1. Introduction

Dabur India Limited referred to as (“We”,” Us”, “Our”, “Dabur”) takes your (“You”, “User”, “Subscriber”, “Customer”, “Data Principal) privacy very seriously and is committed to protecting and respecting your online privacy and recognize your need for appropriate protection and management of any personal data you share with us.

This Privacy Notice applies to all services offered by us and to all individuals whose personal data is collected, processed or stored on our websites, applications or systems, except the services provided on websites, applications or systems that have separate privacy policies that do not incorporate this Privacy Notice. If You provide Us with your Personal Data including your contact details and any other information that will allow Us to identify You and provide You with Our services, we will process it according to this policy.

This Privacy Notice also applies comprehensively to all aspects of our company's operations, encompassing all entities, subsidiaries, and affiliates under our control. This ensures uniformity and consistency in the protection of user data across our entire organizational framework.

References to “Dabur” in this Notice means Dabur India Limited and any company directly or indirectly owned and/or controlled by Dabur India Limited that you are interacting with or have a business relationship with.

2. Definitions

• Consent : Free, specific, informed, unconditional and unambiguous with a clear affirmative action, signifying an agreement to the processing of the personal data of Data Principals for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
• Cookies:A small text file stored on a user machine that may later be retrieved by a web server from the machine. Cookies allow web servers to keep track of the end user’s browser activities, and connect individual web requests into a session.
• Data Fiduciary: Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data. In this context, Dabur.
• Significant Data Fiduciary: Any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under Section 10 of the DPDP Act.
• Data Retention: The policies and processes used within Dabur for determining the time period for archiving and storing of personal data.
• Data Principal: the individual to whom the personal data relates and where such individual is a person with disability, includes her lawful guardian, acting on her behalf. In this case “You”, “User”, “Subscriber”, “Customer”.
• Data Processing :A wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
• Data Processor :Any person who processes personal data on behalf of a Data Fiduciary (i.e., Dabur).
• Personal Data :Any data about an individual who is identifiable by or in relation to such data.
• Personal Data Breach :Any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.
• Applicable Data Privacy Laws :Includes Digital Personal Data Protection Act 2023, DPDPA Draft Rules, Information Technology Act, 2000 along with Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and other applicable industry specific legislations that govern the handling of personal data

3.What Personal Data do we collect?

Dabur pledges to gather user data through lawful and transparent means, ensuring explicit consent from the Data Principal where necessary. Our data collection practices are designed to adhere to applicable laws and regulations, and we strive to provide clear information regarding the purposes and methods of data collection. We may collect your Personal Data such as:

• Identity and Contact Information: Your name, personal address, mobile number, email address, company name, and other contact details.
• Technical and Device Information:Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.
• Usage and Interaction Data:Information about how you use our websites and services, including traffic data, browsing history, search queries, page views, and interaction patterns.
• Communications and Inquiry Data:Information you provide when contacting our customer service or support teams, submitting inquiries, requesting consultations, expressing interest in products or services, or engaging with us via email, phone, chat, or contact forms
• Marketing and Preference DataYour preferences regarding marketing communications, newsletter subscriptions, and promotional offers, including engagement metrics such as email opens, clicks, and content interactions.
• Location DataWith your consent, we may collect your current location such as Pin Code etc. to provide localized content, promotions, or advertising.
• User-Generated Content:Testimonials, reviews, feedback, and other content you choose to share on our websites or platforms.
• Business Information:Information about your company including company name, year of incorporation, contact details, distribution details, etc.
• Other Information: Any other personal data necessary to provide services via our websites, including data collected through forms, surveys, or interactions with our digital platforms.

4. How do we collect the personal data?

We may collect your Personal Data through the following means:

• When you register with us as a customer, vendor, distributor, or franchise applicant.
• When you submit inquiries, feedback, or complaints via contact forms, email, phone, or chat.
• When you subscribe to receive marketing communications, newsletters, or promotional offers.
• When you participate in surveys, market research, or user experience studies.
• When you fill out online forms indicating your interests or preferences.
• Through cookies and similar technologies placed on your device while using our websites.
• When you interact with our advertisements, including clicking on display ads and making purchases through our retail partners.
• When you open, read, or click on content in our emails or SMS communications, allowing us to understand your interests and improve future content.
• When you visit the website to serve relevant advertising or event information.
• When you provide information to selected third parties and consent to its sharing with us (e.g., age, gender, lifestyle, interests), which we may use to personalize content and advertising.

5. What is the purpose of collecting personal data ?

Your Personal Data will only be used for the purpose for which it is collected, which includes but is not limited to:

• Customer Support and Communication:
• • To respond to inquiries, feedback, or complaints and provide updates regarding user requests.
  • To authenticate the identity of individuals contacting us via various channels.
• Marketing and Promotional Communication:
• • To send newsletters, promotional offers, and marketing communications tailored to user preferences.
• User Experience Personalization:
• To personalize content, recommendations, and interfaces based on user behavior and preferences.
• Website Analytics and Performance Monitoring:
• To analyze website usage, monitor performance, and improve functionality.
• Security and Fraud Prevention:
• To detect and prevent fraudulent, unauthorized, or suspicious activities.
• Legal and Regulatory Compliance:
• To comply with applicable laws, regulations, and legal obligations
• To respond to legal requests and enforce our terms of service
• Third-Party Service Enablement:
• To integrate and enable features provided by third-party services (e.g., payment gateways, social media logins).
• Market Research and Product Improvement:
• To conduct market research and gather insights to enhance our products and services.
• User-Generated Content and Testimonials:
• To collect and feature user experiences, reviews, and opinions shared on our websites.

6. How we use Cookies?

A cookie is a small text file that a website saves on your computer or mobile device when you visit the said site. It enables the website to remember your actions and preferences (such as login, location, etc.) over a period, so you don’t have to keep re-entering them whenever you come back to the site or browse from one page to another, thereby making your next visit easier.

We use cookies across the platform and its related websites (collectively, “the sites”, “Platform”, “Website”) to save your session as You browse the Platform, deliver advertisement to you, etc.

7. Your Rights

• Right to information of personal data

You have the right to obtain information about your personal data from Us. This includes confirming whether We are processing or have processed your personal data, receiving a summary of the personal data being processed, and knowing the identities of all Companies/ Organizations (also called as “Data Fiduciaries”) with whom your personal data has been shared.

• Right to correction and erasure of personal data

You have the right to correct and erase your personal data, as per the applicable laws and prescribed procedures. When you request correction and erasure, we should correct any inaccurate or misleading data, complete any incomplete data, update your data, and erase data that is no longer necessary, except when retention is required for a legal purpose.

• Right of grievance redressal

You have the right to easily register a grievance with Us. If you are unsatisfied with Our response or receive no response within the prescribed period (i.e., 30 days), you can file a complaint with the Data Protection Board of India according to the prescribed procedure.

• Right to nominate

You have the right to nominate another individual, as prescribed, who will exercise your rights as a Data Principal in case of your death or incapacity. "Incapacity" refers to your inability to exercise your rights due to unsoundness of mind or body, as defined by Digital Personal Data Protection Bill.

How to exercise your rights?

We will respond to your request as soon as reasonably possible. In general, our response will be within Thirty (30) business days. Should we not be able to respond to your access request within Thirty (30) business days after receiving your request, we will inform you in writing within Thirty (30) business days of the time by which we will be able to respond to your request. If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under any applicable law or regulation).

Please note that depending on the request that is being made, we will only need to provide you with access to the personal data contained in the documents requested, and not to the entire documents themselves. In those cases, it may be appropriate for us to simply provide you with confirmation of the personal data that Dabur has on record.

If you have any questions about how Dabur processes your personal data or exercise any of the above rights related to your personal data, please send an e-mail to: corpcomm@dabur.com or submit a request through the “Contact Us” form on our website available at: https://www.dabur.com/contact-us

8. Children’s Personal Data

Our platform is intended for use by individuals aged 18 and above. If you are under the age of 18, while you may browse our websites/platform, you should not make purchases, register for services, or submit any personal data to us.

We, along with our associates and affiliates, do not knowingly collect personal data from individuals under the age of 18. If you believe that a child has inadvertently provided us with their personal data, please notify us immediately using the contact details provided in our Grievance Redressal section.

Upon receiving such a notification, we will take prompt and appropriate action to delete the child’s personal data from our records. If we identify that we have unintentionally collected personal data from a child below the age of 18, we will remove that child's personal data from our records as soon as practical. We are committed to protecting the privacy of children and ensuring that their data is handled with the utmost care and responsibility.

9. Self-Declaration of Disability

Where applicable, individuals are required to self-declare if they are a person with a disability and provide the necessary details to facilitate this declaration. This information is essential for us to obtain verifiable consent from a parent or guardian when required for the collection of personal data.

We are committed to ensuring that all necessary measures are taken to protect the rights and privacy of individuals with disabilities, and we will handle this information with the utmost care and confidentiality.

10. Withdrawal of Consent

The consent that you provide for the collection, use and disclosure of your personal data will remain valid until such time it is being withdrawn by you in writing. You may choose to withdraw your consent for the processing of your personal data at any time. However, please be aware that withdrawing your consent may affect our ability to provide you with certain services, benefits, or communications that rely on your consent.

Please note that withdrawing consent does not affect our right to continue to collect, use and disclose personal data where such collection, use and disclosure without consent is permitted or required for legitimate purpose under applicable laws.

Upon receipt of your written request to withdraw your consent, we may require reasonable time for your request to be processed and for us to notify you of the consequences of us acceding to the same, including any legal consequences which may affect your rights and liabilities to us. In general, we shall seek to process your request within thirty (30) business days of receiving it.

11. Data Retention & Storage

Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “Purposes of processing”. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements. In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for a set period of time.

The total retention period is defined and will be implemented in accordance with Dabur’s data retention policy and applicable data protection laws. After the end of the data retention period, your personal data will be deleted or anonymized.

We shall, unless retention is necessary for compliance with any law for the time being in force, erase personal data in a secure manner

• When you exercise your right to delete
• As soon as it is reasonable to assume that the specified purpose of such data is no longer necessary.

12. Accuracy of Personal Data

We rely on the personal data provided by you (or your authorized representative). It is your responsibility to ensure that the personal data you submit is accurate, complete, and up to date to ensure smooth communication and accurate recordkeeping. Please update us if there are changes to your personal data by informing us at corpcomm@dabur.com or submit a request through the “Contact Us” form on our website available at: https://www.dabur.com/contact-us

If you do not provide complete and accurate personal data to Dabur it may adversely affect our ability to deliver services to you, process your orders, or communicate effectively. Inaccurate information could also lead to delays or complications in fulfilling your requests or legal obligations.

13. International Transfer

Dabur may transfer your personal data cross-border in accordance with notification by the Central Government of India. Your personal data may be transferred to countries outside India that may not provide the same level of data protection. In such cases, we will ensure adequate safeguards are in place to protect your personal data.

We maintain processes designed to help ensure that any processing of personal data is consistent with this Privacy Notice and protects the confidentiality, availability, and integrity of your personal data in compliance with applicable law. Where required by law, we put in place additional legal mechanisms designed to help ensure adequate data protection for your personal data when transferred to another country.

In addition, we may disclose or transfer your personal data in the event of a re-organization, merger, sale, joint venture, assignment, or other transfer or disposition of all or any portion of our business.

14. Disclosure of Personal Data

Your Personal Data will be accessed internally by Dabur employees in accordance with their scope of work and competence, only on a need-to-know basis.

Your Personal Data may be shared with, or transferred to:

• Dabur Group including affiliated companies and any subcontractors, agents or service providers who work for us or provide services to us or affiliated companies (including their employees, sub-contractors, service providers, directors and officers)
• Trusted third-parties like
• Our vendors
• Delivery partners
• Advertisers, advertising networks, advertising servers
• Social media networks
• Analytics companies
• Government or regulatory authorities, where required by law
• Lawyers and advisors for legal proceedings
• Anyone you authorize

Dabur requires third parties with whom we share personal data to adhere to the same stringent privacy standards as upheld by Dabur. Disclosure of personal data is done in accordance with our privacy policy and contractual agreements that mandate compliance with our data protection principles.

15. Security of Personal Data

We have implemented reasonable security safeguards to protect your personal data from accidental loss, misuse, access without authorization, alteration, or disclosure. Additionally, we restrict access to your personal data to employees, agents, contractors, and other third parties on a need-to-know basis. They will only process your personal data according to Dabur’s instructions.

Dabur is dedicated to upholding the highest standards of data protection. Our policies and procedures are continuously reviewed and updated to align with leading industry standards and regulatory requirements to safeguard the privacy and security of user data.

16. Data Breach Notification

In the unfortunate event of a data breach, we are dedicated to promptly notifying the affected users and the Data Protection Board. We will do so without undue delay and, if possible, within 72 hours of becoming aware of the breach. We have established an internal process to notify the designated Authority and the Data Principals of any data breach.

17. Your Responsibility

Notwithstanding the obligation for Dabur to put in place all necessary means to comply with the accuracy principle under applicable data protection laws, You agree to:

• Comply with the provisions of all applicable laws for the time being in force while exercising Your rights
• Ensure not to impersonate another person while providing their personal data for a specified purpose
• Ensure not to register a false or frivolous grievance or complaint with Us or the Data Protection Board
• Furnish only such information as is verifiably authentic, while exercising the right to correction and erasure

18. Links to Other Websites

Our Websites/Platforms may contain links to websites of other organizations. This policy does not cover how that organization processes Personal Data. We encourage you to read the privacy policies on the other websites you visit.

19. Availability of the Privacy Notice in Other Languages

This Privacy Notice is also available in other languages including languages specified in the Eighth Schedule to the Constitution of India. In the event of any conflict between the English version and any translations of this Privacy Notice, the English version shall prevail.

20. Grievance Redressal

If you have any concerns, complaints, or grievances regarding the processing of your Personal Data or the exercise of your rights, you may contact our designated Grievance Officer using the details provided below.

We are committed to addressing your concerns in a timely and transparent manner. In accordance with DPDPA, we will respond to your grievance within seven (30) working days from the date of receipt.

Grievance Officer Name : Mr. Byas Anand Designation : Corporate Communication Head Email : corpcomm@dabur.com Address : Dabur India Limited, Kaushambi Corporate Office Sahibabad, Ghaziabad - 201010, Uttar Pradesh, India Contact Number : 0120-3962100 or 0120-4374935

If you are not satisfied with the response received, you may also have the right to escalate the matter to the Data Protection Board of India, as per the provisions of DPDPA.

Please note that we will not charge you for any request. Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we shall generally inform you of the reasons (except where we are not required to do so under any applicable law or regulation).

21. Updates to this Privacy Notice

We may update and amend this privacy notice from time to time by posting an amended version on our website. The amended version will be effective as of the date it is published. When we make material changes to this Privacy Notice, we'll provide users with notice as appropriate under the circumstances, e.g., by displaying a prominent notice on the website or by sending an email.

This Privacy Notice was last updated on 27th October 2025