DPDP Act Data Protection Notice

This notice explains how Ravi Foods Pvt. Ltd. (“RFPL”, “we”), maker of the Dukes brand, handles digital personal data under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it. It should be read with our Privacy Policy.

1. Key terms

Data Principal – you, the person the personal data is about. For a child or a person with a disability, this includes the parent or lawful guardian.
Data Fiduciary – the one who decides why and how personal data is processed. For this website, that is RFPL.
Personal data – any data about an individual who can be identified by or in relation to that data.
Processing – collecting, recording, storing, using, sharing, changing or deleting data.
Data Protection Board – the body set up under the DPDP Act to deal with complaints and breaches.

2. Who we are

RFPL is the Data Fiduciary for personal data collected through dukesindia.com, our enquiry and order forms, our careers page and our direct communication with customers, distributors, HoReCa and export buyers. Contact details are in section 14.

3. What personal data we process

Identity and contact details: name, phone number, email address, postal address
Business details given in distributor, HoReCa, bulk-order, private-label and export enquiries
Order and delivery details for purchases from our online shop
Job application details, including your CV, when you apply through the Careers page
Technical data such as IP address, browser and device information, and website usage data collected through cookies and analytics

4. Why we process it

We process your personal data only for lawful purposes, and only as much as we need for them:

To answer your enquiries and requests
To take, deliver and support your orders
To assess your job application
To set up and manage distributor, HoReCa, bulk and export relationships
To improve our website, products and services
To send you updates and offers where you have said yes
To keep our systems secure and to prevent fraud and misuse
To meet our legal, tax and accounting duties

5. Consent

Where we rely on your consent, we ask for it clearly, in plain language, and for a specific purpose. Consent is a free and informed choice: we will not make your consent a condition of something that does not need it. Our forms tell you what data is used and why before you submit. You can withdraw consent at any time, and withdrawing should be as easy as giving it. After you withdraw, we stop processing the data unless the law allows or requires us to keep it. Withdrawal does not make past processing unlawful.

6. Uses that do not need consent

The DPDP Act allows processing without consent in certain cases, called “legitimate uses”. For us these can include responding to a request you made yourself and gave your data for, meeting a legal obligation or a court order, and handling a medical or safety emergency. We use these only as the law allows.

7. Your rights as a Data Principal

Right to information – ask for a summary of the personal data we process and the processing we carry out, and the names of others we have shared it with.
Right to correction and erasure – ask us to correct wrong or incomplete data, update it, or delete it when it is no longer needed for the purpose or any legal need.
Right to grievance redressal – complain to us, and if you are not satisfied, approach the Data Protection Board.
Right to nominate – name another person to exercise your rights if you die or cannot do so yourself.

8. How to use your rights

Write to us at the address in section 14 with your name, the email or phone number you used with us, and what you want us to do. We may ask you to confirm who you are before we act, to protect your data. We will reply within the time the law sets.

9. Your duties

The DPDP Act also asks Data Principals to follow the law, not to pretend to be someone else, not to hide material facts when giving data for a government document or similar purpose, not to file a false or frivolous complaint, and to give only correct details when asking for correction or erasure.

10. Children’s data

We do not knowingly collect data from anyone under 18 years of age. If we ever need a child’s data, we will get the verifiable consent of the parent or lawful guardian first. We do not track, monitor the behaviour of, or send targeted advertising to children. If you think a child has given us data without such consent, tell us and we will delete it.

11. Sharing and transfers

We do not sell personal data. We share it only with service providers who work for us under our instructions (for example website hosting, messaging, payment and delivery partners), with authorities where the law requires it, and with others only where you agree. Where data is transferred outside India, we do so only where the DPDP Act and the government’s notifications permit it.

12. Keeping data accurate, secure and only as long as needed

We take reasonable steps to keep data complete and accurate where it is used to decide something about you or shared with others. We use reasonable security safeguards, including encryption, access control and secure infrastructure, and we take care that our service providers do the same. We keep personal data only as long as the purpose needs or the law requires, and then delete it or make it anonymous.

13. Personal data breaches

If a personal data breach happens, we act immediately to contain it, tell the Data Protection Board and each affected person in the form the rules require, and take steps to stop it happening again.

14. Grievance contact

Questions, requests and complaints about your personal data go to:

Grievance Officer, Ravi Foods Pvt Ltd – Unit 2
7-4-112/1, Madhuban Colony Road, Kattedan, Hyderabad – 500077, Telangana, India
Phone: +91 78938 46784 / +91 040 2436 2238
Email: info@dukesindia.com (subject line: “Data Protection Request”)