Privacy Policy & Data Protection Notice

1.Data Fiduciary Details & Scope

This Privacy Policy applies to the digital platform, web portal, and shopping catalog operated by Apna Prabh (OPC) Private Limited ("Company", "We", "Us", or "Our"). Under Section 2(i) of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Apna Prabh acts as the Data Fiduciary determining the purpose and means of personal data processing.

2.Data Minimization Principle: What We Collect

We adhere strictly to the principle of Data Minimization under Section 6 of the DPDP Act. We only collect personal data that is strictly necessary to provide our e-commerce catalog, fulfill your orders, ensure legal age eligibility, and disburse verified commissions:

3.Notice and Grounds for Data Processing

Under Sections 4, 5, and 6 of the DPDP Act, 2023, your personal data is processed strictly on the following lawful grounds:

• Free, Specific, Informed, Unconditional Consent: You give unambiguous affirmative consent by checking the consent box during registration or checkout. Consent is never bundled or pre-selected.
• Performance of Contract: To process your purchase orders, generate GST tax invoices, deliver packages to your physical address, and manage your account ledger.
• Compliance with Legal & Statutory Obligations: Maintaining financial accounts and invoices for mandatory statutory audit periods under the Indian Companies Act, 2013, GST Act, and Income Tax Act, 1961.

4.Third-Party Processors & Analytics Audit

We value your privacy and do not sell, rent, trade, or monetize your personal information to third parties or advertising networks. We do not run invasive behavioral tracking scripts or third-party ad retargeting pixels.

Data is shared strictly on a need-to-know basis with authorized Data Processors under strict confidentiality contracts:

• Payment Aggregator: Razorpay Software Private Limited (strictly for processing online payments under PCI-DSS Level 1 compliance).
• Logistics & Delivery Partners: Our internal delivery partners and courier agencies receive only the recipient name, delivery address, and phone number necessary to hand over parcels.
• Regulatory / Law Enforcement: Disclosed only when legally required by a valid court order or statutory investigative agency under Indian law.

5.Rights of the Data Principal (Your Rights)

Under Chapter III of the DPDP Act, 2023, you (as the Data Principal) possess the following statutory rights:

6.Protection of Children (Age 18+ Verification)

In accordance with Section 9 of the DPDP Act, 2023, our platform does not process the personal data of children. We enforce mandatory Date of Birth (DOB) verification during registration, preventing anyone under the age of 18 from creating an account or executing commercial transactions.

7.Data Retention and Security Safeguards

We implement robust organizational, administrative, and technical measures to safeguard your personal data:

• Encryption: Password hashes are salted and securely stored using modern cryptographic algorithms (`bcrypt`).
• Secure Transport: SSL/TLS encryption for all data in transit across our portal.
• Retention Period: Personal data is retained only as long as an active account exists or for a statutory period (8 years for financial/tax records as required by Indian accounting law), after which it is securely shredded or anonymized.