This document constitutes the official Privacy Notice of Divine Cows Private Limited, formulated in strict conformance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020.
1. Identity of the Data Fiduciary
The Data Fiduciary legally responsible for determining the purpose and means of processing personal data collected across the domain divinecows.in and direct concierge channels is:
- Legal Entity Name: Divine Cows Private Limited
- Principal Desk: Mumbai, Maharashtra, India
- FSSAI License: FoSCoS E-Commerce & Marketer Registration No. 21526001000492
- Designated Grievance & Data Protection Officer: Mr. Raghavan Sharma
- Official Privacy Desk: care@divinecows.in
2. Categories of Personal Data Collected & Purpose Specification
Pursuant to the statutory requirement of Data Minimisation, we collect exclusively that digital personal data which is strictly required to fulfill reservation requests, manage nationwide cold-chain dispatch, and satisfy tax compliance:
| Data Category | Specific Processing Purpose | Lawful Basis (DPDP Act, 2023) | Retention Horizon |
|---|---|---|---|
| Email Address | Inaugural dispatch announcement, priority reservation access tokens, and transactional receipts. | Consent (Section 6) | Until patron revokes consent or unsubscribes. |
| Patron Name & Mobile Number | SMS / WhatsApp dispatch notifications, courier verification, and concierge gift card notes. | Performance of Contract & Consent | Duration of active order fulfillment + 180 days for delivery verification. |
| Postal Delivery Address & PIN Code | Physical logistics, cold-chain route planning, and door-to-door delivery across India. | Performance of Contract | Statutory financial audit period (8 years for GST invoices). |
| Technical Log Metadata (IP & User Agent) | DDoS mitigation, rate-limiting spam prevention, and server integrity defense. | Legitimate Security Interest | Rolling 30-day purged security logs. |
3. Technical & Organizational Security Measures
We employ defense-in-depth security architecture to ensure patron personal data remains strictly impervious to unauthorized access, alteration, or compromise:
- Cryptographic Transit Encryption: All data transmitted between the patron's browser and our servers is secured via Transport Layer Security (TLS 1.3) with modern cipher suites.
- Encrypted Rest Storage: Subscriber tables and transactional records are encrypted at rest utilizing AES-256 multi-tenant cryptographic storage.
- Row-Level Security (RLS): Our database utilizes strict PostgreSQL Row-Level Security policies. Unauthenticated or public internet users are granted write-only single-row insert access without permissions to query, scan, or read other patrons' records.
- Content Security Policy (CSP): Our web architecture enforces strict CSP headers, preventing cross-site scripting (XSS), malicious script injections, and clickjacking attacks.
4. Rights of Data Principals
Under Chapter III of the Digital Personal Data Protection Act, 2023, you are endowed with enforceable statutory rights regarding your personal information:
- Right to Access & Summary: You may request a complete summary of personal data held in our systems, along with identities of third-party logistics partners with whom it has been shared.
- Right to Correction & Erasure: You may request the immediate rectification of inaccurate contact details, or request total erasure of your subscriber record from our active mailing rosters.
- Right of Grievance Redressal: If you believe your personal data has been handled inconsistently with our covenants, you are entitled to redressal through our designated Grievance Officer within 48 hours.
- Right to Nominate: You may designate an individual who, in the event of incapacity, shall exercise your rights as a Data Principal.
5. Cookies & Digital Tracking Disclosure
In keeping with our philosophy of quiet luxury and restraint, Divine Cows does not deploy behavioral advertising tracking cookies, third-party pixel beacons (such as Meta Pixel or cross-site behavioral retargeters), or digital fingerprinting mechanisms on this website. Session-level cookies, if set, are strictly functional and essential for site performance and security validation.
6. Grievance Redressal Mechanism
Any questions, withdrawal of consent, or formal statutory complaints may be directed to our designated Grievance Officer:
Attention: Grievance Officer
Divine Cows Private Limited
Email: care@divinecows.in
Response Commitment: Acknowledgment within 24 hours; substantive resolution within 48 business hours.