PRIVACY POLICY

Innovative Retail Concepts Private Limited (“IRCPL” or “we” or “bigbasket”) is a company incorporated in India whose registered office is at Ranka Junction, No. 224 (old Sy No.80/3), 4th Floor, Vijinapura, Old Madras Road, K R Puram, Bangalore - 560016, India that takes the privacy of your information seriously.

This privacy policy (“Privacy Policy”) describes the types of Data we collect from you, through our stores, other premises, website (including sub-domains and microsites) mobile applications, or other means (“Data” more specifically defined below). It describes the purposes for which we collect that Data, the other parties with whom we may share it, and the measures we take to protect it. It also tells you about some of your rights and choices with respect to your Personal Data (defined below), and how you can reach us for any queries related to our security practices.

You are advised to carefully read this Privacy Policy before accessing our website, application or services (“Platform”). By continuing your access to our Platform, you are consenting to the collection and processing of your Data in accordance with the practices and policies outlined in this Privacy Policy.

Our products and services are targeted at users in India, and this Privacy Policy is intended to comply with the laws of India. If you are accessing or using the Platform from an overseas location, you are requested to independently validate the impact of any applicable local laws. If you do not agree with this Privacy Policy at any time, you may discontinue using our Platform and write to our Grievance Officer at the address specified below to request for deletion of your Personal Data. Please note that any deletion request shall be fulfilled subject to retention requirements under applicable laws in India.

1. DEFINITIONS

In this Privacy Policy, the following definitions are used:

• Cookies
  A small file placed on your device by our website or mobile application when you either visit or use certain features of our website or mobile application. It allows the Platform to remember your actions or preference for such a period of your association with us.
• Data
• means any information provided by you through our systems and Platform including Personal Data (defined below) when you visit our physical stores or Platform.
• Data Protection Laws
• any applicable law for the time being in force relating to the processing of Personal Data in India.
• Partners
• select third parties (including Tata Group Entities) with whom we have contracts or arrangements through which they may offer products or services to You or our other users, and to whom we may disclose your Data for a relevant purpose.
• Service Providers
• includes entities to whom we, or other Tata Group Entities, will disclose your Data in order for them to process it for the purpose of providing services to us pursuant to written contract.
• Personal Data
• Any Data about an individual who is identifiable by or in relation to such Data.
• Tata Group Entity
• Tata Sons Private Limited, and its subsidiaries, affiliates, associate companies and joint venture companies with whom we have a contractual arrangement to, inter alia, share Data for the purposes described in this Privacy Policy.
• User or you
• The natural person who accesses our physical stores or Platform for the purpose of providing their services to us as delivery partner, picker, or through other operational roles.

2. WHAT DATA DO WE COLLECT ABOUT YOU

bigbasket collects Data for various purposes as set out in this Privacy Policy. This Data includes, without limitation, the following categories :

Personal information: Your name, email address, permanent and postal address, phone number, age, sex, date of birth, marital status, nationality, ethnicity, religion, biometric details, travel history, or any other personal information provided in responses to surveys or questionnaires.

Identification related information: your photograph, government-issued identification documents PAN, Driving Licence, Voter ID, or other KYC documents.

Vehicle Details: type of vehicle, vehicle registration certificate, vehicle number and motor vehicle insurance details.

Financial information: payout details, payout history, preferences, method, mode and manner of payout, and other similar Data.

Technical information: Platform usage, Internet Protocol (IP) address and similar information collected via automated means, such as cookies, pixel tags and similar technologies. Unique mobile device identifier (e.g. IDFA or other device IDs on Apple devices like the iPhone and iPad),

Transaction information: the date of a transaction, total amount, transaction history and preferences and related details.

Location information: real-time precise information about the location of mobile device using GPS location (including the latitude, longitude or altitude of the mobile device) and the date and time the location information is recorded.

3. HOW WE COLLECT DATA

bigbasket collects your Data in the following ways:

Information You Give Us: We receive and store any information you enter on our Platform or give us in any other way (e.g., at outlets, stores, hotels, kiosks). Please see the section titled “Data Shared by You” for more information.

Automatic Information We Collect: We use “cookies”, pixels and similar technologies to receive and store certain types of information whenever you interact with us. Please see the section below, titled “Data that is Collected Automatically” for more information.

E-mail Communications: To help us make e-mails more relevant and interesting, we often receive a confirmation (if your device supports such capabilities) when you open e-mail from us or click on a link in the e-mail. You can choose not to receive marketing emails from us by clicking on the unsubscribe link in any marketing email.

Automatic Information We Collect from Other Websites: We receive and store certain types of information when you interact with third-party websites that use our technology or with whom we have a specific agreement. Because we process this information on behalf of the applicable website operators, collection, processing, and use of such information is subject to the applicable website operators’ privacy policies and is not covered by our Privacy Policy.

Information from Other Sources: We may obtain information from other sources. An example of this is when you authorize a third-party website (such as the website of another Tata Group Entity), to interact directly with our website or mobile application to provide or receive Data about you.

Information Previously Provided to Tata Group Entities: Where you have shared any information previously with any of the Tata Group Entities and have consented to the further sharing of such information, such information will be shared with us by the Tata Group Entities.
You can make choices about our collection and use of your Data. For example, you may want to access, edit or remove your Data on our website or mobile application. When you are asked to provide Data, you may decline, however, in such a case, you may not be able to avail benefit of some of our products, programmes or services or access our stores or physical premises.

4. DATA SHARED BY YOU

bigbasket may collect your Data in several ways. For instance:

when you register with us to apply for a position with us to provide your services;

when you complete surveys conducted by or for us;

when you elect to receive any communications from us;

from the systemic information gathered by your visit to our physical stores, or Platform or

by way of correlation or inferences from information sourced from sources, such as manpower sourcing agents/entities, third party recruiters and other service providers that collector process your Data based on your consent.

5. DATA THAT IS COLLECTED AUTOMATICALLY

We automatically collect some information when you visit our website or use our mobile application. This information helps us to make improvements to our content and navigation. The information collected automatically includes your IP address.

Our web servers or affiliates who provide analytics and performance enhancement services collect IP addresses, operating system details, browsing details, device details and language settings. This information is aggregated to measure the number of visits, average time spent on the site, pages viewed and similar information.

We may collect your Data automatically via Cookies, pixels and similar technologies in line with settings on your browser. For more information about Cookies, please see the section below, titled “Cookies”.

6. OUR USE OF DATA

Any or all the above Data may be required by us from time to time to provide information relating to bigbasket and to work on the experience when using our website or mobile application. Specifically, Data may be used by us for the following reasons:

carry out our obligations arising from any contract entered into between you and us;

provide (including customizing and improving) products and/or services and communicate with you about products and/or services offered by us or any of our third party service providers;

enable payouts, billing and invoicing related purposes;

enable Tata Group Entities, and Partners to offer their products and/or services and communicate with you about such products and/or services;

enable our customers to view your name, location and service history while providing delivery services and to track the progress of delivery or status of the order placed by our customers;

processing, disclosing, transmitting, and/or sharing the Data with Tata Group Entities, and other third parties which have business or contractual dealings with us for any legitimate purpose/use and in terms of this Privacy Policy;

provide you with personalized recommendations and improve your experience on our Platform;

operate, evaluate and improve our business (including for administration and management related purposes), and Platform;

generate aggregated Data to prepare insights to enable us to understand trends with a view to learning more about your preferences or other characteristics;

provide privileges and benefits to you, based on your profile;

communicate with you through phone calls, SMS, WhatsApp, email, app notifications, or any other mode of communication on the contact details provided by you (including to respond to your requests, questions, feedback, claims or disputes), to customize and improve our services or for transactional and account-related updates, onboarding, training, operational and support-related information, compliance, audit, and other regulatory communications, and promotional messages and newsletters.;

enforce the terms of use of our Platform;

protect against and prevent fraud, illegal activity, harm, financial loss and other legal or information security risks; and

serve other purposes for which we provide specific notice at the time of collection, and as otherwise authorized or required by applicable law. We treat these inferences as Personal Data where required under applicable law. Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your Personal Data. Where required under applicable law, we will only use your Personal Data with your consent; as necessary to provide you with products and/or services; or for such other purpose as is permissible under applicable law We may make broader use of anonymized Data from which individuals cannot be identified.

7. MINORS

Our Platform is not intended for use by minors. If you are under 18, you may use our Platform only with express consent of a parent or guardian. In the event that we learn that we have received the Personal Data from a minor without verification of parental consent, we will delete that information at the earliest. If you believe that you may have provided us with such information, please contact the Grievance Officer.

8. SHARING OF DATA

We may share your Data with/ for:

Partners: We may make available to you such services, products, or applications provided by our Partners for use on or through our website or mobile application. If you choose to use such service, your information related to those transactions may be shared with such Partner. Such Partners will be required to respect the security of your Data and to treat it in accordance with this privacy policy and applicable law

Tata Group Entities: We may make available to you products, services and /or applications of Tata Group Entities, to assist them to reach out to you in relation to their programs or campaigns and to process your queries and requests. Accordingly, we may share your Data with Tata Group Entities. We may also share your Data with the Tata Group Entities as is relevant for the purposes set out in Clause 7 above, and to facilitate the operation of our business.

Tata Consumer Platform: Your Data may be shared with Tata Group Entities and other participating entities on the Tata Consumer Platform operated by Tata Digital Limited (“TDL”) for purposes of enrolment, offering you products, services and benefits on the TDL. Accordingly, we may share your Data with other Tata Group Entities, Partners and Service Providers.

Service Providers: We or other Tata Group Entities may share your Data with third-party service providers. Examples include storing and analyzing Data, protecting and securing our systems, providing search results and links, providing customer service, credit analysis, processing your information for profiling, user analysis and payment processing. These Service Providers will be required to only process Data in accordance with express instructions and as necessary to perform services for purposes set forth in this Privacy Policy. The Service Providers will also be required to safeguard the security and confidentiality of the Data they process by implementing appropriate technical and organizational security measures and confidentiality obligations binding employees accessing Data.

When bigbasket acts as a Service Provider: We may process and share your Data with Tata Group Entities and Partners when we act as a service provider to such Tata Group Entities and Partners.

Protecting bigbasket: We may release Data when we such a release is appropriate to comply with applicable law or legal process, enforce or apply the Terms of Use of our website or mobile application and other agreements, protect bigbasket against harm or financial loss, when we believe disclosure is necessary to protect individuals’ vital interests, or in connection with an investigation of suspected or actual fraudulent or illegal activity. This may include exchanging information with other companies and organizations for fraud protection, risk management and dispute resolution. This does not include selling or otherwise disclosing personally identifiable information from users for commercial purposes in violation of this Privacy Policy.

Business Transfers: As we continue to develop our business, we might sell or buy subsidiaries or business units. Your Data (including in relation to loyalty programs) may be transferred as part of such transaction or in the course of exploratory activities related thereto, including due diligence and audit exercises. The relevant transferee may thereafter make use of Data in accordance with then applicable Law.

Third Parties: We may also share your Data with other third parties where:

You request or authorize us to do so;

We need to comply with applicable law or respond to valid legal process; or

We need to operate and maintain the security of our website or mobile application, including to prevent or stop an attack on our computer systems or networks.

• With Other Users: If you are a delivery partner, we may share your name, phone number and/or profile picture (if applicable), tracking details with other users to provide them the Services.
• For Crime Prevention or Investigation: We may share this information with governmental agencies or other companies assisting us, when we are:
• Obligated under the applicable laws or in good faith to respond to court orders and processes; or
• Detecting and preventing against actual or potential occurrence of identity theft, fraud, abuse of Services and other illegal acts;
• Under a duty to disclose or share your personal Data in order to enforce our Terms of Use and other agreements, policies or to protect the rights, property, or safety of the Company, our customers, or others, or in the event of a claim or dispute relating to your use of our Services. This includes exchanging information with other companies and organisations for the purposes of fraud detection and credit risk reduction.

We require these third parties by contract to only process Personal Data in accordance with our instructions and as necessary to perform services on our behalf or in compliance with applicable law. We also require them to safeguard the security and confidentiality of the Personal Data they process on our behalf by implementing appropriate confidentiality, technical and organizational security measures.
Please note that Tata Group Entities and Partners may have privacy practices that differ from those of bigbasket. The use of your Data will be governed by their privacy statements when you provide Data on their websites.

9. KEEPING DATA SECURE

We will use technical and organisational measures to safeguard your Data and we store your Data on secure servers. Technical and organisational measures include measures to deal with any suspected Data breach. If you suspect any misuse or loss or unauthorised access to your Data, please let us know immediately by contacting us by e-mail.

10. RETENTION OF DATA

bigbasket retains Data for as long as necessary for the use of our products and/or services or to provide access to and use of our Platform, or for reasonable purposes such as complying with our legal obligations, resolving disputes, enforcing our agreements or as otherwise stated in this Privacy Policy, and for such periods or purposes as are permitted under applicable law. Because these needs can vary for different Data types and purposes, actual retention periods can vary significantly.
Even if we delete your Data, including on account of exercise of your right under Clause 12 below, it may, subject to applicable law, persist on backup or archival media for audit, legal, tax or regulatory purposes.

11. YOUR RIGHTS AND CHOICES

When we process Data about you, we do so with your consent and/or as necessary to operate our business, meet our contractual and legal obligations, protect the security of our systems and our customers, or fulfil other legitimate interests of bigbasket as described in this Privacy Policy.

We may transfer the Data we collect from you to recipients in India, where we are headquartered. India may not have the same Data Protection Laws as the country in which you initially provided the information. When we transfer your Data to India, we will protect that information as described in this Privacy Policy, as disclosed to you at the time of Data collection or as described in any of our program-specific privacy policies.

Depending on which Data Protection Laws are applicable to you, you may have the right or choice to:

opt out of some collection or uses of your Data, including the use of cookies, pixels and similar technologies and the use of your Data for marketing purposes.

access your Data, rectify it, restrict or object to its processing, or request its deletion or anonymization.

change or edit information submitted to us.

receive the Data you provided to us to transmit it to another company.

withdraw any consent provided or alter your preferences.

where applicable, lodge a complaint with your supervisory authority.

You may submit a request as described in the “How to Contact Us” section below. We will not charge you for any request. Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why.

It is important that the Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during the period for which we hold it.

12. WHERE WE STORE DATA

Data collected under this Privacy Policy is hosted on servers located in India. Subject to applicable law, we may at our sole discretion, transfer Data, including Personal Data to any other third party that agrees to ensure the same level of Data protection as is provided by us under the terms hereof, located outside India. You hereby consent to the storage and processing of Data, including Personal Data in locations outside India.

13. PROCESSING YOUR DATA

We take steps to ensure that the Data we collect under this Privacy Policy is processed according to the provisions of this Privacy Policy and the requirements of applicable law.
To ensure that your Data receives an adequate level of protection, we have put in place appropriate written contracts with Tata Group Entities, Partners and Service Providers that we share your Data with. This ensures your Data is treated by such parties in a way that is consistent with applicable law.

14. SECURITY

While bigbasket takes every standard measure to protect against unauthorized access to and unlawful interception of Data, no internet site can fully eliminate security risks. It is bigbasket’s continuous endeavor to implement all necessary measures to protect the security, integrity and confidentiality of the Data against unauthorized breach and hacking. For the purpose of checking possible vulnerabilities and attacks, bigbasket may conduct periodical internal review of Data and security measures..

If you are provided with any identification code, password or any other piece of information as part of the security procedure adopted by us, you should treat such information as confidential and not disclose it to any third party including to other users. You are solely responsible for the activities that occur under your account including the confidentiality of your password and bigbasket is not responsible for the same.

Notwithstanding anything contained in this Policy or elsewhere, bigbasket shall not be held responsible for any loss, damage or misuse of the Data, if such loss, damage or misuse is attributable to a Force Majeure Event. A "Force Majeure Event" means any event that is beyond the reasonable control of bigbasket and includes, without limitation, fire, flood, explosion, acts of God, civil commotion, strikes, lock outs or industrial action of any kind, riots, insurrection, war, acts of government, power failure, sabotage, computer hacking, unauthorised access to computer Data and storage device, system failure, virus, attacks, bugs, computer crashes, breach of security and encryption.

15. SEVERABILITY

If any court or competent authority finds that any provision of this Privacy Policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Privacy Policy will not be affected.

16. CHANGES TO THIS PRIVACY Policy

Our business changes constantly and our Privacy Policy will also undergo changes from time to time. We may notify you of any updates to our Privacy Policy through emails or such other modes of communication, unless you have instructed us not to, but you are advised and encouraged to check our Platform frequently to stay abreast of any recent changes to our Privacy Policy. The updated version of the Privacy Policy will be effective against you as soon as it is accessed by you. Any changes posted on our Platform will be notified to you in the manner described above and you shall be deemed to have accepted the terms of the updated Privacy Policy based on your continued use of our Platform following the alterations.

17. HOW TO CONTACT US

To request to manage, review, update, or delete your Data or to otherwise reach us for more information, please submit a request by e-mailing us at grievanceofficer@bigbasket.com.

18. GRIEVANCE REDRESSAL

For information about management of your Data please reach out to us at

Email:grievanceofficer@bigbasket.com

Address: Ranka Junction, No. 224 (old Sy No.80/3), 4th Floor, Vijinapura, Old Madras Road, K R Puram, Bangalore - 560016, India