Privacy Policy

1. Who we are

This Privacy Policy explains how Reddy Anna ("Reddy Anna", "we", "us", "our") collects, uses, shares and protects your personal data when you visit reddyanna.com (the "Website") or buy from us. We are the data fiduciary / data controller for the personal data described here.

This policy is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and, for visitors from the European Economic Area and the United Kingdom, the General Data Protection Regulation ("GDPR").

2. Personal data we collect

We do not knowingly collect sensitive personal data such as health, biometric or financial account credentials, and we do not ask for Aadhaar or other government ID to place an order.

3. How and why we use your data

We do not sell your personal data and we do not use it for automated decision-making that produces legal effects for you.

4. Who we share it with

We share only the data needed for each purpose, with:

• Courier and logistics partners – name, phone, address and order details to deliver and pick up parcels.
• Payment aggregator (e.g. Razorpay) – order amount, name, email and phone to process online payments and refunds.
• Technology providers – website hosting, email and SMS providers who process data on our instructions under confidentiality obligations.
• Professional advisers – accountants, auditors and lawyers, where necessary.
• Government and law-enforcement authorities – when required by law, court order or to protect rights and safety.

Our Website loads fonts from Google Fonts, which means your browser connects to Google servers and shares your IP address with Google when pages load. Please see our Cookie Policy.

5. Data storage and international transfers

Your data is stored on secure servers. Where a service provider processes data outside India, we ensure the transfer is permitted under the DPDP Act and, for EEA/UK users, protected by appropriate safeguards such as Standard Contractual Clauses.

6. How long we keep it

• Order, invoice and payment records: for as long as required under the GST and income-tax laws and for resolving disputes (generally up to 8 years).
• Support messages: up to 3 years after the issue is closed.
• Server logs: up to 180 days, unless needed to investigate a security incident.
• Marketing preferences: until you withdraw consent.

After that, data is deleted or anonymised.

7. Security

We use HTTPS encryption, access controls, server-side validation of every order, and limit access to personal data to staff and partners who need it. Online payments are processed by a PCI-DSS compliant payment aggregator. No method of transmission over the internet is 100% secure, but we follow reasonable security practices and will notify you and the authorities of a personal data breach as required by law.

8. Your rights

Subject to applicable law, you have the right to:

• access a summary of your personal data and how it is processed;
• correct, complete or update inaccurate data;
• erase your data where it is no longer needed (records we must keep by law will be retained);
• withdraw consent at any time (this does not affect earlier processing);
• nominate another person to exercise your rights in case of death or incapacity (DPDP Act);
• for EEA/UK users: object to or restrict processing, data portability, and lodge a complaint with your local supervisory authority;
• raise a grievance with our Grievance Officer and, if unresolved, approach the Data Protection Board of India.

To exercise any right, email grievance@reddyanna.com from the email address used for your order. We will respond within 30 days.

9. Children

The Website is meant for adults. Persons under 18 may use it only with the involvement of a parent or legal guardian. We do not knowingly collect data from children without verifiable parental consent, and we do not track or target advertising at children.

10. Grievance Officer

In accordance with the Information Technology Act, 2000, the DPDP Act, 2023 and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer is:

We acknowledge complaints within 48 hours and resolve them within one month of receipt.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. Material changes will be highlighted on the Website.