Privacy Policy

1. Account & Registration Data

What we collect:

• Full name
• Email address
• Phone number (for order updates & support)
• Password (hashed, never stored in plain text)

Why: To create your account, send order confirmations, and contact you about your purchases or support requests.

Legal basis: Your consent (you create the account) & contractual necessity (we need your email to process orders)

2. Address & Billing Data

What we collect:

• Billing address (street, city, state, postal code)
• Shipping address (same fields)
• Phone number (for delivery coordination)

Why: To process payments, arrange deliveries, and contact you about shipments.

Legal basis: Contractual necessity (required to fulfill your order) & legitimate interest (delivery logistics)

3. Payment Information

What we collect:

• Credit/Debit Card: Last 4 digits only (for your reference; full card data processed by payment gateway only)
• UPI/Mobile Payment: Transaction ID only (no account details stored)
• Bank Details (if applicable): For refunds only, never stored permanently

Why: To process payments securely.

Legal basis: Contractual necessity & PCI DSS compliance

🔐 Important: We never store full credit card numbers. Payment processing is handled by certified payment gateways (Razorpay, etc.). We only receive transaction confirmation, not sensitive card data.

4. Order & Purchase History

What we collect:

• Products ordered
• Order date, amount, & status
• Delivery address & tracking info
• Any returns, refunds, or support tickets

Why: To fulfill orders, manage returns, and provide customer support.

Legal basis: Contractual necessity (to process your order)

5. Newsletter & Marketing Data

What we collect:

• Email address
• First & last name
• Email open rates & click behavior (via MailerLite)
• Product preferences (inferred from clicks)

Why: To send newsletters, promotions, & product updates (only if you opt-in).

Legal basis: Your explicit consent (you subscribe or tick the newsletter checkbox at signup)

📧 Opting out: Every email has an “Unsubscribe” link. Click it, & we remove you from the list immediately. No hard feelings!

6. Website & Browsing Data

What we collect:

• Pages you visit
• Time spent on each page
• Products you view or add to cart (but don’t buy)
• Device type (mobile, desktop, tablet)
• Browser type & OS (e.g., Chrome on Windows)
• IP address (anonymized after 7 days)
• Referrer (how you found us: Google, social media, direct link, etc.)

Why: To understand how you use our site, improve user experience, & measure marketing campaign effectiveness.

Legal basis: Legitimate interest (improving our website)

🍪 How: Via cookies & analytics tools (see “Cookies” section below)

7. Support & Communication Data

What we collect:

• Emails you send to our support team
• Chat messages (if you use live chat)
• Feedback or survey responses
• Support tickets (category, description, resolution)

Why: To respond to your questions, resolve issues, & improve our service.

Legal basis: Contractual necessity & legitimate interest

8. Voluntary Information

You may optionally provide:

• Product reviews or testimonials
• Dietary preferences or health goals (for product recommendations)
• Birthday (if you want a birthday discount)

Legal basis: Your explicit consent

We use your data for:

What We DON’T Do With Your Data

• ❌ Sell it — We never sell your data to third parties
• ❌ Rent it — We don’t rent your contact info to other companies
• ❌ Trade it — We don’t trade data with competitors
• ❌ Share it for profit — We don’t monetize your personal information
• ❌ Use it for other businesses — Your data stays with Biotag only

We share your data only with trusted partners who need it to serve you. All partners sign data protection agreements.

1. Courier & Logistics Partners

Data shared: Name, address, phone, order details

Why: To deliver your packages

Partners: Delhivery, Ecomm Express, etc. (varies by location)

Privacy: They’re bound by their own privacy policies & our data agreements

2. Payment Processors

Data shared: Name, billing address, payment amount (NOT full card data)

Why: To process payments securely

Partners: Razorpay, Stripe, or other certified payment gateways

Privacy: PCI DSS compliant; they handle card data, not us

3. Email Service Provider (MailerLite)

Data shared: Email address, first & last name, newsletter engagement

Why: To send newsletters & marketing emails

Partner: MailerLite (EU-based, GDPR compliant)

Privacy: MailerLite Privacy Policy applies

📧 Newsletter Only: You only end up in MailerLite if you subscribe. If you unsubscribe, we immediately remove you from their system.

4. Analytics & Website Tools

Data shared: Anonymized browsing behavior, device type, referrer (NO personal data)

Why: To measure website traffic & user behavior

Tools: Google Analytics, Hotjar, or similar

Privacy: Data is anonymized; individual users can’t be identified

5. Legal Authorities (If Required)

Data shared: As required by law

When: We may disclose data if required by court order, government request, or to prevent fraud/harm

⚖️ Transparency: We’ll notify you of legal requests whenever possible (unless prohibited by law).

6. Business Acquisitions or Transfers

If Biotag is acquired or merged, your data may be transferred to the new owner under the same privacy terms. We’ll notify you of any material changes.

We use industry-standard security measures to protect your data:

• 🔒 HTTPS/SSL encryption: All data transmitted between your browser & our servers is encrypted
• 🔐 Password hashing: Passwords are one-way encrypted; we can’t see them
• 🚨 PCI DSS compliance: Payment data handled by certified gateways only
• 🛡️ Firewalls & access controls: Only authorized staff can access sensitive data
• 📋 Data minimization: We collect only what’s necessary
• 🔄 Regular backups: Data backed up & protected against loss

⚠️ Honest note: While we do everything possible to secure your data, no system is 100% impenetrable. If a breach occurs, we’ll notify you within 72 hours as required by law.

📌 Right to be forgotten: You can request deletion of your data anytime. We’ll delete it (except where legal obligations require retention) within 30 days.

What Are Cookies?

Cookies are small text files stored on your device to remember preferences & track behavior. We use them to:

• Keep you logged in
• Remember cart items
• Measure website traffic
• Show relevant ads (retargeting)

Types of Cookies We Use

How to Control Cookies

In your browser:

• Most browsers allow you to block or delete cookies
• You can set your browser to ask before accepting cookies
• ⚠️ Warning: Disabling functional cookies may break site features (cart, login, checkout)

Opt out of specific trackers:

• Google Analytics opt-out
• NAI opt-out tool
• Unsubscribe from newsletters (turns off MailerLite tracking)

Under Indian law & GDPR (if applicable), you have the right to:

1. Access Your Data

Request a copy of all data we hold about you. We’ll provide it within 30 days.

2. Correction (Rectification)

If your data is inaccurate, request we correct it (e.g., wrong phone number).

3. Deletion (Right to Be Forgotten)

Request deletion of your data (except where we’re legally required to retain it, like tax records).

4. Data Portability

Request your data in a portable format (e.g., CSV) to move to another service.

5. Restrict Processing

Ask us to limit how we use your data (e.g., stop marketing emails but keep order records).

6. Object to Processing

Withdraw consent for marketing, analytics, or personalized ads anytime.

7. Lodge a Complaint

If we violate your rights, you can file a complaint with:

• 🇮🇳 India: Central Authority (under data protection rules)
• 🇪🇺 EU (if applicable): Your country’s data protection authority

📧 How to exercise your rights: Email [email protected] with “Data Request” + your specific request. Include proof of identity & allow 30 days for processing.

Our site is not intended for children under 13.

We don’t knowingly collect data from children under 13. If we become aware of it, we’ll delete it immediately. Parents who suspect we’ve collected a child’s data can contact us.

⚠️ Age Verification: We don’t actively verify age, but you represent that you’re 13+ by using this site.

If You’re in the EU

We comply with GDPR. Your rights under GDPR are stated above. If you’re unhappy with our response, you can lodge a complaint with your national data protection authority.

If You’re Outside India & EU

This policy applies. We’ll follow local laws where applicable. Your data may be transferred internationally; we’ll keep it secure under the same standards.

📌 Data Transfer: If your data is transferred outside India, it’s protected by equivalent safeguards & our data processing agreement.

We review this policy annually (June 2027 next). If we make material changes:

• We’ll update the “Last updated” date above
• We’ll notify you via email if the changes significantly affect your rights
• Continued use of the site = acceptance of new terms

📧 Subscribe to updates: Want to be notified of privacy changes? Email [email protected] with “Privacy Notifications”.

Privacy concerns or data requests?

• 📧 Email: [email protected]
• 📝 Subject: “Data Request” or “Privacy Concern”
• ⏰ Response time: Within 10 business days

Include:

• Your full name & email
• Specific request (access, deletion, correction, etc.)
• Proof of identity (copy of ID, if required)