Privacy Policy

Compliant with the Digital Personal Data Protection (DPDP) Act, 2023

Last Updated: March 2025

We respect your personal privacy and are committed to safeguarding the personal data of our Bengaluru customers and visitors under the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

1. Categories of Personal Data Collected

We collect only the minimum necessary personal data required to process your subscription and fulfill agricultural deliveries:

• Identity Data: Full Name.

• Contact Information: Mobile Phone Number (used for order verification and WhatsApp orchard photo/video dispatches), Email Address.

• Fulfillment Data: Bengaluru delivery address (street address, apartment/villa complex, flat number, and 6-digit pin code).

• Farm Visit Information: Vehicle registration number (for Magadi gate security) and headcount of accompanying guests.

• Technical Information: IP address, browser type, and interaction metrics on our 3D interactive canopy experience.

Note: We do not process, capture, or store credit card, debit card, or UPI PIN numbers. All payment processing is handled by RBI-authorized Payment Aggregators (e.g., Razorpay / Cashfree / PhonePe).

2. Purpose of Data Processing & Lawful Grounds

Your data is processed strictly based on your clear, affirmative consent for the following specified purposes:

• Reserving your specific tree or modular quota in the Magadi orchard.

• Sending automated phenological updates (flowering, fruit-set, and harvest updates via WhatsApp).

• Routing delivery batches through Bangalore logistics partners within 48 hours of harvest.

• Issuing digital QR Gate Passes for authorized weekend entry to the Magadi farm.

• Statutory tax and accounting compliance under Indian law.

3. Data Storage, Retention & Security

3.1. Data Localization: All personal data is hosted and stored on secure cloud servers.

3.2. Retention Period: Personal data is retained for the duration of the mango harvest season (April to July) plus an additional statutory retention period of up to 3 years for tax and dispute records, after which it is permanently purged or anonymized.

3.3. Technical Security: We enforce 256-bit SSL encryption across all website routes, role-based access control, and tokenized APIs for our WhatsApp updates.

4. Third-Party Data Sharing

We do not sell, rent, or trade your personal data. We disclose information strictly on a need-to-know basis with:

• Logistics Partners: Bengaluru-based last-mile dispatch personnel (Name, Phone, Delivery Address only).

• Communication Service Providers: WhatsApp to send automated orchard photos and delivery notifications.

• Statutory Authorities: Only when mandated by Indian law enforcement or regulatory authorities.

5. Your Rights as a Data Principal (Under DPDP Act 2023)

As a Data Principal residing in India, you hold the following statutory rights:

• Right to Access & Summary: You can request a summary of your personal data processed by us.

• Right to Correction & Erasure: You can update inaccurate data or request complete deletion of your data once fulfillment is concluded.

• Right to Nominate: In the event of death or incapacity, you can nominate an individual to exercise your rights.