Privacy Policy

Bombay Namkeen operates a family-owned Gujarati farsan and snack manufacturing business based in Kanpur, Uttar Pradesh. Our website provides a digital product catalogue, local cart estimation, and direct WhatsApp order inquiries.

We value your personal privacy and are committed to processing your personal data lawfully, fairly, and transparently in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian information technology regulations.

We practice data minimization and only collect personal information that you voluntarily provide or that is strictly necessary to operate our website and fulfill orders:

• Order & Enquiry Details: When you prepare an order or submit a wholesale enquiry, you may provide your Name, Mobile/WhatsApp Phone Number, Delivery Address, Landmark, City, and Pincode.

• Contact Inquiries: When submitting our website contact form, you provide your Name, Email Address (optional), Phone Number, and message.

• Device & Consent Receipts: We record an anonymous first-party consent receipt identifier, your category selections (Essential, Analytics, Marketing), and coarse server-derived metadata (browser family, coarse device category, and truncated IP for audit security). We do NOT perform device fingerprinting or collect biometric data.

• No Financial Card Data: Bombay Namkeen does NOT operate an online payment gateway on this website and does not collect or store credit card, debit card, or netbanking passwords. All transactions are finalized via official WhatsApp through UPI or cash-on-delivery/pickup.

We process your data strictly for specified, lawful business purposes:

• Order Fulfillment & Verification: To prepare your snack parcel, verify live stock availability, calculate courier delivery fees, and coordinate dispatch through official WhatsApp.

• Customer Communication: To respond to product inquiries, bulk wedding gifting requests, and support queries.

• Security & Fraud Prevention: To enforce atomic rate limiting on forms, prevent automated spam attacks, and maintain immutable consent audit logs as required by law.

• Service Improvement: When optional analytics consent is granted, to understand general catalogue traffic trends in an aggregated, non-personalized manner.

We do NOT sell, rent, trade, or monetize your personal data to any third-party advertisers or data brokers.

Your data is shared only on a strict need-to-know basis with:

• Logistics & Delivery Partners: Third-party courier and local delivery services (e.g., Delhivery, India Post, or local riders) strictly to deliver your packaged parcel to your address.

• Infrastructure Providers: Secure enterprise cloud hosting (Supabase / PostgreSQL) hosted with ISO/IEC 27001-certified data centres and Row Level Security encryption.

• Statutory & Legal Authorities: Only when required under a lawful subpoena, court order, or statutory compliance obligation under Indian law.

• Guest Cart & Preferences: Stored locally in your browser storage until cleared or superseded.

• Order & Wholesale Inquiries: Retained for up to 3 years to satisfy statutory accounting, GST audit, and business record requirements, after which records are archived or safely deleted.

• Consent Records: Retained for a documented period of 3 years to demonstrate compliance with consent mandates under the DPDP Act.

• Customer Erasure: You may request erasure of your non-statutory personal data at any time through our Privacy Requests portal.

As a Data Principal under Indian law, you possess enforceable rights regarding your personal data:

• Right to Access Summary: You may request a summary of personal data processed by us and the processing activities undertaken.

• Right to Correction & Updating: You may request correction of inaccurate or misleading personal data or completion of incomplete records.

• Right to Erasure: You may request deletion of personal data that is no longer necessary for the purpose for which it was collected or mandated by law.

• Right of Grievance Redressal: You have the right to register a grievance with our designated Grievance Officer and receive resolution within 30 days.

• Right to Nominate: You may nominate an individual who will exercise your rights in the event of death or incapacity.

• Right to Complain: If your grievance is unresolved, you may lodge a complaint with the Data Protection Board of India once operationalized.

For any questions, data access requests, or privacy grievances, please contact our designated Grievance Officer:

• Name: Mr. Nikhil Chauhan (Grievance & Privacy Officer)

• Organization: Bombay Namkeen

• Address: 8/210, Khalasi Line, Arya Nagar, Kanpur, Uttar Pradesh 208002

• Phone: +91 9794031047

• Email: privacy@bombaynamkeen.in / orders@bombaynamkeen.in

• Dedicated Request Portal: Visit our Contact & Privacy Requests page to submit an electronic ticket.

Notice: This Privacy Policy has been prepared for operational transparency and statutory guidance under the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Consumer Protection (E-Commerce) Rules, 2020. Final legal review by qualified Indian legal counsel is recommended prior to formal statutory filings.