Digital Personal Data Protection Act, 2023
What we do with your details
This is the notice the Act requires us to give you. It is written to be read, not to be survived — if any part of it is unclear, call Jinto on 8590 657900 and ask.
A copy in Malayalam
You are entitled to this notice in Malayalam. A written Malayalam version is being prepared with a translator — until it is published here, call 8590 657900 and Jinto will go through it with you in Malayalam.
Who holds your data
Jinto Jomon, trading as AELA, Idukki, Kerala, India. Under the Act we are the Data Fiduciary — the people who decide what is collected and why, and who are answerable for it.
Two different groups of people appear in our records: growers whose estates we manage, and customers who buy cardamom from the shop. We also record the workers who work on an estate, so that days and wages can be accounted for.
What we collect, and why
Each purpose below is separate. We do not collect anything for one reason and quietly use it for another.
Running your estate account and showing you the work log
- Your name, phone number and WhatsApp number
- Your email address, used to sign in
- Your village, district and postal address
- Your estate names, locations, area and plant counts
- The work recorded on your estates, and its costs
- Photographs and documents from your estates
We rely on a permitted use under the Act for this, rather than asking each time. s.7(a) — you gave us these details yourself, to receive the service you asked for, and have not told us to stop.
Keeping a record of who worked on an estate, and what they were paid
- Worker name and phone number
- Role, daily wage and days worked
- Address, where recorded
We rely on a permitted use under the Act for this, rather than asking each time. s.7(i) — employment purposes, and to protect the employer from loss or liability. See the assessment: whether the grower or AELA is the fiduciary here is a determination the client must record.
Sending you the cardamom you ordered
- Your name, email address and phone number
- Your delivery address and pincode
- What you ordered and what you paid
We ask your permission for this, and you can take it back. s.6 — taken at checkout, and withdrawable at any time.
Replying to a message you send us
- Your name, email address and phone number
- What you wrote to us
We ask your permission for this, and you can take it back. s.6 — taken on the contact form.
What we do not do
- We do not sell your details, and we do not share them with anyone for their own marketing.
- We do not track you around the internet, and there are no advertising or analytics cookies on this site.
- We do not use your details to make automated decisions about you.
- We do not ask children for personal data, and the shop is not aimed at anyone under 18.
How long we keep it
The Act says we must erase personal data once the purpose it was collected for is finished, unless the law requires us to keep it. Where a period below is long, it is because a statute sets it — not because we prefer to hold on.
| What | How long | Why |
|---|---|---|
| Store orders and delivery addresses | 8 years | Books of account must be kept eight years under the Companies Act and the income-tax rules. Erasing an order sooner would break a statutory record. |
| Contact-form enquiries | 1 year | A year is long enough to pick up a conversation. After that it is clutter. |
| Consent records | While needed | Kept while the consent is live and for as long as it may need to be evidenced. These prove the lawfulness of everything else. |
| Sent notifications | 1 year | Each one records the number or address it went to, so it expires like anything else holding contact details. A year is long enough to answer "were they told?". |
| Security and access logs | 1 year | One year, matching the retention the Rules expect of logs used to detect and investigate incidents. |
| Grower account and estate work history | While needed | Kept for as long as the grower is a client, because it is the service. Erased on request once the engagement ends and no statutory record depends on it. |
What you can ask us to do
These are your rights under the Act. Using any of them is free, and we answer within 30 days.
A copy of my datas.11
A summary of the personal data we hold about you and what we do with it.
Correct somethings.12
Tell us what is wrong, incomplete or out of date and we will fix it.
Erase my datas.12
We will erase what we hold unless the law requires us to keep it — we will tell you which parts, and why.
Nominate someones.14
Name a person who may exercise these rights for you if you die or cannot act for yourself.
Raise a grievances.13
Tell us we have got something wrong about your data.
If you are a grower with a portal login, everything above is also in your account, where you can download a copy of your data straight away.
How it is kept safe
Passwords are stored only as a one-way hash, so nobody here can read yours. Photographs and documents from an estate are stored outside the public part of the site and are served only after we check that the person asking owns them — a stranger with the exact filename still gets nothing.
Every screen in the grower portal is scoped to the account that is signed in, and that scope comes from the session rather than from anything in the web address, so one grower cannot reach another grower’s records by editing a URL.
If a breach ever happens, the Act requires us to tell both the Data Protection Board and every person affected. We will, and we will not wait to be asked.
If we get it wrong
Tell us first — it is the fastest way to fix it, and the Act expects you to have given us the chance.
If we do not sort it out, you can complain to the Data Protection Board of India. A complaint may be made to the Board after exhausting the grievance route above.
Changes to this notice
When we change what we do with your data, this notice changes first and we record which version you were shown when you agreed to anything.
This is version 2026-09-01.