Privacy Policy

This Privacy Policy describes how AnnVaya (“we”, “us”, or “our”) collects, uses, processes, stores, and discloses your personal data when you visit our website (annvaya.com), create an account, or place an order with us. This policy applies to all interactions you have with us online and offline in connection with our products and services.

This policy is published in compliance with the following Indian laws and regulations:

• Information Technology Act, 2000 and the IT (Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
• Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules)
• Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020

By using our website or purchasing our products, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy. If you do not agree, please discontinue use of our website and services.

We act as a Data Fiduciary as defined under the DPDP Act, 2023 and are responsible for all personal data processed through our platform. Our Data Processor for payments is Razorpay Software Pvt Ltd, and our hosting platform is Shopify Inc., both of whom process data on our behalf under contractual arrangements.

We collect the following categories of personal data when you interact with AnnVaya:

a) Identity and Contact Data
Full name, email address, mobile phone number, delivery address (including street, city, state, and PIN code), and billing address. This data is collected when you register an account, place an order, or contact us.

b) Order and Transaction Data
Details of products purchased, order value, order history, quantities, discount codes applied, delivery preferences, and order status information.

c) Payment Data
Payment is processed exclusively by Razorpay Software Pvt Ltd, an RBI-authorised Payment Aggregator. We do not receive, store, or process raw card numbers, CVV codes, bank account numbers, UPI PINs, or any other payment credentials. Razorpay processes this data under its own Privacy Policy and PCI-DSS compliance framework.

d) Account Data
Username, hashed password, account preferences, wishlist items, and saved addresses if you create an account on our platform.

e) Technical and Device Data
IP address, browser type and version, device type and operating system, pages visited, time spent on pages, referral URL, and other standard web server log data collected automatically via Shopify and analytics tools.

f) Communication Data
Records of your correspondence with us including emails, WhatsApp messages, and support tickets, including the content of your queries and our responses.

g) Marketing Preferences
Your opt-in or opt-out preferences for marketing communications, including email newsletters, promotional SMS, and WhatsApp marketing messages.

We collect personal data through the following means:

a) Direct Interactions
When you create an account, place an order, fill in a contact or inquiry form, subscribe to our newsletter, participate in a survey or promotion, or contact our customer support team, you directly provide us with personal data.

b) Automated Technologies and Cookies
When you browse our website, we automatically collect technical data using cookies, web beacons, pixels, and similar tracking technologies. This includes session data, browsing behaviour, product views, and cart activity. Please refer to Section 10 (Cookies and Tracking) for full details.

c) Third-Party Sources
We may receive data from the following third-party services operating on our website:

• Google Analytics (Google LLC) — provides aggregated website usage statistics with IP anonymisation enabled. Data is transmitted to Google servers.
• Meta Pixel (Meta Platforms, Inc.) — tracks conversions from Facebook and Instagram advertisements. Data is processed by Meta under its own data policy.
• Shopify Inc. — our e-commerce platform provider that processes order, payment, and customer data on our behalf as a Data Processor.
• Razorpay Software Pvt Ltd — RBI-authorised Payment Aggregator that processes payment data as an independent controller.

We do not purchase personal data from third-party data brokers or marketing lists.

We process your personal data only for specific, lawful purposes. Each purpose and its legal basis under the DPDP Act, 2023 and SPDI Rules, 2011 is listed below:

• Order fulfilment: Processing and delivering your orders. Data used: identity, contact, order, payment data. Legal basis: Contractual necessity.
• Customer support: Responding to queries, complaints and return requests. Data used: identity, contact, communication data. Legal basis: Contractual necessity.
• Payment processing and fraud prevention: Facilitating secure payment via Razorpay. Data used: order and payment data. Legal basis: Contractual necessity and legal obligation.
• Account management: Maintaining your registered account. Data used: account, identity, contact data. Legal basis: Contractual necessity.
• Marketing communications: Sending promotional emails or messages — only if you opt in. Data used: contact and marketing preference data. Legal basis: Consent (opt-in only).
• Analytics and improvement: Understanding website usage to improve our services. Data used: technical and device data. Legal basis: Legitimate interest.
• Legal compliance: Meeting GST, Companies Act and IT Rules obligations. Data used: identity, order, transaction data. Legal basis: Legal obligation.
• Grievance redressal: Addressing complaints under IT Rules 2021 and CPA 2019. Data used: identity and communication data. Legal basis: Legal obligation.

Important: We will not use your personal data for any purpose beyond those listed above without first obtaining your explicit prior consent. You have the right to withdraw consent at any time for consent-based processing without affecting the lawfulness of prior processing.

Under the IT (Sensitive Personal Data or Information) Rules, 2011, certain categories of data are classified as Sensitive Personal Data or Information (SPDI) and require heightened protection and explicit consent for collection.

Financial Information: Payment card details, bank account numbers, and related financial credentials are classified as SPDI. This data is processed exclusively by Razorpay Software Pvt Ltd under PCI-DSS compliance. We do not receive, store, or have access to your raw financial credentials at any point during a transaction. Razorpay acts as an independent data controller for payment data.

Passwords: If you create an AnnVaya account, your password is stored in a one-way cryptographic hash form. We cannot view, access, or recover your plain-text password.

Data We Do Not Collect: We do not knowingly collect biometric data, health or medical records, sexual orientation, physical or mental health conditions, caste or community information, or any other SPDI beyond what is described above. Our products are natural food items and we do not require any health or medical information from you to process your order.

If you believe we have inadvertently collected SPDI beyond what is described here, please contact our Grievance Officer immediately and we will take corrective action within 48 hours of receiving your notice.

We do not sell, rent, or trade your personal data to any third party for their independent marketing or commercial purposes. We share your data only in the following limited circumstances:

a) Razorpay Software Pvt Ltd (Payment Processing)
Your payment data is shared with Razorpay, our RBI-authorised Payment Aggregator, solely to process transactions. Razorpay is an independent data controller for payment data and operates under its own Privacy Policy at razorpay.com/privacy. We have no access to your card or banking credentials.

b) Shopify Inc. (Platform Infrastructure)
Our website is hosted on Shopify’s e-commerce platform. Shopify processes order, customer, and operational data on our behalf as a Data Processor under a Data Processing Agreement. Shopify implements enterprise-grade security and is subject to applicable data protection standards.

c) Logistics and Courier Partners
We share your name, delivery address, and mobile phone number with our logistics and courier partners solely for the purpose of delivering your order. These partners are contractually prohibited from using your data for any other purpose.

d) Analytics and Advertising Platforms
Google Analytics: We use Google Analytics with IP anonymisation enabled. Opt out at tools.google.com/dlpage/gaoptout.
Meta Pixel: We use Meta Pixel to measure advertising effectiveness. Manage preferences at facebook.com/ads/preferences.

e) Government and Regulatory Authorities
We will disclose your data to law enforcement, courts, regulators (including FSSAI, tax authorities, and the Data Protection Board of India), or other government bodies when required by a lawful order, legal obligation, or court direction under Indian law.

f) Business Transfers
In the event of a merger, acquisition, or sale of business assets, your data may be transferred to the acquiring entity subject to equivalent data protection obligations.

We retain your personal data only for as long as necessary for the purpose collected or as required by law:

• Order and transaction records: 7 years from date of transaction (GST Act, Companies Act, Income Tax Act)
• Active account data: Duration of account plus 6 months after account deletion (Contractual necessity and IT Rules 2021)
• Marketing consent and preferences: Until withdrawal of consent plus 30 days for processing (DPDP Act, 2023)
• Customer support communications: 2 years from last communication (Legitimate interest and CPA 2019)
• Technical and server log data: 12 months (IT Rules, 2021)
• Cancelled or deleted account data: Minimum 180 days post deletion (IT (Intermediary Guidelines) Rules, 2021 — mandatory)
• Grievance records: 3 years from resolution (Consumer Protection Act, 2019)

After the applicable retention period expires, we will securely delete or anonymise your personal data in a manner that prevents reconstruction or re-identification.

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights with respect to your personal data held by us:

a) Right to Access Information
You may request a summary of the personal data we process about you, the purposes for which it is processed, and the identities of any Data Processors or third parties with whom it has been shared.

b) Right to Correction and Updation
You may request correction of inaccurate, incomplete, or outdated personal data. Most account details can be updated directly in your AnnVaya account dashboard.

c) Right to Erasure
You may request erasure of personal data no longer necessary for its original purpose, subject to our legal obligations (for example, transaction records required for GST compliance). We will process erasure requests within 30 days and notify you of the outcome.

d) Right to Withdraw Consent
Where we process data on the basis of consent (for example, marketing communications), you may withdraw consent at any time using the unsubscribe link in our emails, or by contacting us. Withdrawal does not affect the lawfulness of processing that occurred prior to withdrawal.

e) Right to Grievance Redressal
You may raise grievances with us regarding our data practices. We acknowledge within 48 hours and resolve within 30 days as required by the DPDP Act and IT Rules, 2021.

f) Right to Nominate
Under the DPDP Act, 2023, you may nominate another individual to exercise your data rights in the event of your death or incapacity. Contact our Grievance Officer to register a nomination.

Rights under SPDI Rules, 2011: You also have the right to review personal data (including SPDI) we hold about you and to request correction of inaccuracies by submitting a written request to our Grievance Officer.

To exercise any right, email our Grievance Officer with the subject line “Data Rights Request — [Your Name]” with proof of identity. We will respond within the timelines prescribed by applicable law.

Our website, products, and services are intended for individuals who are 18 years of age or older. We do not knowingly collect, process, or store personal data of minors (persons under 18 years) without verifiable parental or guardian consent.

Under the Digital Personal Data Protection Act, 2023, processing personal data of children (persons below 18 years) requires verifiable consent from a parent or lawful guardian before any processing occurs. We do not conduct behavioural tracking or serve targeted advertising directed at children.

If you are under 18, please do not use our website or submit personal information without the explicit supervision and consent of a parent or guardian.

If we become aware that we have inadvertently collected personal data from a minor without verifiable parental consent, we will immediately delete such data from our systems. If you believe we may have collected data about a minor, please contact our Grievance Officer and we will act within 48 hours of receiving your report.

Our website uses cookies and similar tracking technologies to operate, improve, and personalise your experience. The following categories of cookies are used:

a) Essential / Strictly Necessary Cookies (Cannot be disabled)
Required for the website to function correctly, including maintaining your shopping cart, processing checkout, managing login sessions, and ensuring website security. These cookies do not track you for advertising purposes and cannot be disabled while using the site.

b) Analytics Cookies (Opt-out available)
We use Google Analytics with IP anonymisation to understand how visitors use our website. Google may transfer this data to its servers outside India. Opt out using the Google Analytics Opt-out Browser Add-on.

c) Marketing and Advertising Cookies (Consent required)
We use Meta Pixel and Google Ads tracking to measure advertising campaign effectiveness and enable retargeting. You may manage these preferences through:

• Your browser settings (delete or block third-party cookies)
• Meta Ad Preferences
• Google Ads Settings

Managing Cookies: You may control and delete cookies through your browser settings. Disabling certain cookies may affect website functionality. We seek your consent before placing non-essential cookies on your device as required by applicable Indian law.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure:

• HTTPS Encryption: All data transmitted between your browser and our website is encrypted using TLS (HTTPS).
• Razorpay PCI-DSS Compliance: Payment data is handled by Razorpay, certified to the Payment Card Industry Data Security Standard (PCI-DSS Level 1).
• Shopify Security Infrastructure: Our platform implements enterprise-grade security including encryption at rest, regular security audits, and SOC 2 Type II compliance.
• Password Hashing: Account passwords are stored as irreversible cryptographic hashes. We cannot access or recover your plain-text password.
• Access Controls: Access to customer data is restricted on a need-to-know basis within our organisation, and team members are bound by confidentiality obligations.
• Regular Security Reviews: We periodically review our data handling practices and security controls.

Data Breach Notification: In the event of a personal data breach likely to cause harm to you, we will notify you and the Data Protection Board of India (once operational) within the timelines prescribed under the DPDP Act, 2023. Breach notifications will be sent to your registered email address.

While we implement robust safeguards, no transmission or storage method is completely secure. We encourage you to use a strong, unique password and to log out from shared devices.

We may update this Privacy Policy to reflect changes in our practices, services, or applicable law. When changes are made, we will update the “Last Updated” date at the top of this page.

For material changes that significantly affect your rights or our data practices, we will provide at least 30 days’ advance notice by email to your registered address, as required under the IT (Intermediary Guidelines) Rules, 2021.

Your continued use of our website or services after the effective date of any updated policy constitutes your acceptance of the revised terms. If you do not agree, you may close your account and discontinue use of our services before the effective date.

We recommend reviewing this page periodically to remain informed about how we protect your information.

The Digital Personal Data Protection Act, 2023 establishes the Data Protection Board of India (DPBI) as the nodal regulatory authority for personal data protection in India.

If you are dissatisfied with our response to your data rights request or grievance after first escalating to our Grievance Officer, you have the right to lodge a complaint with the Data Protection Board of India once it becomes operational. Information about the DPBI, its complaint procedures, and contact details will be updated on this page as the DPBI becomes fully operational. For official updates, refer to the Ministry of Electronics and Information Technology (MeitY) website at meity.gov.in.

Separately, for issues related to defective products, unfair trade practices, or e-commerce order disputes, you may also approach the National Consumer Helpline at 1800-11-4000 or the District Consumer Disputes Redressal Commission in your jurisdiction under the Consumer Protection Act, 2019.