Data Deletion Policy

1. About this Policy

This Data Deletion Policy explains how you can request the deletion of personal data held by Balu Ram Rajeshwar Kumar (the proprietary firm operating the brand "Annapurna Spices", hereinafter "we", "our", "us"), what we can delete, what we are legally required to retain, and how long the process takes.

This policy is published in compliance with Section 12 of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices) Rules, 2011, and the data-deletion expectations of platforms such as Meta (Facebook, Instagram, WhatsApp) and Google.

This policy must be read together with our Privacy Policy, Terms of Service, and Refund & Cancellation Policy.

2. What You Can Request

You may request that we:

• Delete your customer account, including profile name, email, phone, addresses, and saved preferences.
• Delete your MaAI Health Profile, taste preferences, allergies, mood-recipe history, and Smart Compare history.
• Delete your saved order list, wishlist, and cart contents.
• Delete your stored marketing-consent records and unsubscribe you from email, SMS, and WhatsApp marketing.
• Delete WhatsApp chat history, attachments, and notes that we hold internally about you (subject to Section 5 below).
• Delete data we hold from your interactions with our social-media handles (comments, DMs, lead-form submissions you sent us), to the extent such data is stored by us outside the platform itself.
• Delete browsing-level data linked to your account (analytics, cookie identifiers, click history) where it is identifiable to you.

3. How to Submit a Deletion Request

You may raise a data-deletion request through any of the following channels:

3.1 By email (recommended)

Send an email from your registered email address to annapurna2486@gmail.com with the subject line "Data Deletion Request". Please include:

• Full name as registered with us.
• Registered mobile number and email address.
• Approximate date of last order (if any) and any order number(s).
• Channels for which deletion is requested (website account, WhatsApp chats, MaAI profile, marketing list, social-media DMs, all of the above, etc.).
• Confirmation that the request is being made by you or by a legally authorised nominee.

3.2 By WhatsApp

Message us on our WhatsApp Business number from the same number that is registered with us, with the words "DELETE MY DATA". You will receive an acknowledgement and identity-verification follow-up.

3.3 In writing

Send a signed letter to: Balu Ram Rajeshwar Kumar – Attn: Grievance Officer, Shop No. 2486, Gurudwara Road, near Singh Sabha, Anand Colony, Neelpur, Rajpura, District Patiala, Punjab – 140401, India.

3.4 Through your account

Where the feature is enabled, you may also use the in-app "Delete my account" option in your account settings. We may still ask you to confirm the request via email or WhatsApp for verification.

4. Identity Verification

To protect your data from unauthorised deletion, we will verify your identity before processing the request. Verification is typically done by:

• Confirmation from the registered email or mobile number on file.
• An OTP sent to that contact.
• Where the request is made by a nominee or legal heir, suitable authorisation documents (power of attorney, succession certificate, or equivalent).

If we are unable to verify your identity, we may decline the request.

5. What We Are Legally Required to Retain

Even after a deletion request is processed, we are required by law to retain certain records. These include:

• Tax invoices and order records: retained for at least 8 financial years from the date of issue, as required under Section 36 of the CGST Act, 2017 and the Income Tax Act, 1961.
• FSSAI traceability records: retained as required under the Food Safety and Standards Act, 2006 and applicable regulations.
• Payment, KYC, and anti-money-laundering records: retained as mandated by the Reserve Bank of India and the Prevention of Money Laundering Act, 2002 (where applicable).
• Records under active legal proceedings, audits, investigations, or disputes: retained until conclusion of the matter.
• Anonymised / aggregated analytics: may be retained without restriction as it is no longer identifiable to you.

Such retained records are kept in restricted-access archives, protected by access controls, and used solely for the legal purpose for which they are retained.

6. Data on Third-Party Platforms

We do not control data held independently by third-party platforms. To delete data held by those platforms, you must use the controls provided by them:

• WhatsApp: use WhatsApp's "Delete chat" feature on your device, and request account deletion via WhatsApp Settings > Account > Delete My Account. Note that copies of messages we have already received cannot be deleted from your device by us, but we will delete our internal copy on request.
• Facebook & Instagram (Meta): manage data via your Meta account settings or visit facebook.com/help / help.instagram.com.
• Google (sign-in, YouTube, Google Business reviews): manage data via myaccount.google.com.
• Marketplaces (Amazon, Flipkart, JioMart, Blinkit): follow their respective account deletion processes.

For data we have received from such platforms and stored on our systems, you can use this Data Deletion Policy to have it deleted from our records.

7. Timelines

• Acknowledgement: within 48 hours of receiving the request.
• Identity verification: typically completed within 3 business days.
• Deletion from active systems: within 30 days of verification.
• Removal from backups: data persists in encrypted backups for up to 90 additional days, after which it is overwritten in the normal backup-rotation cycle.
• Confirmation: we will send a written confirmation to your registered email once deletion is complete.

8. Effect of Deletion

• You will lose access to your account, MaAI profile, saved lists, order history, and personalised recommendations.
• Future orders will require fresh registration / fresh data submission.
• Order history retained under tax law cannot be visually re-linked to your deleted account but will continue to exist in archived form for the periods stated above.
• Marketing consent and contact details will be moved to a suppression list to ensure you are not contacted again, unless you re-register and opt in.

9. Refusal of Requests

We may decline a deletion request, in whole or part, where:

• Identity cannot be verified.
• The request is manifestly unfounded, vexatious, or repetitive.
• Retention is required under applicable law, regulation, or court order.
• Data is required for the establishment, exercise, or defence of legal claims.
• Deletion would adversely affect the rights of another person.

In such cases we will inform you in writing of the reason and the parts of the request we are unable to fulfil.

10. Grievance Officer & Escalation

If you are dissatisfied with the handling of your deletion request, you may escalate to our Grievance Officer:

You may further escalate unresolved complaints to the Data Protection Board of India once it is operational, in accordance with the DPDP Act, 2023.

11. Updates

We may revise this policy from time to time. The effective date at the top of this page reflects the latest version. Material changes will be communicated through our website, email, or WhatsApp.