Privacy & Data Protection Policy

1. Data Controller & Scope of Policy

Under the provisions of India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000, the Data Fiduciary (Data Controller) responsible for your personal information is:

• Entity Name: Citiblock Farmer Producer Company Limited (trading commercially as Vindhya Millets)
• Corporate Office: Mirzapur, Uttar Pradesh - 231001, India
• Website: https://vindhyamillets.com/
• Email Contact: cityblockfpo@gmail.com | vindhyamillets@gmail.com

This policy covers all personal information collected online through our e-commerce store, customer care inquiries, and partnership onboarding forms.

2. Information We Collect

2.1 Information You Provide Voluntarily

• Identity & Contact Information: Full name, billing and shipping address, mobile phone number, and email address when you register or place an order.
• Transaction & Order Details: Products purchased, packet quantities (such as 250g/500g ragi biscuits, unpolished kodo millet, multigrain flour), transaction IDs, order dates, and delivery preferences.
• Payment Information: We utilize secure third-party payment gateways. We do not collect or store full credit/debit card numbers, CVVs, net-banking credentials, or UPI PINs on our servers.
• Customer Support Records: Records of communications, questions, or reviews submitted through contact forms, emails, or WhatsApp support (+91 8318558986).
• Farmer & B2B Distribution Inquiries: Farmer landholding details, cooperative details, or wholesale trade volume preferences provided during partnership registration.

2.2 Technical Information Collected Automatically

• Device & Connection Data: IP address, device hardware model, operating system version, browser type, and time zone.
• Usage & Interaction Data: Pages visited, product clicks, cart additions, session durations, and referral sources.
• Location Data: Non-precise regional location (city/state level) derived from IP address to provide localized shipping calculations and language preferences (Hindi/English).

3. Lawful Basis & How We Use Your Data

In adherence to DPDP Act principles, we process personal data only when we have a lawful purpose and valid consent:

• Contractual Order Fulfillment: Verifying transactions, preparing packages, generating tax invoices, and delivering products to your address.
• Delivery & Courier Notifications: Sending automated dispatch, live tracking links, and SMS/WhatsApp delivery updates.
• Customer Care & Support: Addressing order inquiries, replacement requests, or refund claims.
• Legitimate Security Operations: Detecting and mitigating fraudulent orders, cyber threats, and bot traffic.
• Statutory Tax Compliance: Maintaining financial and tax records as required under Indian GST and company laws.
• Personalized Communication (With Consent): Sharing harvest updates, nutritional millet guides, and discount coupons. You can opt out at any time.

4. Data Sharing & Third-Party Processors

We do not sell, rent, monetise, or trade your personal data. Information is shared exclusively with vetted partners under strict non-disclosure obligations:

• Logistics & Courier Partners: Delivery carriers (such as Delhivery, BlueDart, DTDC, India Post Speed Post) receive only recipient name, destination address, and contact number.
• Payment Gateways: Regulated payment aggregators (e.g., Razorpay, Cashfree, UPI networks) process payment instruments through PCI-DSS Level 1 compliant environments.
• Cloud Infrastructure & Security: Secure cloud servers that host our database with encrypted backups.
• Legal & Law Enforcement: Only when strictly mandated by a valid court order, government authority, or statutory notice under Indian law.

5. Cookies & Tracking Technologies

Our website utilizes first-party and performance cookies to maintain user shopping sessions, preserve cart items, and record preference choices. We categorize cookies into Essential (required for cart and checkout) and Analytics (anonymous performance tracking).

You can review and adjust your cookie choices at any time through our Cookie Policy page or by resetting browser cookies.

6. Data Security & Retention Standards

We deploy robust organizational and technical security measures to protect your data:

• Transport Layer Security (TLS/HTTPS): 256-bit encryption on all client-server communications.
• Role-Based Access Control: Strict credential hierarchy preventing unauthorized internal personnel access.
• Data Retention Limitations: Order data is retained only for the duration required to satisfy statutory GST and accounting laws (typically 7 years in India), after which it is securely anonymized or deleted.

7. Your Rights Under India's DPDP Act 2023

Every customer possesses legally enforceable rights concerning their digital personal data:

• Right to Summary & Access: You can request an executive summary of personal data held by us, alongside processing activities.
• Right to Correction & Erasure: You can request immediate correction of inaccurate data or deletion of data no longer required for statutory purposes.
• Right to Grievance Redressal: Readily accessible mechanism to register complaints regarding data privacy.
• Right to Nominate: You may nominate another individual to exercise privacy rights in the event of incapacity.

To exercise any of these statutory rights, please email our Grievance Officer at cityblockfpo@gmail.com with the subject line "DPDP Data Subject Request".

8. Statutory Grievance Redressal Officer

Pursuant to Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Consumer Protection (E-Commerce) Rules, 2020, the details of our designated Grievance Officer are:

9. Children's Privacy

Our website and millet food products are intended for general consumer purchase. We do not knowingly collect personal data from minors under 18 years of age without parental or guardian consent. If you believe a minor has submitted personal data without authorization, please contact us for prompt erasure.

10. Frequently Asked Questions (Privacy & Data)

11. Contact Channels