Privacy Policy

1. Introduction

This Privacy Policy (“Policy”) describes how tthreebnd nutrition llp, a limited liability partnership registered under the Limited Liability Partnership Act, 2008, having its registered office in India (“Company,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects information obtained through the website ritualpop.com (the “Website”), mobile applications, and related services (collectively, the “Services”).

This Policy is published in compliance with the Information Technology Act, 2000 (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Digital Personal Data Protection Act, 2023 (“DPDP Act”), as applicable.

By using the Services, you consent to the collection, use, and processing of your information as described in this Policy. If you do not agree with this Policy, please do not use the Services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, shipping address, and billing information when you create an account or place an order.
• Payment Information: Payment card details, UPI IDs, or other payment credentials. These are processed by our third-party payment processors and are not stored on our servers.
• Communication Data: Information you provide when you contact us, submit feedback, respond to surveys, or participate in promotions.
• Waitlist Information: Email address and any other information you provide when joining our waitlist.
• Health-Related Preferences: Optional information about your health goals, menstrual cycle, or supplement preferences provided to personalize your experience.

2.2 Information Collected Automatically

• Device & Usage Data: IP address, browser type, operating system, device identifiers, pages visited, time spent, referring URLs, and clickstream data.
• Cookies & Tracking Technologies: We use cookies, web beacons, pixels, and similar technologies to collect information about your browsing behavior. See Section 8 for details.
• Location Data: Approximate geographic location derived from your IP address.
• Analytics Data: Aggregated and anonymized data about how users interact with the Services.

2.3 Information from Third Parties

We may receive information about you from third-party services, including payment processors, analytics providers, advertising partners, and social media platforms, to the extent permitted by their respective privacy policies.

3. Purpose of Data Collection

We collect and process your information for the following purposes:

• To process and fulfill your orders, including shipping and payment processing.
• To create and manage your account and subscriptions.
• To communicate with you regarding orders, updates, promotions, and customer support.
• To personalize your experience and recommend relevant products.
• To send marketing and promotional communications (with your consent where required).
• To analyze usage patterns, improve the Services, and develop new features.
• To detect, prevent, and address fraud, security issues, and technical problems.
• To comply with legal obligations, enforce our Terms of Service, and protect our rights.
• For any other purpose with your consent.

4. Legal Basis for Processing

Under the DPDP Act, 2023 and applicable Indian law, we process your data based on:

• Consent: Where you have given clear consent for us to process your personal data for specific purposes.
• Contractual Necessity: Where processing is necessary to fulfill our contract with you (e.g., processing orders).
• Legitimate Uses: As permitted under the DPDP Act for certain legitimate uses specified therein.
• Legal Obligation: Where processing is necessary for compliance with applicable laws.

5. Sharing of Information

We may share your information with the following categories of recipients:

• Service Providers: Third-party vendors who assist us with payment processing, shipping and logistics, email delivery, analytics, customer support, cloud hosting, and marketing. These providers are contractually obligated to use your data only for the purposes we specify.
• Business Partners: Partners involved in co-branded products, promotions, or joint offerings.
• Analytics & Advertising Partners: Third parties that help us analyze usage data and deliver targeted advertisements.
• Legal & Regulatory: Government authorities, law enforcement, or other parties when required by law, legal process, or to protect our rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, reorganization, sale of assets, or similar corporate transaction, your information may be transferred to the acquiring entity.
• With Your Consent: Any other third party with your explicit consent.

We do not sell your personal data to third parties.

6. Data Storage & Security

Your data is stored on secure servers located in India and/or with cloud service providers who may store data outside India. Where data is transferred outside India, we ensure appropriate safeguards are in place in accordance with the DPDP Act.

We implement reasonable security practices and procedures, including encryption, access controls, and regular security assessments, as required under the SPDI Rules and the DPDP Act. However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data and shall not be liable for any unauthorized access or breach that occurs despite our reasonable security measures.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. When your data is no longer needed, we will securely delete or anonymize it.

Specifically: (a) account data is retained for the duration of your account and for up to 3 years thereafter; (b) transaction data is retained for a minimum of 8 years as required under Indian tax and commercial laws; (c) marketing data is retained until you opt out; (d) analytics data may be retained indefinitely in anonymized form.

8. Cookies & Tracking Technologies

We use the following types of cookies and tracking technologies:

• Essential Cookies: Required for the Website to function properly (authentication, shopping cart, security).
• Analytics Cookies: Help us understand how visitors interact with the Website (e.g., Google Analytics).
• Marketing Cookies: Used to deliver relevant advertisements and track campaign effectiveness (e.g., Meta Pixel, Google Ads).
• Preference Cookies: Remember your settings and preferences for a better experience.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Services.

9. Your Rights

Under the DPDP Act, 2023 and applicable Indian law, you have the following rights:

• Right to Access: You may request a summary of your personal data being processed and the processing activities.
• Right to Correction: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to Grievance Redressal: You may raise complaints about our data processing activities.
• Right to Nominate: You may nominate an individual to exercise your rights in case of your death or incapacity, as provided under the DPDP Act.

To exercise any of these rights, please contact us at hello@ritualpop.com. We will respond to your request within 30 days or such period as prescribed under applicable law. We may verify your identity before processing your request.

10. Marketing Communications

With your consent, we may send you promotional emails, SMS messages, or push notifications about our products, offers, and content. You may opt out at any time by: (a) clicking the “unsubscribe” link in our emails; (b) replying “STOP” to our SMS messages; (c) adjusting your notification preferences in your account settings; or (d) contacting us at hello@ritualpop.com.

Even after opting out of marketing communications, we may continue to send you transactional or service-related communications (such as order confirmations and shipping updates).

11. Third-Party Links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policies of any third-party websites you visit. Accessing third-party links is at your own risk.

12. Children’s Privacy

The Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete such data promptly. If you believe we may have collected data from a child, please contact us at hello@ritualpop.com.

13. Grievance Officer

In accordance with the IT Act, 2000 and the SPDI Rules, the details of the Grievance Officer are as follows:

14. Changes to This Policy

We reserve the right to update this Policy at any time. Changes will be effective upon posting to the Website with an updated “Last updated” date. We will make reasonable efforts to notify you of material changes through email or a prominent notice on the Website. Your continued use of the Services after any modification constitutes your acceptance of the revised Policy.

15. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: