Privacy Policy

Indigaana Organic Inc. 

Website: indigaana.in Last updated: 1 Sep 2026

This Privacy Policy explains how Indigaana Organic Inc. ("Indigaana," "we," "us," or "our") collects, uses, discloses, and protects personal data of visitors and customers ("you") of indigaana.in, in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA") and the Digital Personal Data Protection Rules, 2025.

Under the DPDPA, Indigaana acts as the Data Fiduciary for the personal data you share with us, and you are the Data Principal.

Note on applicability: The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Core obligations of the Act — including consent, notice, and data-fiduciary duties — come into force in a phased manner, with full effect by 13 May 2027. Indigaana has adopted the practices in this Policy in advance of the compliance deadline as our working standard.

1. Personal Data We Collect

We collect only the personal data necessary for the purposes described in this Policy. Depending on how you interact with indigaana.in, this may include:

We do not knowingly collect sensitive categories of data such as health, biometric, or financial account credentials beyond what is required to process an order.

2. How We Collect Personal Data

• Directly from you — when you place an order, create an account, fill out a contact or stockist enquiry form, or subscribe to updates.
• Automatically — through cookies and similar technologies when you browse indigaana.in.
• From third parties — such as our payment gateway or logistics partners, strictly to fulfil an order or transaction you have initiated.

3. Notice and Consent

In line with Sections 5 and 6 of the DPDPA, before or at the time we collect your personal data for any purpose requiring consent, we will give you a clear notice describing:

• The personal data being collected and the purpose of processing;
• The manner in which you may exercise your rights under the Act;
• The manner in which you may lodge a complaint with the Data Protection Board of India.

Your consent will be:

• Free — not a precondition for using non-essential parts of the site;
• Specific — tied to the stated purpose;
• Informed — given after you've seen the notice;
• Unconditional and unambiguous — given through a clear affirmative action (for example, ticking a checkbox), never a pre-ticked box or implied silence.

You may withdraw consent at any time, as easily as you gave it, by writing to our Grievance Officer (Section 10). Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to provide certain services (e.g., we cannot ship an order without a delivery address).

Processing without consent

As permitted under Section 7 of the DPDPA, we may process limited personal data without separate consent for "legitimate uses," such as:

• Data you voluntarily provide for a specified purpose (e.g., a stockist enquiry), where you haven't indicated you don't consent to its use;
• Compliance with a court order or legal obligation;
• Responding to a medical emergency involving a threat to life;
• Purposes related to employment, where applicable.

4. How We Use Personal Data

We use personal data only for the purpose(s) it was collected for, including to:

• Process, ship, and fulfil your orders;
• Create and manage your account;
• Respond to enquiries, support requests, and stockist applications;
• Send order updates, receipts, and service communications;
• Send marketing communications, only where you have opted in, with an easy opt-out in every message;
• Improve our website, products, and customer experience;
• Detect, prevent, and investigate fraud or security incidents;
• Comply with applicable law, regulation, or a lawful request from a government or judicial authority.

5. Disclosure of Personal Data

We do not sell your personal data. We share personal data only where necessary, with:

• Service providers who help us operate our business — payment gateways, logistics/courier partners, website hosting, email/SMS service providers, and analytics providers — each bound by contract to use your data only for the purpose we specify and to apply appropriate safeguards.
• Legal and regulatory authorities, where disclosure is required by law, regulation, court order, or to protect the rights, property, or safety of Indigaana, our customers, or the public.
• Business transfers, if Indigaana is involved in a merger, acquisition, or sale of assets — in which case we will notify you before your personal data becomes subject to a different privacy policy.

Cross-border transfer

Personal data may be processed or stored on servers located outside India by our service providers. As permitted under Section 16 of the DPDPA, we will only transfer personal data to countries or territories that have not been restricted by the Central Government.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law (for example, tax and accounting record-keeping requirements). Once the purpose is served and retention is no longer legally required, we will erase or anonymise your personal data, in accordance with Section 8(7) of the DPDPA.

If you close your account or withdraw consent, we will erase your personal data unless we are required to retain it for legal, accounting, dispute-resolution, or fraud-prevention purposes.

7. Cookies and Tracking Technologies

indigaana.in uses cookies and similar technologies to:

• Keep your cart and session active;
• Remember your preferences;
• Understand site usage through analytics;
• Support marketing, only where you have consented.

You can control or disable cookies through your browser settings. Disabling essential cookies may affect site functionality (e.g., checkout).

8. Data Security

We implement reasonable technical and organisational safeguards to protect personal data against unauthorised access, alteration, disclosure, or destruction, as required under Section 8(5) of the DPDPA. These include encrypted transmission of payment data, access controls, and regular security review of our systems and service providers.

Data breach notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDPA and DPDP Rules, 2025.

9. Your Rights as a Data Principal

Under Sections 11–14 of the DPDPA, you have the right to:

• Access a summary of the personal data we hold about you and the processing activities carried out;
• Correction and completion of inaccurate or incomplete personal data;
• Erasure of personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements;
• Grievance redressal — to raise a complaint with us and receive a response within a reasonable time;
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
• Withdraw consent at any time (see Section 3).

To exercise any of these rights, please contact our Grievance Officer (Section 10). We may need to verify your identity before acting on your request.

If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India.

10. Grievance Officer

In accordance with the DPDPA, Indigaana has appointed a Grievance Officer to address your questions, requests, and complaints regarding this Policy and your personal data.

Grievance Officer Name: [NAME] Email: [privacy@indigaana.in] Address: [REGISTERED BUSINESS ADDRESS] Response timeline: We aim to acknowledge grievances within [X] business days and resolve them within [X] days.

11. Children's Data

We do not knowingly collect personal data from individuals below the age of 18 without verifiable parental or guardian consent, as required under Section 9 of the DPDPA. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will delete it. We do not use children's personal data for tracking, behavioural monitoring, or targeted advertising.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will indicate the most recent revision. Where changes are material, we will provide notice through the website or via email before the changes take effect.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your personal data, please contact:

Indigaana Organic Inc. Email: info@indigaana.in , Address: Hinkal, Mysore, Karnataka