Privacy Policy

1Introduction

NeoWinn Biotech Private Limited (“NeoWinn,” “we,” “us,” or “our”), a company incorporated under the Companies Act, 2013, with its registered office in Bangalore, Karnataka, India, is committed to protecting the privacy of all individuals who visit our website at www.neowinnbiotech.com (the “Website”) and use our services.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data in accordance with the Information Technology Act, 2000 (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and the Digital Personal Data Protection Act, 2023 (“DPDP Act”), as applicable.

2Personal data we collect

2.1 Information you provide directly

We collect personal data that you voluntarily provide to us when you:

• Place an order through our online shop (for eligible products)
• Create a user account or register on our Website
• Subscribe to our newsletter or blog updates
• Contact us through the contact form, email, or toll-free number (1800 8898 913)
• Submit a query through the chatbot on our Website
• Apply for career opportunities

The categories of personal data we may collect include:

• Name, email address, phone number, and postal/delivery address
• Billing and shipping information
• Payment information (processed securely through third-party payment gateways — we do not store credit/debit card numbers, UPI IDs, or bank account details on our servers)
• Order history and product preferences
• Communication records (emails, chat transcripts, feedback)
• Professional credentials (for healthcare professionals accessing gated content)

2.2 Information collected automatically

When you visit our Website, certain information is collected automatically through cookies and similar technologies:

• IP address, browser type and version, operating system
• Device identifiers and screen resolution
• Pages visited, time spent on pages, click patterns, and navigation paths
• Referring URL (the website that directed you to ours)
• Approximate geographic location (derived from IP address)

2.3 Information from third parties

We may receive information about you from third-party sources, including:

• Payment gateway providers (transaction confirmation, payment status)
• Logistics and delivery partners (delivery status updates)
• Analytics providers (aggregated website usage data)

3How we use your personal data

We process your personal data for the following purposes, each supported by a lawful basis under the DPDP Act:

• To process and fulfil your orders, including payment processing, dispatch, and delivery
• To communicate with you about your orders, queries, or feedback
• To provide customer support through email, phone, or chat
• To send transactional communications (order confirmations, shipping updates, invoices)
• To send marketing communications, including newsletters and product updates (only with your explicit opt-in consent; you may withdraw consent at any time)
• To improve our Website, products, and services through analytics and usage patterns
• To detect, prevent, and address fraud, security incidents, or technical issues
• To comply with applicable laws, regulations, and legal obligations, including the IMS Act, 1992, and FSSAI regulations
• To process job applications submitted through the Careers section

4Cookies and tracking technologies

4.1 What are cookies

Cookies are small text files placed on your device when you visit our Website. They help us recognise your browser, remember preferences, and understand how you interact with our Website.

4.2 Types of cookies we use

• Essential cookiesRequired for the Website to function (e.g., shopping cart functionality, session management, security). These cannot be disabled.
• Analytics cookiesHelp us understand how visitors use our Website (e.g., Google Analytics). These collect aggregated, anonymised data about page views, traffic sources, and user behaviour.
• Functional cookiesRemember your preferences (language, region, display settings) to provide a personalised experience.
• Marketing cookiesUsed to deliver relevant advertisements and measure campaign effectiveness. These are only placed with your explicit consent.

4.3 Managing cookies

You may manage or disable cookies through your browser settings. Please note that disabling essential cookies may impair the functionality of the Website, including the ability to place orders. Most browsers allow you to view, delete, and block cookies from specific or all websites.

5Payment processing

All payments on our Website are processed through third-party payment gateways (such as Razorpay, CCAvenue, or similar PCI-DSS compliant providers). When you make a purchase:

• Your payment details (card number, UPI ID, net banking credentials) are entered directly on the payment gateway’s secure page or embedded form
• NeoWinn does not receive, access, process, or store your complete payment credentials
• The payment gateway provides us only with a transaction reference number and confirmation of payment status (success/failure)
• All payment data transmission is encrypted using SSL/TLS protocols

We recommend that you review the privacy policy of the payment gateway used at the time of transaction.

6Data sharing and disclosure

6.1 Service providers

We engage trusted third-party service providers who assist us in operating our business. These include:

• Payment gateway providers (for transaction processing)
• Logistics and courier partners (for order delivery — your name, address, and phone number are shared for shipping purposes)
• Cloud hosting and IT infrastructure providers (for website hosting and data storage)
• Email and communication platforms (for sending transactional and marketing communications)
• Analytics providers (for website performance analysis)

All service providers are contractually obligated to process your data only for the purposes specified by us and in compliance with applicable data protection laws.

6.2 Legal requirements

We may disclose your personal data if required to do so by law, regulation, legal process, or governmental request, including under the IT Act, 2000, the DPDP Act, 2023, or any order of a court or regulatory authority of competent jurisdiction.

6.3 Business transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this policy.

7Data retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Order and transaction records8 years from the date of transaction (as required under the Income Tax Act, 1961, and GST regulations)
• Customer account dataUntil you request account deletion
• Marketing preferencesUntil you withdraw consent
• Website analytics data26 months (aggregated and anonymised)
• Job application data12 months from the date of application, unless the application results in employment

Upon expiry of the retention period, your personal data will be securely deleted or anonymised.

8Data security

We implement reasonable security practices and procedures, as required under the SPDI Rules, 2011, to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our servers
• Encrypted storage of sensitive personal data at rest
• Access controls limiting data access to authorised personnel only
• Regular security assessments and vulnerability testing
• Incident response procedures for data breaches

While we take reasonable measures to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

9Your rights under the DPDP Act, 2023

As a Data Principal under the DPDP Act, you have the following rights:

• Right to accessYou may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to correctionYou may request correction or updating of inaccurate or incomplete personal data.
• Right to erasureYou may request deletion of your personal data, subject to our legal retention obligations.
• Right to withdraw consentWhere processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to grievance redressalYou may raise a complaint with our Grievance Officer (see Section 12).
• Right to nominateYou may nominate another individual to exercise your rights in the event of your death or incapacity, as per the DPDP Act.

To exercise any of these rights, please contact our Grievance Officer at the details provided in Section 12.

10Children’s privacy

Our Website contains information about infant and maternal nutrition products. However, our Website is not directed at children under the age of 18 years. We do not knowingly collect personal data from children. If you are a parent or guardian and believe that your child has provided personal data to us, please contact us, and we will take steps to delete such data.

In compliance with the DPDP Act, processing of personal data of a child (below 18 years) requires verifiable consent from the parent or lawful guardian.

11Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Any changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this page periodically. Continued use of the Website after changes constitutes acceptance of the updated policy.

12Grievance Officer

In accordance with the IT Act, 2000, and the DPDP Act, 2023, we have appointed a Grievance Officer to address your concerns regarding data privacy: