Privacy policy

 

This Privacy Policy (“Policy”) outlines how Ceres Foods Private Limited (hereinafter referred to as “Ceres Foods”), a company incorporated under the laws of India and the brand owner of “MOI SOI” (collectively referred to as “We”, “Us”, or “Our”), collects, uses, discloses, and protects the personal data of users (hereinafter referred to as “You”, “Your”) who access or use our website: www.moisoi.in (“Website”).

This Policy complies with the Digital Personal Data Protection (DPDP) Act, 2023, Information Technology (IT) Act, 2000, SPDI Rules, 2011, IT Rules, 2021, Consumer Protection (E-Commerce) Rules, 2020, and Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, along with applicable international laws such as the General Data Protection Regulation (GDPR) (collectively referred to as “Applicable Laws”).

This Policy complies with the Digital Personal Data Protection (DPDP) Act, 2023, Information Technology (IT) Act, 2000, SPDI Rules, 2011, IT Rules, 2021, Consumer Protection (E-Commerce) Rules, 2020, and Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (collectively referred to as “Applicable Laws”).

1. Personal Information & Purpose Mapping

We collect only the personal data necessary to deliver our services. Below is a detailed breakdown of the categories of data collected and their corresponding purposes:

Category of Data Collected Specific Data Points Purpose of Collection & Processing
Identity & Contact Data Full name, email address, phone number, delivery address Account creation, order fulfillment, transactional communication, and identity verification.
Transaction & Financial Data Payment details (processed via PCI-DSS compliant third-party gateways), order history, billing information Processing payments, managing refunds, fraud prevention, accounting, and legal compliance.
Technical & Device Data IP address, browser type, device identifiers, approximate location Website optimization, platform security, IT management, and delivery route optimization.
Preference Data Dietary preferences or allergies (voluntarily provided), product reviews, saved items Personalizing user experience and catering to specific food requirements.
Marketing & Communication Data User communication preferences, marketing consent logs Delivering opt-in promotional communications, updates, and targeted offers.


1.1 Sensitive Data & Minors

Personal and sensitive data is processed strictly in accordance with Applicable Laws. We do not knowingly collect data from individuals below 18 years without verifiable parental or guardian consent.

2. Lawful Basis for Processing

Processing of your personal data is based on:

  • User Consent: Explicit consent provided at the time of data collection.

  • Performance of Contract: Necessary processing to fulfill orders, process payments, and complete deliveries.

  • Legal Obligations: Statutory retention requirements for tax, accounting, and regulatory compliance.

  • Legitimate Uses: As specified under Section 7 of the DPDP Act, 2023 (e.g., fraud prevention, network and cybersecurity).

3. Disclosure of Personal Information

We do not sell or rent personal data. Data may be shared with:

  • Service Providers: Payment processors, logistics/delivery partners, IT infrastructure support, and analytics providers (strictly on a need-to-know basis and subject to strict confidentiality agreements).

  • Legal Authorities: Courts, law enforcement, regulators, or statutory bodies when required by law.

  • Business Transfers: In connection with any merger, acquisition, or sale of company assets, subject to standard data protection safeguards.

Cross-Border Transfers

Where personal data is transferred outside India, it is conducted strictly in compliance with the DPDP Act, 2023 and applicable legal safeguards.

4. Data Security and Retention

4.1 Security Measures

We implement standard technical and organizational security protocols including:

  • End-to-end encryption for transactional data

  • Network firewalls and threat management

  • Role-based access controls

  • Periodic security audits

4.2 Data Retention

Personal data is retained only as long as necessary to fulfill the purpose for which it was collected or as required by applicable tax, accounting, and legal statutes, after which it is securely deleted or anonymized.

4.3 Data Breach Protocol

In the event of a personal data breach, affected users and the Data Protection Board of India will be notified within the timelines prescribed under the DPDP Act, 2023, along with details of corrective measures taken.

5. Data Fiduciary

Under the DPDP Act, 2023, Ceres Foods Private Limited acts as the Data Fiduciary, determining the purpose and means of processing personal data.

6. Rights of Users

Subject to Applicable Laws, you hold the following rights regarding your personal data:

  • Right to Access: Request a summary of your personal data being processed.

  • Right to Correction & Erasure: Request correction of inaccurate data or deletion of unnecessary personal data.

  • Right to Withdraw Consent: Revoke previously granted consent at any time.

  • Right to Grievance Redressal: Access readily available means to resolve concerns regarding data processing.

  • Right to Nominate: Nominate an individual to exercise your data protection rights in the event of death or incapacity.

📩 Contact: hello@moisoi.in
📞 Phone: +91 99304 90007

7. Cookies and Tracking Technologies

7.1 Usage

We use cookies and similar technologies for essential platform functionality, basic site performance analytics, and custom functionality.

7.2 User Control

You may disable non-essential cookies via your web browser settings or manage preferences using the cookie banner available on our Website.

8. Specific Consent Mechanism for Notifications & Marketing

We enforce a strict explicit consent mechanism for promotional and marketing communications:

  • Opt-In Mechanism: Marketing communications via Email, SMS, WhatsApp, or Push Notifications are only sent with your explicit, voluntary opt-in consent (e.g., un-ticked default checkboxes during signup or checkout).

  • Withdrawal / Opt-Out: You may withdraw your consent for marketing communications at any time by clicking the "Unsubscribe" link in any promotional email, replying "STOP" to SMS/WhatsApp messages, or updating your account settings.

  • Transactional Messages Exemption: Essential operational messages (order updates, delivery status, password resets) do not require marketing consent.

9. Children’s Privacy

We do not knowingly collect or process personal data of individuals under 18 years of age. Any such data discovered without valid parental consent will be deleted immediately.

10. Third-Party Services

Our Website may contain links to third-party platforms (e.g., payment gateways, social media integrations). We are not responsible for the privacy practices of these external sites and encourage you to review their policies independently.

11. User Responsibilities

Users agree to:

  • Provide accurate, complete, and updated information.

  • Maintain the security of their account credentials.

  • Refrain from impersonating others or providing false details.

12. Amendments

This Policy may be updated periodically to reflect changes in legal, regulatory, or operational requirements. Continued use of the Website after updates constitutes acceptance of the revised Policy.

13. Governing Law & Jurisdiction

This Policy is governed by and construed in accordance with the laws of India. Courts in Mumbai, Maharashtra shall have exclusive jurisdiction over any disputes arising under this Policy.

14. Grievance Redressal Mechanism

If you have any questions, concerns, or grievances regarding the processing of your personal data or this Policy, you may contact our designated Grievance Officer.

Grievance Redressal Procedure

  1. Submit your grievance in writing via email or post detailing the nature of the issue and your contact details.

  2. We will acknowledge receipt of your complaint within 48 hours.

  3. We endeavor to investigate and resolve all legitimate grievances within 15 days of receipt (or within the statutory timelines prescribed under Applicable Laws).

Grievance Officer / Data Protection Officer
📧 Email: hello@moisoi.in
📞 Phone: +91 99304 90007
📍 Address: Office No. 4A, 4th Floor, Clan House Plot No. 161A, Hemu Kalani Marg Sindhi Society, Chembur Mumbai – 400071

Last Updated: 21 July 2026