Last updated: [DATE]
This policy explains what personal data we collect, why, and what rights you have. It is written to comply with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
Who we are
[REGISTERED BUSINESS NAME], [FULL ADDRESS], is the data fiduciary responsible for your personal data. Contact us at [EMAIL] about anything in this policy.
What we collect
When you place an order: your name, email address, phone number, billing and shipping address, and the details of what you bought.
When you begin checkout but don’t complete it: if you have entered your email address, we may store it in order to contact you about your incomplete order. You can opt out of these messages at any time.
When you create an account: your name, email, password (stored encrypted), and your order history.
When you contact us: whatever you choose to include in your message.
Automatically: IP address, browser and device type, pages viewed, and referring source, collected through cookies and analytics tools.
What we never collect: your card number, CVV, UPI PIN or bank credentials. These go directly to Razorpay and are never visible to us.
Why we use it
- To process, fulfil and deliver your order
- To send order confirmations, dispatch updates and service messages
- To respond to your questions and handle warranty or return requests
- To contact you about an incomplete order, where you have given us your email
- To send marketing messages, only where you have opted in
- To detect and prevent fraud
- To meet our legal, tax and accounting obligations
- To understand how the Site is used and improve it
Legal basis
We process your data on the basis of your consent, and where necessary to perform our contract with you, to comply with law, and for our legitimate business interests in operating and securing the Site.
Who we share it with
We share personal data only with parties who need it to serve you:
- Razorpay — to process your payment
- Courier partners — name, address and phone, to deliver your order
- [EMAIL PROVIDER, e.g. Brevo] — to send transactional and marketing email
- Google Analytics and Meta — anonymised usage data
- Our hosting provider — which stores the Site and its database
- Government authorities, where required by law
We do not sell your personal data.
How long we keep it
Order records for eight years, as required for tax purposes. Marketing contacts until you unsubscribe. Analytics data for up to 26 months. Abandoned-cart email addresses for 90 days.
Security
We use HTTPS across the Site, restrict admin access, and require two-factor authentication for staff accounts. No system is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password.
Your rights
Under the DPDP Act you may:
- Ask what data we hold about you
- Ask us to correct inaccurate data
- Ask us to erase your data, subject to our legal retention obligations
- Withdraw consent for marketing at any time
- Nominate someone to exercise these rights if you are unable to
- Raise a grievance with us, and escalate to the Data Protection Board of India
Write to [EMAIL] to exercise any of these. We will respond within 30 days.
Cookies
We use cookies that are necessary for the Site to work — remembering your cart and keeping you logged in — and analytics and advertising cookies, which you can decline. You can also block cookies in your browser, though the Site may not work fully if you do.
Children
The Site is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe we have, write to us and we will delete it.
Grievance Officer
As required under Indian law:
Name: [NAME] Designation: Grievance Officer Email: [EMAIL] Address: [ADDRESS] Response time: within 30 days of receipt
Changes
We may update this policy. Material changes will be announced on this page with a revised date.