Privacy Policy — Food Hackers Lab

R3S Foods and Wellness Private Limited, operating as Food Hackers Lab (“we”, “us”, “our”), respects your privacy. This Privacy Policy explains what personal data we collect through www.foodhackerslab.com (the “Website”), why we collect it, how we use and protect it, and what rights you have.

This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act); the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and, where applicable to visitors in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR).

1. Who we are — Data Fiduciary / Controller

R3S Foods and Wellness Private Limited
Registered office: Blue Rose Industrial Estate, A-419, Western Express Hwy, next to Metro Mall, Magathane, Borivali East, Mumbai, Maharashtra 400066
Email: privacy@foodhackerslab.com

We are the Data Fiduciary (under the DPDP Act) and Data Controller (under the GDPR) for the personal data described in this Policy.

2. What personal data we collect

2.1 Data you give us directly — enquiry and contact forms. When you submit an enquiry through the Website, we collect: your name, email address, telephone number (if you provide it), company or organisation name (if you provide it), and the content of your message, together with the date and time of submission.

2.2 Data collected automatically. Our hosting provider and standard web-server infrastructure may automatically log technical information such as IP address, browser type and version, device type, operating system, referring URL, pages visited and timestamps. This is generated as an ordinary incident of operating a website and is used for security, integrity and troubleshooting.

2.3 Cookies. The Website uses only strictly necessary cookies required for the Website to function and to keep it secure. We do not currently use advertising, profiling or third-party analytics cookies. [If you later add Google Analytics, Meta Pixel, a LinkedIn Insight Tag, a chat widget or a newsletter platform, this clause and Clause 5 must be updated and a cookie-consent banner added.]

2.4 What we do not collect. We do not knowingly collect financial-account information, government identification numbers, health data, biometric data, or any other category of sensitive personal data through the Website. Please do not include such information in an enquiry message.

2.5 Children. The Website is intended for business and professional audiences and is not directed at children. We do not knowingly collect personal data of any person below eighteen (18) years of age. If we learn that we hold such data, we will delete it. Where required by the DPDP Act, processing of a child’s data will not be undertaken without verifiable parental consent, and we will not undertake tracking, behavioural monitoring or targeted advertising directed at children.

3. Why we use your data, and our lawful basis

We do not sell your personal data. We do not share it for third-party advertising. We do not use it for automated decision-making or profiling that produces legal or similarly significant effects.

4. Consent and withdrawal

Where we rely on your consent, that consent is free, specific, informed, unconditional and unambiguous, and is given by a clear affirmative action — your submission of the enquiry form. You may withdraw your consent at any time by writing to [privacy@foodhackerslab.com]. Withdrawal is as easy as giving consent, does not affect the lawfulness of processing carried out before withdrawal, and following withdrawal we will cease processing and erase your data unless retention is required by law.

5. Who we share your data with

We disclose personal data only to:

(a) Service providers (“Data Processors”) who operate our infrastructure — for example website hosting, email services and, where applicable, form or CRM providers. They act only on our documented instructions, under written contracts requiring confidentiality and appropriate security, and may not use your data for their own purposes.
(b) Professional advisers — lawyers, auditors, accountants — bound by professional duties of confidentiality.
(c) Authorities — where disclosure is required by law, court order, or a lawful request from a government or regulatory body.
(d) A successor — in connection with a merger, acquisition or transfer of our business, subject to this Policy continuing to apply.

Our current principal processors are: [LIST — e.g. hosting provider, email provider, form provider].

6. International transfers

Our service providers may store or process data on servers located outside India, including in [JURISDICTIONS — e.g. the European Union, the United States, Singapore]. Any such transfer is made only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and, where personal data of EEA/UK residents is transferred outside those territories, under an appropriate safeguard such as the European Commission’s Standard Contractual Clauses or an adequacy decision. Details are available on request.

7. How long we keep your data

We do not retain personal data for longer than is necessary for the purpose for which it was collected.

8. Security

We implement reasonable security safeguards appropriate to the nature of the data, including encryption in transit (HTTPS/TLS), access control on a need-to-know basis, secured and password-protected accounts, and periodic review of our practices, consistent with Rule 8 of the SPDI Rules, 2011 and Section 8(5) of the DPDP Act. However, no method of transmission over the internet or of electronic storage is completely secure, and while we take our obligations seriously, we cannot and do not guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board of India, and affected individuals, as and to the extent required by law.

9. Your rights

Subject to applicable law and to verification of your identity, you have the right to:

Access — obtain a summary of the personal data we hold about you, the processing activities undertaken, and the identities of others with whom it has been shared (DPDP Act s.11; GDPR Art. 15);
Correction, completion and updating — have inaccurate or incomplete data corrected (DPDP Act s.12; GDPR Art. 16);
Erasure — have your data deleted where it is no longer needed for the purpose for which it was collected, or where you withdraw consent (DPDP Act s.12; GDPR Art. 17);
Restriction and objection to processing based on legitimate interests (GDPR Arts. 18 and 21);
Portability — receive your data in a structured, commonly used, machine-readable format (GDPR Art. 20);
Nominate another individual to exercise your rights in the event of your death or incapacity (DPDP Act s.14);
Grievance redressal — a readily available means of raising a grievance with us (DPDP Act s.13); and
Withdraw consent at any time (Clause 4).

To exercise any right, write to [privacy@foodhackerslab.com]. We will respond within thirty (30) days. There is no charge, unless a request is manifestly unfounded or excessive.

10. Your duties as a Data Principal

Under Section 15 of the DPDP Act, you must not impersonate another person when providing data, must not suppress material information, must not register a false or frivolous grievance or complaint, and must furnish only authentic and verifiably correct information when exercising your right of correction.

11. Grievance Officer

In accordance with the DPDP Act, 2023, the Information Technology Act, 2000 and the rules thereunder, the details of our Grievance Officer are:

Designation: Grievance Officer, R3S Foods and Wellness Private Limited
Email: grievance@foodhackerslab.com
Address: Blue Rose Industrial Estate, A-419, Western Express Hwy, next to Metro Mall, Magathane, Borivali East, Mumbai, Maharashtra 400066
Phone: +91- 98046 64664
Hours: Monday to Friday, 10:00–18:00 IST (excluding public holidays)

Grievances are acknowledged within 24 hours and resolved within fifteen (15) days. If you remain dissatisfied, you may complain to the Data Protection Board of India, or, if you are in the EEA/UK, to your local supervisory authority.

12. Changes to this Policy

We may update this Policy. The updated version takes effect when posted, and the “Last updated” date will change. Material changes will be highlighted on the Website.

13. Governing law

This Policy is governed by the laws of India, and the courts at Mumbai, Maharashtra have exclusive jurisdiction, without prejudice to any non-waivable rights you may have under the law of your own country of residence.