Privacy Policy

Policy: Privacy Policy
Supersedes: the previous Privacy Notice
Version: 2.0  |  Effective: 7 August 2026

This Privacy Policy explains what personal data Horekaa Technocon Private Limited (“Horeka”, “we”, “us”) collects when you use horeka.co, why we collect it, who we share it with, and the rights you have over it.

It is written to comply with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the SPDI Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020.

1. Who we are

Horeka is the Data Fiduciary for the personal data described here — we decide why and how it is processed.

2. What we collect

2.1 Data you give us

2.2 Data collected automatically

• Device and connection — IP address, device type, operating system, browser, screen size, language;
• Usage — pages viewed, searches, products viewed, cart activity, clicks, time on page, referring URL;
• Approximate location — derived from IP address or pin code, to determine serviceability;
• Precise location — only if you grant device permission, to suggest a delivery address;
• Cookies and similar technologies — see our Cookie Policy;
• Session recording and heatmaps — we use Hotjar to understand how the site is used. Recordings are pseudonymised and text you enter into form fields is masked.

2.3 Data from third parties

This corrects our previous notice, which stated we collect no data from third parties. We do, as follows:

• Payment aggregators — Razorpay, Cashfree and PhonePe confirm transaction success or failure and return a reference;
• Logistics partners — delivery status, timestamps, proof of delivery and rider notes;
• WhatsApp Business via MyOperator — where you message us, your WhatsApp number, message content and any images you send;
• Analytics and advertising — Google Analytics and Google Ads provide aggregated and pseudonymous measurement data;
• Sellers — order fulfilment status and any complaint correspondence.

2.4 Sensitive personal data

We do not seek sensitive personal data. However, note that financial information and passwords are classified as sensitive personal data under the SPDI Rules, 2011. We handle these with corresponding safeguards: passwords are stored only as salted hashes, and full payment credentials are never stored by us at all.

2.5 Children

Our services are not directed at children under 18, and we do not knowingly collect their data. As required by Section 9 of the DPDP Act, we do not carry out behavioural tracking or targeted advertising directed at children. If you believe a child has given us data, contact [email protected] and we will delete it.

3. Why we process your data, and on what basis

Under the DPDP Act we process personal data either with your consent or for certain legitimate uses permitted by Section 7.

Withdrawing consent is as easy as giving it. Use the settings in your account, the unsubscribe link in any marketing message, or email [email protected]. Withdrawal does not affect processing already carried out, and we may still need to process data to complete an order in progress or to meet a legal obligation.

4. Who we share your data with

We do not sell your personal data. Ever.

Every processor is bound by contract to process data only on our instructions, apply reasonable security safeguards, and delete or return it when no longer needed.

5. Cross-border transfer

Your data is stored primarily in India. Some of our processors — analytics, communications and cloud infrastructure — may process data outside India. Where they do, we transfer only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and we impose contractual safeguards. Payment data is processed in India in accordance with RBI’s data localisation directions.

6. How long we keep it

As required by Section 8(7) of the DPDP Act, we erase personal data once the purpose is served and retention is no longer required by law. Where erasure is not possible, we anonymise it irreversibly.

7. Your rights

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you, the processing activities undertaken, and the identities of those we have shared it with;
• Correction and completion — to have inaccurate or misleading data corrected and incomplete data completed;
• Erasure — to have your data erased where it is no longer needed for the purpose and no law requires us to keep it;
• Withdraw consent — at any time, as easily as it was given;
• Grievance redressal — a readily available means of raising a complaint with us;
• Nominate — to nominate another individual to exercise your rights in the event of your death or incapacity.

How to exercise them

Email [email protected] with the subject line PRIVACY — [your request], or use the privacy controls in your account. We will verify your identity — this protects you — and respond within 30 days. There is no charge. If we cannot fulfil a request, we will explain why and how to challenge that decision.

Under Section 15 of the DPDP Act you are required to provide authentic information and not to raise false or frivolous requests.

8. Security

We apply reasonable security safeguards as required by Section 8(5) of the DPDP Act, including: TLS encryption in transit; encryption at rest for sensitive fields; salted password hashing; role-based access control and least-privilege access; multi-factor authentication for administrative accounts; network and application firewalls with malware scanning; logging and monitoring of access to personal data; regular backups; and vendor due diligence.

No system is perfectly secure. In the event of a personal data breach we will notify the Data Protection Board of India and every affected individual, in the form and within the time the Act requires.

If you discover a security vulnerability, please report it responsibly to [email protected]. We will not pursue action against good-faith researchers who report privately and do not access or exfiltrate other users’ data.

9. Marketing

We send promotional messages by email, SMS and WhatsApp only where you have consented. Every message carries an opt-out, and you can change your preferences in your account at any time. Opting out of marketing does not stop transactional messages about your orders, which are necessary to deliver the service.

Our numbers are registered under the TRAI TCCCP Regulations, 2018, and commercial communications are sent through registered headers and consent-linked templates.

10. Automated processing

We use automated systems for fraud scoring, search ranking, recommendations and review moderation. These do not produce legal effects concerning you. Where an automated decision materially affects you — such as an order being declined for suspected fraud — you may request human review by contacting [email protected].

11. Third-party links

Our site links to seller storefronts, brand sites and payment pages operated by others. We are not responsible for their privacy practices. Please read their policies before providing data to them.

12. Changes to this policy

We update this policy as our practices or the law change. Material changes are notified by email or an in-app notice at least 7 days before they take effect. The version number and effective date at the top always reflect the current version, and previous versions are available on request.

13. Complaints

Contact [email protected] first — we will acknowledge within 48 hours and respond within 30 days. If unresolved, escalate to our Grievance Officer via Grievance Redressal.

As required by Section 13(3) of the DPDP Act, you must exhaust our internal process before approaching the Data Protection Board of India. You retain the right to do so thereafter.