Privacy Policy

1. Introduction & Data Fiduciary Identity

Halli Siri™ Natural Products ("Halli Siri", "we", "us", or "our"), operating from Haridevanahalli, Kallur, Gubbi Taluk, Tumkur District, Karnataka 572220, is the Data Fiduciary responsible for processing your personal data through our website https://www.hallisiri.com (the "Platform").

We value your trust and are committed to safeguarding your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and applicable Indian data privacy regulations. This Privacy Policy outlines what personal data we collect, why we collect it, how it is secured, and your rights as a Data Principal.

2. Data Inventory: What Personal Data We Collect

In compliance with the principle of Data Minimization, we only collect personal information that is strictly necessary for order fulfillment, customer support, and legitimate business operations:

• Contact & Identification Details: Full Name, Mobile / WhatsApp Phone Number, and Email Address.
• Delivery & Postal Address: House/Flat Number, Street/Road, Area/Landmark, City/District, State, and 6-digit Postal Pincode.
• Order & Transaction Records: Purchased products, selected quantities, order timestamps, and referral codes.
• Payment Identifiers: Razorpay Order ID, Razorpay Payment ID, payment method type (e.g., UPI, Card), and payment status ("Paid").
• Customer Inquiries & Feedback: Name, phone number, email address, message contents, and voluntary customer reviews.
• Consent Evidence: Timestamped records of your affirmative consent, consent version, and source.

3. Purpose of Processing & Lawful Basis

We process your personal data for the following specific, lawful purposes:

• Order Fulfillment & Delivery: To package your traditional millet products, dispatch packages, and deliver them to your doorstep.
• Customer Communication & Support: To send order confirmations, shipment tracking updates, delivery notifications, and respond to your inquiries.
• Accounting & Tax Compliance: To maintain mandatory accounting ledgers, invoices, and audit trails required under the Central Goods and Services Tax (CGST) Act, 2017.
• Optional Marketing & Updates: Only where you have provided separate, voluntary, affirmative consent, we may send you wellness newsletters, new harvest updates, and seasonal offers.

4. Third-Party Data Processors

Your personal data is shared strictly on a need-to-know basis with trusted service providers who process data on our behalf under strict confidentiality obligations:

• Razorpay Software Private Limited: Payment gateway aggregator for payment processing and fraud prevention.
• Supabase, Inc.: Secure cloud database provider for storing order records and inquiry logs.
• Vercel, Inc.: Cloud hosting and application delivery infrastructure.
• Google Workspace (Gmail): Secure transactional email communication provider.
• Logistics & Postal Couriers (India Post / Courier Partners): Delivery agencies provided only with your name, delivery address, and contact number for parcel delivery.

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

5. Consent Management & Withdrawal Rights

Under the DPDP Act 2023, your consent must be free, specific, informed, unconditional, and unambiguous. We enforce this through:

• Unchecked Checkboxes: Consent checkboxes on our platform are never pre-checked by default.
• Purpose Separation: Mandatory consent for order fulfillment is kept strictly separate from optional marketing communication consent.
• Right to Withdraw Consent: You have the right to withdraw your optional marketing consent at any time without affecting your ability to purchase or receive products.

To withdraw marketing consent, you may use our online withdrawal facility or email us directly at hallisiri2306@gmail.com with the subject line "Withdraw Marketing Consent".

6. Data Retention & Erasure

We retain personal data only for as long as necessary to satisfy the purpose for which it was collected:

• Order & Billing Records: Retained for 7 years to comply with statutory taxation, accounting, and consumer protection requirements.
• Inquiries & Contact Messages: Retained for up to 12 months after resolution of your query.
• Marketing Consent Records: Retained until consent is withdrawn.

7. Rights of the Data Principal

Under the DPDP Act 2023, you have the following rights regarding your personal data:

• Right to Access: The right to obtain a summary of your personal data processed by us and the identities of data processors with whom it was shared.
• Right to Correction & Erasure: The right to request correction of inaccurate data or erasure of data that is no longer necessary for its original purpose or statutory retention.
• Right of Grievance Redressal: The right to have complaints addressed by our Data Fiduciary Grievance Officer.
• Right to Nominate: The right to nominate an individual who will exercise your rights in the event of death or incapacity.

8. Security Safeguards

We implement comprehensive technical and organizational safeguards to protect your personal data against accidental loss, unauthorized access, alteration, and disclosure:

• Strict HTTPS / TLS 1.3 encryption across all website communications.
• Database Row Level Security (RLS) preventing public access to customer order records.
• Server-side price verification and payment reconciliation.
• Role-based access controls restricting customer records exclusively to verified administrative personnel.

9. Children & Minors

Our Platform is intended for use by adults of legal contractual age. We do not knowingly market directly to or collect personal data from individuals under 18 years of age without parental guidance.

10. Grievance Officer & Contact Details

In accordance with the DPDP Act 2023 and the Information Technology Act, 2000, if you have any questions, grievances, or wish to exercise your Data Principal rights, please contact our designated Grievance Officer:

We will acknowledge your grievance within 24 business hours and aim to resolve all legitimate requests within 30 days.