Legal

Privacy Policy

Effective date: 27 July 2026
Last updated: 27 July 2026

This Privacy Policy explains what personal data we collect when you use bcasu.com, why we collect it, who we share it with, how long we keep it, and the rights you have over it under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

We have tried to write it in plain language. If anything is unclear, email info@bcasu.com and we will explain it.

1. At a glance

This summary is for convenience only. The sections below govern.

2. Who we are

For the purposes of the Digital Personal Data Protection Act, 2023, the Data Fiduciary is:

3. Definitions

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Data Principal" means you, the individual the Personal Data relates to.
• "Data Fiduciary" means the person who decides why and how Personal Data is processed — here, us.
• "Data Processor" means a person who processes Personal Data on our behalf, such as a courier or payment gateway.
• "Processing" means any operation on Personal Data, including collection, storage, use, sharing and erasure.
• "the Act" means the Digital Personal Data Protection Act, 2023, and "the Rules" means the Digital Personal Data Protection Rules, 2025.

4. Scope and your consent

This Policy applies to Personal Data we collect through the Website, our order and subscription process, customer support, and our communications with you.

Where we rely on your consent, we ask for it by clear affirmative action. We do not use pre-ticked boxes, and we do not treat silence or inactivity as consent. You can withdraw consent at any time, as described in section 13.

We ask only for data we actually need. Declining to give us data that is necessary to fulfil an order means we cannot process that order, but it does not stop you browsing the Website.

5. Personal data we collect

Data you give us

• Name, email address and phone number.
• Delivery and billing address, including pin code.
• Order and subscription history, and any preferences you set.
• Messages you send us, including complaint and return correspondence.
• Reviews, ratings and any content you post.
• Marketing preferences.

Data we collect automatically

• IP address, approximate location derived from it, device type, operating system and browser.
• Pages viewed, referring page, and how you move through the Website.
• Cookie identifiers, as described in section 8.

Data we receive from others

• Payment status and a masked reference from our payment gateway.
• Delivery status and delivery confirmation from our courier partners.

6. How we collect it

Directly from you when you place an order, create an account, subscribe, write to us or post a review. Automatically through cookies and server logs when you browse. And from our payment and logistics partners when they report back on a transaction or a delivery.

7. Why we process it, and our lawful basis

We process Personal Data for the following purposes:

• To fulfil your order — taking payment, packing, dispatching, delivering, and handling returns and refunds.
• To support you — answering questions, tracing parcels, resolving complaints.
• To operate subscriptions — scheduling and taking payment for recurring orders.
• To meet legal obligations — tax and GST records, company law record-keeping, food-safety traceability, and responding to lawful requests from authorities.
• To keep the Website safe — detecting fraud, abuse of promotions, and security incidents.
• To improve what we do — understanding, in aggregate, how the Website is used.
• To send marketing, where you have asked for it. See section 15.

Our lawful basis is your consent, or one of the legitimate uses permitted by section 7 of the Act, including where you have voluntarily given us data for a specified purpose and have not indicated that you object, and where processing is necessary to comply with a legal obligation.

8. Cookies and tracking

Cookies are small files stored by your browser. We use:

• Strictly necessary cookies, which make the cart, checkout and login work. The Website cannot function without these.
• Analytics cookies, which tell us in aggregate how the Website is used.
• Marketing cookies, where you have agreed to them, used to measure and target advertising.

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will break checkout. We do not use tracking or behavioural advertising cookies directed at children.

9. How we share and disclose data

We share Personal Data only with those who need it, and only for the purposes in section 7:

• Courier and logistics partners, to deliver your order and to run a return pickup.
• Payment gateways, to take and refund payment.
• Technology providers who host the Website, send our transactional email, and provide analytics.
• Professional advisers such as accountants and lawyers, where necessary.
• Authorities, where we are required by law to disclose, or where disclosure is necessary to establish or defend a legal claim.
• An acquirer, if our business or part of it is sold or reorganised. We will tell you if that happens and this Policy continues to apply until replaced.

Our processors act on our instructions under contract. They may not use your data for their own purposes.

10. Data retention and erasure

We keep Personal Data only for as long as the purpose it was collected for requires, and then erase it, unless a law requires us to keep it longer.

In practice that means:

• Order, invoice and payment records are retained for the periods required under GST and company law — generally up to eight financial years.
• Complaint, return and food-safety records are retained for as long as needed for traceability and to defend a claim.
• Account and marketing data is erased when you close your account or withdraw consent, subject to the record-keeping above.
• Server logs and analytics data are kept for a short period and then deleted or aggregated so they no longer identify you.

When the purpose is served and no legal requirement applies, we erase the data, and ask our processors to do the same.

11. Data security

We use reasonable security safeguards to protect Personal Data, including encryption of the Website in transit, access controls so that staff see only what their role requires, and contractual security obligations on our processors.

No system is perfectly secure, and we do not claim otherwise. If something does go wrong, section 16 explains what we will do.

12. Your rights as a Data Principal

Under the Act you have the right to:

• Access a summary of the Personal Data we hold about you and how we process it, and the identities of the parties we have shared it with.
• Correct, complete or update inaccurate or incomplete data.
• Erase your Personal Data, unless retention is required for a legal purpose.
• Nominate another individual to exercise your rights if you die or become incapacitated.
• Grievance redressal, as described in section 20.

How to exercise them

Email info@bcasu.com with the words "Data Request" in the subject line, and tell us which right you wish to exercise. So that we can find your records, please include the email address or phone number you used to place your orders. We may ask a further question to confirm it is really you before we act.

We will respond within 90 days, as the Rules require, and in practice usually much sooner. We do not charge for this.

13. Withdrawing your consent

You can withdraw consent at any time, and it is as easy to withdraw as it was to give. Use the unsubscribe link in any marketing email, change the preference in your account, or simply email info@bcasu.com.

Withdrawal takes effect going forward. It does not make unlawful anything we did while the consent was in force, and it does not affect processing we are required to carry out by law, such as keeping an invoice.

14. Children's personal data

The Website is intended for adults. We do not knowingly collect Personal Data from anyone under 18 without the verifiable consent of a parent or lawful guardian, as the Act requires.

We do not undertake tracking or behavioural monitoring of children, and we do not direct advertising at children.

If you believe a child has given us Personal Data, contact us and we will delete it.

15. Marketing communications

We send marketing only where you have asked for it. Every marketing message carries a one-click unsubscribe, and we act on it promptly.

Transactional messages are different: order confirmations, dispatch and tracking notices, delivery updates and refund confirmations are part of fulfilling your order, and you will continue to receive them while an order is live even if you have unsubscribed from marketing.

16. Personal data breaches

If a Personal Data breach occurs, we will:

• notify each affected Data Principal without delay, through the contact details we hold for you, describing the nature of the breach, its likely consequences, what we have done to mitigate it, what you can do to protect yourself, and who to contact;
• notify the Data Protection Board of India without delay, and provide a detailed report within 72 hours or such longer period as the Board allows.

17. Third-party links and services

The Website links to third-party sites and relies on third-party services. This Policy does not cover them. Read their privacy policies before giving them your data.

18. Data transfers

Some of our technology providers store or process data on servers outside India. Where that happens, we transfer Personal Data only in accordance with section 16 of the Act, and we do not transfer it to any country the Central Government has restricted.

We place contractual obligations on those providers to protect your data to the standard this Policy describes, wherever it is held.

19. Changes to this Policy

We may update this Policy. Where a change is significant we will tell you by email or by a notice on the Website before it takes effect. The "Last updated" date at the top of this page always reflects the current version.

20. Grievance redressal and contact

If you have a question or complaint about how we handle your Personal Data, contact our Grievance Officer:

We will respond within 90 days. If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India.

For complaints about an order rather than your data, our Terms & Conditions, Refund & Return Policy and Shipping Policy set out the route, and the National Consumer Helpline is available on 1915 (8 AM to 8 PM).