1. Introduction

Shruffles Heavenly Bites, operating through www.shruffles.in (“Shruffles,” “we,” “us,” or “our”), respects the privacy of every customer, website visitor, gift recipient, and person who contacts us.

This Privacy Policy explains how we collect, use, store, share, retain, and protect your personal data when you visit our Website, place an order, make an enquiry, engage with us on WhatsApp or Instagram, or otherwise use our services.

This Policy is intended to comply with applicable laws in India, including the Digital Personal Data Protection Act, 2023, rules issued under it where applicable, and other relevant laws relating to privacy, electronic records, and consumer protection.

For the purposes of applicable Indian data-protection law, Shruffles acts as the Data Fiduciary in relation to personal data collected through our Website and services.

2. Scope of This Policy

This Policy applies to personal data collected:

• Through our Website, www.shruffles.in.

• When you place an order or make a payment.

• When you contact us through WhatsApp, Instagram, email, telephone, or a website form.

• When you make a gifting, event, bulk-order, return-gift, or customised-order enquiry.

• When you subscribe to our offers, updates, or promotional communications.

This Policy does not apply to third-party websites, payment gateways, delivery partners, WhatsApp, Instagram, or other services that may have their own privacy policies.

3. Personal Data We Collect

We may collect the following categories of personal data.

A. Identity and contact information

• Name.

• Mobile number.

• Email address.

• Billing address.

• Delivery address.

• City, state, and PIN code.

B. Order and gifting information

• Products selected and order value.

• Delivery instructions and preferred delivery date.

• Gift message or occasion details.

• Details of a gift recipient, including name, mobile number, and address, where you provide them.

• Enquiries relating to corporate gifting, celebrations, return gifts, or customised orders.

C. Payment and transaction information

• Payment status, transaction reference, amount paid, and payment method.

• Limited information received from payment gateways to confirm or reconcile your payment.

We do not intentionally collect or store your complete debit-card number, credit-card number, CVV, UPI PIN, internet-banking password, or other confidential payment credentials. Such information is processed by payment service providers under their own privacy policies and security practices.

D. Communications and support information

• Messages, emails, WhatsApp chats, Instagram messages, feedback, reviews, photographs, or other content that you voluntarily share with us.

• Information provided when you request customer support, raise a complaint, or seek an order update.

E. Technical and usage information

When you use our Website, we may automatically collect limited technical information, such as:

• IP address.

• Browser type and device type.

• Operating system.

• Pages visited, links clicked, and time spent on the Website.

• Referring website or URL.

• Approximate location based on IP address.

• Cookie, analytics, and similar technology information.

4. Information We Do Not Request

Please do not send us Aadhaar details, PAN details, passwords, OTPs, UPI PINs, complete card details, health information, or other sensitive personal information through WhatsApp, Instagram, email, or website forms unless we specifically ask for it and it is legally necessary.

5. Why We Process Your Personal Data

We process personal data only for clear and legitimate purposes, including to:

• Accept, process, prepare, and deliver your order.

• Confirm payments and issue invoices or order confirmations.

• Contact you about your order, delivery, cancellation, refund, or replacement.

• Respond to enquiries, feedback, support requests, or complaints.

• Arrange gifting, customised orders, event orders, and bulk orders.

• Improve our products, packaging, Website, services, and customer experience.

• Prevent fraudulent, suspicious, unlawful, or unauthorised transactions.

• Maintain financial, accounting, tax, and business records.

• Comply with legal obligations or lawful requests from authorities.

• Send promotional messages, festive offers, product launches, and updates where you have consented or where otherwise permitted by applicable law.

We will not use your personal data for a materially different purpose without providing appropriate notice and, where required, obtaining your consent.

6. Consent and Your Choices

By voluntarily providing personal data to us for an order, enquiry, delivery, or other stated purpose, you consent to our processing of that data for the relevant purpose.

Where we rely on consent, you may withdraw it at any time by contacting us at [privacy email address]. Withdrawal of consent will not affect processing already completed before the withdrawal. Please note that if you withdraw consent for information necessary to fulfil an active order, we may be unable to complete that order or provide the requested service.

You may opt out of promotional communications at any time by:

• Using the unsubscribe option in an email, where available.

• Replying with an opt-out request to a promotional message.

• Contacting us at [privacy email address].

You may continue to receive essential communications relating to an order, payment, delivery, refund, or legal obligation.

7. Cookies and Similar Technologies

We may use cookies, pixels, and similar technologies to operate our Website, remember preferences, understand website usage, improve security, and measure the effectiveness of our content.

You may control cookies through your browser settings. If you choose to disable cookies, certain Website features may not function as intended.

8. Sharing of Personal Data

We do not sell, rent, or trade your personal data.

We may share personal data only where reasonably necessary with:

• Payment gateways and payment-service providers.

• Delivery, courier, and logistics partners.

• Website hosting, cloud-storage, analytics, communication, and technology providers.

• Professional advisers, accountants, auditors, insurers, legal advisers, or business consultants.

• Government authorities, regulators, courts, law-enforcement agencies, or other parties where required by law.

• A buyer, successor, or adviser in connection with a merger, business transfer, restructuring, or sale of assets, subject to applicable law.

We require service providers to handle personal data only for authorised purposes and to use reasonable safeguards.

9. WhatsApp, Instagram, and Social Media

When you contact us through WhatsApp, Instagram, or another social-media platform, your information may also be collected and processed by that platform under its own privacy policy.

Please do not share sensitive financial information, passwords, OTPs, card details, or UPI PINs through social-media messages.

10. Children’s Personal Data

Our Website and services are not intended to knowingly collect personal data from children without the consent of a parent or lawful guardian.

Where we become aware that we have collected personal data relating to a child without appropriate consent, we will take reasonable steps to delete or otherwise address that data in accordance with applicable law.

We do not knowingly undertake tracking, behavioural monitoring, or targeted advertising directed at children.

11. Data Security

We use reasonable technical, organisational, and administrative safeguards to protect personal data from unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These safeguards may include restricted access, secure service providers, password protection, access controls, and reasonable record-management practices.

However, no method of internet transmission, electronic storage, or communication is completely secure. While we take reasonable care to protect your data, we cannot guarantee absolute security.

12. Personal Data Breaches

If we become aware of a personal data breach that may affect your rights or interests, we will take reasonable steps to investigate, contain, and address the breach. We will notify affected individuals and relevant authorities where required under applicable law.

13. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to:

• Complete your order and delivery.

• Handle returns, refunds, replacements, or customer support.

• Maintain tax, accounting, and transaction records.

• Resolve disputes or enforce our rights.

• Meet legal, regulatory, or reporting obligations.

When personal data is no longer required, we will delete, anonymise, or securely dispose of it in accordance with applicable law and reasonable business practices.

14. Your Rights

Subject to applicable law, you may request to:

• Obtain information about the personal data we process about you.

• Correct, update, or complete inaccurate personal data.

• Request erasure of personal data that is no longer necessary for the stated purpose.

• Withdraw consent where processing is based on consent.

• Opt out of marketing communications.

• Raise a privacy-related grievance.

• Nominate another individual to exercise your rights in circumstances permitted by applicable law.

To protect your privacy, we may request reasonable information to verify your identity before acting on your request.

15. Cross-Border Processing

Some of our service providers, such as website-hosting, analytics, payment, communication, or cloud-service providers, may process personal data outside India. Where this occurs, we will take reasonable steps to ensure that processing is carried out in accordance with applicable Indian law and appropriate safeguards.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business practices, technology, or legal obligations.

The updated Policy will be published on this page with a revised “Last updated” date. We encourage you to review this page periodically.