Madhukosha

Privacy Policy

Operated by Madhukosha Apiary Services Private Limited

Version 1.0 | Effective Date: 1 September 2026 | Last updated: 1 September 2026 | Jurisdiction: Bengaluru, Karnataka, India

Madhukosha Apiary Services Private Limited (“Madhukosha”, “we”, “us” or “our”) operates the website at https://madhukosha.org and the Madhukosha Android application (together, the “Platform”). Through the Platform we provide an informational crop-pollination lookup tool (the “Lookup Tool”) and sell the PolliHab, a terracotta beehive supplied with an established honey bee colony. This Privacy Policy explains what personal data we collect, why we collect it, the lawful basis on which we process it, whom we share it with, where it goes, how long we keep it, and the rights available to you. It is published in accordance with the Information Technology Act, 2000 and the rules made under it, and is formulated in compliance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. This Policy forms part of, and must be read with, the Terms of Use, the Consent Policy and the Cookie Policy.

Who We Are and How to Contact Us

Data Fiduciary. Madhukosha Apiary Services Private Limited is the Data Fiduciary in respect of the personal data described in this Policy. Our registered office is at 305, 1st Floor, Heritage Street, 6th Block, Banashankari 6th Stage, Bengaluru, Karnataka 560060, India.
Contact for data protection questions. We have appointed the following person to answer questions about the processing of your personal data and to receive grievances: Vijithendra Thejaswi, Chief Executive Officer, Madhukosha Apiary Services Private Limited, 305, 1st Floor, Heritage Street, 6th Block, Banashankari 6th Stage, Bengaluru, Karnataka 560060, India, email hello@madhukosha.org. We refer to this person in this Policy as the Grievance Officer.
Scope. This Policy applies to personal data we process about visitors to the Platform, persons who submit an enquiry or order form, and purchasers of the PolliHab. It does not apply to any website or service operated by a third party, including those we link to.

Definitions

“Personal Data” means any data about an individual who is identifiable by or in relation to such data.
“Data Principal” means the individual to whom the Personal Data relates.
“Data Fiduciary” means the person who alone or with others determines the purpose and means of processing Personal Data. Madhukosha is the Data Fiduciary.
“Data Processor” means any person who processes Personal Data on our behalf, including our hosting, form-storage, communications, analytics and payment providers.
“Applicable Law” means the Digital Personal Data Protection Act, 2023 and the rules made under it, the Information Technology Act, 2000 and the rules made under it, the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, and every other law applicable to us, each as amended.
Terms defined in the Terms of Use and used in this Policy have the meaning given to them in the Terms of Use.

What Personal Data We Collect

We collect only the Personal Data described below. We do not require you to create an account, and we do not issue login credentials, because the Platform has no account or login function.

Category	Items	How it reaches us
Enquiry and contact data	Name; mobile number; pincode; email address (optional); role (farmer, estate owner, beekeeper, urban hobbyist, institution or other).	You type it into the enquiry or order form on the Platform.
Requirement data	Number of PolliHab units required; crop; acreage; location details relevant to pollination.	You type it into the same form.
Transaction data	Quotation reference; payment status; payment reference and receipt; amount paid; date of payment.	Generated when you pay through a Razorpay Payment Link. We do not receive or store your card number, UPI credential, CVV or bank password.
Communications data	The content of your emails, WhatsApp messages and telephone enquiries to us, and our replies.	You send them to us, or we send them to you.
Marketing preference	Whether you have opted in to receive marketing and promotional communications, and to the use of your contact details for advertising audience targeting; and the date and record of that opt-in or its withdrawal.	You tick, or do not tick, a separate and un-pre-ticked box on the form.
Technical and usage data	IP address, browser and device type, pages viewed, referring page, date and time of access, and error and security logs.	Collected automatically by our hosting and content-delivery provider and, where you consent, by our analytics provider.

We do not collect. We do not collect government identity numbers, bank account details, biometric data, health data or precise geolocation. We do not knowingly collect Personal Data of children. We do not buy Personal Data from data brokers or enrich your data from outside sources.
Optional fields. Your email address is optional. The Lookup Tool may be used without submitting any Personal Data.

Why We Process Your Personal Data, and on What Basis

Under section 4 of the Digital Personal Data Protection Act, 2023, Personal Data may be processed only for a lawful purpose, either with your consent under section 6 or for one of the legitimate uses listed in section 7. Section 7 is a closed list. The table below states, for each purpose, which of the two applies.

Purpose	Personal Data used	Lawful basis
To answer your enquiry, assess whether the PolliHab is suitable for your crop and location, and prepare and send you a quotation	Enquiry, contact and requirement data	Section 7(a) — the specified purpose for which you voluntarily provided the data
To take payment through a Razorpay Payment Link, issue a receipt, and record the sale	Contact and transaction data	Section 7(a), and legal obligation for the retention of financial records
To arrange delivery of the PolliHab unit and communicate delivery timing	Contact, requirement and transaction data	Section 7(a)
To send service and transactional messages about your enquiry, quotation, payment or delivery, by telephone, WhatsApp or email	Contact and transaction data	Section 7(a)
To handle a replacement request, a grievance, or a dispute	All categories relevant to the matter	Section 7(a), and section 7(e) where a judgment, decree or order applies
To keep the Platform available, secure and free from misuse, and to investigate unauthorised access	Technical and usage data	Section 7(a), limited to what is strictly necessary to deliver securely the service you asked for
To measure and improve how the Platform is used, using Google Analytics	Technical and usage data, analytics cookies	Consent under section 6, given through the cookie banner
To send you marketing and promotional communications about Madhukosha products	Name, mobile number, email address	Consent under section 6, given through a separate opt-in
To include your contact details in advertising audiences on Meta and Google platforms, so that we can show you Madhukosha advertising	Mobile number, email address	Consent under section 6, given through the same separate opt-in, which describes this use expressly
To comply with a legal obligation to disclose information to the State, or to respond to a lawful demand	Whatever the law requires	Sections 7(d) and 7(e)

We do not repurpose your data. We will not use Personal Data collected for one purpose in the table above for a different purpose without first giving you a fresh notice and obtaining fresh consent where the law requires it.
We do not profile you. We do not build behavioural profiles of identifiable individuals, and we do not take automated decisions that produce legal effects for you.

Consent, and How to Withdraw It

How we take consent. Where we rely on your consent, we take it by a clear affirmative action — you tick a box that is not pre-ticked, or you select your preferences on our cookie banner. We do not use pre-ticked boxes, we do not treat silence or inaction as consent, and we do not bundle consent for marketing or analytics with the submission of your enquiry. You can obtain a quotation and buy a PolliHab without consenting to marketing, advertising audiences or analytics.
The consent notice. Before or when we ask for your consent, we give you a notice that stands on its own, in clear and plain language, itemising the Personal Data concerned, stating the purpose, and giving the means to withdraw consent, exercise your rights and complain to the Data Protection Board of India. That notice is set out in the Consent Policy.
How to withdraw. You may withdraw your consent at any time, and it must be as easy to withdraw as it was to give. You may withdraw by clicking the unsubscribe link in any marketing email, by replying “STOP” to any marketing WhatsApp message, by changing your preferences on our cookie banner, or by writing to hello@madhukosha.org. We will act on a withdrawal within seven (7) days of receiving it.
Effect of withdrawal. Withdrawal does not affect the lawfulness of anything we did before you withdrew. On withdrawal we will stop the processing that depended on that consent and, unless we are required by law to keep the data or need it to establish or defend a legal claim, we will erase it and cause our Data Processors to do the same.

Who We Share Your Personal Data With

We do not sell, rent or trade your Personal Data. We share it only as set out below.

Recipient	What they receive	Why	Where they process it
Airtable	Enquiry, contact, requirement and marketing-preference data	Storage of form submissions and our customer records	United States
Cloudflare	Technical and usage data	Website hosting support, content delivery and security	United States
Razorpay	Name, contact details, amount and payment status	Collection of payment through Payment Links, and refunds where applicable	India
Meta Platforms (WhatsApp, and advertising)	Mobile number for WhatsApp messaging; contact details for advertising audiences, only where you have consented	Communication with you about your enquiry; and, on consent, advertising audience targeting	United States and Ireland
Google (Analytics, and Google Ads in future)	Technical and usage data on consent; contact details for advertising audiences, only where you have consented	Measurement of Platform usage; and, on consent, advertising audience targeting	United States
Professional advisers, auditors and authorities	Only what is necessary	Legal, tax and regulatory compliance, and the establishment or defence of legal claims	India

Processor obligations. Each of the above who processes Personal Data on our behalf does so under a written contract that requires it to process the data only on our instructions, to apply reasonable security safeguards, to keep the data confidential, not to engage a sub-processor without our authorisation, to notify us of any personal data breach, and to erase or return the data when we tell it to. We remain responsible for compliance with Applicable Law irrespective of any such contract.
Business transfer. If we merge with, are acquired by, or transfer our business or assets to another entity, Personal Data may be transferred as part of that transaction, subject to the receiving entity continuing to be bound by this Policy or a policy no less protective.

Transfer of Personal Data Outside India

Some of our Data Processors are located outside India, as stated in the table in clause 6. Personal Data is therefore transferred to and stored in the United States and Ireland.
Section 16 of the Digital Personal Data Protection Act, 2023 permits such transfers unless the Central Government has, by notification, restricted transfer to the country or territory concerned. As at the effective date of this Policy, no such notification restricts transfer to the United States or Ireland. Rule 15 of the Digital Personal Data Protection Rules, 2025 additionally requires us to meet any requirements the Central Government specifies in respect of making Personal Data available to a foreign State or to a person or entity under the control of a foreign State.
If a restriction is notified in respect of a country to which we transfer Personal Data, we will stop transferring Personal Data to that country and will migrate the affected processing.

How Long We Keep Your Personal Data

Category	Retention period	Why
Enquiry, contact, requirement and communications data	Three (3) years from the date on which you last contacted us or we last contacted you, or until you ask us to delete it, whichever is earlier	To respond to repeat enquiries and to deal with any question about a quotation
Transaction and financial records	As long as required under the Companies Act, 2013, the Income-tax Act, 1961 and other applicable tax and accounting law	Statutory record-keeping. We cannot delete these on request while the statutory period runs
Marketing preference and consent records	For as long as the consent is in force, and for three (3) years after it is withdrawn	To prove that consent was given, and that withdrawal was honoured, if this is ever questioned
Security, access and error logs	One (1) year from the date of the processing	Required as a minimum under Rule 6(1)(e) and Rule 8(3) of the Digital Personal Data Protection Rules, 2025
Analytics data	As configured in Google Analytics, and in any event no longer than fourteen (14) months	Measurement only

When the applicable period ends, or when the purpose for which we collected the data is no longer being served, we erase the Personal Data and instruct our Data Processors to do the same, unless we are required by law to keep it.

How We Protect Your Personal Data

Safeguards. We apply reasonable security safeguards to protect Personal Data against personal data breach, including: encryption of data in transit; access control, so that only persons who need the data for their work can reach it; multi-factor authentication on the accounts through which our records are held; logging and periodic review of access, so that unauthorised access can be detected and investigated; backups; retention of logs for one year; and contractual security obligations on our Data Processors.
What we do not claim. No system connected to the internet is completely secure. We do not represent that our safeguards are proof against every attack, and we do not hold any security certification. We describe here what we actually do.
If there is a breach. If a personal data breach occurs, we will inform each affected Data Principal without delay, describing the breach, its likely consequences for that person, the measures we have taken to mitigate risk, the steps that person may take to protect their interests, and the contact details of a person who can answer questions. We will also inform the Data Protection Board of India without delay, and provide the Board with detailed and updated information within seventy-two (72) hours of becoming aware of the breach.

Children

The Platform is intended for persons aged eighteen (18) years and above, and our product is sold to adults for agricultural, institutional or hobbyist use. We do not direct the Platform at children.
We do not knowingly collect the Personal Data of a child. We do not undertake tracking or behavioural monitoring of children, and we do not direct advertising at children.
If you believe that a child has submitted Personal Data to us, please write to hello@madhukosha.org. We will verify the position and erase the data.

Your Rights

Subject to Applicable Law, you have the following rights in respect of Personal Data we process about you.
Right to access. To obtain a summary of the Personal Data we process about you, the processing activities we undertake with it, and the identities of the Data Fiduciaries and Data Processors with whom we have shared it.
Right to correction, completion and updating. To have inaccurate or misleading Personal Data corrected, incomplete data completed, and out-of-date data updated.
Right to erasure. To have your Personal Data erased, unless its retention is necessary for the specified purpose or for compliance with a law.
Right to withdraw consent. Where we rely on consent, to withdraw it at any time, as described in clause 5.
Right of grievance redressal. To complain to us about any act or omission of ours regarding your Personal Data or the exercise of your rights.
Right to nominate. To nominate one or more individuals to exercise your rights on your behalf in the event of your death or incapacity.
How to exercise them. Write to the Grievance Officer at hello@madhukosha.org with the subject line “Data Principal Request”, stating which right you wish to exercise and giving the mobile number or email address you used on our form, so that we can identify your record. We may ask you for further information to verify that the request is genuinely yours. We will respond within thirty (30) days of receiving a complete request.
Your duties. Applicable Law requires you not to impersonate another person, not to suppress material information when providing Personal Data, not to register a false or frivolous grievance or complaint, and to furnish only verifiably authentic information when exercising the right to correction or erasure.
Complaint to the Board. If you are not satisfied with our response, or we do not respond, you may complain to the Data Protection Board of India in the manner provided under the Digital Personal Data Protection Act, 2023 and the rules made under it.

Cookies and Similar Technologies

We use cookies and similar technologies on the Platform. Strictly necessary cookies are set without consent because the Platform cannot work without them. Analytics and any advertising cookies are set only where you consent through our cookie banner. The detail is set out in the Cookie Policy, which forms part of this Policy.

Grievances

Grievance Officer. Vijithendra Thejaswi, Chief Executive Officer, Madhukosha Apiary Services Private Limited, 305, 1st Floor, Heritage Street, 6th Block, Banashankari 6th Stage, Bengaluru, Karnataka 560060, India, email hello@madhukosha.org.
Timelines. We will acknowledge a grievance within forty-eight (48) hours of receiving it and will resolve it within thirty (30) days. Where a grievance concerns a request made under the Information Technology Act, 2000 and the rules made under it, we will acknowledge it within twenty-four (24) hours and dispose of it within fifteen (15) days.
Escalation. If you remain dissatisfied, you may approach the Data Protection Board of India in respect of a data protection grievance, or the consumer dispute redressal commission having jurisdiction in respect of a consumer grievance.

Changes to this Policy

We may amend this Policy. The current version will always be available on the Platform and will carry a version number and an effective date.
We will give notice of a material change on the Platform at least seven (7) days before it takes effect and, where we rely on your consent and the change affects the purpose for which that consent was given, we will obtain your consent afresh.

Governing Law

This Policy is governed by the laws of India. Any dispute arising out of it is subject to the exclusive jurisdiction of the competent courts at Bengaluru, Karnataka, India, without prejudice to your right as a consumer to approach the consumer dispute redressal commission where you reside or work for gain.

← Back to Madhukosha