Privacy Policy

This Privacy Policy explains how Tong Garden Food Products India Pvt. Ltd. ("Tong Garden", "we", "us") collects and uses your personal data when you use shop.tonggarden.co.in, our mobile pages, customer support and membership programme (the "Platform"). 

This Privacy Policy is a companion to, and should be read together with, our Terms and Conditions. Company registration details, the Grievance Officer’s contact information, and governing law/jurisdiction are set out in the Terms and Conditions and are not repeated here. 

We are the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). 

• Privacy contact: privacy@tonggarden.co.in 

Our registered office, CIN and GSTIN are published in our Terms and Conditions. 

1. LAWS WE FOLLOW 

We process personal data in line with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025; the Information Technology Act, 2000 and its rules; and the Consumer Protection (E-Commerce) Rules, 2020. This policy applies to personal data collected in digital form, or collected offline and later digitized. 

2. WHAT WE COLLECT AND WHY 

We collect only what we need for the purposes below. 

We do not collect more data than needed for these purposes and will ask for fresh consent before using your data for any new purpose. 

3. YOUR CONSENT 

We will process your personal data on the basis of your consent, given by a clear action such as ticking a box or tapping "I agree". Marketing communications and non-essential cookies have their own separate opt-ins, and you can use the Platform without agreeing to them. 

We may also process data without consent where the DPDP Act allows it (section 7). This includes data you share voluntarily for a purchase, complying with law or a court order, and responding to a medical emergency. 

You can withdraw consent at any time, as easily as you gave it, from My Account > Privacy settings or by writing to privacy@tonggarden.co.in. Withdrawal does not affect processing already done. If you withdraw consent needed for an order, we may be unable to complete it. 

4. WHO WE SHARE DATA WITH 

We do not sell your personal data. We share it only with: 

• Service providers (Data Processors) acting on our instructions under a written contract: payment gateways, courier and logistics partners, SMS/email/WhatsApp providers and analytics providers. 
• Government, courts and law enforcement, when required by Indian law. 

Each processor may use your data only to provide its service to us. 

5. COOKIES AND SIMILAR TECHNOLOGIES 

We use cookies to run the Platform. 

• Essential cookies keep you logged in and remember your cart. These are always on. 
• Analytics cookies help us understand how the Platform is used. These are on only with your consent. 

You can change your choice at any time through [Cookie settings] at the bottom of every page, or through your browser. 

6. HOW LONG WE KEEP YOUR DATA 

We keep personal data only while it is needed for its purpose, then erase it unless the law requires us to keep it. 

7. HOW WE PROTECT YOUR DATA 

We use reasonable security safeguards, including encryption in transit (HTTPS/TLS), encryption or masking of stored data where appropriate, role-based access controls, access logging and monitoring, and regular backups. Our processors must maintain equivalent safeguards. 

If a personal data breach occurs, we will inform affected users without delay, explaining what happened, the likely impact, what we are doing, and what you can do. We will also report the breach to the Data Protection Board of India as required by law. 

8. YOUR RIGHTS 

Under the DPDP Act you can: 

1. Access a summary of the personal data we hold about you and how we process it, and the identities of those we have shared it with. 
2. Correct, complete or update inaccurate or incomplete data. 
3. Erase your data when it is no longer needed, unless we must keep it by law. 
4. Withdraw consent at any time. 
5. Raise a grievance with our Grievance Officer. 
6. Nominate another person to exercise your rights if you die or become incapable. 

To use these rights, go to My Account > Privacy or email privacy@tonggarden.co.in. We may ask you to verify your identity. We will respond within 15 days at the latest, and aim to do so much sooner. You can also raise a grievance with the Grievance Officer named in our Terms and Conditions, and escalate to the Data Protection Board of India if you are not satisfied with our response. 

You also have duties under section 15 of the DPDP Act, such as not providing false information or filing frivolous complaints. 

9. CHILDREN 

We do not knowingly process the personal data of anyone under 18 without verifiable consent from a parent or legal guardian, and we do not use children’s data for tracking or targeted advertising. Who may use the Platform and place orders is set out in our Terms and Conditions. If you believe a child’s data reached us without such consent, contact us and we will delete it. 

10. DATA STORED OUTSIDE INDIA 

Some service providers may store or process data outside India. We transfer data only to countries not restricted by the Government of India under section 16 of the DPDP Act, and only with safeguards in our contracts. 

11. CHANGES TO THIS POLICY 

We may update this policy when our practices or the law change. We will post the new version here with a new "Last updated" date. For material changes, we will notify you by email or on the Platform and ask for fresh consent where required. 

12. CONTACT US 

For any complaint or question about your personal data, please contact us using the Grievance Officer and Customer Care details published in our Terms and Conditions.