Privacy Policy

1Who we are#

Biteora Foods LLP ("Biteora", "we", "us" or "our"), having its principal place of business at A-83, Second Floor, A-Block, Sector-83, Noida, Gautam Buddha Nagar, Uttar Pradesh, 201305, operates this website and the direct-to-consumer sale of Biteora products.

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Biteora Foods LLP is the Data Fiduciary in respect of the personal data described in this policy. You, as the individual to whom that data relates, are the Data Principal.

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights available to you — including how to have your data corrected or erased.

2The personal data we collect#

We deliberately collect the minimum data required to sell and deliver a food product to you. Specifically:

We do not collect or store your card number, CVV, UPI PIN, net banking credentials or any other payment authentication data. Payment information is captured directly by our payment gateway partner on secure infrastructure certified to the applicable payment card industry standards. We only receive confirmation of whether a payment succeeded or failed, together with a reference number.

We do not collect biometric data, financial account statements, health data, caste or religious affiliation, or any other special category of data. We do not build advertising or behavioural profiles of our customers.

3Purpose of processing, and your consent#

We process your personal data strictly for order fulfilment and customer service. In concrete terms, that means:

• accepting, confirming, packing and dispatching your order;
• enabling our courier partner to deliver to you and to contact you about that delivery;
• processing payments, and processing refunds or replacements under our Return and Refund Policy;
• responding to your questions, complaints and grievances;
• sending transactional communications about an order you have placed; and
• meeting our obligations under tax, accounting, consumer protection and food safety law.

We rely on your consent, given when you place an order or submit a form, and on the "legitimate uses" recognised by Section 7 of the DPDP Act, where you have voluntarily provided data for a specified purpose. Your consent is sought through a clear, standalone notice, and it is limited to the purposes listed above. We will not repurpose your data for something you did not agree to.

We send marketing communications only where you have separately opted in, for example by subscribing to our newsletter. You may withdraw that consent at any time using the unsubscribe link in any such email, or by writing to us. Withdrawing marketing consent does not affect delivery of your existing orders.

4We never sell or rent your data#

We do not sell, rent, trade, licence or otherwise make your personal data available to any third party for that party’s own marketing, advertising, profiling or commercial purposes. We never have, and we will not.

5Who we share data with, and why#

We share the minimum necessary personal data with a small number of service providers who perform an essential function in getting your order to you. Each acts as a Data Processor on our instructions, under contract, and may use the data only for the purpose for which we disclose it.

Beyond these, we disclose personal data only where we are legally compelled to do so — for example in response to a valid order of a court, or a lawful demand from a statutory authority such as a food safety, tax or law enforcement agency — or where disclosure is necessary to establish, exercise or defend a legal claim.

6How long we keep your data#

We retain your personal data only for as long as the purpose for which it was collected continues to be served, and thereafter for such period as we are required to retain it by law — principally invoicing and tax records, which Indian law requires us to preserve for up to eight financial years.

Where you ask us to erase your data and no legal retention obligation applies, we erase it as described in Clause 8. Where a legal obligation does apply, we restrict the data from all active use and erase it once that period expires.

7Your rights as a Data Principal#

The DPDP Act gives you the following rights in respect of your personal data, and we honour all of them:

• Right to access — to obtain a summary of the personal data we hold about you and the processing we have carried out on it;
• Right to correction and updating — to have inaccurate or misleading data corrected, and incomplete data completed;
• Right to erasure — to have your personal data deleted, where we are not required by law to retain it;
• Right to withdraw consent — at any time, as easily as it was given;
• Right of grievance redressal — to a readily available means of raising a complaint with us; and
• Right to nominate — to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

8How to have your data deleted or corrected#

To exercise any right in Clause 7 — including deletion or modification of your personal data — simply write to us:

In your request, please tell us (a) which right you wish to exercise, (b) the name, email address and mobile number used when placing your orders, so that we can locate your records, and (c) if you are asking for correction, the corrected details.

What happens next: we acknowledge your request within 48 hours and complete it within 30 days. We may need to verify your identity before acting, purely to ensure we are not disclosing or deleting one person’s data at another person’s request. There is no fee for making a request.

Please note that if you ask us to erase data that we are legally obliged to retain — such as a tax invoice for a completed purchase — we will erase everything we lawfully can, tell you clearly what must be retained and why, and delete the remainder once the statutory period ends.

9Security safeguards#

We maintain reasonable security safeguards to prevent personal data breaches, as required by Section 8(5) of the DPDP Act. These include encryption of data in transit using HTTPS across the entire website, access controls that limit customer data to personnel who need it to fulfil orders, use of reputable payment and hosting providers, and the practice of not storing payment credentials at all.

No method of transmission or storage is completely secure. In the event of a personal data breach affecting your data, we will notify you and the Data Protection Board of India in the manner and within the timelines prescribed under the DPDP Act and the rules made under it.

10Cookies and website analytics#

Our website uses only such storage as is necessary for the site to function — for example, remembering the contents of your shopping cart in your own browser’s local storage so that it is not lost as you move between pages. This information stays on your device. We do not use third-party advertising cookies or cross-site tracking pixels.

11Children’s data#

Our website and products are directed at a general adult audience. We do not knowingly collect the personal data of any child below the age of 18 years without verifiable consent of a parent or lawful guardian, as required by Section 9 of the DPDP Act. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided us personal data, please contact us and we will erase it promptly.

12Changes to this policy#

We may update this policy to reflect changes in our practices or in the law. The revised version will be published on this page with a new "last updated" date. Where a change materially affects how we handle your personal data, we will take reasonable steps to bring it to your notice.

13Grievance redressal#

In accordance with the Consumer Protection (E-Commerce) Rules, 2020, we operate a grievance redressal mechanism. If something has gone wrong with your order, or you are unhappy with how a request was handled, this is the route to escalate it.

We acknowledge every complaint within 48 hours of receipt and endeavour to resolve it within one month, as required under the said Rules. Please quote your order number and describe the issue so we can help you faster.