Privacy Policy

This Privacy Policy explains how Krumbee & Co ("Krumbee & Co", "we", "us", "our"), operated by KRUMBEE & CO, collects, uses, shares, stores and protects personal data when you visit krumbeeco.in (the "Website"), place an order, create an account or contact us. It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 and the Consumer Protection (E-Commerce) Rules, 2020.

By using the Website or giving us your personal data, you acknowledge this Policy. Where we rely on your consent, we ask for it separately and you may withdraw it at any time.

1. Who is responsible for your data

For the purposes of the Digital Personal Data Protection Act, 2023, the business named in the "Seller and contact details" section below is the Data Fiduciary for personal data collected through the Website. Questions about this Policy can be sent to our grievance officer at the contact details given there.

2. Personal data we collect

Information you give us

• Contact details: your name, email address and mobile number.
• Delivery details: delivery address, PIN code, city and state. Location: when you open our website your browser may ask whether to share your location with us (if you have already allowed it, we look it up automatically on each visit); at checkout you can also tap "Get instant location". Only if you allow it, we receive your device's approximate position (latitude and longitude), use it to find your PIN code and address and to show the delivery date and charge for your area. We do not keep the position itself; we keep only the PIN code and area name for your visit and, if you place an order, the address and any coordinates you confirm for that delivery. You can refuse or withdraw location access at any time in your browser settings and type your PIN code instead.
• Account details: if you create an account, your login email and password. Passwords are stored only in hashed form and cannot be read by us.
• Order details: the products, pack sizes and quantities you buy, offers you apply, and your delivery and payment choices.
• Communications: messages you send us, return or replacement requests, reviews you submit, and your marketing preferences.

Information collected automatically

• Technical and security data: IP address, browser type, device information, pages requested and timestamps, recorded in security and server logs to keep the Website safe and working.
• Cookies: essential cookies that keep your cart and login working, and, only if you allow them, analytics and advertising cookies. See our Cookie Policy.

Information from others

• Payment status and transaction references from our payment gateway, Razorpay. We do not receive or store your full card number, CVV, net-banking password or UPI PIN.
• Delivery status from our courier partners and from our own delivery riders in Kota.
• Message delivery status from our email and WhatsApp service providers.

We do not ask for sensitive personal data such as health records, biometric data or financial passwords. Please do not send such information to us.

3. How we use your data

• To process, confirm, prepare, pack and deliver your orders, including booking couriers or assigning our own riders, and showing delivery estimates for your PIN code.
• To take payments, process refunds and handle cash on delivery where it is available.
• To verify your mobile number by one-time password (OTP) where checkout requires it.
• To send order, delivery, payment and invoice updates by email and, where you have provided your number, by WhatsApp.
• To issue tax invoices and credit notes, keep accounts and meet our obligations under GST and other laws.
• To provide customer support, handle returns, replacements, refunds and grievances.
• To keep the Website and your account secure, prevent fraud, misuse of offers and abuse, and enforce our Terms & Conditions.
• With your separate consent only: to send offers and news by email or WhatsApp, and to measure and improve the Website with analytics and advertising tools.

4. Why we are allowed to process your data

We process personal data on the basis of your consent (for example, for marketing messages and optional cookies), and for legitimate uses recognised under the Digital Personal Data Protection Act, 2023, including where you voluntarily provide data for a specified purpose such as placing an order or asking for support, and where processing is needed to comply with law, a court order or a request from a government authority.

5. Who we share your data with

We share personal data only with the parties below, only to the extent needed for the purpose described, and they are required to protect it. We do not sell your personal data.

• Payment gateway (Razorpay): to process online payments and refunds securely.
• Address lookup (OpenStreetMap Nominatim): if you share your location, the latitude and longitude are sent to this mapping service to find the matching address and PIN code. No name, phone or email is sent.
• Delivery partners: courier companies and courier aggregators (such as Shiprocket and Delhivery) receive your name, address, phone number and parcel details. Our own riders in Kota see only the orders assigned to them, with the details needed to deliver and collect any amount due.
• Communication providers: our email service provider and Meta's WhatsApp Business Platform, to send OTPs, order updates and, with consent, marketing messages.
• Technology providers: our website hosting, storage and backup providers, who process data on our instructions.
• Analytics and advertising providers (Google Analytics, Google Ads, Meta): only if you allow analytics or advertising cookies.
• Professional advisers: accountants, auditors and legal advisers, under duties of confidentiality.
• Authorities: government, tax, law-enforcement or regulatory authorities, or courts, where required by law.
• Business transfers: a successor business if our business is sold or restructured, subject to this Policy.

6. Where your data is processed

Our data is processed in India. Some service providers, such as Google and Meta, may process data on servers outside India. We transfer personal data outside India only as permitted under Indian law, and we choose providers that protect it with appropriate safeguards.

7. How long we keep your data

• Orders, invoices, payments and refunds: for as long as required by tax and accounting laws. Under GST law this is generally at least 72 months from the due date of the annual return for the year concerned.
• Account details: while your account is active, and deleted or anonymised after you ask us to delete it, except records we must keep by law.
• Marketing consent records: for as long as needed to show when and how you gave or withdrew consent.
• Analytics data: only for a limited period, after which it is deleted or aggregated.
• Security logs and backups: for a limited period, after which they are overwritten.

8. How we protect your data

We use reasonable security practices, including encrypted connections (HTTPS), hashed passwords, encrypted storage of service credentials, role-based staff access protected by two-factor authentication, audit logs of sensitive actions, and regular backups. Card and UPI payments are processed by Razorpay, a PCI-DSS compliant payment gateway. No system is completely secure. If a personal data breach occurs, we will act promptly to contain it and notify affected users and authorities as required by law.

9. Your rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how we use it.
• Correct and update inaccurate or incomplete data. You can update most details yourself in My profile.
• Erase your data when it is no longer needed, except where we must keep it by law (for example, tax invoices).
• Withdraw consent at any time. Change cookie choices under "Privacy choices" at the bottom of any page, use the unsubscribe link in our emails, or reply STOP to our WhatsApp messages. Withdrawal does not affect processing already carried out.
• Nominate another person to exercise your rights in the event of your death or incapacity.
• Raise a grievance with our grievance officer, and, if you are not satisfied, approach the Data Protection Board of India.

To exercise these rights, email our grievance officer at the address below from the email address linked to your account or order. We may need to verify your identity before acting. We will acknowledge your request within 48 hours and respond within 30 days.

10. Children

The Website is intended for people aged 18 and above. Children may use it only under the supervision of a parent or lawful guardian. We do not knowingly collect personal data from children without verifiable parental consent, and we do not track or direct advertising at children. If you believe a child has given us personal data, please contact us and we will delete it.

11. Cookies

We use essential cookies that are needed for the Website to work. Analytics and advertising cookies are off by default and are used only if you allow them. Details are in our Cookie Policy.

12. Links to other websites

The Website may link to other websites, such as IYEC or our payment gateway. Their privacy practices are governed by their own policies, and we are not responsible for them.

13. Changes to this Policy

We may update this Policy from time to time. The effective date at the top shows when it was last changed. If we make significant changes, we will highlight them on the Website or tell you by email.

14. Contact and grievance officer

For any question, request or complaint about your personal data, contact our grievance officer using the details below. You can also read how complaints are handled on our Grievance Redressal page.