Privacy Policy
We believe in honest food and honest business. Here's exactly how we handle your data — plainly, with no fine print.
1. Who we are
Back To Source is an organic café, restaurant and bakery with three outlets across Chandigarh and Mohali, India. We also sell cookies and biscotti online through back2source.in (the "Store"), which runs on Shopify Inc.
This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our Store or place an order with us. It applies to all visitors, customers and anyone else who interacts with our Store.
2. What personal data we collect
When you place an order:
- Full name
- Delivery address
- Email address
- Phone number
- Order details (products, quantities, amounts)
When you visit our Store:
- Browser type and version
- Device type and operating system
- Pages visited and time spent on each page
- Referring website or search term
- IP address
- Cookie identifiers (see Section 7)
If you create a customer account: we additionally store your order history and saved addresses. Passwords are stored in encrypted form — we never see them in plain text.
We do not collect payment card numbers or bank details. All payment processing is handled directly by Razorpay (see Section 5).
3. Why we collect it
| Data | Purpose | Legal basis |
|---|---|---|
| Name, address, phone, email | Process and deliver your order; send order confirmation and shipping updates | Contract fulfilment |
| Customer support; respond to queries | Legitimate interest | |
| Email (with consent) | Marketing messages, if you opt in | Your consent — withdraw any time |
| Browsing and device data | Understand how visitors use the Store; improve performance | Legitimate interest |
| IP address | Security and fraud prevention | Legitimate interest |
We do not use your data for automated decision-making or profiling.
4. How long we keep your data
- Order records — 7 years, as required under Indian accounting and GST regulations.
- Customer account data — for as long as your account is active, plus 2 years after your last order or account deletion request.
- Analytics data — up to 14 months, as configured in Google Analytics 4.
- Marketing consent records — until you withdraw consent, plus 1 year thereafter.
When data is no longer needed, it is deleted or anonymised.
5. Third parties we share data with
We share data only where necessary. We do not sell your personal data.
| Partner | What is shared | Why |
|---|---|---|
| Shopify Inc. | Order and account data | E-commerce platform. Shopify is PCI DSS Level 1 certified. Privacy policy → |
| Razorpay Software Pvt. Ltd. | Payment transaction data | Payment processing. Razorpay does not share card or bank details with us. Privacy policy → |
| Shiprocket / courier partners | Name, phone, delivery address | Order fulfilment and delivery |
| Google LLC (Google Analytics 4) | Pseudonymised browsing data via cookies | Website analytics. Privacy policy → |
We may disclose your data if required by law, court order, or a lawful government request in India.
6. How we protect your data
- Our Store runs over HTTPS — all data in transit is encrypted.
- Shopify's infrastructure is ISO 27001 certified and PCI DSS compliant.
- Access to order data within our team is restricted on a need-to-know basis.
- We never store payment card details on our own systems.
No method of transmission over the internet is 100% secure. If you suspect any unauthorised access to your data, please contact us immediately at welcome@back2source.in.
7. Cookies
| Cookie type | Purpose | Can you opt out? |
|---|---|---|
| Strictly necessary | Cart, session, checkout — the Store cannot function without these | No |
| Analytics | Google Analytics 4 — understand how the Store is used | Yes — see below |
| Preferences | Remember your currency or language preference | Yes |
| Marketing | Only placed if you opt in to marketing emails | Yes |
To manage cookies, use your browser's settings or install the Google Analytics Opt-out Browser Add-on.
We do not serve third-party advertising cookies.
8. Your rights under the DPDP Act 2023
Under India's Digital Personal Data Protection Act, 2023, you have the right to:
- Access — know what personal data we hold about you
- Correction — ask us to correct inaccurate or incomplete data
- Erasure — ask us to delete your personal data, where we are not legally required to retain it
- Grievance redressal — raise a complaint with our Grievance Officer (see Section 10)
- Nominate — nominate another person to exercise rights on your behalf in the event of your death or incapacity
To exercise any of these rights, email welcome@back2source.in with subject line "Data Request". We will respond within 30 days.
9. Children's data
Our Store is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
10. Grievance Officer
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you may raise a grievance with:
Grievance Officer — Back To Source
Email: welcome@back2source.in
Address: SCO 10-11-12, First Floor, Sector 17A, Chandigarh 160017, India
We will acknowledge your grievance within 48 hours and resolve it within 30 days.
11. Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes, we will notify you by email (if you have an account) or by a notice on the Store.
Continued use of the Store after a change takes effect means you accept the updated policy.
12. Contact us
For any privacy-related questions, write to us at welcome@back2source.in or visit any of our outlets:
- Sector 17A, Chandigarh — SCO 10-11-12, First Floor, Sector 17A, Chandigarh 160017, opposite Taj Chandigarh
- Sector 22, Chandigarh — Chandigarh
- Sector 66, Mohali — SCO 1-2, First Floor, Jubilee Junction, Airport Road, SAS Nagar (Mohali), Punjab 160071 · +91 90560 24801