Privacy Policy

This Privacy Policy explains how The La Gardenia (“we”, “us”) collects, uses, shares, and protects your personal data when you use our website, place an online order, make a reservation, or contact us. It is published in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Data we collect

We collect only what we need to serve you:

• Orders: your name, mobile number, delivery address and pincode (for delivery orders), order items, and any notes you add.
• Contact form and reservations: your name, mobile number, email address (optional), and your message.
• Payments: processed entirely by Razorpay. We receive only a payment reference and status — we never see or store your card number, UPI PIN, or banking credentials.
• Technical data: standard server logs (IP address, request time) used for security and abuse prevention, such as rate limiting.

We do not knowingly collect sensitive personal data, and we do not use third-party advertising trackers on this website.

2. How we use your data

• to prepare, deliver, and provide updates about your order;
• to respond to your messages, feedback, and reservation requests;
• to process payments and refunds through Razorpay;
• to prevent fraud and abuse of the website;
• to comply with legal obligations, including tax and food-safety record-keeping requirements.

We process your data on the basis of your consent, given when you submit an order or message, and for legitimate uses permitted under the DPDP Act. We do not sell your personal data, and we do not use it for third-party marketing.

3. Who we share data with

• Razorpay (payment aggregator) — to process online payments, under its own privacy policy;
• our delivery staff — your name, address, and phone number, only to the extent needed to deliver your order;
• government or judicial authorities — where required by law or a valid legal order.

4. Cookies and local storage

We use your browser’s local storage to remember your cart between visits, and essential cookies for security (for example, the admin area login). We do not use advertising or cross-site tracking cookies.

5. How long we keep data

• Order records are retained for as long as required for accounting, tax, and food-safety compliance (generally up to 8 years under Indian tax law).
• Contact messages are retained until your query is resolved, and then for up to 12 months, after which they are deleted.
• Server logs used for security are retained for a short rolling period.

6. How we protect your data

We use reasonable security safeguards as required by the DPDP Act and the IT Rules, including encrypted (HTTPS) connections, access-controlled databases, payment processing isolated with an RBI-regulated aggregator, and rate limiting to deter abuse. No method of transmission or storage is completely secure, but we work to protect your data in line with industry practice.

7. Your rights

As a Data Principal under the DPDP Act, 2023, you have the right to:

• access a summary of the personal data we hold about you;
• correct inaccurate or incomplete data;
• request erasure of data we no longer need to retain by law;
• withdraw consent at any time (this does not affect processing already done);
• nominate a person to exercise your rights in case of death or incapacity;
• a readily available means of grievance redressal.

To exercise any of these rights, write to us at hello@thelagardenia.com or use our contact page. We will respond within the timelines prescribed under the DPDP Act.

8. Grievance redressal

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act, 2023.

9. Children

Our website is intended for use by adults. We do not knowingly process the personal data of children in a manner prohibited by Section 9 of the DPDP Act, and we do not undertake tracking or targeted advertising directed at children.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the “Last updated” date above. This policy is governed by Indian law, and disputes are subject to the jurisdiction of the courts at Lucknow, Uttar Pradesh, as set out in our Terms & Conditions.