1. Data Fiduciary Identity & Statutory Scope
This Standalone Privacy Notice is published by Agrawal Signature (“we”, “our”, or “us”), functioning as the Data Fiduciary in terms of Section 2(i) of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and the Digital Personal Data Protection Rules, 2025 notified by the Ministry of Electronics and Information Technology (MeitY), Government of India.
Data Fiduciary Legal Entity: Agrawal Signature Foods Division
Registered Address: Latur, Maharashtra - 413512, India
Contact Email: privacy@agrawalsignature.in
Helpline: +91-8275170115
2. Itemized Personal Data Matrix (Rule 3)
In strict accordance with Rule 3 of the DPDP Rules 2025, the table below provides an itemized, purpose-specific disclosure of the personal data collected, its precise purpose, lawful basis, retention schedule, and third-party processors.
| Category & Items | Specific Purpose | Lawful Basis | Processors | Retention |
|---|---|---|---|---|
| Customer Identity & ContactFull Name, Email, Mobile Number | Account creation, authentication, order confirmation, and dispatch notices | Consent (Sec 6) | Supabase, Resend | Until account deletion or consent withdrawal |
| Shipping & DeliveryRecipient Name, Address, City, State, PIN, Phone | Packing parcels, courier label generation, and doorstep courier delivery | Contractual Performance / Consent (Sec 6) | Shiprocket, Delhivery | 6 years for statutory audit (GST Act 2017) |
| Payment & TransactionOrder ID, Payment Method, Amount, Status (No Card/CVV) | Payment verification, refunds, and generating statutory tax invoices | Legitimate Use (Sec 7) & Tax Compliance | Cashfree Payments | 6 years under Indian taxation laws |
| Technical & SessionIP Address, Browser Agent, Session Cookies, Cart Token | Preserving shopping cart state, session security, and anti-fraud checks | Legitimate Use (Sec 7) | Vercel, Supabase | Session duration or max 90 days |
| Optional MarketingEmail, WhatsApp Number | Chef recipes, culinary updates, and promotional discount codes | Explicit Affirmative Consent (Sec 6) | Resend | Withdrawn immediately upon user opt-out |
3. Affirmative Consent & Ease of Withdrawal (Section 6)
Under Section 6 of the DPDP Act 2023, consent must be free, specific, informed, unconditional, and unambiguous with a clear affirmative action. We do not use pre-ticked checkboxes or forced bundling.
Principle of Comparable Ease for Consent Withdrawal:
In accordance with Section 6(4) of the DPDP Act 2023 and Rule 3 of the DPDP Rules 2025, withdrawing your consent is as easy as providing it. You can instantly modify or withdraw any optional consent through your Account Dashboard or the Data Principal Rights Center without impacting essential purchases.
4. Protection of Children's Personal Data (Section 9)
In full compliance with Section 9 of the DPDP Act 2023:
- We do not knowingly process personal data of any child (individual below 18 years of age) without verifiable consent of their parent or lawful guardian.
- We strictly prohibit tracking, behavioral monitoring, or targeted advertising directed towards children.
- All registered users affirm at account creation and checkout that they are 18 years of age or older, or authorized by a legal guardian.
5. Third-Party Data Processors & Safeguards
We partner with trusted, industry-certified Data Processors bound by strict data protection contracts pursuant to Section 8(2) of the DPDP Act:
PCI-DSS Level 1 compliant gateway. Encrypted 256-bit tokenized payment processing. Agrawal Signature never stores card details or CVVs.
Certified logistics aggregators. Information shared is strictly limited to recipient name, delivery address, and contact number for parcel delivery.
Enterprise cloud database and serverless hosting with end-to-end TLS 1.3 encryption and automated security monitoring.
Transactional email dispatcher for order confirmations, GST invoices, and DPDP statutory receipts.
6. Statutory Rights of Data Principals (Sections 11 to 14)
As a Data Principal under the DPDP Act 2023, you hold the following inviolable statutory rights:
A. Right to Access Information (Section 11)
You have the right to obtain a summary of personal data being processed, details of processing activities, and identities of all Data Fiduciaries/Processors with whom it has been shared. You can download an instant portable JSON export in your account.
B. Right to Correction & Erasure (Section 12)
You have the right to request correction of inaccurate or misleading data, completion of incomplete data, updating of records, and erasure of your personal data when purpose is fulfilled, subject only to statutory tax retention exemptions (e.g. GST Act).
C. Right of Grievance Redressal (Section 13)
You have the right to readily accessible grievance redressal. Our Grievance Officer acknowledges requests within 48 hours and provides resolution within the prescribed statutory period (maximum 30 days).
D. Right to Nominate (Section 14)
You have the right to nominate another individual who shall, in the event of your death or incapacity, exercise your data principal rights. You can register your nominee in your account dashboard.
7. Security Safeguards & Breach Intimation (Section 8)
We implement reasonable security safeguards, including TLS 1.3 encryption in transit, encrypted database storage, strict role-based access control, and daily offsite backups to prevent unauthorized access or breach.
Personal Data Breach Protocol (Section 8(6)):
In the unlikely event of any personal data breach affecting your records, Agrawal Signature is legally bound to intimate both the Data Protection Board of India (DPBI) and each affected Data Principal in the form and manner prescribed under the DPDP Rules 2025.
8. Data Retention & Purpose Limitation
Pursuant to Section 8(7) of the DPDP Act 2023, we retain personal data only for as long as necessary to fulfill the specified purpose for which it was collected, or for statutory compliance. Where an account is erased or consent is withdrawn, personal profiles are purged, while past invoice records are maintained for 6 years strictly to comply with the Central Goods and Services Tax (CGST) Act, 2017.
9. Grievance Redressal Officer & Board Escalation
In compliance with Section 13 of the DPDP Act 2023 and Rule 3 of the DPDP Rules 2025, our designated Grievance Officer is your point of contact for all privacy questions, data requests, or grievances:
Grievance & Data Protection Desk
Agrawal Signature Foods Division
Escalation to the Data Protection Board of India (DPBI):
If your grievance is not resolved by our Grievance Redressal Officer within the statutory period, or if you are unsatisfied with the resolution, you hold the statutory right under Section 13(3) and Section 27 of the DPDP Act 2023 to lodge a formal complaint with the Data Protection Board of India via their official portal at dpb.gov.in.