Privacy Policy

Last updated: 22 July 2026

This Privacy Policy explains how The Million Blooms ("we", "us", "our") collects, uses, discloses, and protects the personal information you share with us. This policy is issued in compliance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and other applicable Indian laws.

1. Information we collect

We collect the following categories of information:

Identity & contact: name, email address, mobile number, gender (optional), date of birth (optional).
Delivery details: sender address, one or more recipient addresses, pincodes, city, state, delivery preferences, and gift messages.
Order details: items purchased, timings, chosen delivery method, coupon codes, gift-card balances used, invoicing preferences.
Payment metadata: only masked transaction IDs and payment status. Full card / UPI credentials are collected and processed by our PCI-DSS compliant payment gateway; The Million Blooms never stores this data on its servers.
Device & usage data: IP address, browser type, device identifiers, pages visited, time-on-page, referring URL, and interactions with our emails / notifications.
Cookies & similar technologies: session cookies for cart continuity, pincode preference, and analytics cookies for aggregated behaviour reporting.

2. Why we collect this data

To process and fulfil your order: including verifying serviceability of the pincode, computing delivery slots, and handing off shipping details to our delivery partners.
To communicate with you: order confirmations, delivery updates, refund status, and important service announcements.
For customer support: to investigate and resolve issues, damaged deliveries, refund requests, and chat / email queries.
To personalise your experience: recommend relevant products, remember your pincode, prefill sender / receiver details on your next order.
For marketing, only with your consent: newsletters, promotional emails / SMS. You can opt out at any time (see Section 8).
To detect fraud and abuse: coupon abuse, chargeback fraud, malicious traffic.
To comply with law: tax invoices, statutory retention, and lawful requests from government authorities.

3. Legal basis for processing

Under the DPDP Act, we process your data on the basis of one or more of the following: (a) your explicit consent (marketing, optional profile fields), (b) performance of a contract (order fulfilment), (c) compliance with legal obligations (GST invoicing, statutory record-keeping), and (d) our legitimate business interests (fraud prevention, service improvement) balanced against your rights.

4. Sharing your information

We share your data only where necessary and only with the following categories of recipients:

Delivery partners (e.g. logistics providers, last-mile riders) — receive recipient name, address, pincode, mobile number, and delivery preferences.
Payment gateways — receive transaction amount and order reference for processing your payment.
Cloud infrastructure and analytics providers — process data under binding data-processing agreements that mirror the safeguards in this policy.
Government or law-enforcement agencies — when required by a legally binding request or court order.

We do not sell your personal data to third parties for their own marketing.

5. Data retention

Order records: retained for a minimum of 8 years to comply with GST and other tax laws.
Account data: retained for as long as your account is active. You can request deletion at any time (see Section 6).
Guest-checkout data: retained for up to 3 years for warranty / refund / dispute purposes, then anonymised.
Marketing preferences: retained until you unsubscribe or until we sanitise our marketing database (whichever is earlier).

6. Your rights

Under the DPDP Act you have the right to:

Access the personal data we hold about you.
Correct or update any inaccurate information.
Erase your data, subject to our legal retention obligations.
Withdraw consent for optional processing (e.g. marketing) at any time.
Nominate another person to exercise these rights on your behalf in case of death or incapacity.
Raise a grievance with our Grievance Officer (see Section 11).

To exercise any of these rights, please write to care@themillionblooms.com from the email address linked to your account. We will respond within the timelines prescribed under the DPDP Act.

7. Cookies

Our website uses cookies and similar technologies to remember your session, cart, and pincode preference, and to gather aggregated analytics. You can disable cookies in your browser settings; however, features like the shopping cart and pincode memory may not work if you do so.

8. Marketing communication

If you have subscribed to newsletters or promotional messages, you can opt out at any time by clicking the unsubscribe link in the email footer or replying STOP to promotional SMS. Transactional messages related to your orders will continue to be sent as they are essential for service delivery.

9. Data security

We employ industry-standard safeguards to protect your data: HTTPS/TLS in transit, encrypted storage for sensitive fields, role-based access controls, and periodic security reviews. Despite our best efforts, no system on the internet is 100% secure. If we become aware of a breach that materially affects you, we will notify you in accordance with applicable law.

10. Children's data

Our services are not intended for anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided data to us, please email care@themillionblooms.com and we will delete it promptly.

11. Grievance Officer

Any complaints about the use of your personal data may be addressed to our Grievance Officer:

Name: Grievance Officer, The Million Blooms
Email: care@themillionblooms.com
Address: Jalandhar, Punjab, India

We aim to acknowledge grievances within 48 hours and resolve them within 30 days.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Updates take effect on the "Last updated" date shown above. If a change materially affects how we process your data, we will notify you by email or a prominent website banner.

13. Contact us

For any privacy-related questions, email care@themillionblooms.com.