Privacy Policy
Effective date: 8 August 2026·Last updated: 8 August 2026
1.Our commitment
BOOMBABA VENTURES (“BOOMBABA VENTURES”, “we”, “us”) respects your privacy. This Policy explains what personal data we collect through boombaba.in, why we collect it, how we use and protect it, and what rights you have over it.
This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
In the language of the DPDP Act, we are the Data Fiduciary and you are the Data Principal.
2.Data we collect
Information you give us directly
| Category | Examples | Why |
|---|---|---|
| Identity | Name, date of birth or age confirmation | Order fulfilment, age verification |
| Contact | Email, phone number, billing and shipping address | Delivery, order updates, invoicing |
| Order | Products, quantities, order history, invoice records | Fulfilment, statutory record-keeping |
| Communications | Emails, WhatsApp messages, support tickets, reviews | Support, quality improvement |
| Marketing | Newsletter subscription and preferences | Sending you the Journal, if you opt in |
Identity
- Examples
- Name, date of birth or age confirmation
- Why
- Order fulfilment, age verification
Contact
- Examples
- Email, phone number, billing and shipping address
- Why
- Delivery, order updates, invoicing
Order
- Examples
- Products, quantities, order history, invoice records
- Why
- Fulfilment, statutory record-keeping
Communications
- Examples
- Emails, WhatsApp messages, support tickets, reviews
- Why
- Support, quality improvement
Marketing
- Examples
- Newsletter subscription and preferences
- Why
- Sending you the Journal, if you opt in
Information collected automatically
IP address, browser type and version, device and operating system, referring URL, pages viewed, time on page, and cookie identifiers. See our Cookie Policy.
Payment information — an important clarification
We do not collect or store your card number, CVV, UPI PIN, or net-banking credentials. These are captured directly by our PCI-DSS compliant payment partner, Shiprocket Checkout. We receive only a transaction reference, the status, and the last four digits of the instrument for reconciliation.
What we do not collect
We do not knowingly collect data from anyone under 18. We do not collect biometric data, health data, sexual orientation, caste, religion or political affiliation. We do not require you to disclose what you use our products for, and we ask that you do not tell us.
3.Legal basis and purpose
We process your personal data on the basis of your consent, freely given at the point of collection, and where processing is necessary to perform our contract with you or to comply with a legal obligation.
We use your data only to:
- Process, fulfil, ship and invoice your order;
- Verify that you are 18 or over;
- Communicate order status, delivery updates and service messages;
- Handle returns, replacements, refunds and complaints;
- Send marketing communications only where you have opted in;
- Detect, prevent and investigate fraud, abuse and security incidents;
- Comply with tax, GST, accounting and other statutory obligations;
- Improve the Site, our products and our service, using aggregated and de-identified data.
We do not sell, rent or trade your personal data. Ever. To anyone.
5.Where your data is stored
Your data is stored on servers located in India, or with reputable global service providers who maintain equivalent standards of protection. Where any transfer outside India occurs, it will be to a country not restricted by the Central Government under Section 16 of the DPDP Act, and subject to contractual safeguards.
6.How long we keep it
| Data | Retention |
|---|---|
| Order and invoice records | 8 years — required under GST and income tax law |
| Account data | Until you ask us to delete it, or 3 years of inactivity |
| Marketing consent records | Until withdrawal, plus 1 year as proof of consent |
| Support correspondence | 3 years from closure |
| Analytics and cookie data | Up to 26 months |
| CCTV / warehouse records, if any | 90 days |
Order and invoice records
- Retention
- 8 years — required under GST and income tax law
Account data
- Retention
- Until you ask us to delete it, or 3 years of inactivity
Marketing consent records
- Retention
- Until withdrawal, plus 1 year as proof of consent
Support correspondence
- Retention
- 3 years from closure
Analytics and cookie data
- Retention
- Up to 26 months
CCTV / warehouse records, if any
- Retention
- 90 days
When the retention period ends, data is securely deleted or irreversibly anonymised.
7.Your rights as a Data Principal
Under the DPDP Act, 2023 you have the right to:
- Access — obtain a summary of the personal data we hold about you and how it is processed;
- Correction — have inaccurate or incomplete data corrected, completed or updated;
- Erasure — have your data deleted, except where retention is required by law;
- Withdraw consent — at any time, as easily as you gave it. Withdrawal does not affect processing already carried out;
- Grievance redressal — complain to us first, and escalate to the Data Protection Board of India if unsatisfied;
- Nominate — appoint another individual to exercise these rights on your behalf in the event of your death or incapacity.
To exercise any right, write to privacy@boombaba.in from your registered email address with the subject line “DPDP Request”. We will verify your identity and respond within 30 days. There is no charge for a reasonable request.
To unsubscribe from marketing, click the unsubscribe link in any email, or reply STOP. This is honoured within 7 days.
8.Security
We maintain reasonable security practices proportionate to the sensitivity of the data, including:
- HTTPS/TLS encryption across the entire Site;
- Encryption of personal data at rest;
- Role-based access control — access limited to those who need it to do their job;
- Payment processing handled entirely by a PCI-DSS Level 1 compliant gateway;
- Regular software patching and platform updates;
- Periodic access reviews and password rotation.
No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal without undue delay, as required under Section 8(6) of the DPDP Act.
9.Children’s data
The Site is not intended for and is not directed at anyone under 18. We do not knowingly collect personal data from a child. If we learn that we have collected data from a person under 18, we will delete it immediately and cancel any associated order. If you believe a minor has provided us data, contact privacy@boombaba.in at once.
11.Changes to this Policy
We may update this Policy. Material changes will be notified by email to registered users and by a prominent notice on the Site at least 7 days before taking effect. The “Last updated” date always reflects the current version.
12.Grievance Officer
In accordance with Rule 5(9) of the SPDI Rules, 2011 and Section 13 of the DPDP Act, 2023:
- Name
- Mayank Prakash
- Designation
- Grievance Officer & Data Protection Contact
- Phone
- +91 74680 13061
- Address
- Building No. 01, Pure Narsingh Bhan, Faizabad–Allahabad Road, near Pure Narsingh Bhan Branch Post Office, Dewkali Mod, Bela Pratapgarh, District Pratapgarh, Uttar Pradesh, 230001
- Hours
- Monday to Saturday, 10:00–18:00 IST (excluding public holidays)
Acknowledgement within 24 hours. Resolution within 15 days.
If you remain dissatisfied, you may approach the Data Protection Board of India established under the DPDP Act, 2023.