Privacy policy

PRIVACY POLICY
DIT'O by Boatload Minds Pvt. Ltd.
Last Updated: September 2026

Boatload Minds Pvt. Ltd. ("Boatload Minds," "we," "us," or "our") operates the DIT'O platform, including the website, online store, and machine-customer portal (collectively, the "Services"). Our Services are hosted on Shopify. This Privacy Policy explains how we collect, use, store, and disclose your personal data when you interact with the Services.

This Privacy Policy applies to two categories of users: (a) retail/FMCG customers who browse and purchase our products publicly, and (b) machine customers (HoReCa and corporate clients) who access a gated portal to order consumables for their DIT'O machines. Where your rights or our obligations differ between these categories, we have noted this clearly.

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

1. Applicability and Governing Law

This Privacy Policy is governed by the laws of India, including the:

  • Digital Personal Data Protection Act, 2023 ("DPDPA") and rules notified thereunder;
  • Information Technology Act, 2000 ("IT Act") and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
  • Consumer Protection Act, 2019, to the extent applicable.

To the extent we process personal data of individuals in the European Economic Area or United Kingdom, we also comply with the General Data Protection Regulation ("GDPR") and applicable UK data protection law. We rely on the European Commission's Standard Contractual Clauses for cross-border transfers from the EEA/UK.

We are the Data Fiduciary under DPDPA and the Data Controller under GDPR for the personal data we collect through the Services.

2. Grievance Officer

In accordance with the IT Act, SPDI Rules, and DPDPA, we have designated a Grievance Officer to address any concerns or complaints regarding the processing of your personal data:

Grievance Officer: Mr. Gowtham
Designation: Compliance / Data Protection Officer
Email: care@pourdito.com
Address: SF No 378, Door No 26 D,V,N Industrial Estate, Peelamedu, Coimbatore – 641004, Tamil Nadu, India

We will acknowledge your complaint within 48 hours and resolve it within 30 days of receipt.

3. Personal Data We Collect

3.1 Retail / FMCG Customers

When you browse or purchase products through our public storefront, we may collect:

  • Contact details: name, email address, phone number, delivery address, billing address.
  • Transaction data: products viewed, added to cart, purchased, returned, or cancelled; order history.
  • Payment information: processed securely through Shopify Payments or third-party payment gateways. We do not store full card numbers on our servers.
  • Account information (if you create an account): username, password (encrypted), and preferences.
  • Device and usage data: IP address, browser type, pages visited, click behaviour, and session data, collected automatically via cookies and similar technologies.
  • Communications: content of any messages you send to our customer support team.

3.2 Machine Customers (HoReCa / Corporate)

In addition to the above, for machine customers whose accounts are provisioned by our team:

  • Account provisioning data: email address and contact details provided during the onboarding process; account activation via invite link.
  • Machine and portal access data: customer tags assigned to your account (e.g., approved product blends and SKU access levels), login history, and order history for consumables.
  • Business information: company name, GST number (where applicable), and billing or delivery location.

Note: Machine customer accounts are created and managed by Boatload Minds staff. You do not self-register. Your access permissions (i.e., which consumable blends you can order) are encoded as account tags set by our team based on your commercial agreement.

3.3 Sensitive Personal Data

We do not intentionally collect sensitive personal data as defined under the SPDI Rules, such as biometric, health, or political data. Passwords are stored in encrypted form. Payment card data is processed by our payment gateway and we do not store full card numbers on our servers. We ask that you do not submit sensitive personal information to us through the Services.

4. Cookies and Tracking Technologies

We use cookies and similar technologies on our storefront. These include:

  • Essential cookies: Required for the store and cart to function (e.g., session cookies, cart cookies). These cannot be disabled.
  • Analytics cookies: We may use tools such as Google Analytics or Shopify Analytics to understand how visitors interact with our site. These collect anonymised or pseudonymised data.
  • Marketing and advertising cookies: If we run advertising campaigns via Meta (Facebook/Instagram), Google, or similar platforms, their pixels or tags may be present on our site and may collect data about your browsing activity to serve you relevant ads. You can opt out of interest-based advertising via your device settings or the relevant platform's privacy controls.

You may manage or disable non-essential cookies through your browser settings. Note that disabling cookies may affect store functionality.

5. How We Use Your Personal Data

We process your personal data for the following purposes:

  • To fulfil orders, process payments, arrange shipping, and manage returns and exchanges.
  • To create and manage your account, and (for machine customers) to manage your portal access and approved consumable catalogue.
  • To send you transactional communications: order confirmations, shipping updates, account activation links, and support responses.
  • To send you marketing communications by email, SMS, or WhatsApp — only where you have given consent or where permitted by applicable law. You may opt out at any time.
  • To improve our Services through analytics and usage data.
  • To detect and prevent fraud, abuse, and security incidents.
  • To comply with our legal obligations under Indian law and applicable regulations.

We process your data on the following legal bases (under GDPR, where applicable): performance of a contract; compliance with legal obligations; legitimate interests (fraud prevention, service improvement); and consent (for marketing communications and non-essential cookies).

6. Communication Channels

We may communicate with you through the following channels:

  • Email: for order confirmations, account management, support, and marketing (with consent).
  • SMS: for transactional alerts and, where you have opted in, promotional messages.
  • WhatsApp: for customer support and operational communications with machine customers. By providing your WhatsApp number during onboarding or checkout, you consent to receiving messages from us on this channel. You may opt out by notifying us at care@pourdito.com.

We will not send unsolicited marketing via WhatsApp or SMS without your prior consent.

7. Disclosure of Personal Data

We may share your personal data with:

  • Shopify Inc.: as our platform provider and data processor. Shopify processes data in accordance with its own Privacy Policy (https://www.shopify.com/legal/privacy).
  • Payment processors: such as Razorpay, or other gateways, for the purpose of processing transactions.
  • Logistics and fulfilment partners: to arrange delivery of your orders.
  • Marketing and analytics platforms: such as Google Analytics, Meta Business Suite, or similar, where applicable and as described in Section 4.
  • Legal and regulatory authorities: where required by law, court order, or government directive.
  • Business successors: in the event of a merger, acquisition, or sale of assets, subject to appropriate confidentiality obligations.

We do not sell your personal data to third parties.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by law. Our general retention guidelines are:

  • Account data: retained for the duration of your account and for 3 years following account closure, unless a longer period is required by law.
  • Transaction and order data: retained for 8 years from the date of transaction, in compliance with applicable tax and accounting laws.
  • Machine customer portal access data (tags, permissions, order logs): retained for the duration of your commercial agreement with us and for 3 years thereafter.
  • Marketing consent records: retained until you withdraw consent and for 3 years thereafter as evidence of compliance.
  • Analytics and usage data: retained for up to 26 months, consistent with standard analytics platform practices.

After the applicable retention period, your personal data will be securely deleted or anonymised.

9. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

  • Right to access: request a copy of the personal data we hold about you.
  • Right to correction: request that we correct inaccurate or incomplete personal data.
  • Right to erasure / deletion: request deletion of your personal data, subject to legal retention obligations.
  • Right to data portability: request your personal data in a structured, machine-readable format.
  • Right to withdraw consent: where processing is based on consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.
  • Right to grievance redressal (DPDPA): you have the right to have your grievance redressed by our Grievance Officer (see Section 2) and, if unsatisfied, to approach the Data Protection Board of India once it is constituted.

To exercise any of these rights, contact us at care@pourdito.com. We will verify your identity before processing your request and respond within 30 days.

We will not discriminate against you for exercising your rights.

10. Security

We implement reasonable technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These include encrypted storage of passwords and payment data, access controls limiting staff access to personal data, and secure HTTPS transmission.

No system is completely secure. We cannot guarantee absolute security and are not responsible for security breaches outside our reasonable control. You are responsible for keeping your account credentials confidential.

In the event of a personal data breach likely to result in risk to your rights, we will notify you and, where required, the relevant regulatory authority, in accordance with applicable law.

11. Children's Data

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a person under 18, we will delete it promptly. If you believe we have collected data from a minor, please contact our Grievance Officer.

12. Third-Party Links

Our Services may contain links to third-party websites or platforms. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing any personal data.

13. International Transfers

Your personal data may be transferred to and processed in countries outside India, including by Shopify (headquartered in Canada) and other service providers. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses for transfers to EEA/UK recipients, and transfers only to jurisdictions with adequate data protection as determined by applicable Indian law.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this document and, where required by law, notify you by email or by a prominent notice on our website. Your continued use of our Services after any update constitutes acceptance of the revised policy.

15. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact:

Boatload Minds Pvt. Ltd.
SF No 378, Door No 26 D,V,N Industrial Estate,
Peelamedu, Coimbatore - 641004, Tamil Nadu, India
Email: care@pourdito.com