1. Who we are
PVS Mango Bakers (“Mango Bakers”, “we”, “us”) runs this website, mangobakers.com, and our bakery outlets across Thrissur. Our head office is at PVS Building, BNC Corner, Punkunnam, Thrissur 680002, Kerala, India. We decide how your personal data is used, which makes us the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023.
This policy covers personal data we collect through this website and when you order or contact us by WhatsApp, phone or email. It should be read together with our Terms & Conditions.
2. Information we collect
Information you give us
- Orders and enquiries: your name, phone number, the items you want, the pickup outlet or delivery address, the date and time, and any notes, such as the message on a cake or allergy information you choose to share.
- Custom cake details: reference designs and photos you send us for edible prints, along with names, ages or messages for the cake.
- Contact form and messages: your name, phone number, topic and message, and your email address if you write to us.
- Offers sign-up: your email address if you subscribe to offers and new launches.
- Careers: your CV and the details in it if you apply for a job.
- Payments: for UPI or bank transfers we see the payer name and transaction reference. We do not collect or store card numbers, PINs or OTPs. Card and UPI payments are processed by the banks and payment apps involved.
Information collected automatically
- Technical data: when you visit the website, our hosting provider (Cloudflare) automatically processes your IP address, browser type, device information, the pages you request and the date and time, to deliver the site and protect it from abuse.
- We do not use advertising trackers, and we do not use analytics tools that build a profile of you.
3. How we use your information
- to confirm, prepare and hand over or deliver your order, and to contact you about it;
- to make custom cakes to your design and message;
- to reply to your enquiries, feedback and complaints;
- to send you offers and new launches, only if you have asked us to (you can stop them at any time);
- to consider your job application;
- to keep invoices and accounting records required by tax law;
- to keep the website secure, fix problems and prevent fraud or misuse;
- to meet legal obligations and respond to lawful requests from authorities.
We do not sell or rent your personal data to anyone.
4. Consent and legal basis
We process your personal data with your consent, which you give when you place an order, send us a message, subscribe or apply for a job, for the purpose you shared it for. We also process data where the law allows it without separate consent, for example to keep tax records, comply with the law, or respond to a medical emergency.
You can withdraw your consent at any time by contacting us (see section 13). Withdrawal doesn’t affect anything we did before, and we may still need to keep some records where the law requires it. If you withdraw consent for an order in progress, we may not be able to complete it.
5. Who we share it with
We share personal data only as needed for the purposes above:
- Our staff and outlets who prepare and hand over your order.
- Delivery partners, where you ask for delivery: your name, phone number and address only.
- Service providers who run things on our behalf, such as website hosting (Cloudflare), email, and messaging (WhatsApp). They may use your data only to provide their service to us.
- Banks and payment apps that process your payment.
- Our accountants and auditors, and government authorities where the law requires it.
When you message us on WhatsApp, your conversation is also handled under WhatsApp’s own privacy policy.
6. Cookies and third-party content
This website doesn’t set its own cookies for tracking or advertising. Some features load content from other companies, who may receive your IP address and, in some cases, set their own cookies:
- Google Fonts, which load the fonts used on every page;
- Google Maps, the map on our Contact page;
- Instagram, which plays our reels when you open one;
- WhatsApp, when you tap a WhatsApp or order button;
- Cloudflare, which may set strictly necessary security cookies to protect the site from attacks.
These companies process that data under their own privacy policies. You can block or delete cookies in your browser settings; the website will still work, although embedded maps or videos may not load.
7. How long we keep it
- Order details and invoices: for as long as tax and accounting laws require, generally up to 8 years.
- Custom cake photos and messages: deleted within 30 days after your order is completed, unless you ask us to keep them for a repeat order.
- Enquiries, feedback and complaints: up to 2 years after we last hear from you.
- Offers sign-up: until you unsubscribe.
- Job applications: up to 12 months, unless you join us.
- Website technical logs: kept by our hosting provider for a short period, usually a few days to a few weeks.
When we no longer need personal data, we delete it or make it anonymous.
8. Keeping it safe
We use reasonable security measures to protect your personal data. The website is served only over encrypted HTTPS, access to customer information is limited to staff who need it, and we work with reputable service providers. No method of sending or storing data is completely secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.
We will never ask for your card PIN, OTP, UPI PIN or passwords. If someone claiming to be Mango Bakers asks for these, do not share them, and please let us know.
9. Your rights
Under the Digital Personal Data Protection Act, 2023 you have the right to:
- access a summary of the personal data we hold about you and how we use it, and know who we have shared it with;
- correct, complete or update inaccurate or incomplete data;
- erase your data when it’s no longer needed, unless the law requires us to keep it;
- withdraw consent at any time, including unsubscribing from offers;
- nominate another person to exercise these rights for you in case of death or incapacity;
- raise a grievance with us and, if you’re not satisfied with our response, complain to the Data Protection Board of India.
To use any of these rights, contact us using the details in section 13. We may need to confirm your identity first, for example by replying from the phone number you ordered with.
10. Children
Our website and ordering are meant for adults. We don’t knowingly collect personal data from children under 18 except with the consent of a parent or guardian. For example, a parent may give a child’s name and age for a birthday cake. If you believe a child has given us personal data without consent, please contact us and we’ll delete it.
11. Where data is stored
We are based in India. Some of our service providers, such as our website host and messaging providers, may store or process data on servers outside India. Where this happens, we use providers with appropriate safeguards and follow any restrictions set by the Government of India.
12. Changes to this policy
We may update this policy when our services or the law change. The latest version will always be on this page with its “last updated” date. If the changes are significant, we’ll also highlight them on the website.
13. Contact and grievances
For any question, request or complaint about your personal data, contact our Grievance Officer. We aim to acknowledge requests within 48 hours and resolve them within 30 days.