This Privacy Policy ("Policy") sets out how Akshayakalpa Farms And Foods Private Limited ("Akshayakalpa", "Company", "we", "us", or "our"), a company incorporated under the Companies Act, 2013, having its registered office at #367/G, 3rd Main Road, Sharadanagara, Tippur - 572201, Tumkur District, Karnataka, India, collects, uses, stores, processes, discloses, and protects your personal data when you use our website (https://www.akshayakalpa.org), mobile application, or any other platform or service (collectively referred to as the "Platform" or "Service").
Akshayakalpa is committed to protecting your privacy and ensuring the security of your personal data. We recognize the trust you place in us when you share your personal information, and we take this responsibility seriously. This Policy demonstrates our commitment to transparency in our data practices and compliance with applicable data protection laws.
This Policy explains how we collect and process your personal data. Merely accessing or browsing our Platform, or continuing to use it, does not amount to your consent to the processing of your personal data. Where we rely on your consent, we will first give you a notice describing the personal data we seek and the purposes for which we will process it, and will then ask for your consent separately, through a clear affirmative action (such as ticking an unticked box or switching on a toggle), in accordance with Sections 5 and 6 of the Digital Personal Data Protection Act, 2023.
At account registration, you will be presented with: (a) a checkbox to accept our Terms and Conditions; (b) a standalone privacy notice describing the personal data necessary to create your account and to process, deliver and support your orders, together with a checkbox by which you consent to that processing; and (c) separate, optional and unticked choices for (i) marketing communications, (ii) personalised recommendations and offers, and (iii) non-essential cookies, analytics and advertising technologies. Consent under (b) is limited to the personal data necessary for providing our services. Declining any optional choice under (c) will not affect your ability to create an account or use the Platform. You may change any of these choices at any time through the Privacy Centre in our app or the Cookie Preferences link on our website. The privacy notice and every request for consent will be made available in English and in the languages specified in the Eighth Schedule to the Constitution of India, at your option.
This Privacy Policy should be read in conjunction with our Terms and Conditions. In the event of any conflict between this Privacy Policy and the Terms and Conditions regarding data practices, this Privacy Policy shall prevail to the extent of such conflict.
We may update this Policy from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons. We will notify you of material changes in the manner set out in Section 15. Where a change involves processing your personal data for a new purpose, or processing personal data not covered by your existing consent, we will seek your fresh consent and will not treat your continued use of the Platform as consent.
We are introducing some of the features described in this Policy in phases, including the Privacy Centre in our app, the cookie banner and Cookie Preferences link on our website, separate consent options at registration, the Data Request Form, and notices in languages other than English. Notwithstanding anything else in this Policy, until a feature is available to you:
We will update this Policy when these features are live.
This Privacy Policy and our data processing practices comply with the following Indian laws and regulations:
We adhere to the following data protection principles:
For the purposes of this Privacy Policy:
Personal Data means any data about an individual who is identifiable by or in relation to such data.
Sensitive Personal Data or Information (SPDI) means, for the purposes of the SPDI Rules (which apply until the corresponding provisions of the DPDP Act come into force), personal data consisting of information relating to:
Data Principal means the individual to whom the personal data relates (i.e., you, the user).
Data Fiduciary means Akshayakalpa, the entity that determines the purpose and means of processing personal data.
Data Processor means any person who processes personal data on behalf of the Data Fiduciary.
Processing means any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
Consent means the free, specific, informed, unconditional and unambiguous indication of the Data Principal's wishes, given through a clear affirmative action, signifying agreement to the processing of her personal data for a specified purpose and limited to such personal data as is necessary for that purpose, as provided in Section 6 of the DPDP Act.
Child means an individual who has not completed the age of eighteen years.
Board means the Data Protection Board of India established under the DPDP Act.
Consent Manager means a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
Personal Data Breach means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.
We collect and process the following categories of personal data:
Account Information:
Delivery and Address Information:
Financial and Payment Information:
Order and Transaction Information:
Communication Information:
Technical and Usage Information:
Demographic Information:
Refund Verification Information:
Farm Visit Information:
Referral Information:
We collect personal data through the following methods:
Direct Collection:
Automatic Collection:
Third-Party Sources:
Certain information is mandatory for account creation, order placement, and service delivery. Failure to provide mandatory information will prevent you from using certain features or services. Optional information helps us provide enhanced services but is not required for basic functionality. We will clearly indicate which information is mandatory and which is optional at the point of collection.
Our Platform is not intended for Children, and you must be 18 years of age or older to create an account. We ask you to confirm your age at registration. We do not knowingly process the personal data of a Child, except the number and age band of Children accompanying a parent or lawful guardian on a farm visit, and any other personal data of a Child that the parent or lawful guardian chooses to provide, which we will process only with the verifiable consent of that parent or lawful guardian in accordance with Section 9 of the DPDP Act and the DPDP Rules. We do not undertake tracking or behavioural monitoring of Children or targeted advertising directed at Children, and we do not process personal data of Children in any manner likely to cause a detrimental effect on their well-being. We will not use photographs or videos in which a Child is identifiable for promotional purposes without the verifiable consent of the parent or lawful guardian. If you are a parent or lawful guardian and believe that we hold your Child's personal data without your consent, please contact our Grievance Officer at compliance@akshayakalpa.org, and we will erase that data.
We collect and process your personal data for the following legitimate purposes:
Service Delivery:
Communication:
Marketing and Promotions (only with your separate consent):
Analytics and Improvement (using anonymised data, or with your separate consent where personal data is used):
Compliance and Legal Obligations:
Security:
We process your personal data only on the following grounds permitted under the DPDP Act:
Where processing is based on your consent, you may withdraw your consent at any time, with the same ease with which you gave it, through the Privacy Centre in our app, the Cookie Preferences link on our website, the unsubscribe link in our emails, or by writing to compliance@akshayakalpa.org. On withdrawal, we will stop, and will cause our Data Processors to stop, processing your personal data for the purpose concerned within a reasonable time, unless processing without your consent is required or authorised under law. Withdrawal will not affect the lawfulness of processing before withdrawal. If you withdraw consent to processing that is necessary for providing our services, we may be unable to continue providing those services, and you will bear the consequences of such withdrawal.
We may share your personal data with carefully selected third-party service providers who perform services on our behalf. These service providers act as Data Processors and include:
Payment Processing Services:
These processors handle payment transactions securely and are bound by strict confidentiality and security obligations.
Delivery and Logistics Partners:
These partners require access to your delivery address and contact information to fulfill orders.
Technology and Analytics Providers:
These providers help us operate, analyze, and improve our Platform.
Marketing and Communication Services:
These services help us communicate with you and deliver personalized experiences.
Customer Support Tools:
These tools enable us to provide effective customer support.
We may disclose your personal data where required or permitted by law:
Government and Regulatory Authorities:
Law Enforcement and Legal Processes:
Compliance Obligations:
In the event of a merger, acquisition, reorganization, asset sale, or similar business transaction involving Akshayakalpa, your personal data may be transferred to the acquiring or successor entity. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy. The transferee will be required to honor this Privacy Policy or provide you with notice and an opportunity to opt out before making material changes.
We may share aggregate, anonymized, or de-identified data that cannot be used to identify you personally with third parties for various purposes, including:
Such data does not constitute personal data and is not subject to the restrictions in this Privacy Policy.
We engage Data Processors only under a valid contract, as required by Section 8(2) of the DPDP Act. All Data Processors with whom we share personal data are contractually obligated to:
We do not sell, rent, or trade your personal data to third parties for monetary consideration. Any sharing is done strictly for the purposes outlined in this Policy and subject to appropriate safeguards.
On request, we will provide you the identities of the Data Fiduciaries and Data Processors with whom we have shared your personal data, and a description of the personal data shared, in accordance with Section 11 of the DPDP Act.
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The retention period varies depending on the type of data and the purpose for which it is used.
You have the right to request deletion of your account and associated personal data in accordance with the Digital Personal Data Protection Act, 2023. Account deletion requests can be submitted through your account settings or by contacting us at support@akshayakalpa.org. While your deletion request is pending, you may withdraw your consent for any optional processing (such as marketing) at any time.
Pre-Deletion Requirements: Before we can process your account deletion request, you must:
Restrictions on Account Deletion: You cannot delete your account if:
Reason for Deletion: As part of the account deletion process, we request that you provide a reason for deleting your account. This information is collected solely for service improvement purposes and is optional. Failure to provide a reason will not prevent account deletion.
Upon receiving a valid account deletion request:
Immediate Actions (Within 24 hours):
Verification Period (7-14 days):
Data Deletion (Within 30 days of request approval): The following personal data will be permanently deleted or anonymized:
Even after account deletion, we retain certain data to comply with legal, regulatory, tax, and business requirements:
Financial and Transaction Data (Retained for up to 8 years): As required under the Companies Act, 2013 (including Section 128), the Central Goods and Services Tax Act, 2017, and income-tax laws, we retain:
This financial data is retained in a secure, restricted-access environment and is used solely for regulatory compliance, audits, tax reporting, fraud prevention, legal claims, and anti-money-laundering controls.
Order History Data (Retained indefinitely for analytics): We retain anonymized order data including:
This anonymized data cannot be used to identify you personally and is retained solely for business analytics, demand forecasting, inventory planning, product improvement, and service optimization. Data that has been irreversibly anonymised such that you cannot be identified is not personal data, and its retention does not require your consent.
Legal and Compliance Records:
Logs: As required under the DPDP Rules, we retain personal data, associated traffic data and logs of processing for a minimum period of one year from the date of processing, and we maintain logs of our information and communication technology systems as required under the directions issued by the Indian Computer Emergency Response Team (CERT-In).
Fraud Prevention and Security Data:
Backup Data: Personal data may persist in backup systems for up to 90 days after deletion from production systems. Backup data is securely stored and not actively used, accessed, or processed except for disaster recovery purposes.
Definition of Inactive Account: An account is considered inactive if there has been no login activity, order placement, or wallet transaction for a continuous period of 365 days (12 months).
Inactivity Notification Process: Before marking an account as inactive, we will send you notifications at:
Consequences of Inactivity: When an account is marked as inactive:
Reactivation of Inactive Account: You may reactivate an inactive account at any time by:
Upon successful verification, your account will be reactivated and any Cash Balance held in the suspense account will be restored to your wallet within 7 working days.
Erasure of Inactive Accounts: If an account remains inactive for a further period of three years after it has been marked inactive, we will treat the purposes for which your personal data was collected as no longer being served and will erase your personal data, other than (i) the minimum data needed to restore any Cash Balance held in the suspense account, and (ii) data we must retain under Section 7.4. We will notify you at least 48 hours before such erasure, and the erasure will not take place if you log in or contact us within that period.
Unclaimed Balances: Cash Balances held in the suspense account for inactive accounts will be retained for 7 years from the date of inactivity, after which they will be dealt with in accordance with applicable law.
We are committed to ensuring that your personal data is secure. We have implemented appropriate technical, organizational, physical, and administrative measures to protect your personal data against unauthorized access, accidental loss, destruction, damage, disclosure, or alteration.
Encryption:
Access Controls:
Network Security:
Application Security:
Policies and Procedures:
Employee Training:
Third-Party Management:
All payment transactions are processed through PCI-DSS compliant payment gateways. We do not store complete payment card details on our servers. Payment information is encrypted and tokenized, with tokens stored securely. We comply with RBI guidelines on payment data security and storage.
While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your personal data. In the event of a Personal Data Breach, we will intimate each affected Data Principal and the Board, in the form, manner and within the time prescribed under the DPDP Rules, and will report cyber security incidents to CERT-In within the time prescribed by it.
You are responsible for:
Cookies are small text files placed on your device by websites and applications you visit. Cookies help websites recognize your device and remember information about your visit, such as your preferences, login status, and browsing history.
Your consent to cookies: Except for Essential Cookies, we will not place cookies or similar technologies (including pixel tags and third-party software development kits) on your browser or device unless you have consented to them through our cookie banner on the website or the Privacy Centre in our app. Our cookie banner allows you to accept all, reject all, or choose by category, with equal ease. You may change your choices at any time through the Cookie Preferences link in the footer of our website or the Privacy Centre in our app.
Essential Cookies: These cookies are necessary for the Platform to function properly and cannot be disabled. They enable core functionality such as:
Functional Cookies: These cookies enable enhanced functionality and personalization, such as:
Analytics and Performance Cookies: These cookies help us understand how visitors use our Platform, including:
We use Google Analytics and similar services. These third-party analytics providers have their own privacy policies governing how they collect and use data.
Marketing and Advertising Cookies: These cookies track your browsing activity across websites to deliver personalized advertisements, including:
In addition to cookies, we may use:
In addition to the Cookie Preferences link and the Privacy Centre, you can control and manage cookies through your browser settings. Most browsers allow you to:
Please note that if you disable or refuse cookies, some features of the Platform may not function properly, and your user experience may be degraded. You may not be able to use certain portions of our Service if cookies are disabled.
Browser-Specific Instructions:
Our mobile application may request the following permissions:
You can manage app permissions through your device settings. Denying certain permissions may limit app functionality.
Currently, our Platform does not respond to "Do Not Track" signals from browsers. We may implement such responses in the future as industry standards develop.
Third-party service providers (e.g., Google Analytics, Facebook Pixel, payment processors) may set cookies on our Platform. We do not control these third-party cookies. Please refer to the privacy policies of these third parties for information about their cookie practices. Third-party analytics and advertising cookies are set only where you have consented to them.
As a Data Principal under the DPDP Act, you have the following rights, which you may exercise in accordance with the DPDP Act and the DPDP Rules:
Erasure will be carried out in the following circumstances, among others:
This right is subject to limitations, particularly where retention is required by law (e.g., financial records for tax and AML compliance).
Your rights are subject to certain limitations and exceptions under applicable law. We may deny or limit your request if:
We will inform you of the reasons for any denial or limitation and your right to seek redressal.
To exercise any of your rights, please use the Privacy Centre in our app, the Data Request Form on our website, or write to our Grievance Officer at compliance@akshayakalpa.org, quoting the mobile number registered with your account. We will verify your identity before acting on a request and may ask for additional information only to the extent necessary for verification.
We will respond to your request within 30 days, and in any event within the period prescribed under applicable law. If we require additional time, we will notify you and provide the reason for the extension.
You have the right to opt out of receiving marketing communications from us at any time. You may:
Please note that even if you opt out of marketing, you will continue to receive transactional communications related to your account and orders.
We may use automated decision-making and profiling to:
You may request human review of any decision made solely by automated means that significantly affects you, and we will explain the decision on request.
Under Section 15 of the DPDP Act, while exercising your rights you must comply with applicable law; not impersonate another person while providing your personal data; not suppress any material information while providing your personal data for any document, unique identifier, or proof of identity or address; not register a false or frivolous grievance or complaint with us or the Board; and furnish only information that is verifiably authentic when exercising your right to correction or erasure.
We store your personal data on servers located within India. Payment data is stored in India by our RBI-authorised payment aggregators in accordance with RBI requirements.
Certain third-party service providers (e.g., cloud hosting, analytics, marketing tools) may be located outside India, which may result in transfer of your personal data to jurisdictions outside India.
When we transfer personal data outside India, we:
We use reputable cloud service providers with servers located primarily in India. These providers maintain high security standards and comply with applicable data protection regulations. Cloud storage agreements include data protection clauses and security requirements.
Different categories of data may be stored in different locations:
Financial data, including wallet transactions, payment details, and refund records, is processed with heightened security measures. We:
SPDI, as defined in Section 3, is subject to additional protections:
If you grant our mobile app permission to access your location, we may collect:
You can disable location access at any time through your device settings. Location data is used solely for improving delivery services and providing location-specific content.
Currently, we do not collect biometric data (fingerprints, facial recognition, etc.). If we introduce biometric authentication in the future, we will:
We may record telephone calls and chat conversations with customer service for:
You will be informed at the beginning of the call if it is being recorded. Call recordings are retained for not more than 90 days, unless required for a dispute or under law, and are accessible only to authorized personnel. You may request access to or deletion of your call recordings subject to legal retention requirements.
When you book a farm visit, we process the Farm Visit Information described in Section 4.1 to manage your booking, ensure the safety of visitors and animals, and document and respond to any incident. Our farm premises are under CCTV surveillance for safety and security; CCTV footage is retained for 30 days unless it is required for an incident, a dispute or under law. We will take photographs or videos of you for promotional use only if you have given your separate, optional consent at the time of booking or at check-in, and you may withdraw that consent at any time. Photographs or videos in which a Child is identifiable will be used for promotional purposes only with the verifiable consent of the Child's parent or lawful guardian. If you include other adults in your booking, please inform them that we will process their names and contact details for the purposes of the visit, as described in this Policy.
Our Platform may contain links to third-party websites, applications, or services that are not owned or controlled by Akshayakalpa. These may include:
We are not responsible for the privacy practices, content, or security of third-party websites or services. Once you click on a link to a third-party site or service, you leave our Platform and this Privacy Policy no longer applies.
Third-party websites and services have their own privacy policies governing how they collect, use, and protect your personal data. We encourage you to read the privacy policies of any third-party sites you visit. The inclusion of any link does not imply our endorsement of the linked site or service.
If you use social media features on our Platform (e.g., Facebook login, share buttons), these features may collect information about your use of the Platform and share it with the social media platform. Your interactions with social media features are governed by the privacy policies of the respective social media platforms.
If you choose to create an account or log in using third-party authentication services (e.g., Google, Facebook), we will receive certain information from those services as permitted by their privacy settings. This may include your name, email address, profile picture, and other information you have made public on those platforms.
In accordance with the SPDI Rules, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act and DPDP Rules, we have appointed a Grievance Officer to address your concerns regarding privacy and data protection. The Grievance Officer is also the person designated to answer, on our behalf, your questions about the processing of your personal data.
Chief Grievance Officer:
Name: Rashmi Kalleshappa
Email: compliance@akshayakalpa.org
Phone: +91 8861026660
Designation: Grievance Officer
The Grievance Officer is responsible for:
If you have any concerns or complaints regarding this Privacy Policy, our data practices, or any potential violation of your privacy rights, you may file a complaint with our Grievance Officer:
Please provide the following information in your complaint:
We will acknowledge receipt of your complaint within 24 hours and endeavor to resolve your complaint within 30 days from the date of receipt. If we require additional time to investigate and resolve your complaint, we will inform you and provide an estimated timeline. In every case, we will respond within the period prescribed under applicable law.
If you are not satisfied with the resolution provided by our Grievance Officer, you may escalate your complaint to:
The Data Protection Board of India, through the digital platform made available by the Board, after exhausting our grievance redressal mechanism as required under Section 13 of the DPDP Act.
You also have the right to approach appropriate courts or consumer forums in accordance with applicable law.
This Privacy Policy is subject to changes from time to time at the sole discretion of Akshayakalpa. We may update this Policy to reflect:
When we make material changes to this Privacy Policy, we will:
For non-material changes (e.g., clarifications, formatting updates), we may simply update the Policy without additional notification.
We recommend that you review this Privacy Policy periodically. Changes that do not require your consent will take effect on the date stated in the notification. Changes that require your consent will take effect for you only once you have given that consent.
If you do not agree with the updated Privacy Policy, you may withdraw your consent or request deletion of your account in accordance with Section 7 of this Policy. We will not treat your continued use of the Platform as consent to processing that requires your consent.
We maintain a version history of material changes to this Privacy Policy. You may request access to previous versions by contacting us at compliance@akshayakalpa.org.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:
Akshayakalpa Farms And Foods Private Limited
Registered Office: #367/G, 3rd Main Road, Sharadanagara Tippur - 572201 Tumkur District, Karnataka, India
General Inquiries:
Customer Support (Voice, WhatsApp, SMS):
Data Protection and Privacy Inquiries:
Office Hours:
We are committed to addressing your privacy concerns and will respond to your inquiries within a reasonable timeframe.
From time to time, we may send you information about special offers, promotions, new products, and competitions through email, SMS, push notifications, or other communication channels. This is done to enhance your experience and provide you with value-added services.
We will send you marketing communications only if you have opted in through a separate, unticked consent option at registration or in the Privacy Centre in our app, and only through the channels you have chosen. You may withdraw this consent at any time as described in Sections 5.3 and 10.4.
Purchases of goods may be subject to special offers and promotions at our discretion. The terms of such offers are subject to our Terms and Conditions. We may change the terms of special offers, or withdraw them altogether, at any time without prior notice.
We reserve the right to offer different customers different special offers, promotions, and the ability to enter different competitions. This may be based on factors such as:
Such differentiation is based on legitimate business practices and is not intended to discriminate unfairly.
When you participate in promotions, surveys, or competitions, we may use your personal data to:
Specific terms and conditions for each promotion or competition will be provided separately and will govern your participation.
If any provision of this Privacy Policy is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be severed, and the remaining provisions shall continue in full force and effect.
Our failure to enforce any provision of this Privacy Policy shall not constitute a waiver of that provision or any other provision. No waiver shall be deemed a continuing waiver unless expressly stated in writing.
This Privacy Policy, together with our Terms and Conditions, constitutes the entire agreement between you and Akshayakalpa regarding the collection, use, and protection of your personal data and supersedes all prior agreements and understandings.
This Privacy Policy is drafted in English. Our privacy notice and every request for consent are available in English and in the languages specified in the Eighth Schedule to the Constitution of India, at your option, as required under Sections 5(3) and 6(3) of the DPDP Act. In the event of any conflict between the English version and any translation, the English version shall prevail.
This Privacy Policy should be read in conjunction with our Terms and Conditions. Both documents are complementary and form part of your agreement with Akshayakalpa. In case of any conflict specifically relating to data protection matters, this Privacy Policy shall prevail.
By checking the consent box in our privacy notice during registration, you acknowledge that:
Your consents to marketing communications, personalised recommendations and non-essential cookies are sought separately and are optional.
This Privacy Policy apply universally to all platforms, channels, interfaces, and methods through which Akshayakalpa provides services or through which you access our services, including but not limited to:
Digital Platforms:
Application Programming Interfaces (APIs):
Communication Channels:
Service Delivery Methods:
Third-Party Integrations:
For services accessed through APIs:
This Privacy Policy applies to our processing of your personal data regardless of how you access our services, whether through our website, mobile app, API, or any other method.
This document applies to any new platforms, technologies, or service delivery methods that Akshayakalpa may introduce in the future, unless explicitly stated otherwise in a separate agreement or policy specific to that platform.