Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how The Right Energy Private Limited, a company incorporated under the Companies Act, 2013, having its registered office in Indore, MP, India, the full registered address being available upon request (hereinafter referred to as "The Right Energy," "Company," "We," "Us," or "Our"), collects, uses, stores, processes, transfers, and protects the personal data of individuals ("You," "Your," "User," or "Data Principal") who access or use the website located at https://www.therightenergy.net (the "Platform") and the products and services offered through it (collectively, the "Services").

The Right Energy acts as the "Data Fiduciary" within the meaning of the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and is responsible for determining the purpose and means of processing Your personal data.

This Policy is published in accordance with the provisions of: (i) the Digital Personal Data Protection Act, 2023; (ii) the Information Technology Act, 2000 and the rules framed thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and (iii) the Consumer Protection (E-Commerce) Rules, 2020.

This Policy constitutes an electronic record under the Information Technology Act, 2000 and does not require any physical or digital signature. By accessing the Platform, providing Your personal data, or availing any of Our Services, You signify Your free, specific, informed, unconditional, and unambiguous consent, given through clear affirmative action, to the collection, storage, use, processing, and disclosure of Your personal data in accordance with this Policy. If You do not agree with any provision of this Policy, You must immediately discontinue access to and use of the Platform.

2. Applicability and Age Restriction

The Services offered on the Platform are intended solely for individuals who have attained eighteen (18) years of age and are competent to contract under the Indian Contract Act, 1872. We do not knowingly collect or process the personal data of children (defined under the DPDP Act as individuals below the age of eighteen years). By using the Platform, You represent and warrant that You are at least eighteen (18) years of age. If We become aware that We have inadvertently collected personal data from a child without verifiable parental consent, We shall promptly delete such data in accordance with Section 9 of the DPDP Act.

3. Definitions

For the purposes of this Policy, the following terms shall have the meanings ascribed to them below:

• "Data Fiduciary" means The Right Energy Private Limited, which alone or in conjunction with others determines the purpose and means of processing personal data.
• "Data Principal" means You, the natural person to whom the personal data relates.
• "Data Processor" means any person who processes personal data on Our behalf.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Processing" means a wholly or partly automated operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, use, disclosure, and erasure.
• "Sensitive Personal Data or Information" shall have the meaning ascribed to it under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

4. Categories of Personal Data We Collect

In the course of Your use of the Platform, We may collect the following categories of personal data:

4.1 Information You Provide Directly

• Identity and Contact Information: Full name, mobile number, email address.
• Address Information: Physical shipping address and billing address.
• Transaction Information: Order details, purchase history, products selected, and consultation bookings.
• Payment Information: Payment transaction reference details processed through our payment gateway. We do not store Your full credit card, debit card, UPI, or net banking credentials on Our servers.
• Communications: Information You provide when contacting Our customer support, submitting queries through embedded lead forms, or interacting with Us via WhatsApp Business API.
• Consultation Information: Information You voluntarily share during Vastu consultations, energy healing sessions, or crystal guidance services, whether conducted in-person, via video call, or via chat.

4.2 Information Collected Automatically

• Technical Data: Internet Protocol (IP) address, device identifiers, browser type and version, operating system, time zone setting, and access timestamps.
• Usage Data: Pages visited, time spent on pages, clickstream data, referring and exit URLs, and other browsing behaviour on the Platform.
• Cookies and Tracking Technologies: Information collected through cookies, web beacons, advertising pixels, and similar technologies, as further described in Section 9 below.

5. Methods of Data Collection

We collect Your personal data through the following methods:

• E-commerce checkout process on the Platform;
• Embedded lead forms, contact forms, and consultation booking forms on the Platform;
• Communications via email, WhatsApp Business API, and telephonic conversations;
• Google Analytics and similar website usage analytics tools;
• Advertising pixels deployed by Us or Our authorised advertising partners;
• In-person, video call, or chat-based consultation sessions.

6. Purposes of Processing

We process Your personal data only for specified, explicit, and lawful purposes ("Specified Purposes") for which You have provided Your consent. The Specified Purposes include:

• Order fulfillment, including processing, packaging, and confirming Your orders;
• Delivery logistics, including sharing Your shipping address with Our courier partners;
• Processing payments through Our authorised payment gateway;
• Providing consultation services (Vastu consultations, energy healing, crystal guidance) booked through the Platform;
• Customer support, including responding to queries, complaints, returns, and refund requests;
• Marketing and promotional communications, subject to Your separate consent, including newsletters, offers, and product recommendations;
• Website usage analytics to improve the Platform, Services, and user experience;
• Fraud prevention, security monitoring, and detection of unauthorised activity;
• Compliance with applicable Indian laws, including the Goods and Services Tax laws, the Income Tax Act, 1961, the Companies Act, 2013, and applicable consumer protection laws;
• Enforcement of Our Terms and Conditions and defence of legal claims.

We shall not process Your personal data for any purpose beyond the Specified Purposes without obtaining Your fresh consent.

7. Legal Basis for Processing

We process Your personal data on the basis of: (a) Your free, specific, informed, unconditional, and unambiguous consent obtained through clear affirmative action; and (b) where applicable, for certain legitimate uses recognised under Section 7 of the DPDP Act, including performance of any function under law, compliance with judicial orders, and responding to medical or public-order emergencies.

8. Disclosure and Sharing of Personal Data

We do not sell Your personal data. We share Your personal data only with the following categories of recipients, and only to the extent necessary to fulfill the Specified Purposes:

8.1 Data Processors and Service Providers

• Cloud Database and Hosting: Supabase, where Your personal data is stored on servers located in the ap-south-1 (Mumbai, India) region.
• Payment Gateway: Razorpay Software Private Limited, for processing online payments. Razorpay is a payment aggregator authorised by the Reserve Bank of India and is independently compliant with applicable data security standards, including the Payment Card Industry Data Security Standard (PCI-DSS).
• Logistics and Courier Partners: Delhivery Limited and Ekart Logistics, with whom We share Your name, shipping address, and contact number solely for delivery purposes.
• Customer Communication Tools: WhatsApp Business API (operated by Meta Platforms, Inc.), used for transactional and, where consented, promotional communications.
• Analytics Providers: Google Analytics, for collection of aggregated and individual usage statistics about the Platform.
• Advertising Partners: Authorised advertising platforms that deploy pixels on the Platform for measurement and remarketing, subject to Your cookie consent.

8.2 Legal and Regulatory Disclosures

We may disclose Your personal data when required to do so by law or in good-faith belief that such disclosure is reasonably necessary to: (i) comply with a legal obligation, court order, or government request; (ii) protect and defend the rights or property of The Right Energy; (iii) prevent or investigate possible wrongdoing in connection with the Services; (iv) protect the personal safety of users or the public; or (v) protect against legal liability.

8.3 Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, or insolvency, Your personal data may be transferred to the successor entity, subject to the protections of this Policy and applicable law.

9. Cookies and Tracking Technologies

The Platform uses cookies and similar tracking technologies, including Google Analytics and third-party advertising pixels, to enhance Your browsing experience, analyse Platform usage, and deliver relevant advertisements. On Your first visit, You will be presented with a cookie consent banner offering You the choice to accept all cookies, reject non-essential cookies, or customise Your preferences. Strictly necessary cookies, which are essential for the Platform to function, will be deployed without consent. All other cookies will be deployed only after You provide affirmative consent. You may withdraw or modify Your cookie consent at any time through the cookie preferences interface on the Platform or by adjusting Your browser settings.

10. Data Retention

We adhere to the principle of purpose limitation and retain Your personal data only for as long as is necessary to fulfill the Specified Purposes for which it was collected, or as required under applicable law. Specifically:

• Order and transaction records, including invoices, are retained for the period required under the Goods and Services Tax laws, the Income Tax Act, 1961, the Companies Act, 2013, and other applicable financial, accounting, and tax legislation (presently, a minimum of eight (8) years from the end of the relevant financial year);
• Customer support communications are retained for a reasonable period necessary to address any subsequent queries, returns, refunds, or disputes;
• Marketing data is retained until You withdraw Your consent to receive marketing communications;
• Analytics data is retained in aggregated or pseudonymised form for the period configured within the relevant analytics tool.

Upon expiry of the applicable retention period, or upon withdrawal of Your consent (subject to Our right to retain data for legal compliance), We shall erase Your personal data and require Our Data Processors to do the same, in accordance with Section 8(7) of the DPDP Act.

11. Rights of the Data Principal

Subject to the conditions set out under the DPDP Act, You, as a Data Principal, have the following rights:

11.1 Right to Information

You have the right to obtain from Us a summary of the personal data being processed, the processing activities undertaken, and the identities of all Data Fiduciaries and Data Processors with whom Your personal data has been shared.

11.2 Right to Correction, Completion, Updating, and Erasure

You have the right to request correction of inaccurate or misleading personal data, completion of incomplete personal data, updating of personal data, and erasure of personal data that is no longer necessary for the purpose for which it was processed, subject to applicable legal retention obligations.

11.3 Right of Grievance Redressal

You have the right to have readily available means of grievance redressal in respect of any act or omission by Us regarding the performance of Our obligations under the DPDP Act, as set out in Section 14 below.

11.4 Right to Nominate

You have the right to nominate any other individual who shall, in the event of Your death or incapacity, exercise Your rights under the DPDP Act.

11.5 Right to Withdraw Consent

You have the right to withdraw Your consent at any time, with the ease comparable to the manner in which such consent was given. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal, and shall not affect Our obligation to retain Your personal data where required under applicable law.

12. Mechanism to Exercise Rights and Withdraw Consent

To exercise any of the rights set out in Section 11, including to withdraw Your consent, You may submit a written request to Our Grievance Officer at grievance@therightenergy.net, clearly stating: (i) Your full name and registered mobile number/email; (ii) the specific right You wish to exercise; and (iii) any supporting information necessary to verify Your identity. We shall acknowledge receipt of Your request within a reasonable period and respond substantively within the timelines prescribed under the DPDP Act and rules made thereunder. Where We are required to continue retaining certain personal data for compliance with legal obligations, We shall inform You of such retention and its basis.

13. Data Security

We have implemented reasonable security practices and procedures consistent with the Information Technology Act, 2000 and the DPDP Act to protect Your personal data against unauthorised access, alteration, disclosure, destruction, or loss. These measures include encryption of data in transit (TLS/SSL), access controls, role-based authentication, secure cloud hosting on Supabase (ap-south-1, Mumbai), and periodic security reviews.

However, no method of transmission over the Internet or method of electronic storage is one hundred percent secure. While We strive to use commercially acceptable means to protect Your personal data, We cannot guarantee its absolute security. In the event of a personal data breach, We shall notify the Data Protection Board of India and each affected Data Principal in the manner and within the timelines prescribed under the DPDP Act.

14. Grievance Redressal

In accordance with Section 8(9) of the DPDP Act and Rule 5(9) of the Consumer Protection (E-Commerce) Rules, 2020, We have appointed a Grievance Officer to address any complaints, grievances, or queries regarding the processing of Your personal data:

The Grievance Officer shall acknowledge each grievance within twenty-four (24) hours of receipt and shall endeavour to redress the grievance within fifteen (15) days, or such other period as may be prescribed under applicable law.

If You are not satisfied with the response provided by the Grievance Officer, You may approach the Data Protection Board of India in accordance with the procedure prescribed under the DPDP Act.

15. Third-Party Links

The Platform may contain links to third-party websites, plug-ins, or applications. Clicking on those links may allow third parties to collect or share data about You. We do not control these third-party websites and are not responsible for their privacy practices. We encourage You to read the privacy policy of every website You visit.

16. Cross-Border Data Transfers

Currently, We store Your personal data on Supabase servers located within India (ap-south-1, Mumbai region). Certain Data Processors, including Google Analytics, WhatsApp Business API, and advertising partners, may process data on servers located outside India. Such transfers shall be undertaken only in accordance with Section 16 of the DPDP Act and any notifications issued by the Central Government in this regard.

17. Changes to this Policy

We reserve the right to amend, modify, or update this Policy at any time. Any material changes shall be notified to You by posting the revised Policy on the Platform with an updated "Last Updated" date, and, where appropriate, by direct communication. Your continued use of the Platform after such notification shall constitute Your acceptance of the revised Policy.

18. Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India. Subject to the dispute resolution provisions of Our Terms and Conditions, the courts and tribunals at Indore, Madhya Pradesh shall have exclusive jurisdiction over any disputes arising out of or in connection with this Policy.

19. Contact Us

For any questions regarding this Policy or Our data processing practices, please contact Us at: