Privacy policy

1.1Nutrify Private Limited (CIN U01611HR2026PTC145559), whose registered office is at 1st Floor, Plot No. B & B1, Vanijya Nikunj, Enkay Centre, Udyog Vihar Phase 5, Gurugram, Haryana 122016, India ("we", "us"), runs The Composta. This policy explains how we collect, use, share and protect personal information about people who visit https://thecomposta.com, ask us for a quotation, write to us, subscribe to our newsletter or buy from us.

1.2We decide why and how your information is used. That makes us the “data fiduciary” under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, and the “controller” under the UK GDPR and the EU GDPR where they apply to you.

1.3Which Indian law applies depends on the date. Until the main provisions of the DPDP Act and the Digital Personal Data Protection Rules, 2025 take effect in May 2027, the Information Technology Act, 2000 (section 43A) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 apply, and this policy is our privacy policy for rule 4 of those rules. From May 2027 the DPDP Act's notice, consent, rights and grievance provisions apply as well. We already follow the rights and practices described here, so you do not need to wait for that date to use them.

1.4Questions about this policy can be sent to contact@thecomposta.com. The person responsible for answering them is our Grievance Officer, whose role is described in our Grievance redressal policy.

2.1We collect information in the following ways. For each, we say what we ask for, what we use it for and what it lets us do for you.

2.2Quotation requests. When you send a quote request, we ask for your name, phone or WhatsApp number, email address, country, full delivery address (street, city and postal code), the packs and quantities on your quote list, and any notes you add. We use this to prepare and send you a quotation with delivery included, and to process, deliver and invoice an order if you go ahead. We cannot prepare a quotation without a name, a phone number, an email address and a delivery address, so these are required. Notes are optional.

2.3Enquiries. When you use the contact form or the bulk and export enquiry form, we ask for your name, phone or WhatsApp number and country, and, depending on the form, your email address, organisation, the kind of buyer you are, the quantity you are interested in, your delivery city or port, the topic and your message. We use this to reply to you. Name, phone and country are required on both forms. The contact form also requires a message, and the bulk and export form requires your email address. Everything else is optional.

2.4Newsletter. If you subscribe, we collect your email address and the date and time you subscribed. We use it to send our newsletter (clause 4).

2.5Messages and calls. If you write to us, phone us or message us on WhatsApp, we keep what you send and notes of the conversation so that we can continue it.

2.6Our dealings with you. This includes your quotation or order reference, the quotation we sent, the order status, delivery and payment records, and invoices. We do not collect card or bank account details through this website. If you pay by bank transfer, your bank and ours handle it, and we keep a record of the payment.

2.7Automatic information. Our website host keeps technical server logs, which include your IP address, the pages requested, the date and time, and your browser type. We use them to keep the site secure and working and to investigate abuse and incidents. Our forms also read your IP address, in server memory only and for a short time, to turn away automated repeat submissions. We do not use cookies for tracking or analytics. The only item stored in your browser is your quote list, described in our Cookie policy.

2.8When you send a quote request, we send you an acknowledgement email automatically, and a copy of the details goes to our team. These automatic steps do not involve any decision about you.

2.9What we do not collect. We do not collect passwords, card details, government identity numbers, health information or precise location through this website. We do not knowingly collect information from anyone under 18.

3.1In India we rely on your consent, which you give by an affirmative act when you submit a form, subscribe or message us, for the purpose you submitted it for. We also rely on the uses of personal data that the DPDP Act allows without consent once it applies, chiefly where you voluntarily give us data for a specified purpose and have not told us you object, where the law requires us to keep or give information, and in a medical or other emergency. You can withdraw consent at any time (clause 10).

3.2If the UK GDPR or EU GDPR applies to you, our legal bases are: performing a contract with you or taking steps at your request before one (quotations and orders); our legal obligations (tax and company records); our legitimate interests in running a secure, well-managed business and answering the people who write to us, which we weigh against your rights; and your consent, for the newsletter.

3.3We do not sell or rent your information. We do not use it for advertising or profiling, and we do not make decisions about you by automated means that have legal or similarly significant effects.

4.1If you subscribe, we will send you news about The Composta, such as new packs and guides from our journal. We use only your email address for this. You consent by entering your address and pressing Subscribe, and we record the date and time. Please subscribe only your own address. If someone has subscribed you by mistake, tell us and we will remove you.

4.2You can unsubscribe at any time by writing to contact@thecomposta.com from the address you subscribed with, asking us to unsubscribe. We stop sending within 5 working days, and usually sooner. After that we keep only a suppression record of your address so that we do not email you again. Unsubscribing does not affect messages about a quotation or order you have made, which are service messages.

4.3Newsletter emails state who we are and give our postal address.

5.1We share personal information only as far as needed. Depending on how we have set up the website at the time, the services we use are:

1. Vercel Inc. (United States), our website host, which serves the site, runs the code that handles our forms and keeps server logs;
2. Notion Labs, Inc. (United States), where we log each quotation request, enquiry and newsletter sign-up as a record we work from;
3. an email delivery service, either Resend (United States) or Brevo (Sendinblue SAS, France), which sends the acknowledgement and replies we email you and the notice that reaches our team, and which may hold our newsletter list;
4. Google LLC (United States), where we keep a spreadsheet copy of submissions and receive an email alert for each one, if that is switched on;
5. Telegram, where a private alert to our team carries the details you submitted, if that is switched on;
6. WhatsApp (Meta), if you choose to continue on WhatsApp. After you send a quote request, the site opens WhatsApp with a message already filled in, and the message is sent only when you press Send. The chat is then governed by WhatsApp's own privacy policy as well as this one;
7. couriers, freight forwarders, shipping lines, customs agents and, for exports, banks, who need your name, address and contact details to deliver and clear your order;
8. our professional advisers (such as accountants and lawyers) and, where the law requires, courts, regulators, tax authorities and law enforcement.

5.2The services we use can change. You can ask us at any time which services hold your information, and we will tell you (clause 10). Each provider may use your information only to provide its service to us, and is required to protect it. If we ever sell or restructure the business, your information may pass to the new owner on the same terms as this policy.

6.1We are based in India, and your information is processed in India and in the countries where our service providers operate, which include the United States and member states of the European Union.

6.2Indian law lets the government restrict the transfer of personal data to particular countries. At the date of this policy none has been notified, and we will follow any such restriction once it applies.

6.3Where the UK GDPR or EU GDPR applies and your information goes to a provider outside the UK or the European Economic Area, we rely on safeguards that those laws recognise. These are the standard contractual clauses (with the UK addendum for the UK) that our providers offer in their data processing terms, and the provider's certification under the EU-US Data Privacy Framework where it has one. India has not received an adequacy decision from the European Commission. You can ask us for details of the safeguards that apply to your information.

7.1We keep information only as long as we need it for the purpose it was collected, and then delete it or make it anonymous:

1. orders, invoices, payment and delivery records: for as long as company, tax and accounting law requires, which can be up to eight financial years;
2. quotation requests and enquiries that do not lead to an order: two years from our last message;
3. newsletter addresses: until you unsubscribe, after which we keep only a suppression record so that we do not email you again;
4. server logs and abuse-prevention data: for the period the law requires us to keep such logs, and no longer than we need them, unless they are needed to investigate an incident.

7.2If we need to keep something longer to defend a legal claim or comply with a legal obligation, we keep only what is necessary and restrict who can see it.

8.1We use encrypted connections (HTTPS) across the site, limit access to the people who need it, protect our accounts with strong passwords and, where offered, two-step sign-in, and keep records only in services that provide access controls. No system is completely secure.

8.2If a breach affects your personal information, we will tell you without delay, say what happened and what we are doing about it, and report it to the authorities within the time the law sets. For incidents in India that includes the Indian Computer Emergency Response Team (CERT-In) and, once the DPDP Rules apply, the Data Protection Board. Where the UK GDPR or EU GDPR applies, it includes the relevant data protection authority.

8.3If you find a weakness in our website, please tell us through our Security & responsible disclosure notice.

9.1We set no cookies of our own to run the site and use no advertising, tracking or analytics tools. Our Cookie policy lists the one item we store in your browser, and what happens if we ever add anything else.

10.1In India, once the DPDP Act's rights provisions apply in May 2027, and in the meantime as a matter of our own practice, you can:

1. ask for a summary of the personal information we hold about you and how it is used, and the identities of the other parties we have shared it with;
2. ask us to correct, complete or update it;
3. ask us to erase it, unless we must keep it by law;
4. have your grievance heard and resolved (clause 12);
5. nominate another person to exercise these rights for you if you die or become unable to act.

10.2To use a right, write to contact@thecomposta.com or support@thecomposta.com from the address or number you used with us, and tell us what you want. We may ask you to confirm who you are. We reply within 30 days, and we do not charge for reasonable requests.

10.3You can withdraw your consent at any time, as easily as you gave it, by writing to the same addresses. Withdrawing does not affect what we did before, and it may mean we can no longer prepare a quotation or deliver an order. To stop the newsletter, see clause 4.

10.4From November 2026 you may also be able to give, review or withdraw consent through a Consent Manager registered with the Data Protection Board, where one is available. You never have to use one, and you can always deal with us directly.

10.5If the UK GDPR or EU GDPR applies to you, you also have the right to access your information, to have inaccurate information corrected, to have it erased, to restrict or object to our use of it (including where we rely on our legitimate interests), to receive the information you gave us in a portable format, and to withdraw consent. We reply within one month.

10.6If you live in a US state, Canada, Australia, the United Arab Emirates or another place with privacy rights of its own, we honour the access, correction and deletion requests that your law gives you. In Canada, the person accountable for our handling of personal information is our Grievance Officer. We do not sell personal information or share it for cross-context behavioural advertising, as those terms are used in US state privacy laws, so an opt-out signal from your browser, such as Global Privacy Control, has nothing to change.

11.1Our website and products are for adults. We do not knowingly collect information from anyone under 18, and we do not offer anything that needs a parent's consent. If you believe a child has given us personal information, write to us and we will delete it.

12.1If you are unhappy with how we have used your information, write first to our Grievance Officer at support@thecomposta.com. We acknowledge every complaint within 48 hours and aim to resolve it within one month. Our Grievance redressal policy sets out the steps.

12.2The DPDP Act's grievance provisions take effect in May 2027, and the Data Protection Board it creates is still being set up. Once it is established and operating, and after you have used our grievance process, you may complain to the Board if we have not resolved your concern.

12.3If you are in the UK, you may complain to the Information Commissioner's Office. We acknowledge a data protection complaint within 30 days and respond without undue delay, and our 48 hour acknowledgement is within that period. If you are in the EU, you may complain to the data protection authority where you live or work. In Germany that is the authority of your federal state.

13.1This policy is governed by the laws of India, and the courts at Gurugram have jurisdiction over disputes about it. This does not limit any right you have under the data protection or consumer law of the place where you live, or your right to go to a consumer commission, a regulator or a data protection authority.

14.1We may update this policy as our business or the law changes. We will post the new version here and change the “Last updated” date at the top of this page. If a change materially affects how we use your information, we will tell you before it takes effect.

15.1Nutrify Private Limited, 1st Floor, Plot No. B & B1, Vanijya Nikunj, Enkay Centre, Udyog Vihar Phase 5, Gurugram, Haryana 122016, India. Email contact@thecomposta.com or support@thecomposta.com. Phone +91 90535 19734, Mon to Sat, 9 am to 6 pm IST.