Daily Flowers Privacy Policy

Effective date: [EFFECTIVE DATE — TO BE CONFIRMED ON PUBLICATION] · Version: 1.0.0

This Privacy Policy explains how Daily Flowers India Pvt. Ltd. handles personal data when you visit the Daily Flowers website or app, create an account, place or receive an order, subscribe, contact us, or deal with us on behalf of a business. It is written to be read on its own, without needing any other document.

In short: we collect the information needed to take, prepare and deliver your orders and to support you; we share it only with those who help us do that; we send marketing only with your consent; we do not sell your personal data; and you can ask us at any time to see, correct or erase your data, withdraw consent, nominate someone to act for you, or complain.

Part 1 — About this Policy

1.1 Who is responsible for your data

Daily Flowers India Pvt. Ltd., a company incorporated under the Companies Act, 2013, having its registered office at [REGISTERED OFFICE ADDRESS] (CIN [CIN]) (Daily Flowers, we, us), decides why and how your personal data is processed on the Platform and is the Data Fiduciary for it. "Platform" means https://dailyflowersai.com and the Daily Flowers mobile applications.

Contact for any question about this Policy or your personal data:

1.2 Whose data this Policy covers

This Policy covers: (a) customers who browse, sign in or order; (b) gift recipients whose details a customer gives us; (c) visitors to the Platform; (d) people who contact our support team or send a business enquiry; and (e) contact persons of business customers. Independent sellers, franchise operators, delivery partners, suppliers and job applicants receive separate privacy notices with their agreements.

1.3 The law that applies

We process personal data in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which continue to apply until the relevant provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) take effect, and with the DPDP Act and the Digital Personal Data Protection Rules, 2025 (DPDP Rules) as their provisions come into force. The DPDP Rules were published on 13 November 2025; the provisions on Consent Managers apply from November 2026 and most other obligations from May 2027. We have written this Policy to the standard of the DPDP Act now, so that you have those rights and protections from today where we can practically provide them.

Part 2 — The personal data we process

We collect only what is needed for the purposes in Part 3. The items marked "required" are needed to provide the service; if you do not provide them, we cannot complete that service.

Sensitive information. We do not ask for information about health, sexual orientation, biometrics or other sensitive categories. Customers sign in with a one-time passcode, so we do not hold customer passwords. Where we need bank account details to pay a refund that cannot be returned to the original payment method, we collect them only with your consent and only for that refund.

Part 3 — Why we use your data, and on what basis

We use personal data only for the purposes below. Where we rely on your consent, you may withdraw it at any time (Part 4). Where you have voluntarily provided data for a specified purpose and not objected to its use, the DPDP Act permits us to use it for that purpose without separate consent (section 7(a)). Some processing is needed to comply with law or a lawful order, or to establish, exercise or defend legal claims or prevent and detect fraud and offences, as the DPDP Act permits.

Automated decisions. We use automated rules to detect suspected fraud or misuse (for example, too many passcode requests from one network). Any decision to close an account or refuse a refund because of such a flag is reviewed by a person, and you may ask us to explain it.

No sale of personal data. We do not sell or rent your personal data, and we do not share it with third parties for their own marketing.

Part 4 — Consent and how to withdraw it

When we ask for consent, we explain what it is for, ask you to give it by a clear action (such as ticking an unticked box), and record when and through which channel you gave it. Consent to marketing is never a condition of buying.

You can withdraw consent at any time, as easily as you gave it:

• in your account under communication preferences;
• by using the unsubscribe link in any marketing email or replying "STOP" to a marketing message where offered; or
• by writing to [PRIVACY EMAIL — TO BE CONFIRMED BY MANAGEMENT] or [email protected].

Withdrawal does not affect processing that took place before it, and does not stop the transactional messages and processing needed to complete orders you have already placed or to meet our legal duties. After withdrawal we stop the processing that relied on consent within a reasonable time, and ask our service providers to do the same.

Consent Managers. From the date the Consent Manager provisions of the DPDP Act apply, you may also give, manage, review and withdraw your consent to us through a Consent Manager registered with the Data Protection Board of India, once we are connected to one. We will publish the details here when that is available. [CONSENT MANAGER INTEGRATION — TO BE CONFIRMED BY MANAGEMENT]

Part 5 — Who we share your data with

We share personal data only with the categories of recipient below, only as much as each needs, and only for the purpose stated. Service providers who process data on our behalf (Data Processors) act on our instructions under written contracts that require reasonable security safeguards, confidentiality and deletion or return of data when the service ends.

On request, we will give you the names of the Data Fiduciaries and Data Processors with whom your personal data has been shared, and a description of what was shared (Part 11).

Part 6 — Gift recipients and children

6.1 Recipients

When you send a gift, you give us the recipient's name, mobile number and address. We use these only to prepare and deliver the gift, to send the recipient delivery updates and the delivery code, and to handle any delivery problem or complaint. We do not send marketing to a recipient unless the recipient separately becomes our customer and consents. A recipient may contact us at any time to ask what we hold about them, to correct it, or to ask us to erase it once the delivery and any related complaint or legal retention period have ended. By giving us a recipient's details you confirm that you are entitled to do so for the purpose of the delivery.

6.2 Children

Our Platform is meant for adults. We do not knowingly allow anyone under eighteen to create an account or place orders. If we need to process a child's personal data other than as a gift recipient, we will first obtain verifiable consent from a parent or lawful guardian in the manner the DPDP Rules require, by checking that the person giving consent is an identifiable adult through reliable identity and age details or an authorised virtual token. We do not track or monitor the behaviour of children, or direct targeted advertising at them. When a gift is addressed to a child, we use the child's name and delivery details only to deliver the gift. If you believe we hold a child's data without proper consent, please contact us and we will act promptly.

Part 7 — Cookies, local storage and analytics

We keep tracking to a minimum and do not use third-party advertising cookies or trackers.

If we introduce any non-essential cookie or tracker in future, we will ask for your consent before it is used and update this Policy.

Part 8 — How long we keep your data

We keep personal data only for as long as it is needed for the purpose for which it was collected, or for longer where the law requires. When that period ends, we erase the data or irreversibly de-identify it, and instruct our Data Processors to do the same.

If you do not use your account for the period after which we would otherwise erase your data, we will tell you at least forty-eight hours before erasure, so that you can sign in or contact us if you want us to keep it.

Part 9 — Where your data is stored and transferred

Our Platform and our main customer records are hosted in India. Some of our service providers — such as messaging, email, mapping and artificial-intelligence service providers — may process data on servers outside India. Where that happens, we transfer only the data the provider needs, under contracts that require protection at least equal to that required by Indian law, and we will not transfer personal data to any country or territory that the Central Government has restricted under section 16 of the DPDP Act, or in breach of any requirement specified under the DPDP Rules. Payment data is stored in India by our payment aggregator as required by the Reserve Bank of India.

Part 10 — How we protect your data

10.1 Security safeguards

We take reasonable security safeguards to prevent personal data breaches, including:

• encryption of data in transit and of stored secrets such as provider keys, and storing passcodes only in scrambled form;
• access controls based on job role, with additional confirmation for sensitive actions, and masking of personal data for staff who do not need to see it;
• logs of access to personal data, with monitoring and review to detect and investigate unauthorised access;
• limits on repeated sign-in and passcode requests to prevent account takeover and misuse;
• backups and recovery arrangements so that the service can continue if data is lost or unavailable;
• written security and confidentiality obligations on every Data Processor; and
• security reviews of new features before release.

We follow a documented information security programme that includes the managerial, technical, operational and physical controls required under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ([SECURITY STANDARD OR CERTIFICATION — TO BE CONFIRMED BY MANAGEMENT]). No system is completely secure, but we work continuously to keep your data safe.

10.2 If there is a personal data breach

If a personal data breach affects you, we will tell you without delay, in clear language, through your account or the contact details you have registered with us: what happened and when, the likely consequences for you, what we have done and are doing to reduce the risk, what you can do to protect yourself, and whom to contact. We will also report the breach to the Data Protection Board of India without delay and give it a detailed report within seventy-two hours of becoming aware of it (or any longer period the Board allows), and report cyber incidents to CERT-In within the time its directions require.

Part 11 — Your rights

11.1 Rights you have

11.2 How to exercise your rights

Send your request through [ACCOUNT PRIVACY SETTINGS / REQUEST FORM — TO BE CONFIRMED BY MANAGEMENT] or by email to [PRIVACY EMAIL — TO BE CONFIRMED BY MANAGEMENT] (or [email protected]), from or quoting your registered mobile number and, where relevant, your order number. To protect you, we will verify your identity — usually by a one-time passcode sent to your registered mobile number — before acting. A nominee must provide proof of identity, the nomination and, where applicable, proof of death or incapacity. To register a nominee, use [NOMINATION FORM — TO BE CONFIRMED BY MANAGEMENT].

We do not charge for handling a request. We will acknowledge your request promptly and respond within one month of receipt and, in any case, within the period required by law (which, under the DPDP Rules, may not exceed ninety days). If we cannot fully meet a request, we will explain why and tell you how to escalate it.

11.3 Your duties

The DPDP Act asks you, when exercising these rights, to comply with applicable law, not to impersonate anyone, not to suppress material information, not to file false or frivolous complaints, and to give only verifiably authentic information when asking for correction or erasure.

Part 12 — Grievance Officer and complaints

If you have a concern about how we handle your personal data, contact our Grievance Officer:

We will acknowledge your grievance within forty-eight hours and resolve it within one month of receipt. If you are not satisfied with our response, or we do not respond within the period required by law, you may complain to the Data Protection Board of India through its online portal ([DATA PROTECTION BOARD COMPLAINT PORTAL URL — TO BE CONFIRMED]). The DPDP Act requires you to use our grievance process first. Our Grievance Redressal Policy describes all complaint routes.

Part 13 — Marketing and your choices

We send marketing by SMS, WhatsApp, email or app notification only with your consent, and respect the preferences you register with your telecom provider. We do not treat an order placed by telephone or WhatsApp as consent to marketing unless you give that consent through an explicit written or digital action. You can change your choices at any time (Part 4).

Part 14 — Links and third-party services

The Platform may link to websites or services of others, such as a payment page, a courier's tracking page or a seller's website. Those services have their own privacy policies, and we are not responsible for how they handle your data once you leave the Platform. The payment page is operated by our payment aggregator under its own privacy policy.

Part 15 — Changes to this Policy

We will update this Policy when our processing or the law changes. We will publish each version, with its version number and effective date, in the Legal & Agreements Centre at https://dailyflowersai.com/legal and keep earlier versions available there. If a change is material — for example, a new purpose that needs your consent — we will tell you in advance and, where required, ask for your consent before the new processing begins.

Schedule 1 — Items to be confirmed by management before publication

Annexure — Legal basis and review notes

Statutes and rules relied on

Open review points

1. Commencement (legal requirement). Confirm dates; decide whether to keep Part 1.3's statement that DPDP-standard rights are offered before May 2027.
2. Lawful basis mapping (interpretive). Part 3 — each non-consent purpose must fit section 7 or section 17.
3. Recipient data (open question). Part 6.1.
4. Related-party processors (recommended protection). Part 5 — CFO/AROS services of SnxwFairies Innovations Pvt. Ltd.; written data processing agreement and instruction-only processing.
5. Cross-border transfers (business assumption to correct). Part 9 — correct the published "India-based infrastructure" statement.
6. Audit-trail retention (legal requirement). Part 8 — replace "kept indefinitely".
7. Significant Data Fiduciary (interpretive). Daily Flowers is not expected to be notified as a Significant Data Fiduciary or to fall within the Third Schedule e-commerce class (two crore or more registered users); re-assess as the user base grows.
8. Activity measurement (open question). Part 7 — IP address stored with first-party activity events; decide whether this rests on consent with an opt-out or on security grounds with a short retention period.
9. Verbal marketing consent (business decision). Part 13 reflects the recommendation in open decision OD-072 that marketing consent requires a digital or written opt-in; management to confirm.
10. PII export controls (business decision). OD-058 — internal policy on who may export customer data, to support the safeguards in Part 10.