Privacy Policy

Scope

Karnani FnB Specialities LLP operates caldera.rocks. This policy explains what personal data we collect when you browse the site or place an order, why we collect it, who it goes to, and what you can ask us to do with it.

It is written to meet the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

What we collect

You give us

• Name, delivery address, pincode, email address and mobile number
• GSTIN, only if you enter one for a business invoice
• Your order history and anything you write to us in an enquiry or complaint

We collect automatically

• IP address, approximate location derived from it, browser and device type
• Pages visited and time on site, so we can see what needs fixing
• Cart contents, stored in your own browser so your crate survives a refresh

We do not collect sensitive personal data such as health, biometric, religious or political information, and we ask you not to send it to us.

Payment data

This is the part people worry about, so it is stated plainly: we never see, receive or store your card number, CVV, expiry date, UPI PIN, net-banking username or password.

Payments are processed by Razorpay. You enter your payment credentials in Razorpay’s own secure environment, not on our page. What comes back to us is a success or failure flag, a payment reference, the amount, and the method used (for example “UPI” or “card ending 4242”). That is all we hold, and we hold it because we have to be able to match a payment to an order and issue a refund.

Why we use it

• To fulfil your order — take payment, pack, dispatch, deliver, invoice, and handle returns and refunds.
• To talk to you about that order — confirmation, dispatch and delivery messages, and replies to your questions.
• Because the law requires it — tax invoices and books of account, and food-safety traceability if a batch is ever queried.
• To keep the shop working — fraud prevention, security, and understanding which pages fail.
• To send you offers — only if you have asked for them. Every marketing message carries a one-click unsubscribe, and unsubscribing never affects your order messages.

Who we share it with

We do not sell your personal data. We never have and we will not. We share the minimum necessary with:

• Razorpay — to process payments and refunds.
• Logistics partners — your name, address and phone number, so the pack can be delivered and so the rider can call you.
• Our hosting and database providers — under contract.
• Our accountants and auditors — invoice and payment records, for statutory filing.
• A public authority — only where we are legally required to disclose, and only what is required.

Cookies & local storage

We use the minimum that makes a shop work:

• Your crate is stored in your browser’s local storage, not on our servers, so what you added is still there when you come back.
• Session data keeps you signed in through checkout if you create an account.
• Analytics, where enabled, tells us which pages are visited and where people drop out. It is aggregated and not used to identify you.

You can clear or block storage in your browser settings. If you do, the cart will empty between visits and checkout may not complete.

How long we keep it

• Order, invoice and payment records — eight years from the end of the relevant financial year, which is the retention required for books of account under Indian company and tax law.
• Enquiry and complaint correspondence — three years from closure.
• Marketing consent records — until you withdraw consent, plus a record of the withdrawal itself.

After that we delete the data or anonymise it so it can no longer identify you.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

• Show you the personal data we hold about you and who we shared it with;
• Correct anything inaccurate, incomplete or out of date;
• Erase your data, where we are not required by law to keep it;
• Withdraw consent you previously gave, at any time;
• Nominate someone to exercise these rights on your behalf in the event of your death or incapacity.

Write to our Grievance Officer below. We verify your identity before acting, and we respond within 30 days. There is no charge.

Security

The site is served over HTTPS throughout. Order data sits in an access-controlled database, administrative access is limited to the people who need it, and payment credentials never reach our systems at all.

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the Data Protection Board of India as the Act requires.

Children

This site is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.

Grievance Officer

If you are not satisfied with our response, you may complain to the Data Protection Board of India.