Last updated: 29 October 2026

This Privacy Notice explains how Herbaveda Overseas (a proprietorship firm, GSTIN 07BANPG8224Q1Z2, 182/A Tilak Bazaar, Khari Baoli, Delhi 110006, India) (“we”, “us”, “our”) collects and uses your personal data when you use herbavedaoverseas.com, place an order or contact us. We follow the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. We are the “Data Fiduciary” for your personal data.

1. What personal data we collect

• Orders and account: name, phone number, email address, billing and delivery address, order details, and your login details if you create an account.
• Payments: payments are processed by Razorpay. We do not see or store your full card, UPI or bank details; we only receive the payment status and transaction reference.
• Enquiry and contact forms: name, phone/WhatsApp number, email, company or firm name, delivery city/address, and the details of your enquiry.
• WhatsApp, phone and email: the messages and details you share with us when you contact us.
• Website usage: IP address, device and browser type, pages visited and similar information collected through cookies and analytics tools, but only after you allow them in our cookie banner (essential cookies, such as your cart, are always on).

2. Why we use it

• To process, pack, ship and deliver your orders, and to handle refunds, replacements and cancellations.
• To reply to your enquiries and send wholesale or bulk quotations you ask for.
• To send order updates and tracking information by SMS, email or WhatsApp.
• To issue invoices and meet our legal, tax (GST) and accounting duties.
• To prevent fraud and keep the website secure.
• With your consent only: to understand how our website is used (Google Analytics) and to measure our advertising (Google). We send offers or marketing messages only if you have agreed to receive them, and you can stop them at any time.

We use your data only for the purpose it was given for. We do not sell your personal data.

3. Who we share it with

We share only the data needed for each task, with:

• Courier and logistics partners: name, phone and delivery address, to deliver your order.
• Razorpay: to process payments and refunds.
• Google (Analytics, Search Console, Google for WooCommerce): website usage data, only if you consent.
• Website service providers: our web hosting, email delivery, security (Cloudflare Turnstile, Jetpack), chat (WhatsApp) and messaging (Telegram, used for our internal enquiry alerts) providers, who handle data on our behalf.
• Government authorities: when required by law.

Some of these providers may store data on servers outside India. Where this happens, we rely on them to protect it as required by Indian law.

4. How long we keep it

• Orders and invoices: for as long as tax and accounting laws require (currently about 6 years under GST law), then deleted.
• Enquiries and messages: up to 3 years after our last contact with you, unless you are an ongoing customer.
• Customer accounts: until you ask us to delete your account, or 3 years of no activity. We will tell you at least 48 hours before deleting an inactive account so you can log in to keep it.
• Analytics data: up to 14 months, as set in Google Analytics.
• Security logs: at least 1 year, as required by the DPDP Rules.

5. Your rights

You can ask us to:

• tell you what personal data we hold about you and who we have shared it with;
• correct, complete or update your data;
• delete your data (unless we must keep it by law, for example invoices);
• withdraw any consent you have given, as easily as you gave it (for example, through the cookie settings button on the page or by replying “STOP” to marketing messages);
• nominate another person to use these rights for you in case of death or incapacity.

To use any of these rights, email our Grievance Officer (below). We will reply within 30 days.

6. Children

We do not knowingly collect personal data of children (under 18) without the verifiable consent of their parent or guardian. If you believe a child has shared personal data with us without such consent, please contact our Grievance Officer and we will delete it.

7. Cookies

We use essential cookies to run the website (for example, to remember your cart and keep you logged in). Analytics and advertising cookies are used only if you click “Accept All” in our cookie banner. You can change your choice at any time using the cookie settings button shown on every page. See our Cookie Policy for details.

8. How we protect your data

We use HTTPS encryption, access controls, anti-spam and security tools, and limit access to your data to people who need it. If a personal data breach happens, we will inform affected users and the Data Protection Board of India as required by law (within 72 hours).

9. Grievance Officer

For any question, request or complaint about your personal data, contact:

Deepak, Grievance Officer
Herbaveda Overseas
182/A Tilak Bazaar, Khari Baoli, Delhi 110006, India
Email: herbavedaoverseas@gmail.com
Phone/WhatsApp: +91 99717 54285 (11:30 AM to 7:00 PM)

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Changes to this notice

We may update this Privacy Notice from time to time. The latest version will always be on this page with its “Last updated” date.