Privacy Policy

Last updated: 1 January 2026 · Effective immediately upon publication

1. Scope & Applicability

This policy applies to all visitors, registered users, and customers who interact with our online store, including account registration, email verification, checkout, order tracking, customer support, and marketing communications (where you have opted in).

By using our website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the website and contact us to request account deletion if applicable.

This policy is designed to comply with applicable Indian laws, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020.

2. Data Controller & Contact Details

The data controller responsible for your personal information is:

• Legal entity: Dramio Private Limited
• Brand / trading name: Dramio
• GSTIN: 27AAMCD5168R1ZP
• Registered address: Unit No. 203-204, A Wing, Kotia Nirman Commercial Premises Co-op Society Ltd, New Link Road, Andheri (W), Mumbai - 400053, Maharashtra, India
• Privacy & data queries: accounts@dramify.in

3. Information We Collect

We collect information that is necessary to operate our e-commerce platform, fulfil orders, provide customer support, and improve your shopping experience. The categories of data we collect include:

3.1 Information You Provide Directly

• Account registration: Full name, email address, password (stored in encrypted/hashed form — we never store plain-text passwords)
• Email verification: Verification status, one-time codes or verification links sent to your email
• Order & checkout: Billing name, delivery/shipping address, city, state, PIN code, phone number, order items, quantities, payment method selected (prepaid or Cash on Delivery)
• Customer support: Messages, complaints, return/refund requests, photographs uploaded as evidence, and any correspondence via email or support forms
• Preferences: Wishlist items, saved addresses, and marketing opt-in/opt-out choices where applicable

3.2 Information Collected Automatically

• Device & browser data: IP address, browser type and version, operating system, device type (mobile/desktop/tablet), screen resolution, and language settings
• Usage data: Pages visited, products viewed, time spent on pages, click patterns, referral URL (how you arrived at our site), and search queries within our store
• Session data: Login session identifiers, shopping cart contents, and authentication tokens required to keep you signed in
• Transaction logs: Order timestamps, payment status (success/failure/pending), and delivery tracking events

3.3 Information We Do Not Collect

We do not intentionally collect sensitive personal data such as financial account numbers, Aadhaar numbers, passport details, health records, or biometric data. Payment card/UPI details are entered directly on secure payment gateway pages — we do not store full card numbers or UPI PINs on our servers.

4. How We Collect Information

• When you register for an account or sign in
• When you complete email verification during registration or checkout
• When you place an order, update your cart, or proceed to checkout
• When you contact us via Track & Support, email, or phone
• When you subscribe to promotional emails or newsletters (opt-in only)
• Automatically through cookies, server logs, and standard web analytics when you browse our site

5. Legal Basis & Purpose of Processing

We process your personal data for the following purposes and on the following legal bases:

Purpose	Data Used	Legal Basis
Account creation & authentication	Name, email, password hash	Contract performance; your consent at registration
Order processing & delivery	Address, phone, order details	Contract performance
Payment processing	Name, order amount, payment method	Contract performance; legal obligation
Order confirmations & shipping updates	Email, phone, order ID	Contract performance; legitimate interest
Customer support & returns	Order history, messages, photos	Contract performance; legitimate interest
Fraud prevention & security	IP, device data, transaction patterns	Legitimate interest; legal obligation
Tax, GST & regulatory compliance	Order records, billing details	Legal obligation
Website improvement & analytics	Usage data, anonymised trends	Legitimate interest
Marketing communications	Email, preferences	Your explicit consent (opt-in)

6. How We Use Your Information

In detail, we use the information we collect to:

• Create, verify, and manage your customer account
• Process, confirm, pack, and dispatch your orders for seeds, live plants, saplings, and organic manure
• Communicate order status, shipping updates, delivery confirmations, and support responses
• Verify your identity during login, checkout, and Track & Support queries
• Process returns, refunds, replacements, and cancellation requests
• Detect and prevent fraudulent transactions, abuse, and unauthorised access
• Maintain accurate business, accounting, and GST records as required by law
• Improve website performance, product catalogue, and user experience based on aggregated usage patterns
• Send promotional offers, new arrivals, and seasonal updates only if you have opted in
• Respond to legal requests, court orders, or regulatory inquiries when required

7. Information Sharing & Third Parties

We do not sell, rent, trade, or monetise your personal information to third parties for their marketing purposes. We share data only as necessary to operate our business:

7.1 Service Providers

• Courier & logistics partners: Name, delivery address, phone number, and order reference for shipment and delivery
• Payment gateways: Transaction amount, order ID, and customer contact for secure payment processing (PCI-DSS compliant partners)
• Email & SMS providers: Email address and/or phone number for transactional messages (order confirmations, OTPs, delivery updates)
• Authentication services: Email address for account verification and password reset flows
• Hosting & infrastructure: Encrypted data stored on secure servers with access controls

7.2 Legal & Regulatory Disclosures

We may disclose personal information when required by law, regulation, court order, or government authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a legal process.

7.3 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal information may be transferred to the successor entity, subject to the same privacy protections described in this policy. We will notify you via email or a prominent website notice if such a transfer occurs.

8. Payment Information

When you pay by UPI, debit/credit card, net banking, or other digital methods, your payment is processed by authorised third-party payment gateways. These gateways handle card/UPI data in accordance with RBI guidelines and industry security standards. We receive only payment confirmation status (success, failure, or pending) and a transaction reference — not your full card number, CVV, or UPI PIN.

For Cash on Delivery (COD) orders, we collect your name, phone, and delivery address to coordinate delivery and payment collection at your doorstep.

9. Cookies & Similar Technologies

Our website uses cookies and similar technologies to provide essential functionality:

Cookie Type	Purpose	Duration
Session cookies	Keep you logged in, maintain Your cart	Until browser session ends
Authentication cookies	Verify your identity across pages	Session or up to 30 days
Preference cookies	Remember your settings and choices	Up to 12 months
Analytics cookies	Understand site usage in aggregate (non-identifiable)	Up to 26 months

You can control or delete cookies through your browser settings. Disabling essential cookies may prevent you from logging in, adding items to your cart, or completing checkout. We do not use third-party advertising cookies or cross-site tracking for behavioural advertising.

10. Data Security

We implement reasonable technical and organisational measures to protect your personal information, including:

• HTTPS/TLS encryption for all data transmitted between your browser and our servers
• Password hashing using industry-standard one-way cryptographic algorithms
• Role-based access controls limiting employee/partner access to personal data on a need-to-know basis
• Regular review of security practices and access logs
• Secure hosting environments with firewall and intrusion monitoring
• Email verification to prevent unauthorised account creation

Despite these measures, no method of electronic storage or transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law.

11. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy:

• Active account data: Retained while your account remains active
• Order & transaction records: Retained for a minimum of 8 years for GST, tax, and legal compliance
• Support & correspondence: Retained for up to 3 years after resolution
• Marketing preferences: Retained until you unsubscribe or delete your account
• Server logs & analytics: Retained for up to 26 months in anonymised or pseudonymised form

When data is no longer required, we securely delete or anonymise it. You may request earlier deletion of your account and associated personal data (subject to legal retention requirements for order/tax records).

12. Your Rights & Choices

Under applicable Indian law and our internal data practices, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to correction: Update inaccurate or incomplete information via your account settings or by contacting us
• Right to deletion: Request deletion of your account and personal data (order records required for tax compliance may be retained in anonymised form)
• Right to withdraw consent: Opt out of marketing emails at any time using the unsubscribe link or by emailing us
• Right to grievance redressal: Raise a complaint with our Grievance Officer (details below)
• Right to nominate: In the event of death or incapacity, your nominee may exercise certain rights on your behalf as permitted by law

To exercise any of these rights, email us at accounts@dramify.in with the subject line "Privacy Request" and include your registered email address and order ID (if applicable). We will respond within 30 days.

13. Marketing Communications

We will only send promotional emails, offers, or newsletters if you have explicitly opted in during registration or checkout. Every marketing email includes an unsubscribe link. Transactional emails (order confirmations, shipping updates, password resets) are essential to our service and cannot be opted out of while you have an active order or account.

14. Children's Privacy

Our website and services are intended for users who are 18 years of age or older. We do not knowingly collect personal information from children under 18. If you are under 18, please use our website only with the involvement and consent of a parent or legal guardian.

If we learn that we have collected personal data from a child under 18 without verified parental consent, we will delete that information promptly. Parents or guardians who believe their child has provided us with personal data may contact us at accounts@dramify.in.

15. Third-Party Links

Our website may contain links to third-party websites such as payment gateways, courier tracking portals, or social media pages. We are not responsible for the privacy practices or content of those external sites. We encourage you to read the privacy policies of any third-party site you visit.

16. Cross-Border Data Transfers

Your data is primarily stored and processed in India. If any of our service providers (such as cloud hosting or email delivery) process data outside India, we ensure appropriate contractual safeguards are in place to protect your information in accordance with applicable Indian data protection requirements.

17. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Order fraud checks may use automated rules (e.g., flagging duplicate orders or mismatched addresses), but any account restriction is reviewed by our team before action is taken.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post the revised policy on our website
• Notify registered users via email for significant changes where required

Your continued use of the website after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.

19. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020, the Grievance Officer for Dramio is:

20. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: