Privacy Policy

DRAFT -- pending review by legal counsel. Not a final legal document. PRIVACY POLICY This policy is aligned to India's Digital Personal Data Protection Act, 2023 (DPDP Act). Naatu Sandhai acts as the Data Fiduciary for personal data collected through the platform; you are the Data Principal. 1. PERSONAL DATA WE COLLECT Account details (name, phone number, email), delivery addresses, order history, and any other information you provide when interacting with the platform. 2. LAWFUL BASIS AND PURPOSE We process your personal data on the basis of your consent, given when you create an account, and to the extent necessary to perform our contract with you (processing your order). We use it to: process orders and coordinate with sellers; communicate with you about orders, delivery, and support; and meet our legal obligations under applicable law (e.g. GST invoicing). 3. WHO WE SHARE DATA WITH Your delivery address and order details are shared only with the seller fulfilling that specific order. We do not sell your personal data. 4. DATA RETENTION We retain your personal data for as long as your account is active, and thereafter only as required to meet our legal and tax record-keeping obligations. 5. CROSS-BORDER TRANSFER Naatu Sandhai does not currently transfer personal data outside India. If this changes, this policy will be updated accordingly before any such transfer takes place. 6. YOUR RIGHTS AS A DATA PRINCIPAL Under the DPDP Act, you have the right to: (a) obtain a summary of the personal data we hold about you and the processing activities; (b) request correction, completion, or updating of your personal data; (c) request erasure of your personal data (subject to our legal retention obligations); (d) nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and (e) withdraw consent at any time, as easily as it was given -- withdrawal does not affect the lawfulness of processing carried out before withdrawal. 7. GRIEVANCE / DATA PROTECTION CONTACT Requests regarding your personal data, or grievances about how it is handled, may be directed to [email protected]. We aim to acknowledge and respond to such requests within a reasonable period, consistent with the DPDP Act's requirements. 8. DATA BREACH NOTIFICATION In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act. 9. COOKIES The platform uses essential session cookies (e.g. for login, cart). These are necessary for the site to function. 10. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. Material changes will be noted on this page; continued use after a new version is published constitutes acknowledgement of the updated policy.