PRIVACY POLICY

1. Introduction

This Privacy Policy is published by Agrocyclex Bio Products Private Limited ("Aura Farmers", "we", "us", "our") in accordance with the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, and the Digital Personal Data Protection Act 2023 ("DPDP Act").

For the purposes of the DPDP Act, Aura Farmers is the Data Fiduciary in respect of your personal data and you are the Data Principal. This policy explains how we collect, use, store, and protect your personal data when you visit https://aurafarmers.in or communicate with us.

2. Personal Data We Collect

We collect personal data only to the extent necessary for the specified lawful purposes below. Categories collected:

• Contact details — name, email address, phone number, organisation (when you submit our contact form or write to us).
• Enquiry details — product interest, quantity, delivery location, and any other details you voluntarily share in your message.
• Technical data — IP address, browser type, device type, pages visited, referrer, and timestamps. Collected by our hosting provider (Cloudflare) for security and performance, and by Cloudflare Web Analytics for aggregated, privacy-preserving site statistics. Cloudflare Web Analytics does not use cookies, does not fingerprint users, and does not collect personally identifiable information.
• WhatsApp communications — when you message us via WhatsApp, we receive your phone number, display name, and the content of your message.

We do not knowingly collect personal data of children under 18 years of age. We do not collect biometric, financial account, health, or other sensitive personal data through this website.

3. Purpose and Legal Basis of Processing

Your personal data is processed for the following specified purposes, on the basis of your consent (given when you initiate contact) or in the legitimate use of furnishing a service you have requested:

• Responding to your enquiry and providing quotations.
• Processing, dispatching, and invoicing bulk orders placed via WhatsApp, phone, or email.
• Maintaining business records as required under the Companies Act 2013, GST laws, and other applicable statutes.
• Improving our products, website, and customer service based on aggregated feedback.
• Complying with legal obligations, court orders, or lawful requests from government authorities.

We do not sell, rent, trade, or otherwise monetise your personal data. We do not use your data for automated decision-making or profiling.

4. Sharing and Disclosure

We share personal data only with:

• Logistics partners — courier and transport providers, strictly for dispatching orders.
• Service providers — Cloudflare (hosting, CDN, DNS, aggregated Web Analytics), Web3Forms (relays contact form submissions to our inbox), WhatsApp (Meta Platforms, for messaging). These parties are contractually or legally bound to protect your data.
• Legal or regulatory authorities — when required by applicable law, court order, or to protect our legal rights.

We do not transfer your personal data outside India except to the extent our service providers (e.g., Cloudflare, Meta/WhatsApp) operate global infrastructure. Such transfers are made only to jurisdictions not restricted by the Central Government under Section 16 of the DPDP Act.

5. Cookies and Tracking

Our website uses only strictly necessary cookies required for basic site functionality and security (set by Cloudflare). We do not use advertising, marketing, or cross-site tracking cookies.

For aggregated site statistics we use Cloudflare Web Analytics, which is cookieless and does not collect personally identifiable information — no consent banner is therefore required under the IT Rules 2011 or the DPDP Act 2023. If we ever enable additional analytics (such as Google Analytics or Meta Pixel), we will display a consent banner and set non-essential cookies only after you grant consent.

6. Data Retention

We retain your personal data only for as long as necessary for the purpose it was collected:

• Contact form enquiries — retained for up to 24 months after last communication, then deleted.
• Order records and invoices — retained for at least 8 years as required under GST and Companies Act recordkeeping rules.
• WhatsApp conversations — retained on our device and WhatsApp's infrastructure per their own retention policies.

Once a retention period ends, data is securely deleted or anonymised.

7. Security Safeguards

We follow reasonable security practices and procedures as prescribed under Rule 8 of the IT (Reasonable Security Practices) Rules 2011, including:

• Access control — only authorised personnel can access personal data.
• Encryption in transit — the website is served over HTTPS (TLS).
• Secure hosting — Cloudflare provides DDoS protection and network-layer security.
• Limited data collection — we collect only what is strictly necessary.

Notwithstanding these safeguards, no method of electronic transmission or storage is 100% secure. In the event of a personal data breach affecting you, we will notify the Data Protection Board of India and affected Data Principals within the timelines prescribed under the DPDP Act.

8. Your Rights as a Data Principal

Under the DPDP Act 2023, you have the following rights:

• Right to information — obtain a summary of personal data we hold about you and the processing activities.
• Right to correction and erasure — request correction of inaccurate or incomplete data, or deletion of data no longer necessary (subject to legal retention requirements).
• Right to grievance redressal — raise a complaint to our Grievance Officer (see §11 below). If unresolved, escalate to the Data Protection Board of India.
• Right to nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent — withdraw consent for processing at any time. Withdrawal does not affect lawfulness of processing done before withdrawal. To withdraw, email us at info@aurafarmers.in.

To exercise any of these rights, contact our Grievance Officer using the details in §11. We will respond within the timelines stated there.

9. Third-Party Services

The following third-party services may process your data when you use our website:

• Cloudflare (cloudflare.com) — hosting, CDN, DDoS protection, DNS, and cookieless Web Analytics. Governed by Cloudflare's privacy policy.
• Web3Forms (web3forms.com) — relays contact form submissions to our inbox. Governed by Web3Forms' privacy policy.
• WhatsApp / Meta Platforms — messaging channel. Governed by WhatsApp's privacy policy.
• Google Fonts / @fontsource (self-hosted) — fonts are self-hosted from our servers; no requests go to Google.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. We will post the revised policy on this page with an updated "Last updated" date. Material changes will be notified via a banner on the website for at least 30 days. Continued use of the website after the effective date constitutes acceptance of the updated policy.

11. Grievance Officer

In compliance with Rule 3(2) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 and Section 8(10) of the DPDP Act 2023, the following individual has been designated as our Grievance Officer to address complaints related to this website, data processing, or content:

Complaint process:

• Submit your complaint by email or post to the address above, describing the issue and your contact details.
• We will acknowledge receipt within 24 hours.
• We will make best efforts to resolve the complaint within 15 days of receipt.
• If unresolved, you may escalate to the Data Protection Board of India established under Section 18 of the DPDP Act 2023.

12. Contact

For general privacy questions not requiring formal grievance redressal: