PRIVACY POLICY

1. Introduction and Scope

Finest Foodworks Private Limited, a company incorporated under the Companies Act, 2013 and having its registered office at Office No. 506, Zion Tower, Plot 273, Sector 10, Kharghar, Navi Mumbai, District Raigad, Maharashtra 410210, India ("Finest Foodworks", "we", "us" or "our"), owns and operates the brand and website "Pattri" at www.pattri.in (the "Website").

We recognise that your personal data belongs to you, and that we hold it only for defined and lawful purposes. This Privacy Policy ("Policy") explains what personal data we collect, why we collect it, the lawful basis on which we process it, with whom we share it, how long we keep it, how we protect it, and the rights available to you in respect of it.

This Policy is issued in compliance with, and is to be read in conjunction with:

•      the Digital Personal Data Protection Act, 2023 (Act 22 of 2023) ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), notified vide Gazette notifications G.S.R. 843(E) and G.S.R. 846(E) dated 13 November 2025, which are being brought into force in phases;

•      the Information Technology Act, 2000 and, in particular, Section 43A thereof, together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), which continue to remain in force until Section 44(2) of the DPDP Act is brought into effect;

•      the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020; and

•      the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to the extent applicable to us.

This Policy applies to all visitors to the Website, all registered users, all customers (current and former), and all persons who otherwise interact with us through the Website, by telephone, by electronic mail, through our social media channels, or through any offline channel where the personal data so collected is subsequently digitised.

2. Definitions

Terms used in this Policy that are defined in the DPDP Act carry the meaning assigned to them in that Act. In particular:

•      "Personal data" means any data about an individual who is identifiable by or in relation to such data.

•      "Data Principal" means the individual to whom the personal data relates, and where that individual is a child, includes the parent or lawful guardian of such child, and where that individual is a person with a disability, includes her lawful guardian acting on her behalf.

•      "Data Fiduciary" means any person who, alone or in conjunction with other persons, determines the purpose and means of processing of personal data. For the purposes of this Policy, Finest Foodworks Private Limited is the Data Fiduciary.

•      "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary.

•      "Child" means an individual who has not completed the age of eighteen years.

•      "Processing" means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

•      "Board" means the Data Protection Board of India constituted under Chapter V of the DPDP Act.

3. Identity and Contact Details of the Data Fiduciary

Data Fiduciary: Finest Foodworks Private Limited

Registered Office: Office No. 506, Zion Tower, Plot 273, Sector 10, Kharghar, Navi Mumbai, District Raigad, Maharashtra 410210, India

Website: www.pattri.in

The contact details of the person able to answer questions about the processing of your personal data are set out at Clause 15 (Grievance Redressal) below.

4. Personal Data We Collect

We collect only such personal data as is necessary for the specified purposes set out in Clause 5. An itemised description of the personal data we collect is as follows:

4.1 Contact and identity data

Name, electronic mail address, mobile number, telephone number, delivery address (street, locality, city, State, PIN code and country), and billing address.

4.2 Transaction and billing data

Billing name, billing address, order details, order history, mode of payment selected, and transaction reference identifiers. We do not collect, receive, record or store your credit card number, debit card number, card expiry date, card verification value (CVV), net banking credentials, or Unified Payments Interface (UPI) personal identification number. All such payment credentials are collected and processed directly by our third-party payment gateway partner on its own systems, and are governed by that partner's privacy policy.

4.3 Account data

Where you create an account on the Website, your login identifier, password in encrypted or hashed form, saved addresses, saved preferences, wish-list, and cart contents.

4.4 Preference and interaction data

Products viewed, products added to cart, products purchased, product reviews or ratings submitted by you, newsletter subscription status, responses to surveys or promotions, and the content of any communication you send to us by electronic mail, telephone, contact form or social media.

4.5 Technical and usage data

Internet Protocol (IP) address, browser type and version, device type, operating system and version, referring website, pages accessed, duration of visit, the exit page, and cookie identifiers. Please refer to Clause 8 (Cookies and Similar Technologies).

We do not knowingly seek, and we request you not to submit to us, any personal data beyond what is described above. We do not process your personal data for any purpose other than those set out in Clause 5.

5. Purposes for Which We Process Your Personal Data

We process your personal data only for the following specified purposes, and each item of personal data described in Clause 4 is processed only to the extent necessary for the purpose against which it is listed:

•      Order fulfilment: to accept, process, confirm, pack, ship, deliver and, where applicable, cancel, return, replace or refund your order. Personal data used: contact and identity data, transaction and billing data.

•      Payment processing: to enable payment for your order through our payment gateway partner and to reconcile payments and refunds. Personal data used: billing name, billing address, order details, transaction reference identifiers.

•      Account administration: to create, maintain, authenticate and secure your account on the Website. Personal data used: account data, contact and identity data.

•      Customer support: to respond to your queries, requests, complaints and grievances, including in relation to orders, deliveries, returns and refunds. Personal data used: contact and identity data, transaction data, and the content of your communication.

•      Transactional communications: to send you order confirmations, dispatch and delivery updates, refund confirmations, and service-related notices by electronic mail or short messaging service. Personal data used: contact and identity data, transaction data.

•      Marketing and promotional communications: where you have separately consented, to send you newsletters, offers, discount codes and information about new products. Personal data used: contact and identity data, preference data.

•      Website operation, analytics and improvement: to operate the Website, to understand aggregate usage trends, and to improve our products, catalogue, content and user experience. Personal data used: technical and usage data, preference and interaction data.

•      Security and fraud prevention: to detect, investigate and prevent fraudulent transactions, abuse of promotional codes, unauthorised access, and other harm to us, to you or to the Website. Personal data used: technical and usage data, transaction data, account data.

•      Legal and regulatory compliance: to comply with applicable law, including tax, accounting, consumer protection and record-keeping obligations, and to respond to lawful requests from courts, tribunals and statutory or investigating authorities. Personal data used: as required by the applicable law or lawful request.

6. Lawful Basis of Processing

We process your personal data only on one of the following bases recognised under the DPDP Act:

6.1 Consent

For the purposes listed at Clause 5, other than those covered by Clause 6.2, we process your personal data on the basis of your consent. Your consent is sought through a clear affirmative action, and is free, specific, informed, unconditional and unambiguous, and is limited to such personal data as is necessary for the specified purpose.

Mere visiting or browsing of the Website is not treated by us as consent to processing beyond what is strictly necessary for the Website to function. Consent for marketing and promotional communications is sought separately and is not bundled with, or made a condition of, the purchase of any product or the creation of any account.

We do not presently engage a Consent Manager registered with the Board. Consent is obtained and managed directly by us.

6.2 Certain legitimate uses

In accordance with Section 7 of the DPDP Act, we may process your personal data without separate consent where you have voluntarily provided your personal data to us for a specified purpose and have not indicated that you do not consent to its use for that purpose, and where processing is necessary for compliance with any judgment, decree or order issued in India, or for compliance with any law for the time being in force in India, or for responding to a medical emergency, or for such other legitimate uses as are specified in Section 7.

6.3 Withdrawal of consent

You may withdraw your consent at any time, and the ease of withdrawing consent shall be comparable to the ease with which it was given. You may withdraw your consent:

•      by using the unsubscribe link contained in every marketing electronic mail we send;

•      through the preferences section of your account on the Website; or

•      by writing to the Grievance Officer at the contact details set out at Clause 15.

Upon withdrawal of consent, we shall, within a reasonable time, cease processing your personal data for the purpose to which the withdrawn consent relates and shall cause our Data Processors to do likewise, unless such processing is required or authorised under any law for the time being in force. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal. Please note that the consequences of withdrawal, such as our inability to fulfil a pending order or to maintain your account, shall be borne by you.

7. How We Collect Your Personal Data

•      Directly from you: when you register on the Website, place an order, subscribe to our newsletter, submit a review, participate in a promotion, or contact us by telephone, electronic mail, contact form or social media.

•      Automatically: through cookies and similar technologies when you browse the Website, as described at Clause 8.

•      From third parties: from our payment gateway partner (payment confirmation status), from our logistics partner (delivery status), and from our website and analytics platform providers, in each case only in respect of your transactions with us.

8. Cookies and Similar Technologies

The Website uses cookies and similar technologies to store information including your preferences and the pages you have accessed, so as to operate the Website and to optimise your experience.

•      Strictly necessary cookies: these are essential for the Website to function, including for maintaining your session, your cart and the security of the Website. These cannot be disabled without rendering the Website inoperable.

•      Preference, analytics and marketing cookies: these are deployed only where you have given consent through the cookie banner presented to you on your first visit and available thereafter. You may accept, decline or subsequently change your cookie preferences through that banner or through your browser settings.

Most browsers permit you to refuse or delete cookies. Declining non-essential cookies will not prevent you from browsing the Website or placing an order.

9. Sharing of Personal Data

We do not sell your personal data. We share your personal data only as set out below, and in each case only to the extent necessary:

9.1 Data Processors engaged by us

We share your personal data with service providers who process it on our behalf and under a valid contract with us, including:

•      our website and e-commerce platform provider;

•      our payment gateway partner;

•      our logistics, courier and shipment-tracking partners;

•      our transactional and promotional messaging providers, for electronic mail and short messaging service;

•      our analytics, tag management and bot-protection providers; and

•      our information technology, hosting, cloud storage and customer support providers.

Our contracts with these Data Processors require them to process your personal data only on our documented instructions, only for the purposes for which we have disclosed it, to maintain reasonable security safeguards, to notify us of any personal data breach, and to erase or return the personal data upon completion of the purpose or termination of the contract. We remain responsible under the DPDP Act for compliance in respect of any processing undertaken by a Data Processor on our behalf.

9.2 Disclosure required by law

We may disclose your personal data where we are required to do so in order to comply with any law for the time being in force, or in response to any judgment, decree, order, summons, notice or lawful direction issued by a court, tribunal, or judicial, quasi-judicial, regulatory, statutory or investigating authority.

9.3 Business transfer

If the whole or any part of our business or its assets is transferred, merged, amalgamated, demerged or sold, your personal data may form part of the transferred assets. In such an event, the transferee shall be bound to process your personal data in accordance with this Policy and the DPDP Act, and we shall inform you of such transfer through the Website or by written intimation.

We do not disclose your personal data to third parties for their own independent marketing purposes.

10. Processing of Personal Data Outside India

Certain of our Data Processors, including our website platform, cloud hosting, analytics and messaging providers, are located outside India, and your personal data may accordingly be stored or processed outside India.

Where we transfer personal data outside India, we do so in accordance with Section 16 of the DPDP Act, which permits such transfer to any country or territory other than a country or territory that the Central Government may by notification restrict, and subject to such terms and conditions as the Central Government may specify. Any such transfer is additionally subject to any stricter obligation imposed by any other law for the time being in force in India in relation to that personal data. We do not transfer your personal data to any country or territory in respect of which a restriction is in force.

11. Personal Data of Children and Persons with Disabilities

The Website and our products are directed at adults. We do not knowingly permit a child to create an account or to place an order in her own name.

Where we process the personal data of a child, or of a person with a disability who has a lawful guardian, we shall, before such processing, obtain verifiable consent from the parent or, as the case may be, the lawful guardian, in the manner prescribed under the DPDP Act and the DPDP Rules. For that purpose, we shall observe due diligence to verify that the individual identifying herself as the parent or lawful guardian is an identifiable adult, by reference to reliable identity and age details already available with us, or to identity and age details voluntarily provided by such individual, or to a virtual token mapped to such details and issued by an entity entitled to issue it, including a Digital Locker service provider.

We shall not undertake any processing of a child's personal data that is likely to cause any detrimental effect on the well-being of the child. We shall not undertake tracking or behavioural monitoring of children, and we shall not direct any targeted advertising at children.

If you believe that a child has provided personal data to us without verifiable parental consent, please write to the Grievance Officer at the contact details set out at Clause 15, and we shall erase such personal data.

12. Retention and Erasure of Personal Data

We retain your personal data only for so long as is necessary for the specified purpose for which it was collected, or for such longer period as retention is necessary for compliance with any law for the time being in force, whichever is later.

Accordingly:

•      personal data collected for order fulfilment, payment processing and customer support is retained for so long as is necessary to complete the order and to give effect to the applicable return, replacement, refund and warranty periods;

•      personal data forming part of, or connected with, our books of account, invoices and tax records is retained for the period prescribed under the Companies Act, 2013, the Central Goods and Services Tax Act, 2017, the Income-tax Act, 1961 and other applicable fiscal legislation;

•      account data is retained for so long as your account remains active, and is erased upon closure of your account, subject to the statutory retention referred to above;

•      personal data processed for marketing and promotional communications is retained until you withdraw your consent or unsubscribe; and

•      personal data required for the establishment, exercise or defence of a legal claim, or for compliance with a direction of a court, tribunal or authority, is retained until the conclusion of the relevant proceeding and the expiry of the applicable limitation period.

Upon the expiry of the applicable retention period, or upon your withdrawal of consent, or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earliest, we shall erase your personal data and shall cause our Data Processors to erase it, unless retention is necessary for compliance with any law for the time being in force.

13. Security Safeguards

We implement reasonable security safeguards to prevent a personal data breach, having regard to the nature of the personal data we hold. These include, as appropriate:

•      encryption, obfuscation or masking of personal data, or the use of virtual tokens mapped to personal data;

•      access control to computer resources on which personal data is processed, and role-based restriction of access to personal data on a need-to-know basis;

•      the maintenance of logs, monitoring and review of access, to enable the detection and investigation of unauthorised access;

•      measures for the continued processing of personal data in the event of the compromise of confidentiality, integrity or availability, including data backup;

•      the retention of logs and personal data for a period necessary to enable the detection of unauthorised access and to undertake investigation and remedial measures; and

•      contractual arrangements with our Data Processors requiring them to implement equivalent reasonable security safeguards.

These safeguards are in addition to the reasonable security practices and procedures required under Section 43A of the Information Technology Act, 2000 read with the SPDI Rules, which continue to apply to us to the extent that we handle sensitive personal data or information as defined therein.

No method of transmission over the internet and no method of electronic storage is entirely secure. While we take the safeguards described above, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

14. Personal Data Breach

In the event of a personal data breach affecting your personal data, we shall, on becoming aware of the breach:

•      intimate you, without delay, through your registered account or through any other mode of communication registered with us, describing the nature, extent and timing of the breach, its likely consequences relevant to you, the measures we have taken or propose to take to mitigate the risk, the safety measures you may take to protect your interests, and our contact details for further information; and

•      intimate the Board without delay, and furnish to the Board within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may on written request allow, the detailed particulars required under the DPDP Rules, including the events and circumstances leading to the breach, the mitigation measures taken, our findings regarding the person who caused the breach, the remedial measures taken to prevent recurrence, and a report on the intimations given to affected Data Principals.

15. Grievance Redressal

You may address any question, request or grievance in relation to the processing of your personal data, or the exercise of your rights under Clause 16, to our Grievance Officer. The Grievance Officer is also the person able to answer, on our behalf, questions raised by you about the processing of your personal data, and is our Grievance Officer for the purposes of the Consumer Protection (E-Commerce) Rules, 2020 and the Information Technology Act, 2000 and the rules made thereunder.

Name: Mr. Abinu 

Designation: Grievance Officer

Address: Office No. 506, Zion Tower, Plot 273, Sector 10, Kharghar, Navi Mumbai, District Raigad, Maharashtra 410210, India

Electronic mail: abinujohn@finestfoodworks.com

We shall acknowledge the receipt of your grievance within forty-eight hours of its receipt and shall redress it within a period of one month from the date of its receipt, in accordance with the Consumer Protection (E-Commerce) Rules, 2020, and in any event within such period as may be prescribed under the DPDP Rules.

If you are not satisfied with the response of the Grievance Officer, or if your grievance is not redressed within the period stated above, you may make a complaint to the Data Protection Board of India in the manner provided under the DPDP Act and the DPDP Rules. Exhausting the grievance redressal mechanism set out in this Clause is a pre-condition to approaching the Board.

16. Your Rights as a Data Principal

Subject to the DPDP Act, you have the following rights in respect of personal data processed by us on the basis of your consent or for a legitimate use:

•      Right to access information: to obtain from us a summary of the personal data of yours being processed and the processing activities undertaken by us, the identities of all other Data Fiduciaries and Data Processors with whom we have shared such personal data along with a description of the personal data so shared, and any other related information.

•      Right to correction, completion, updating and erasure: to have inaccurate or misleading personal data corrected, incomplete personal data completed, personal data updated, and personal data erased, save where retention is necessary for the specified purpose or for compliance with any law for the time being in force.

•      Right of grievance redressal: to have readily available means of registering a grievance with us in respect of any act or omission regarding the performance of our obligations or the exercise of your rights, as set out at Clause 15.

•      Right to nominate: to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under the DPDP Act in accordance with the DPDP Rules.

You may exercise any of these rights by writing to the Grievance Officer at the contact details set out at Clause 15, from the electronic mail address registered with us, or through your account on the Website. We may require you to furnish such particulars as are reasonably necessary to identify you and to locate the personal data in question. We shall respond to your request within the period prescribed under the DPDP Rules.

17. Your Duties as a Data Principal

Section 15 of the DPDP Act imposes certain duties upon you. In particular, you shall:

•      comply with the provisions of all applicable laws while exercising your rights under the DPDP Act;

•      not impersonate another person while providing your personal data to us for a specified purpose;

•      not suppress any material information while providing your personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;

•      not register a false or frivolous grievance or complaint with us or with the Board; and

•      furnish only such information as is verifiably authentic while exercising the right to correction or erasure.

Breach of these duties may attract a penalty under the DPDP Act.

18. Third-Party Websites and Services

The Website contains links to third-party websites and services, including our shipment-tracking partner, our payment gateway partner, and our social media pages. The processing of your personal data on those websites and services is governed by the privacy policies of the respective third parties, and not by this Policy. We do not control, and are not responsible for, the privacy practices of those third parties. We encourage you to read their privacy policies before providing them with your personal data.

19. Amendments to this Policy

We may amend this Policy from time to time to reflect changes in our processing activities or in applicable law, including as the remaining provisions of the DPDP Act and the DPDP Rules are brought into force. Any amended Policy shall be published on the Website with a revised "Last Updated" date. Where an amendment materially affects the purposes for which your personal data is processed, we shall issue a fresh notice to you and, where required, seek your fresh consent.

20. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Subject to the jurisdiction of the Data Protection Board of India under the DPDP Act and to the remedies available under the Consumer Protection Act, 2019, the courts at Mumbai, Maharashtra shall have exclusive jurisdiction in respect of any dispute arising out of or in connection with this Policy.