use Cases for Food Business

4. Legal Basis for Processing

4.1 Contractual Necessity

Processing necessary for fulfilling our contract with you:

• Processing your orders and delivering products
• Managing your account and preferences
• Providing customer support and handling complaints
• Sending order confirmations, invoices, and delivery updates
• Processing returns, refunds, and exchanges

4.2 Legitimate Interests

Processing necessary for our legitimate business interests:

• Improving our website, products, and services
• Preventing fraud, security breaches, and unauthorized activities
• Conducting marketing analysis and business development
• Maintaining business records and internal administration
• Ensuring network and information security

4.3 Legal Obligation

Processing necessary to comply with legal requirements:

• Maintaining tax records and financial accounts (7 years minimum)
• FSSAI compliance for food safety and traceability
• Responding to legal requests, court orders, or government inquiries
• Preventing illegal activities, money laundering, or terrorist financing
• Complying with consumer protection laws

4.4 Consent

Processing based on your explicit consent:

• Marketing communications via email, SMS, or WhatsApp
• Non-essential cookies and tracking technologies
• Sharing data with third parties for marketing purposes
• Processing special category data (if ever applicable)
• Participating in surveys, contests, or promotional activities

5. Data Sharing & Disclosure

5.1 Legal Disclosures

We may disclose your information when required by law:

• To comply with court orders, subpoenas, or legal processes
• To government authorities for tax, regulatory, or investigation purposes
• To enforce our Terms & Conditions and other agreements
• To protect the rights, property, or safety of Shudh Desi Taste, our customers, or the public
• In connection with a business transfer (merger, acquisition, or sale of assets)

5.2 International Data Transfers

Your data may be transferred to and processed in countries outside India:

6. Cookies & Tracking Technologies

6.1 Types of Cookies We Use

6.2 Your Cookie Choices

For detailed information, please visit our Cookies Policy.

7. Data Retention

7.1 Data Deletion Process

Upon expiry of retention periods, we:

1. Anonymize data where possible for statistical and analytical purposes
2. Securely delete electronic records using industry-standard secure deletion methods
3. Physically destroy paper records through cross-cut shredding
4. Notify third-party processors to delete their copies where applicable
5. Maintain deletion logs for audit and compliance purposes

8. Data Security

8.1 Technical Security Measures

8.2 Organizational Security Measures

• Employee Training: Regular privacy and security awareness training for all staff
• Data Protection Officer: Designated DPO overseeing compliance with privacy laws
• Incident Response: Documented procedures for data breach response and notification
• Vendor Management: Due diligence and regular audits of third-party processors
• Business Continuity: Regular backups, Disaster recovery planning, Redundancy
• Physical Security: Secure premises, Access controls, Surveillance for physical records

8.3 Data Breach Notification Protocol

In the event of a data breach affecting your personal information, we will:

1. Notify you within 72 hours of becoming aware of the breach
2. Provide details of the breach, including nature and extent
3. Outline steps we're taking to address the breach and mitigate harm
4. Suggest protective measures you can take
5. Report to relevant authorities as required by law (DPB under DPDPA)
6. Maintain transparent communication throughout the resolution process

9. Your Privacy Rights

9.1 How to Exercise Your Rights

To exercise any of these rights:

1. Submit a written request to our Data Protection Officer via email or postal mail
2. Include sufficient information to verify your identity (we may ask for additional verification)
3. Specify the right(s) you wish to exercise and any relevant details
4. We will acknowledge receipt within 7 days and respond substantively within 15 days
5. No fee unless requests are manifestly unfounded, excessive, or repetitive

9.2 Verification Process

For security and to prevent unauthorized access, we may need to verify your identity before processing requests. This may involve:

• Asking security questions based on your account information
• Requesting identification documents (with sensitive information redacted)
• Verifying through your registered email or phone number via OTP
• Checking recent order history or transaction details
• For sensitive requests, additional verification may be required

9.3 Limitations & Exceptions

Your rights may be limited in certain circumstances:

• When necessary to comply with legal obligations
• For prevention, detection, investigation, or prosecution of offences
• For enforcement of legal rights or claims
• When processing is necessary for public interest
• For research, statistical, or archival purposes (with appropriate safeguards)
• When data has been anonymized for statistical purposes

10. Children's Privacy

10.1 Our Policy Regarding Children

• Our website and services are intended for adults (18 years and older)
• Children may use our services only with parental consent and supervision
• Accounts can only be created by individuals 18 years or older
• We do not market directly to children
• We do not collect age information unless necessary for age-restricted products

10.2 Parental Controls & Responsibilities

If you are a parent or guardian and believe your child has provided us with personal information:

1. Contact us immediately using the contact details in Section 12
2. Provide proof of your relationship to the child (birth certificate, guardianship papers)
3. We will promptly investigate and delete such information if verified
4. We may require additional verification to protect the child's privacy
5. We will confirm deletion and provide details of actions taken

11. Policy Updates & Changes

11.1 Update Notification Process

11.2 Your Acceptance of Changes

By continuing to use our services after policy updates, you accept the revised policy. If you disagree with material changes:

• You may discontinue using our services
• You may request deletion of your data as per your rights
• You may contact us with concerns before the effective date
• You may opt out of specific new processing activities where possible

12. Contact Information

12.1 Business Hours & Response Times

13. Grievance Redressal Mechanism

13.1 Complaint Submission Process

13.2 Escalation to Authorities

If unsatisfied with our resolution, you may escalate to:

13.3 Alternative Dispute Resolution

For certain types of disputes, we may suggest:

• Mediation: Through neutral third-party mediators
• Arbitration: Binding arbitration as per Indian Arbitration Act
• Consumer Forums: Appropriate consumer dispute resolution forums
• Ombudsman: Sector-specific ombudsman schemes where applicable

14. Related Policies & Documents