Privacy Policy

Spice Roots India ("we", "our", "us") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and what rights you have regarding your personal data. We comply with India's Digital Personal Data Protection Act, 2023 (DPDPA).

1. Information We Collect

Personal Identification: Full name, email address, phone number, and delivery address collected at registration and checkout.
Transaction Data: Order history, payment status (processed securely via Razorpay — we never store card details), and invoice records.
Device & Usage Data: IP address, browser type, pages visited, time on site, and referral URL for analytics purposes.
Communications: Messages sent via our Contact form or WhatsApp support.

2. How We Use Your Information

To process and fulfil your orders, send shipping confirmations and delivery updates.
To send promotional emails and SMS (only if you opted in — you can unsubscribe anytime).
To improve our website, catalogue, and customer experience using aggregated analytics.
To comply with legal obligations under Indian tax law (GST Act) and satisfy FSSAI traceability requirements.

3. Data Sharing

Shipping Partners: Your name, address, and phone are shared with Delhivery / Shiprocket solely to fulfill delivery.
Payment Gateway: Order amounts are securely handled by Razorpay (PCI-DSS compliant). We receive only payment confirmation.
Analytics: Anonymised, aggregated data may be processed by Google Analytics. No personally identifiable data is sold, ever.
We do NOT sell or rent your personal data to any third party.

4. Data Storage & Retention

All data is stored on AWS servers located in Mumbai (ap-south-1) region.
Account data is retained for 3 years after your last activity or until deletion is requested.
Order records are retained for 7 years as required by Indian GST and accounting regulations.

5. Your Rights (DPDPA 2023)

Right to Access: Request a copy of all personal data we hold about you.
Right to Correction: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your account and associated data (subject to legal retention requirements).
Right to Withdraw Consent: Unsubscribe from marketing at any time via link in emails or by emailing privacy@spicerootsindia.com.

6. Cookies

We use essential cookies (cart, session) and optional analytics cookies (Google Analytics).
You can manage cookie preferences in your browser settings. Disabling cookies may limit some website features.

7. Contact Us

For any privacy-related requests: privacy@spicerootsindia.com or write to: Spice Roots India, Idukki District, Kerala — 685501.
We will respond to data requests within 30 days as required by DPDPA.