Privacy Policy

1. Identity of the Data Fiduciary (Who We Are)

The entity responsible for processing your personal data (acting as the Data Fiduciary under the DPDP Act, 2023) is:

• Trade / Brand Name: Apna Uttarakhand
• Registered Operation Base: Dehradun, Uttarakhand 248002, India
• Official Website: https://apnauttarakhand.store
• Official Communication Email: support@apnauttarakhand.store
• Customer Support Hotline / WhatsApp: +91 78275 21975

2. Categories of Personal Data We Collect

In order to fulfill your orders for authentic Himalayan spices, teas, and wild herbs, we collect only the necessary, lawful information:

1. Contact and Identity Information: Full name, telephone/mobile number, email address.
2. Delivery & Shipping Details: Street address, flat/house number, landmark, city, district, state, and 6-digit Indian PIN code.
3. Order & Transaction Details: Products purchased, quantities, billing amounts, order dates, invoice history, and delivery status.
4. Payment Transaction Reference: Transaction reference IDs, UPI transaction IDs, or payment mode (Credit Card, Debit Card, Net Banking, UPI, Cash on Delivery). Please note: We do NOT store your sensitive debit/credit card CVV, PINs, or net banking passwords. All payments are encrypted and securely processed by RBI-licensed payment aggregators.
5. Technical Telemetry & Device Information: IP address, device type, operating system, browser version, and approximate geographic location derived from IP to optimize content delivery and prevent fraud.

3. Purpose and Legal Basis for Processing

Under the DPDP Act 2023 and Consumer Protection Rules, we collect and process your personal data solely for legitimate, specific purposes:

• Order Fulfillment: Packaging, dispatching, and delivering your ordered goods from Uttarakhand village cooperatives to your shipping address.
• Customer Support & Updates: Sending order confirmations, dispatch tracking links, delivery SMS/WhatsApp alerts, and responding to inquiries.
• Statutory & Tax Compliance: Maintaining financial accounts, generating Goods and Services Tax (GST) invoices, and complying with Indian taxation and audit requirements.
• Security & Fraud Prevention: Detecting and mitigating malicious traffic, unauthorized payment attempts, and abuse of our services.
• Optional Communications: With your prior explicit consent, sending occasional updates on seasonal Himalayan harvests, new farmer stories, or discounts. You may opt out anytime.

4. Sharing and Disclosure of Data

We treat your personal information with absolute respect. We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

We only share strictly required data with vetted third-party service providers (acting as Data Processors):

• Logistics & Courier Partners: Courier aggregators and delivery partners (e.g., India Post, Delhivery, Blue Dart, DTDC) to deliver your parcels.
• Payment Gateways: Reserve Bank of India (RBI) authorized payment aggregators to facilitate secure UPI, debit/credit card, and net banking payments.
• Communication Partners: Transactional SMS and WhatsApp API providers for delivery notifications.
• Law Enforcement & Statutory Authorities: If explicitly mandated by Indian courts, government agencies, or law enforcement bodies under applicable legal process.

5. Cookies and Local Storage

Our website uses essential session cookies and browser local storage strictly to:

• Maintain your shopping basket items across page reloads.
• Remember your delivery PIN code to calculate shipping eligibility.
• Ensure safe session authentication for registered admin users.

You can adjust your browser settings to reject cookies; however, some shopping features (like cart persistence) may function sub-optimally.

6. Data Security and Retention Standards

We implement industry-standard Reasonable Security Practices and Procedures in accordance with Rule 8 of the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011:

• 256-Bit SSL/TLS Encryption: All data transmitted between your device and our servers is secured using modern TLS 1.3 cryptographic protocols.
• Access Controls: Customer order details are accessible strictly to authorized fulfillment personnel on a need-to-know basis.
• Data Retention: We retain personal data only as long as necessary to fulfill customer orders, resolve returns/disputes, and meet statutory tax audit requirements (typically 7 years for GST audit records under Indian law).

7. Your Rights as a Data Principal (DPDP Act, 2023)

Under Section 11, 12, 13, and 14 of the Digital Personal Data Protection Act, 2023, you hold the following statutory rights regarding your personal data:

• Right to Access: Request a summary of personal data held about you and processing activities undertaken.
• Right to Correction & Erasure: Request the rectification of inaccurate data or the deletion of data that is no longer required for legal or transactional obligations.
• Right to Grievance Redressal: Avail of an accessible grievance redressal mechanism regarding any concerns or perceived breach.
• Right to Nominate: Nominate another individual to exercise your data rights in the event of death or incapacity.
• Right to Withdraw Consent: Withdraw consent for non-essential communications at any time without affecting past lawful processing.

8. Updates to This Privacy Policy

We may periodically revise this Privacy Policy to reflect updates in regulatory norms or operational changes. The latest version will always be available on this page, with the "Last Updated" date clearly indicated at the top. We encourage you to review this policy periodically.