This policy explains how [[LEGAL_ENTITY]] ("we", "us"), which operates the website [[WEBSITE_DOMAIN]] and the store at [[BUSINESS_ADDRESS]], handles your personal data. It is written to be read by a customer, not only by a lawyer, and it reflects our obligations as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023.
1. What We Collect
We collect only what is needed to take an order, deliver it, and answer questions about it afterwards.
2. Why We Use It
- To accept, prepare, pack and deliver your order, and to reach you if something about it needs confirming.
- To send transactional messages: order confirmation, dispatch and tracking updates, and delivery confirmation.
- To issue a GST-compliant invoice and keep the accounting and tax records the law requires us to keep.
- To handle refunds, replacements and complaints, and to trace a batch if a food-safety question is ever raised.
- To send festival offers and news — only if you have separately opted in, and every such message carries a way to stop them.
We process your data on the basis of the consent you give when you place an order or tick a box, and for the certain legitimate uses permitted by the DPDP Act, 2023 — such as fulfilling a purpose you have voluntarily provided data for, and complying with a legal obligation. We do not sell your personal data to anyone, and we do not use it to build advertising profiles.
3. Who Else Sees Your Data
A sweets order cannot be completed by us alone. We share the minimum necessary with the following categories of partner, who are permitted to use it only to perform that service for us:
Payment gateway — [[PAYMENT_GATEWAY_NAME]]
Receives your name, contact details and the amount payable in order to process the transaction. Card and UPI credentials are collected directly by the gateway under its own privacy policy and are never routed through us.
Delivery partners — [[DELIVERY_PARTNER_NAMES]]
Receive the recipient's name, delivery address and phone number, which they need in order to hand the parcel over.
Communication and hosting providers
The SMS, email and website-hosting services we use process your contact details solely to deliver our messages and to serve this website.
Authorities, where legally required
We disclose data to a court, tax authority or other lawful authority only where we are obliged to do so.
4. How Long We Keep It
We keep account and order data for as long as your account is active and for [[DATA_RETENTION_PERIOD]] after your last order, so that we can answer questions about past purchases.
Invoices and tax records are retained for the period required under Indian tax and company law, even if you close your account. Once a retention period ends, or when you withdraw consent and no legal obligation requires us to keep the data, we erase it or irreversibly anonymise it.
5. Your Rights
Under the Digital Personal Data Protection Act, 2023, as a Data Principal you may:
- Access a summary of the personal data we hold about you and of how it has been processed and shared.
- Correct, complete or update data that is wrong or out of date, and have inaccurate data erased.
- Erase your personal data where it is no longer needed for the purpose it was collected for and no law requires us to retain it.
- Withdraw consent at any time, as easily as you gave it. Withdrawing consent does not affect processing already carried out, and we may be unable to complete an order in progress without it.
- Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
- Complain to us through the grievance route below, and thereafter to the Data Protection Board of India if you remain dissatisfied.
To exercise any of these, write to our Grievance Officer using the details in section 9. We may ask you to confirm your identity — usually by responding from the phone number or email address used to place the order — before we act on the request.
6. Cookies
This site uses cookies and similar browser storage to keep your cart contents, keep you signed in, and remember basic preferences. These are necessary for the site to function. Any analytics or marketing cookies, if introduced, will be loaded only after you consent, and you can clear or block cookies from your browser settings at any time.
7. Security
The site is served over HTTPS, access to customer records is limited to staff who need it to fulfil orders, and payment credentials never reach our systems. No method of transmission or storage is completely secure, but if a personal data breach affecting you occurs, we will notify you and the Data Protection Board of India as required by law.
8. Children
Our services are intended for adults. We do not knowingly collect the personal data of a child under 18 without verifiable consent from a parent or lawful guardian, and we do not carry out behavioural tracking or targeted advertising directed at children. If you believe a child has given us data, tell us and we will delete it.
9. Grievance Officer and Contact
For any question about this policy, or to exercise your rights, contact our Grievance Officer. We aim to acknowledge every request promptly and resolve it within the timelines prescribed under Indian law.
Grievance Officer
[[GRIEVANCE_OFFICER_NAME]]
[[GRIEVANCE_OFFICER_EMAIL]]
Phone
[[BUSINESS_PHONE]]
Postal address
[[LEGAL_ENTITY]], [[BUSINESS_ADDRESS]]
10. Changes to This Policy
We may update this policy as our services or the law change. The revised version will be posted on this page with a new "last updated" date, and material changes will be notified to you by email or on the site before they take effect.