Privacy Policy

1. Who We Are

Dune Aura ("we", "us", "our") is a cold-pressed edible oil and stone-ground spice manufacturer operating at DSS 53, Sector 9A Market, Gurugram (Gurgaon), Haryana 122001, India. Our website is duneaura.com. Contact: [email protected] | +91 99995 55242.

This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website, place an order, or contact us. It is governed by the Information Technology Act, 2000 (as amended), the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. Data We Collect

We collect the following categories of personal data:

• Identity data: name, as provided when placing an order or contacting us.
• Contact data: email address, phone number, delivery address.
• Transaction data: order details, payment method (UPI ID, transaction reference). We do not store card numbers or full UPI credentials.
• Usage data: IP address, browser type, pages visited, time on site — collected automatically via Google Analytics 4 (GA4) with your consent.
• Communications data: messages sent via our contact form or WhatsApp.

We do not collect sensitive personal data such as financial account details beyond what is necessary to process a payment, health data, biometric data, or data relating to children under 18.

3. How We Use Your Data

• To process and fulfil your orders and send order confirmations.
• To respond to enquiries and provide customer support.
• To send transactional communications (order updates, delivery notifications).
• To improve our website and products using aggregated, anonymised analytics.
• To comply with legal obligations under Indian law (FSSAI, GST, Consumer Protection Act 2019).

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data on the following bases:

• Consent: for analytics cookies (GA4) and marketing communications.
• Contract: to fulfil orders you place with us.
• Legitimate interest: to prevent fraud and improve our services.
• Legal obligation: to comply with applicable Indian laws.

5. Cookies and Analytics

We use Google Analytics 4 (GA4) to understand how visitors use our site. GA4 uses cookies to collect anonymised usage data. This data is processed by Google LLC in accordance with Google's Privacy Policy. You can opt out of GA4 tracking by declining analytics cookies when prompted, or by installing the Google Analytics Opt-out Browser Add-on.

We also use the Meta Pixel (Facebook Pixel) to measure advertising effectiveness and understand how visitors interact with our site after clicking a Meta ad. The Pixel only activates after you accept analytics cookies. You can opt out via your Facebook Ad Preferences.

We also use GoDaddy Payments for checkout. GoDaddy's payment processing is subject to GoDaddy's own privacy policy.

6. Data Sharing

We share your data only with:

• GoDaddy Commerce: to process payments and manage orders.
• Google LLC: for analytics (GA4) and Search Console.
• Meta Platforms, Inc.: for advertising measurement via Meta Pixel (only when consent is given).
• Delivery partners: name and address shared only as needed to fulfil your order.
• Government authorities: if required by law, court order, or regulatory authority.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, or as required by law. Order records are retained for 7 years to comply with GST and accounting obligations. Analytics data is retained for 14 months in GA4.

8. Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act 2023, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Erase your personal data (subject to legal retention obligations).
• Withdraw consent for processing based on consent.
• Nominate another person to exercise these rights on your behalf.
• Raise a grievance with us or with the Data Protection Board of India.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Data Security

We implement reasonable security practices as required by the IT (SPDI) Rules 2011, including HTTPS encryption, access controls, and secure third-party payment processing. However, no internet transmission is completely secure. If you believe your data has been compromised, contact us immediately at [email protected].

10. Children's Privacy

Our website and services are not directed at children under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact and Grievance Officer

For privacy-related queries, complaints, or to exercise your rights, contact our Grievance Officer: