Privacy Notice

In this Privacy Notice, the following definitions are used:

• (a) Cookies: A small file placed on your device by our website or mobile application when you either visit or use certain features of our website or mobile application. A cookie generally allows a website to remember your actions or preference for a certain period of time.
• (b) Data: Means personal information and SPDI about you, which either directly or indirectly in combination with other information, could allow you to be identified when you access the mobile application.
• (c) Data Protection Laws: Any applicable law for the time being in force relating to the processing of Data, including the Information Technology Act, 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011, as amended or replaced from time to time.
• (d) Partners: Select third parties (including Tata Group Entities) with whom we have contracts or arrangements through which they may offer products or services to you or our other users, and to whom we may disclose your Data for a relevant purpose.
• (e) Service Providers: Includes entities to whom we, or other Tata Group Entities, will disclose your Data in order for them to process it for the purpose of providing services to us pursuant to written contract.
• (f) SPDI: The Data Protection Laws define sensitive personal data or information of a person as personal information about that person relating to (a) passwords; (b) financial information such as bank account, credit, and debit card details or other payment instrument details; (c) physical, physiological and mental health condition; (d) sexual orientation; (e) medical records and history; or (f) biometric information.
• (g) IRCPL: IRCPL, a company incorporated in India whose registered office is at Ranka Junction, No. 224 (old Sy No.80/3), 4th Floor, Vijinapura, Old Madras Road, K R Puram, Bangalore - 560016, India.
• (h) Tata Group Entity: Tata Sons Private Limited, and its subsidiaries, affiliates, associate companies, and joint venture companies with whom we have a contractual arrangement to, inter alia, share data for the purposes described in this Privacy Notice.
• (i) User or you: The natural person who accesses our stores, website, or mobile application.

IRCPL collects Data for various purposes set out in this Privacy Notice. This Data includes, without limitation, the following categories:

• (a) Contact information: First and last name, email address, postal address, country, employer, phone number, and other similar contact data.
• (b) Financial information: Payment instrument information, transactions, transaction history, preferences, method, mode, and manner of payment, spending pattern or trends, and other similar data.
• (c) Technical information: Website, device, and mobile app usage, Internet Protocol (IP) address, and similar information collected via automated means, such as cookies, pixels, and similar technologies.
• (d) Transaction information: The date of the transaction, total amount, transaction history, preferences, and related details, if applicable.
• (e) Account information: Your account membership number, registration, payment information, and program-specific information, when you use access the application to provide services or participate in program, as is applicable.
• (f) Personal information: Age, sex, date of birth, marital status, nationality, details of government identification documents provided, occupation, ethnicity, religion, travel history, or any other personal information provided as part of the onboarding flow on the application.
• (g) Your reviews, feedback, and opinions: About our products, programmes, and services.
• (h) Payment instrument information: Through our application pages, you may choose to store your preferred payment mode/instrument details which may be managed by service provider/s.
• (i) Location Information:Precise Location Information and How to Opt Out When you use one of our location-enabled services (for example, when you access Services from a mobile device), we may collect and process information about your mobile device’s GPS location (including the latitude, longitude or altitude of your mobile device) and the time the location information is recorded to customize the Services with location-based information and features (for example, to assign you new orders in your area or provide applicable promotions for your zone of working). Some of these services require your personal data for the feature to work and we may associate location data with your device ID and other information we hold about you. We keep this data for no longer than is reasonably necessary for providing services to you. If you wish to use the particular feature, you will be asked to consent to your data being used for this purpose. You can withdraw your consent at any time by disabling the GPS or other location-tracking functions on your device, provided your device allows you to do this. However, this may affect Your experience of certain functionalities on the Platform Background Location capture and How to Opt Out When you use one of our location-enabled services (for example, when you access Services from a mobile device), we may collect and process information about your mobile device’s GPS location while the app is in background (including the latitude, longitude or altitude of your mobile device) and the time the location information is recorded to customize the Services with location-based information and features (for example, to assign you new orders in your area or provide applicable promotions for your zone of working). Some of these services require your personal data for the feature to work and we may associate location data with your device ID and other information we hold about you. We keep this data for no longer than is reasonably necessary for providing services to you. If you wish to use the particular feature, you will be asked to consent to your data being used for this purpose. You can withdraw your consent at any time by disabling the GPS or other location-tracking functions on your device, provided your device allows you to do this. However, this may affect Your experience of certain functionalities on the Platform The delivery app continuously tracks the device’s location when the application is running in the foreground or background, which is then utilized by the system for below purposes: a) Track the delivery partner’s route b) Calculate the ETD (Estimated time of delivery) metric and show the end customers.

We collect Data in the following ways:

• Information You Give Us: We receive and store any information you enter on our website or mobile application or give us in any other way (e.g., at outlets, stores, hotels, kiosks). Please see the section titled “Data Shared by You” for more information.
• Automatic Information We Collect: We use “cookies”, pixels and similar technologies to receive and store certain types of information whenever you interact with us. Please see the section below, titled “Data that is Collected Automatically” for more information.
• E-mail Communications: To help us make e-mails more relevant and interesting, we often receive a confirmation (if your device supports such capabilities) when you open e-mail from us or click on a link in the e-mail. You can choose not to receive marketing emails from us by clicking on the unsubscribe link in any marketing email.
• Automatic Information We Collect from Other Websites: We receive and store certain types of information when you interact with third-party websites that use our technology or with whom we have a specific agreement. Because we process this information on behalf of the applicable website operators, collection, processing, and use of such information is subject to the applicable website operators’ privacy policies and is not covered by our Privacy Notice.
• Information from Other Sources: We may obtain information from other sources. An example of this is when you authorize a third-party website (such as the website of another Tata Group Entity), to interact directly with our website or mobile application to provide or receive Data about you. In that case, we might receive such Data used by that third-party website to identify your account with that website.
• Information Previously Provided to Tata Group Entities: Where you have shared any information previously with any of the Tata Group Entities and have consented to the further sharing of such information, such information will be shared with us by the Tata Group Entities.

You can make choices about our collection and use of your Data. For example, you may want to access, edit, or remove your Data on our website or mobile application. When you are asked to provide Data, you may decline, however, in such a case, you may not be able to avail the benefit of some of our products, programmes, or services or access our stores or physical premises.

IRCPL may collect your Data in several ways from your use of our stores, website, or mobile application. For instance:

• (a) When you register with us for providing various services as the case maybe.
• (b) When you conduct a transaction with us through our website, or mobile application;
• (c) When you elect to receive any communications from us;
• (d) From the information gathered by your visit to our stores, website, or mobile application; or
• (e) By way of correlation or inferences from information.

• (a) We automatically collect some information when you visit our website or use our mobile application. This information helps us to make improvements to our content and navigation. The information collected automatically includes your IP address.
• (b) Our web servers or affiliates who provide analytics and performance enhancement services collect IP addresses, operating system details, browsing details, device details, and language settings. This information is aggregated to measure the number of visits, average time spent on the site, pages viewed, and similar information. Tata X uses this information to measure the site usage, improve content, and to ensure safety and security, as well as enhance the performance of our website or mobile application.
• (c) We may collect your Data automatically via Cookies, pixels, and similar technologies in line with settings on your browser. For more information about Cookies, please see the section below, titled “Cookies.”
• (d) We use Google Maps API and Google Location Services to provide location-based services (including tracking route and estimates time of delivery). Therefore, by enabling GPS tracking, you consent to the collection of precise location data. All location data collected will be stored securely and retained only by us and/ or our Service Providers to serve the purposes outlined in this policy.

IRCPL may use your Data to enhance your experience when using our website or mobile application. Specifically, Data may be used by us for the following reasons:

• (a) Carry out our obligations arising from any contract entered into between you and us;
• (b) Customizing and improving our application and communicate with you about products and/or services offered by us;
• (c) To provide location-based services
• (d) Enable payment, billing and invoicing related purposes;
• (e) Enable Tata Group Entities, Service Providers, and Partners to offer their products and/or services throught the application and communicate with you in ths regards;
• (f) Process, disclose, transmit, and/or share the Data with Tata Group Entities and other third parties which have business or contractual dealings with us for any legitimate purpose/use and in terms of this Privacy Notice;
• (g) Provide you with offers (including for financial products and/or services), personalized services, recommendations, and improve your experience on our website and mobile application;
• (h) Operate, evaluate, and improve our business (including for administration and management related purposes), website and mobile application;
• (i) Generate aggregated data to prepare insights to enable us to understand customer behavior, patterns, and trends.
• (j) Provide privileges and benefits to you, marketing and promotional campaigns based on your profile;
• (k) Communicate with you (including to respond to your requests, questions, feedback, claims or disputes) and to customize and improve our the application;
• (l) Enforce the terms of use of our website and mobile application;
• (m) Protect against and prevent fraud, illegal activity, harm, financial loss, and other legal or information security risks; and
• (n) Serve other purposes for which we provide specific notice at the time of collection, and as otherwise authorized or required by applicable law.

We treat these inferences as personal information (or SPDI, as the case may be), where required under applicable law. Some of the above grounds for processing will overlap, and there may be several grounds which justify our use of your personal information.

Where required under applicable law, we will only use your personal information with your consent; as necessary to provide you with products and/or services; or for such other purpose as is permissible under applicable law. We may make broader use of anonymized personal information from which individuals cannot be identified.

We may share your Data with/for:

• (a) Partners: We may make available to you services, products, or applications provided by Partners for use on or through our website or mobile application. If you choose to use such service, customer information related to those transactions may be shared with such Partner. Such Partners will be required to respect the security of your Data and to treat it in accordance with this privacy policy and applicable law.
• (b) Tata Group Entities: We may make available to you products, services and/or applications of Tata Group Entities, to assist them to reach out to you in relation to their programs or campaigns and to process your queries and requests. Accordingly, we may share your Data with Tata Group Entities. We may also share your Data with the Tata Group Entities as is relevant for the purposes set out in Clause 7 above, and to facilitate the operation of our business.
• (c) Tata Consumer Platform: Your Data may be shared with Tata Group Entities and other participating entities on the Tata Consumer Platform operated by Tata Digital Limited (“TCP”) for purposes of enrolment, offering your services and benefits on the TCP. Accordingly, we may share your Data with other Tata Group Entities, Partners, and Service Providers.
• (d) Service Providers: We or other Tata Group Entities may share your Data with Service Providers. Examples include storing and analyzing Data, protecting and securing our systems, providing search results and links, providing customer service, credit analysis, processing your information for profiling, user analysis, location tracking and payment processing. These Service Providers will be required to only process Data in accordance with express instructions and as necessary to perform services for purposes set forth in this Privacy Notice and/ or their respective privacy policies governing their use of Data. The Service Providers will also be required to safeguard the security and confidentiality of the Data they process by implementing appropriate technical and organizational security measures and confidentiality obligations binding employees accessing Data.
• (e) When IRCPL acts as a Service Provider: We may process and share your Data with Tata Group Entities and Partners when we act as a service provider to such Tata Group Entities and Partners.
• (f) Protecting IRCPL: We may release Data when we believe release is appropriate to comply with applicable law or legal process, enforce or apply the relevant Terms and Conditions of Use of our website or mobile application and other agreements, protect IRCPL against harm or financial loss, when we believe disclosure is necessary to protect individuals’ vital interests, or in connection with an investigation of suspected or actual fraudulent or illegal activity. This may include exchanging information with other companies and organizations for fraud protection, risk management and dispute resolution. This does not include selling or otherwise disclosing personally identifiable information from users for commercial purposes in violation of this Privacy Notice.
• Business Transfers: As we continue to develop our business, we might sell or buy subsidiaries or business units. Your Data (including in relation to loyalty programs) may be transferred as part of such transaction or in the course of exploratory activities related thereto, including due diligence and audit exercises. The relevant transferee may thereafter make use of Data in accordance with then applicable Law.
• (g) Third Parties: We may also share your Data with other third parties where:
  • (i) You request or authorize us to do so;
  • (ii) We need to comply with applicable law or respond to valid legal process; or
  • (iii) We need to operate and maintain the security of our website or mobile application, including to prevent or stop an attack on our computer systems or networks.

We require these third parties by contract to only process sensitive personal data in accordance with our instructions and as necessary to perform services on our behalf or in compliance with applicable law. We also require them to safeguard the security and confidentiality of the sensitive personal data they process on our behalf by implementing appropriate confidentiality, technical and organizational security measures.

Please note that Tata Group Entities and Partners may have privacy practices that differ from those of IRCPL. The use of your Data will be governed by their privacy statements when you provide Data on their websites.

When we process Data about you, we do so with your consent and/or as necessary to operate our business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfil other legitimate interests of IRCPL as described in this Privacy Notice. We may transfer Data we collect about you to recipients in India, where we are headquartered. India may not have the same Data Protection Laws as the country in which you initially provided the information. When we transfer your Data to India, we will protect that information as described in this Privacy Notice, as disclosed to you at the time of data collection or as described in our program-specific privacy notice.

Depending on which Data Protection Laws are applicable to you, you may have the right or choice to:

• Opt out of some collection or uses of your Data, including the use of cookies, pixels and similar technologies and the use of your Data for marketing purposes.
• Opt out at any time by disabling location services in your device settings;
• Access your Data, rectify it, restrict or object to its processing, or request its deletion or anonymization.
• Change or edit information submitted to us.
• Receive the Data you provided to us to transmit it to another company.
• Withdraw any consent provided or alter your preferences.
• Where applicable, lodge a complaint with your supervisory authority.

You may submit a request as described in the “How to Contact Us” section below. We will not charge you for any request. Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why.

Below, you will find additional privacy information that you may find important. Data Protection Laws, depending on your country, may include the following rights in relation to your Data:

• a) Right to Confirmation and Access - the right to confirm our methods of processing and request
  • (i) copies of the information we hold about you at any time, or
  • (ii) that we modify, update or delete such information.
• b) Right to Correction - the right to have your Data rectified if it is inaccurate or incomplete.
• c) Right to be Forgotten - the right to request that we delete or remove your Data from our systems.
• d) Right to Restrict / Object to Our Use of your Data - the right to limit the way in which we can use it.
• e) Right to Data Portability - the right to request that we move, copy or transfer your Data.
• f) Right to Withdraw Consent – the right to withdraw your consent provided earlier.
• g) Right to File Complaints – the right to raise complaints to a regulatory authority.

For information about managing your Data and promotional communications, please e-mail us at customerservice@bigbasket.com.

It is important that the Data we hold about you is accurate and current. Please keep us informed if your personal information changes during the period for which we hold it.

14.1

IRCPL implements standard measures to protect against unauthorized access to and unlawful interception of Data. However, no internet site can fully eliminate security risks. IRCPL endeavors to take all measures to protect the security, integrity, and confidentiality of the Data against unauthorized breach and hacking. For the purpose of checking possible vulnerabilities and attacks, IRCPL may conduct periodical internal review of data and security measures. However, the internet is not absolutely a secure environment, and we cannot ensure or warrant 100% security.

14.2

If you are provided with any identification code, password, or any other piece of information as part of the security procedure adopted by us, you should treat such information as confidential and not disclose it to any third party, including other users. You are solely responsible for the activities that occur under your account, including the confidentiality of your password, and IRCPL is not responsible for the same.

14.3

Notwithstanding anything contained in this Policy or elsewhere, IRCPL shall not be held responsible for any loss, damage, or misuse of the Data if such loss, damage, or misuse is attributable to a Force Majeure Event. A "Force Majeure Event" means any event that is beyond the reasonable control of IRCPL and includes, without limitation, fire, flood, explosion, acts of God, civil commotion, strikes, lockouts or industrial action of any kind, riots, insurrection, war, acts of government, power failure, sabotage, computer hacking, unauthorized access to computer data and storage device, system failure, virus, attacks, bugs, computer crashes, breach of security, and encryption.