Privacy Policy

Introduction and Data Fiduciary

This Privacy Policy describes how Arata Nutraceuticals ("Arata Nutraceuticals", "we", "our", "us") collects, uses, shares, protects and otherwise processes your personal data through our website ARATANUTRA.COM ("Platform").

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Arata Nutraceuticals is the Data Fiduciary that determines the purpose and means of processing your personal data. Our registered office is Flat No. 107, Vasantha Green View, Sy No. 79 of Hafeezpet, Miyapur, Hyderabad 500049, Telangana, India.

You may browse certain sections of the Platform without registering with us. We do not offer any product or service under this Platform outside India, and your personal data will primarily be stored and processed in India.

By visiting this Platform, providing your information, or availing any product or service offered on the Platform, you expressly consent to the processing of your personal data in accordance with this Privacy Policy, the Terms of Use, and the applicable service/product terms. If you do not agree, please do not use or access our Platform.

Personal data we collect

We collect the following categories of personal data:

Contact and identity data — name, email address, telephone / mobile number, and any information you provide as proof of identity or address.

Order data — shipping address, city, state, PIN code, order history, communication preferences.

Payment data — collected and processed directly by our payment gateway (Razorpay). We do not store your full card number, CVV, UPI PIN or net-banking password on our servers. We only receive a transaction reference and the last four digits of the payment instrument for reconciliation.

Technical data — IP address, device type, browser type, operating system, referring URL, pages viewed and timestamps, collected via cookies and analytics tools (see 'Cookies and analytics' below).

Communications — the content of any emails, WhatsApp messages, or support tickets you send us.

If you receive an email or a call from a person or association claiming to be Arata Nutraceuticals and asking for a card PIN, net-banking password or one-time password, do not share it. Report the incident to us at aratanutra@gmail.com and to your bank.

Purposes and legal basis for processing

We process your personal data for the following purposes, on the legal basis noted for each:

• Fulfilling your order (name, address, phone, payment) — legitimate contractual purpose under the DPDP Act.
• Sending order confirmation, dispatch and delivery updates by email and WhatsApp — necessary for performance of the order.
• Providing customer support and handling grievances — necessary for performance and required under Consumer Protection (E-Commerce) Rules, 2020.
• Detecting, preventing and investigating fraud, unauthorised transactions and abuse of the Platform — legitimate interests.
• Complying with tax, accounting and other statutory obligations — legal obligation.
• Analysing website usage in aggregated, anonymised form (via Google Analytics 4 and Meta Pixel) — only after you provide consent through the cookie banner.
• Marketing communications about our products, offers and updates — only after you provide consent, and you may withdraw consent at any time.

Third-party processors and disclosures

We share personal data only with the following categories of trusted third parties, each of which processes data on our behalf under a contract requiring appropriate security and confidentiality:

We may also disclose personal data to government agencies, courts or law enforcement authorities if required to do so by law or in good-faith belief that such disclosure is reasonably necessary to respond to legal process, enforce our Terms, or protect the rights, property, or safety of our users or the public.

• Netlify Inc. (hosting and application runtime) — processes technical data and any data submitted through the Platform.
• Razorpay Software Pvt. Ltd. (payment processing) — processes name, email, phone and payment instrument details.
• Resend Inc. (transactional email delivery) — processes name and email address to send order confirmations and shipping notifications.
• Courier and logistics partners (e.g. Bluedart, DTDC, India Post, as applicable per shipment) — processes name, phone and shipping address to deliver your order.
• Google LLC (Google Analytics 4) — processes technical and usage data, only after you consent via the cookie banner.
• Meta Platforms Inc. (Meta Pixel) — processes technical and usage data, only after you consent via the cookie banner.

Cookies and analytics

We use cookies and similar tracking technologies to remember your preferences (e.g. cookie consent choice) and, only after you consent, to measure how visitors use the Platform.

Strictly-necessary cookies (session, security, consent state) are set without asking, because the Platform cannot function without them. They store no marketing identifier.

Analytics and advertising cookies (Google Analytics 4 and Meta Pixel) are set only after you accept the cookie banner shown on your first visit. Declining leaves these tags dormant. You can change your choice later by clearing site data for aratanutra.com in your browser and reloading the site.

Third-party analytics providers may set their own cookies and transmit data to servers outside India (see the 'Cross-border data transfer' section below). Please review their privacy policies for details.

Cross-border data transfer

Personal data is stored primarily in India. When you accept analytics or advertising cookies, technical data (IP address, device identifiers, page views) is transmitted to Google (Google Analytics 4) and Meta (Meta Pixel), which may process that data on servers in the United States and other jurisdictions.

The Government of India may from time to time notify countries to which personal data may not be transferred under Section 16 of the DPDP Act. We will comply with any such restriction and will update this Privacy Policy accordingly.

Children's data

The Platform and our products are intended for adults aged 18 years or older. We do not knowingly collect personal data from children (individuals under 18 years) or persons with a legal guardian, as defined under the DPDP Act.

If a parent or lawful guardian believes that a child has submitted personal data to us without their verifiable consent, please contact the Grievance Officer immediately at aratanutra@gmail.com and we will delete such data promptly.

Security precautions

We adopt reasonable security practices and procedures to protect personal data from unauthorised access, disclosure, loss or misuse. These include HTTPS/TLS for all data in transit, encryption of secrets at rest, bcrypt-hashed administrator credentials, rate limiting on sensitive endpoints, and access controls that restrict who inside Arata Nutraceuticals can view your data.

However, the transmission of information over the internet is not completely secure for reasons beyond our control. By using the Platform, you accept the residual security implications of data transmission over the internet and are responsible for ensuring the protection of any login credentials you use to access the Platform.

Data breach notification

In accordance with Section 8(6) of the DPDP Act, if we become aware of a personal data breach that is likely to affect your rights, we will notify the Data Protection Board of India and the affected Data Principals without undue delay, describing the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach.

Data retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. Specifically:

Order and invoice data — retained for 8 (eight) financial years to comply with the Income Tax Act, 1961 and the Goods and Services Tax law.

Customer support communications — retained for 3 (three) years from the last interaction.

Marketing consent records — retained until you withdraw consent, and thereafter as required to prove the earlier consent.

Technical and analytics data — retained in aggregated, anonymised form indefinitely; identifiable technical logs are retained for 90 (ninety) days.

After the applicable retention period, personal data is deleted or irreversibly anonymised.

Your rights under the DPDP Act, 2023

As a Data Principal you have the following rights, exercisable free of charge by writing to the Grievance Officer (contact details below):

To exercise any of these rights, write to the Grievance Officer at aratanutra@gmail.com with the subject line 'DPDP request'. We may need to verify your identity before acting on the request.

• Right to access — obtain a summary of the personal data we process about you and the purposes.
• Right to correction and erasure — have inaccurate data corrected, incomplete data completed, or personal data erased when no longer required (subject to our retention obligations).
• Right to nominate — nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to grievance redressal — raise a complaint about the way we handle your personal data. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
• Right to withdraw consent — withdraw any consent you previously gave for the processing of your personal data. Withdrawal is not retrospective; processing carried out before withdrawal remains lawful. Withdrawing consent that is necessary for the provision of a service may result in us being unable to continue that service.

Consent

By visiting our Platform or by providing your information, you consent to the collection, use, storage, disclosure and other processing of your personal data on the Platform in accordance with this Privacy Policy. If you provide us any personal data relating to other people, you represent that you have the authority to do so.

By providing your contact details, you consent to us and our authorised service providers contacting you through SMS, instant messaging apps, calls and/or email for the purposes specified in this Privacy Policy. You may withdraw your consent at any time by writing to the Grievance Officer with the subject line 'Withdrawal of consent for processing personal data'. Withdrawal of consent will not be retrospective.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Where changes are material, we will notify you by email or through a prominent notice on the Platform before the changes take effect. The 'Last updated' date at the top of this policy indicates when it was most recently revised.