Privacy Policy

1. Introduction

Welcome to Trishikha Organics ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or make a purchase from us.

This policy is published in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 notified by the Government of India. We act as a "Data Fiduciary" under the DPDP Act for the personal data we process.

2. Information We Collect

We collect information that you provide directly to us when you:

• Place an order on our website
• Contact us with inquiries or feedback
• Submit a grievance, correction, or deletion request via /my-data

Personal information we collect includes:

• Name (first and last name) — for order processing and communication
• Email address — for order confirmations, shipping updates, and data access
• Phone number — for delivery coordination
• Shipping and billing address — for delivery and invoicing
• Payment information — processed securely via Razorpay (we do not store card details)

3. Legal Basis & How We Use Your Information

Your personal data is processed under Section 7 of the DPDP Act, 2023 (Legitimate Uses) — processing is necessary to fulfill orders you voluntarily place. No separate consent is required for order processing.

We use the information we collect for the following purposes:

• Order Fulfillment: To process, ship, and deliver your orders (Section 7 legitimate use)
• Communication: To send order confirmations, shipping updates, and respond to your inquiries
• Customer Service: To provide customer support and handle returns or refunds
• Legal Compliance: To comply with applicable laws including the Income Tax Act and CGST Act

4. Third-Party Services

We use trusted third-party services to operate our business:

• Razorpay: For secure payment processing. Your payment information is handled directly by Razorpay and is subject to their privacy policy.
• Shiprocket: For order fulfillment and shipping. We share your shipping address with our logistics partners to deliver your orders.
• Supabase: For secure storage of order data, customer information, and authentication (database hosting).

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes:

• SSL/TLS encryption for all data transmission
• Secure payment processing through Razorpay (PCI-DSS compliant)
• Regular security assessments and updates
• Access controls and authentication measures

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

• Order and transaction data: Retained for a minimum of 8 years from the end of the relevant financial year, as required under Section 36 of the Central Goods and Services Tax (CGST) Act, 2017.
• Non-transactional personal data: Deleted upon request or when the purpose for collection has been fulfilled, subject to the 14-day cooling-off period under the DPDP Rules, 2025.
• Inactive accounts: Data associated with accounts inactive for over 1 year may be scheduled for deletion, with prior notice to you.

7. Your Rights as a Data Principal

Under the DPDP Act, 2023 and DPDP Rules, 2025, you ("Data Principal") have the following rights regarding your personal data:

• Right to Access (Rule 14): Request a summary of your personal data we hold and the processing activities performed on it.
• Right to Correction (Rule 14): Request correction of inaccurate or incomplete personal data, including your name, phone number, and address. Correction requests are reviewed and processed by our team.
• Right to Erasure (Rule 8): Request deletion of your personal data. Deletion requests are subject to a 14-day cooling-off period during which you may cancel. Data associated with paid orders is retained for 8 years as required by tax law.
• Right to Data Portability: Request your personal data in a commonly used, machine-readable format (JSON).
• Right to Nominate (Rule 14): Appoint a nominee who may exercise your rights on your behalf in the event of your death or incapacity via /nominee.
• Right to File a Grievance: Submit a grievance to our Grievance Officer regarding the processing of your personal data via /grievance.
• Right to Complain to the Data Protection Board: If your grievance is not resolved within 90 days, or you are unsatisfied with our response, you may file a complaint with the Data Protection Board of India.

To exercise any of these rights, visit your data management page at /my-data or contact us at trishikhaorganic@gmail.com.

8. Grievance Redressal

In accordance with Rule 14(3) of the DPDP Rules, 2025, if you have any concerns or complaints regarding the processing of your personal data, you may submit a grievance. We are committed to resolving all grievances within 90 days of receipt.

You can file a grievance online at /grievance or via email.

If your grievance is not resolved within 90 days, or if you are not satisfied with our response, you may file a complaint with the Data Protection Board of India as established under the DPDP Act, 2023.

9. Nominee Appointment

Under Rule 14 of the DPDP Rules, 2025, you have the right to appoint a nominee who may exercise your data principal rights on your behalf in the event of your death or incapacity. You can appoint or manage your nominee at /nominee. If you are a nominee and need to submit a claim, visit /nominee-claim.

10. Cookies

We use essential cookies to ensure the proper functioning of our website, including maintaining your shopping cart and authentication status. We do not use third-party tracking or advertising cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: