This Privacy Policy describes how Verdant Roots ("we", "us", "our") collects, uses, stores, and protects your personal information when you visit our website, place an order, sign up for a service, or otherwise interact with us. We are committed to handling your data responsibly and in line with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.
1. Information we collect
We collect the following categories of information:
- Information you give us directly — name, email, phone, shipping address, billing address, GSTIN (for business orders), and any message you include in a contact or consultancy form.
- Account information — if you create a customer account, we store your name, email, an encrypted password, order history, and saved addresses.
- Order and payment information — products ordered, prices, delivery status. We do not store full card numbers, CVV, or UPI PIN. All card transactions are processed by our PCI-DSS compliant payment partner, Razorpay.
- Plant-care and service information — photographs, site notes, and care logs associated with your service visits.
- Technical information — IP address, browser type, device, pages visited, and referral source. We use this for security, fraud prevention, and to understand which content is useful.
- Cookies — essential, analytics, and (with consent) marketing cookies. See our Cookie Policy for details.
2. How we use your information
We use the data we collect for the following purposes:
- To process and deliver your orders, including shipping, returns, and refunds.
- To schedule and perform service visits, AMC plans, and plant-doctor consultations.
- To communicate with you about your order, account, subscription, or enquiry.
- To send care tips, AMC reminders, and our monthly newsletter (you can unsubscribe at any time).
- To improve our website, products, and services — through aggregate analytics.
- To prevent fraud, secure our site, and comply with legal obligations.
We do not sell your personal information to third parties, ever.
3. Legal basis for processing
We rely on one or more of the following legal bases: (a) performance of a contract with you (e.g. delivering an order); (b) your explicit consent (e.g. newsletter); (c) our legitimate interests (e.g. fraud prevention, site analytics); and (d) compliance with a legal obligation.
4. Sharing your information
We share your information only with the parties that need it to serve you:
- Couriers and shipping partners — name, address, phone (so they can deliver and reach you).
- Payment processors — Razorpay processes card and UPI transactions on our behalf.
- Cloud hosting and email service providers — who help us run our site and send you emails.
- Government authorities — when required by law or to protect our legal rights.
Each of these partners is contractually bound to protect your data.
5. Data storage and security
Your data is stored on secure servers in India, protected by industry-standard encryption in transit (TLS 1.2+) and at rest. Access is restricted to authorised team members who need it to do their job. We conduct periodic security reviews and follow the ISO 27001-aligned controls.
6. Data retention
We retain your data for as long as needed to provide our services, comply with legal obligations, and resolve disputes. In general:
- Order and invoice records: 8 years (required by Indian tax law).
- Service and AMC records: 5 years after the last visit.
- Marketing and analytics data: 24 months unless you delete it earlier.
- Account data: until you close your account, plus 30 days grace.
7. Your rights
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your data (subject to the retention rules above).
- Withdraw consent for marketing communications at any time.
- Lodge a complaint with the Data Protection Board of India.
To exercise any of these rights, email us at privacy@verdantroots.in. We respond within 7 working days.
8. Children's privacy
Our site is not directed to children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will delete it.
9. International transfers
Some of our service providers (e.g. cloud hosting) may process data outside India. Where this happens, we ensure the recipient country provides an adequate level of protection, or we use contractual safeguards.
10. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will reflect any change. For material changes, we will notify you by email or a prominent notice on our site.
11. Grievance officer
In accordance with the IT Rules 2011, our Grievance Officer is:
Niharika Rao
Founder, Verdant Roots
Email: grievance@verdantroots.in
Phone: +91 80 4000 0000
Address: Plot 12, Green Lane, Indiranagar, Bengaluru 560038