Scope
Karnani FnB Specialities LLP operates caldera.rocks. This policy explains what personal data
we collect when you browse the site or place an order, why we collect it, who it goes to,
and what you can ask us to do with it.
It is written to meet the Digital Personal Data Protection Act, 2023 and the
Information Technology (Reasonable Security Practices and Procedures and Sensitive
Personal Data or Information) Rules, 2011.
What we collect
You give us
- Name, delivery address, pincode, email address and mobile number
- GSTIN, only if you enter one for a business invoice
- Your order history and anything you write to us in an enquiry or complaint
We collect automatically
- IP address, approximate location derived from it, browser and device type
- Pages visited and time on site, so we can see what needs fixing
- Cart contents, stored in your own browser so your crate survives a refresh
We do not collect sensitive personal data such as health, biometric, religious or
political information, and we ask you not to send it to us.
Payment data
This is the part people worry about, so it is stated plainly:
we never see, receive or store your card number, CVV, expiry date, UPI PIN,
net-banking username or password.
Payments are processed by Razorpay. You enter your payment
credentials in Razorpay’s own secure environment, not on our page. What comes back
to us is a success or failure flag, a payment reference, the amount, and the method used
(for example “UPI” or “card ending 4242”). That is all we hold,
and we hold it because we have to be able to match a payment to an order and issue a
refund.
Why we use it
- To fulfil your order — take payment, pack, dispatch, deliver,
invoice, and handle returns and refunds.
- To talk to you about that order — confirmation, dispatch and
delivery messages, and replies to your questions.
- Because the law requires it — tax invoices and books of
account, and food-safety traceability if a batch is ever queried.
- To keep the shop working — fraud prevention, security, and
understanding which pages fail.
- To send you offers — only if you have asked for them. Every
marketing message carries a one-click unsubscribe, and unsubscribing never affects
your order messages.
Who we share it with
We do not sell your personal data. We never have and we will not. We share the
minimum necessary with:
- Razorpay — to process payments and refunds.
- Logistics partners — your name, address and phone number, so
the pack can be delivered and so the rider can call you.
- Our hosting and database providers — the site is hosted on
Netlify and order records are held in Supabase, both under contract.
- Our accountants and auditors — invoice and payment records,
for statutory filing.
- A public authority — only where we are legally required to
disclose, and only what is required.
Cookies & local storage
We use the minimum that makes a shop work:
- Your crate is stored in your browser’s local storage, not on
our servers, so what you added is still there when you come back.
- Session data keeps you signed in through checkout if you create an
account.
- Analytics, where enabled, tells us which pages are visited and
where people drop out. It is aggregated and not used to identify you.
You can clear or block storage in your browser settings. If you do, the cart will
empty between visits and checkout may not complete.
How long we keep it
- Order, invoice and payment records — eight years from the end
of the relevant financial year, which is the retention required for books of
account under Indian company and tax law.
- Enquiry and complaint correspondence — three years from
closure.
- Marketing consent records — until you withdraw consent, plus
a record of the withdrawal itself.
After that we delete the data or anonymise it so it can no longer identify you.
Your rights
Under the Digital Personal Data Protection Act, 2023 you may ask us to:
- Show you the personal data we hold about you and who we shared it
with;
- Correct anything inaccurate, incomplete or out of date;
- Erase your data, where we are not required by law to keep it;
- Withdraw consent you previously gave, at any time;
- Nominate someone to exercise these rights on your behalf in the
event of your death or incapacity.
Write to our Grievance Officer below. We verify your identity before acting, and we
respond within 30 days. There is no charge.
Security
The site is served over HTTPS throughout. Order data sits in an access-controlled
database, administrative access is limited to the people who need it, and payment
credentials never reach our systems at all.
No system is perfectly secure. If a breach ever affects your personal data, we will
notify you and the Data Protection Board of India as the Act requires.
Children
This site is not directed at children. We do not knowingly collect personal data from
anyone under 18. If you believe a child has given us data, write to us and we will delete
it.
Grievance Officer
If you are not satisfied with our response, you may complain to the Data Protection
Board of India.