Legal › Privacy Policy
Privacy Policy
How AquaSips collects, uses, stores, and protects your personal data — under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
1. Who is the Data Fiduciary
AquaSips, a sole proprietorship operated by Mohammed Nazeer Uddin, is the Data Fiduciary under the DPDP Act, 2023.
You can reach us at the WhatsApp number +91 83098 29081 or via the form on www.aquasips.in. The proprietor acts as the Grievance Officer for this website and responds to grievances within 30 days.
2. What data we collect
| Category | Examples | Why |
|---|---|---|
| Contact | Name, mobile number, email, delivery address | To deliver water and issue receipts |
| Order & payment | Order history, UPI transaction reference, amount | Reconcile prepaid UPI orders |
| Location | GPS coordinate captured when you tap "Send my location" | So our delivery rider can find you |
| Device & usage | IP address, browser/app version, error logs | Security and bug fixing |
| Delivery proof | Package photo + GPS at the doorstep | Dispute resolution (DPDP s.7(b)) |
We do not collect Aadhaar, PAN, bank account, OTP, or card numbers. UPI payments are handled by your UPI app and (optionally) Razorpay — see Section 6.
3. Why we use your data (Lawful basis)
- Consent (DPDP s.6) — when you tick the consent box on order or sign-up.
- Certain Legitimate Uses (DPDP s.7) — fulfilling the delivery you asked for, responding to support, and complying with tax/FSSAI law.
4. How long we keep it
| Data | Retention |
|---|---|
| Order, invoice, delivery proof | 8 years (Income-tax Act, GST Act) |
| Account profile (active customer) | While the account is active + 3 years |
| GPS location for a single order | Deleted within 30 days of delivery |
| Marketing/communication consent | Until you withdraw consent |
| Server logs | 90 days |
5. Who can see your data
- AquaSips staff and the delivery rider assigned to your order.
- Our payment processor (Razorpay Software Pvt. Ltd.) only when you pay via dynamic QR — see Razorpay Privacy.
- Our hosting provider (Hostinger International Ltd.) hosts the VPS in their data centre — see Hostinger Privacy.
- Government authorities only on a valid written legal order.
We do not sell, rent, or trade your data. No third-party advertising trackers are loaded on this site.
6. Payments & UPI
Public orders are prepaid via UPI. You scan a QR or tap a UPI deep-link and pay directly to our merchant VPA. We see only the UPI reference number, payee VPA, and amount — never your bank credentials or PIN.
7. Your rights (DPDP s.11–14)
- Right to access a summary of your data.
- Right to correction & erasure of inaccurate or no-longer-needed data.
- Right to grievance redressal within 30 days.
- Right to nominate another person to exercise your rights in case of death or incapacity.
- Right to withdraw consent at any time (won't affect lawful processing already done).
To exercise any right, message +91 83098 29081 with the subject "DPDP request" and your registered mobile.
8. Security
- HTTPS (TLS) on every page with automatically renewed certificates.
- Passwords stored as bcrypt hashes; refresh tokens are httpOnly cookies.
- Database access restricted to the application user; daily encrypted backups to Backblaze B2.
- Server is patched regularly and runs only the AquaSips application stack.
9. Children
AquaSips is intended for adult customers. We do not knowingly collect data from anyone under 18. If you believe a child has shared data with us, contact us and we will delete it.
10. Changes to this policy
If we change this policy materially, we will email registered customers and post a notice on the home page at least 14 days before the change takes effect.