Privacy Policy

We have tried to write this in plain language rather than legalese. Where the law uses a specific term — Data Principal (you), Data Fiduciary (us), Data Processor (a supplier acting on our instructions) — we have used it and explained it.

Who we are

This website is operated by [full registered legal name of the firm, as filed with the Registrar of Firms / GST registration] (Firm), trading as The Nilgiri Root. In the language of the Digital Personal Data Protection Act, 2023 (the DPDP Act), we are the Data Fiduciary for the personal data described here — meaning we decide why and how it is processed, and we are accountable for it.

What this policy covers

This policy applies to personal data we process about people in India in connection with https://www.thenilgiriroot.com, our sales and enquiry channels, and our business relationships. It applies whether you reach us through the website, WhatsApp, email or phone.

It does not cover:

• Websites and services operated by other companies that we link to. Once you follow a link away from our site, their privacy terms apply, not ours.
• Personal data we process purely on behalf of a business customer under a separate contract, where that customer decides the purposes — in those cases they are the Data Fiduciary and we act as a Data Processor.
• Data that is not personal data — for example aggregated statistics from which no individual can be identified.

The DPDP Act does not apply to personal data you yourself make publicly available, or to data processed for purely personal or domestic purposes.

The personal data we collect

We collect only what we need for a specific, stated purpose. We do not sell personal data, and we do not buy contact lists.

Data you give us directly

• Quotation and enquiry forms — your name, company, designation, email, phone number, city and state, optionally your GSTIN, and the requirement details you choose to describe (cut sizes, volumes, packaging, delivery dates, notes).
• Newsletter — your email address only.
• Contact form, WhatsApp and the on-site assistant — whatever you choose to write to us, plus the contact details you provide so we can reply.

Data we collect automatically

• Technical and security data — IP address, browser and device type, and request timestamps. We use these to keep the site available and to stop automated abuse of our forms.
• Usage data — which pages you viewed, how you arrived, and approximate region. This is collected only if you accept analytics cookies, and it is pseudonymous.

Data we do not want

Please do not send us financial account details, government identifiers such as Aadhaar or PAN, health information, or any other sensitive personal data through the website forms or the chat assistant. We have no business need for it. If you send it anyway we will delete it once we have dealt with your message.

Why we are allowed to process it

Under the DPDP Act, personal data may be processed either with your consent (section 6) or for certain legitimate uses (section 7). We rely on both, depending on the activity. The table under How we use it states which basis applies to each purpose.

Where we rely on consent

Where we ask for consent, we ask for it separately for each purpose — accepting analytics does not subscribe you to marketing, and vice versa. Our consent requests are specific, informed and unambiguous, and are never bundled into a single take-it-or-leave-it checkbox. Consent is as easy to withdraw as it was to give: use Your Privacy Choices at any time.

Withdrawing consent does not make our earlier processing unlawful, and it does not affect processing that rests on a legitimate use. If withdrawal means we can no longer do something for you — for example, send you the updates you asked for — we will simply stop doing that.

Where we rely on legitimate uses

Section 7(a) of the DPDP Act permits processing where you have voluntarily provided your personal data for a specified purpose and have not indicated that you object. When you fill in a quotation form, you are voluntarily giving us your details precisely so that we can quote — so we may use them for that. We also rely on legitimate uses to keep our systems secure and to comply with law.

How we use your data, purpose by purpose

This table is generated from the same configuration that drives the consent controls on this site, so it cannot drift out of step with what actually happens.

We do not use your personal data to make automated decisions that produce legal or similarly significant effects about you, and we do not profile you for advertising.

Who we share it with

We share personal data only with suppliers who process it on our written instructions as Data Processors, and only as far as they need it to do their job. They may not use it for their own purposes.

• Supabase — hosting, database and serverless functions behind this site.
• Google Analytics (Google LLC) — usage measurement, only where you have accepted analytics cookies.
• Our email delivery provider — sending transactional replies and, where you have subscribed, newsletters.
• WhatsApp (Meta Platforms) — only where you choose to start a WhatsApp conversation with us.

We may also disclose personal data where we are legally obliged to: to a court, a regulator, or a law enforcement agency acting under lawful authority. We will not hand over data on an informal request without a lawful basis for doing so.

If our business is ever sold or reorganised, personal data may transfer to the acquiring entity. We would tell you before that happened and your rights would carry over unchanged.

Where your data is stored, and transfers outside India

Some of the suppliers listed above operate infrastructure outside India, so your personal data may be stored or processed abroad. Section 16 of the DPDP Act permits transfers of personal data outside India, except to territories that the Central Government specifically restricts by notification. We monitor those notifications and will stop transfers to any restricted territory.

Where data does leave India, we:

• keep a written record of the transfer, the destination and the supplier;
• put a data processing agreement in place with binding confidentiality and security obligations;
• require the supplier to assist us in meeting your rights requests and our breach-reporting duties;
• transfer only the minimum data needed for the purpose.

Sector-specific rules may separately require certain records to be kept in India. Where they apply to us, we follow them.

Note for review: the specific hosting regions for each supplier, and the executed data processing agreements, need to be confirmed and listed here before publication.

How long we keep it

We keep personal data only as long as the purpose it was collected for still exists, plus any period we are legally required to retain it for — for instance tax and food-safety record-keeping obligations. The per-purpose periods are in the table above.

Once a retention period ends we delete the data or irreversibly anonymise it. Where data is held in backups it is removed on the normal backup rotation rather than immediately, and remains protected in the meantime.

Your rights as a Data Principal

Chapter III of the DPDP Act gives you the following rights. They are free to exercise.

Right to access information about your data

You can ask us for a summary of the personal data we hold about you, what we are doing with it, and the identities of any other Data Fiduciaries and Processors we have shared it with — together with a description of what was shared.

Right to correction, completion, updating and erasure

You can ask us to correct data that is inaccurate or misleading, complete data that is incomplete, update data that has gone stale, and erase data we no longer need. We will erase on request unless we are required by law to keep it — if that applies, we will tell you which obligation prevents deletion and when it expires.

Right of grievance redressal

You can complain to us about anything in this policy or how we have handled your data, and we must respond. See Grievances and escalation. You must give us the chance to resolve your complaint before approaching the Data Protection Board of India.

Right to nominate

You can nominate another individual to exercise these rights on your behalf if you die or become incapacitated. Tell us through the grievance channel and we will record the nomination.

Right to withdraw consent

Where we rely on your consent, you can withdraw it at any time and as easily as you gave it, through Your Privacy Choices.

Your duties

The DPDP Act also places duties on Data Principals: not to impersonate someone else when providing data, not to suppress material information, not to register false or frivolous grievances, and to provide only authentic information when asking us to correct or erase data. The Act provides for penalties where these duties are breached.

How to exercise your rights

The quickest route is Your Privacy Choices, where you can review your consent settings, change them, and raise a request. You can also email contact@thenilgiriroot.com.

So that we do not disclose someone's data to the wrong person, we need to be reasonably satisfied you are who you say you are. We will normally verify by sending a confirmation link to the email address already on our records. We will not ask you for identity documents unless there is a genuine doubt.

We aim to respond within 30 days. If a request is unusually complex we will tell you why and how much longer we need.

Children and persons with a guardian

This is a business-to-business site and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18.

Under section 9 of the DPDP Act, processing a child's personal data requires verifiable consent from a parent or lawful guardian. The Act also prohibits tracking, behavioural monitoring and targeted advertising directed at children, and any processing likely to cause a detrimental effect on a child's well-being. The same protections apply to a person with a disability who has a lawful guardian.

If we become aware that we hold a child's personal data without verifiable parental consent, we will delete it. If you believe a child has given us their details, please contact contact@thenilgiriroot.com and we will remove it promptly.

Cookies and similar technologies

Cookies are small files stored on your device. We group ours into three categories, and you control the optional ones. Non-essential cookies are not set until you accept them — there is no pre-ticked box and no "continuing to browse means you agree".

• Strictly necessary (always on) — Required for the site to function — remembering your consent choices, keeping you signed in, and protecting forms from abuse. These cannot be switched off.
• Analytics (optional) — Help us understand which pages are useful and where people get stuck, so we can improve the site. Aggregated and pseudonymous — we don't use these to identify you.
• Marketing (optional) — Would let us measure which campaigns bring buyers to the site and show relevant follow-ups. We do not currently set any marketing cookies — this control is here so that if we ever do, your existing choice is already on record.

The full inventory — every cookie, its provider, purpose and lifetime — is in the Cookie Policy. You can change your choices whenever you like from Your Privacy Choices, and you can also clear or block cookies in your browser settings.

How we protect your data

Section 8(5) of the DPDP Act requires us to take reasonable security safeguards to prevent a personal data breach. The measures we currently rely on include:

• encryption in transit (HTTPS/TLS) across the whole site, and encryption at rest in our database;
• row-level access controls so that records are only readable by the roles that need them;
• a Content Security Policy and related HTTP security headers to reduce injection and clickjacking risk;
• rate limiting and spam controls on public forms;
• access to production systems limited to the people who need it;
• contractual security obligations on every Data Processor we use.

No system is perfectly secure, and we do not claim otherwise. What we do commit to is handling a failure properly — see below.

If there is a personal data breach

Section 8(6) of the DPDP Act requires us to notify both the Data Protection Board of India and every affected Data Principal if a breach occurs. Our procedure is:

1. Contain and assess — stop the exposure and establish what data, and whose, was involved.
2. Tell you without delay — we will describe the nature and extent of the breach, when it happened, the likely consequences, what we have done about it, and what you can do to protect yourself. We will give you a contact point for questions.
3. Notify the Board — an initial intimation without delay, followed by a detailed report within 72 hours covering the circumstances, the mitigation taken, the findings on who caused it, and the remedial measures put in place to prevent recurrence.
4. Record and learn — every incident is logged in our internal breach register with its timeline and outcome, whether or not it met the notification threshold.

Note for review: the 72-hour detailed-report window follows the Draft DPDP Rules. Confirm the timelines against the Rules as finally notified before publication, and confirm the internal escalation owners.

Our obligations as a Data Fiduciary

Independently of any request from you, we are required to and do:

• process personal data only for a lawful purpose, and only as much as that purpose needs;
• make reasonable efforts to keep the data we hold accurate, complete and consistent, particularly where it will be used to make a decision affecting you or shared with another fiduciary;
• maintain reasonable security safeguards;
• erase personal data once its purpose is served and no legal retention obligation remains, and ensure our Processors do the same;
• publish the contact details of a person able to answer your questions about processing;
• operate a grievance redressal mechanism;
• engage Processors only under a valid contract;
• remain accountable for compliance even where processing is carried out by a Processor on our behalf.

We have not been designated a Significant Data Fiduciary by the Central Government. That designation triggers additional obligations — appointing a Data Protection Officer based in India, appointing an independent data auditor, and conducting periodic Data Protection Impact Assessments. If we are ever designated as one, we will comply and update this policy. In the meantime, questions and complaints go to our grievance officer below.

Grievances and escalation

If you are unhappy with how we have handled your personal data or your request, please tell us first. We take complaints seriously and would rather fix a problem than have you escalate it.

If we do not resolve it. If you have raised a grievance with us and are not satisfied with the outcome — or we have not responded in time — you may complain to the Data Protection Board of India. Exhausting our internal process first is a precondition under the DPDP Act. Contact details and the procedure are published by the Board.

Changes to this policy

We update this policy when our processing changes or the law does. The "last updated" date at the top always reflects the current version.

If a change materially affects your rights or introduces a new purpose that relies on your consent, we will not simply update the page: we will tell you directly — by email where we have your address, and by a notice on the site — and where consent is needed we will ask for it afresh before the new processing starts. Continuing to use the site is not treated as agreement to a new purpose.

Available in English. If you would prefer to receive this policy or communicate with our grievance officer in हिन्दी or தமிழ், please write to contact@thenilgiriroot.com and we will arrange it. The DPDP Act entitles you to access consent notices in any language listed in the Eighth Schedule to the Constitution.