Privacy policy

Privacy Policy

Effective Date: [EFFECTIVE DATE]
Last Updated: [LAST UPDATED DATE]

At [STORE NAME] ("we", "us", "our", or "the Store"), we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how we protect it, and the rights available to you when you visit or purchase from [WEBSITE URL] (the "Website").

This policy is intended for customers in India and is designed to be consistent with applicable Indian data-protection and e-commerce requirements, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules and regulations, as they come into force and apply to us. The DPDP Rules, 2025 establish requirements including clear, understandable notices describing the personal data collected and the purposes for which it is processed.

1. Who We Are

The entity responsible for your personal data is:

Business/Store Name: [STORE NAME]
Legal Entity Name: [LEGAL ENTITY NAME, IF DIFFERENT]
Business Address: [BUSINESS ADDRESS]
Email: [EMAIL ADDRESS]
Phone: [PHONE NUMBER]
Website: [WEBSITE URL]

For questions, privacy requests, or complaints concerning your personal data, please contact us using the information above.

2. Information We Collect

We collect information that is reasonably necessary to operate our online store, process orders, provide services, communicate with customers, comply with legal obligations, and improve our Website.

2.1 Information You Provide Directly

Depending on how you interact with us, we may collect:

  • Full name

  • Email address

  • Mobile/telephone number

  • Billing address

  • Shipping/delivery address

  • Account login information, if you create an account

  • Products purchased or considered

  • Order history

  • Payment and transaction information

  • Return, refund, replacement, or exchange information

  • Customer-service messages and correspondence

  • Reviews, feedback, photographs, or other content you voluntarily submit

  • Information provided when subscribing to newsletters or promotional communications

2.2 Payment Information

When you make a purchase, payment may be processed by an independent payment gateway or payment service provider.

We generally do not need to store your complete credit-card number, debit-card number, CVV, UPI PIN, banking password, or other authentication credentials.

Payment information is handled by the relevant payment service provider in accordance with its security practices and privacy policy.

2.3 Information Collected Automatically

When you visit our Website, certain technical information may be collected automatically, including:

  • IP address

  • Browser type and version

  • Device type

  • Operating system

  • Approximate location derived from technical information

  • Pages viewed

  • Products viewed

  • Date and time of visits

  • Referring website or advertising source

  • Website interactions

  • Cookie identifiers and similar technologies

We use this information primarily for security, analytics, website functionality, and improving the customer experience.

2.4 Information From Third Parties

We may receive information from third parties that help us operate our business, such as:

  • Shopify or our e-commerce platform

  • Payment gateways

  • Courier and logistics providers

  • Advertising and analytics providers

  • Customer-support providers

  • Social-media platforms, where you interact with us through those platforms

We expect third parties that process personal data on our behalf to use appropriate safeguards and to process information only for legitimate business purposes.

3. How We Use Your Information

We may use personal information for the following purposes:

3.1 Processing and Delivering Orders

We use your information to:

  • Process purchases

  • Confirm orders

  • Accept and verify payments

  • Prepare products for dispatch

  • Arrange courier pickup

  • Deliver products to your address

  • Send order and delivery updates

  • Handle cancellations, returns, refunds, and replacements

3.2 Customer Support

We may use your information to:

  • Respond to questions and requests

  • Resolve complaints

  • Provide after-sales support

  • Investigate delivery or payment issues

  • Communicate regarding your orders

3.3 Website and Business Operations

We may use information to:

  • Operate and maintain our Website

  • Improve website functionality

  • Understand customer preferences

  • Analyse sales and website performance

  • Detect technical problems

  • Prevent fraud and unauthorized activity

  • Maintain business records

3.4 Marketing

Where permitted by applicable law and, where required, with your consent, we may use your contact information to send:

  • New-product announcements

  • Special offers

  • Discounts

  • Seasonal promotions

  • Newsletters

  • Other marketing communications

You can unsubscribe from promotional communications at any time.

Unsubscribing from marketing communications will not necessarily stop essential transactional messages, such as order confirmations, payment notifications, shipping updates, or information relating to an existing order.

3.5 Legal and Regulatory Compliance

We may process or disclose information when reasonably necessary to:

  • Comply with applicable Indian laws

  • Meet tax, accounting, or regulatory requirements

  • Respond to lawful government requests

  • Prevent fraud or unlawful activity

  • Establish, exercise, or defend legal claims

  • Protect our rights, property, customers, or business

4. Legal Basis and Consent

Where applicable under Indian data-protection law, we will process personal data based on your consent or another lawful basis permitted by applicable law.

Where processing is based on consent, you may withdraw your consent at any time using the method provided by us.

Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

Certain information may nevertheless need to be retained or processed where required or permitted by law, or where necessary to complete an order or fulfil another lawful business purpose.

The DPDP Act provides, among other things, that consent should be free, specific, informed, unconditional and unambiguous, and that withdrawal should be as easy as giving consent where consent is the basis for processing.

5. Cookies and Similar Technologies

Our Website may use cookies and similar technologies.

A cookie is a small text file stored on your device that can help a website remember information about your visit.

We may use cookies to:

  • Keep products in your shopping cart

  • Maintain your session

  • Remember preferences

  • Provide essential website functionality

  • Understand how customers use our Website

  • Measure website performance

  • Improve our products and services

  • Detect security issues

  • Support advertising or marketing activities, where applicable

Managing Cookies

You may be able to control or delete cookies through your browser settings.

However, disabling certain cookies may affect the functionality of our Website. For example, some shopping-cart, checkout, login, or security features may not work correctly.

Where required by applicable law, we will provide appropriate choices or controls for non-essential cookies and similar technologies.

6. Third-Party Services

We use third-party companies and service providers to help operate our business.

Depending on the services we use, these may include:

E-commerce Platform

[SHOPIFY OR OTHER PLATFORM NAME] may host or support our online store and process certain information required for website functionality and orders.

Payment Providers

We may use providers such as:

  • [RAZORPAY]

  • [STRIPE]

  • [PAYU]

  • [CASHFREE]

  • [OTHER PAYMENT PROVIDER]

The payment provider may process payment information according to its own privacy policy and terms.

Shipping and Courier Providers

We may share relevant customer information with shipping providers, such as:

  • [SHIPROCKET]

  • [DELHIVERY]

  • [BLUEDART]

  • [DTDC]

  • [OTHER COURIER PROVIDER]

Information may include your name, phone number, shipping address, order information, and other information reasonably necessary to deliver your order.

Analytics and Marketing Services

We may use services such as:

  • [GOOGLE ANALYTICS]

  • [META PIXEL]

  • [GOOGLE ADS]

  • [OTHER ANALYTICS/MARKETING SERVICES]

These services may use cookies or similar technologies to help us understand Website activity or measure advertising performance.

Important: You should remove any third-party service listed above that you do not actually use.

7. Sharing of Personal Information

We do not sell or rent your personal information as a standalone commercial product.

We may share personal information with trusted parties where reasonably necessary for operating our business, including:

  • E-commerce and hosting providers

  • Payment processors

  • Courier and logistics companies

  • Technology and IT service providers

  • Customer-support providers

  • Accounting and professional advisers

  • Marketing and analytics providers

  • Government authorities where legally required

  • Legal advisers or other parties where necessary to protect our legal rights

We aim to limit information shared with third parties to what is reasonably necessary for the relevant purpose.

8. International Data Transfers

Some service providers we use may process or store personal information outside India.

Where personal information is transferred outside India, we will take reasonable steps to ensure that such processing is carried out in accordance with applicable Indian law and any applicable contractual, security, or regulatory requirements.

9. Data Security

We take reasonable security measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, misuse, or destruction.

These measures may include:

  • Secure website connections

  • Encryption where appropriate

  • Access controls

  • Password protection

  • Restricted employee access

  • Secure payment processing through third-party providers

  • Monitoring for suspicious activity

  • Appropriate backup and recovery procedures

  • Reasonable organizational and technical safeguards

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

If we become aware of a personal-data breach that requires notification under applicable law, we will take appropriate steps to investigate, mitigate, and notify relevant persons or authorities as required.

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

  • Completing and documenting transactions

  • Providing customer support

  • Managing returns and refunds

  • Maintaining business and accounting records

  • Complying with tax and legal obligations

  • Resolving disputes

  • Preventing fraud

  • Enforcing our agreements

  • Meeting other lawful business requirements

When information is no longer required, we will take reasonable steps to delete, anonymize, or otherwise dispose of it, subject to applicable legal and regulatory requirements.

11. Customer Rights

Subject to applicable law and any conditions or exceptions provided by law, you may have rights regarding your personal data.

These may include the right to:

11.1 Access Information

Request information about the personal data we process about you and information about how it is being used, where such access is provided by applicable law.

11.2 Correction

Ask us to correct personal information that is inaccurate, incomplete, or outdated.

11.3 Deletion

Request deletion of personal information where you are legally entitled to request deletion.

We may need to retain certain information where required by law or where another lawful basis permits or requires continued processing.

11.4 Withdraw Consent

Where processing is based on consent, you may withdraw that consent.

11.5 Raise a Complaint

You may contact us if you believe your personal information has been handled improperly or if you have concerns about our privacy practices.

11.6 Nominate Another Individual

Where applicable under Indian data-protection law, you may have the right to nominate another individual to exercise certain rights on your behalf in the event of death or incapacity.

The specific rights available to you may depend on the applicable law and the circumstances of the processing.

To exercise your rights, contact us at [EMAIL ADDRESS].

We may need to verify your identity before fulfilling certain requests to protect your account and personal information.

The DPDP Act also provides rights relating to access, correction/erasure, grievance redressal, and withdrawal of consent, subject to the Act and applicable rules.

12. Children's Privacy

Our Website is intended for general consumers and is not knowingly directed toward children in circumstances where applicable law requires parental consent.

We do not knowingly request or intentionally collect personal data from children in violation of applicable law.

If you believe that a child has provided personal information to us in circumstances where this should not have occurred, please contact us at [EMAIL ADDRESS].

13. Customer Reviews, Photos, and User-Submitted Content

If you voluntarily submit a product review, photograph, testimonial, comment, or other content, we may use that content for legitimate business purposes, including displaying it on our Website or marketing channels, subject to the terms applicable to that submission.

Please do not submit sensitive personal information or information belonging to another person without appropriate permission.

If you want us to remove content that you previously submitted, contact us at [EMAIL ADDRESS].

14. Links to Other Websites

Our Website may contain links to third-party websites, including payment providers, social-media platforms, courier services, or other websites.

We are not responsible for the privacy practices, content, security, or policies of third-party websites.

We recommend reviewing the privacy policy of any third-party website you visit.

15. Data Breaches and Security Incidents

If we become aware of a personal-data breach, we will take reasonable and appropriate measures to:

  1. Investigate the incident.

  2. Contain and mitigate the effects.

  3. Restore affected systems where appropriate.

  4. Assess whether notification is required.

  5. Notify affected individuals and/or relevant authorities where required by applicable law.

We will cooperate with applicable regulatory requirements concerning personal-data breaches.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • Changes to our business

  • Changes to our Website

  • New services or technologies

  • Changes to third-party service providers

  • Changes in applicable laws or regulations

  • Changes to our data-processing practices

When we update this policy, we will change the "Last Updated" date shown at the top.

Where required by law, we will provide additional notice or obtain consent for material changes.

We encourage you to review this Privacy Policy periodically.

17. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or wish to make a privacy-related complaint, please contact us:

[STORE NAME]
Legal Entity: [LEGAL ENTITY NAME]
Address: [BUSINESS ADDRESS]
Email: [EMAIL ADDRESS]
Phone: [PHONE NUMBER]
Website: [WEBSITE URL]

Privacy/Grievance Contact

Name: [PRIVACY CONTACT / GRIEVANCE OFFICER NAME]
Email: [GRIEVANCE EMAIL ADDRESS]
Phone: [GRIEVANCE PHONE NUMBER]
Address: [GRIEVANCE ADDRESS, IF DIFFERENT]

We aim to acknowledge and handle privacy-related requests and complaints within the timeframe required by applicable law.

18. Governing Law

This Privacy Policy shall be governed by the laws applicable in India.

Any dispute concerning this Privacy Policy shall be subject to the applicable courts and legal processes having jurisdiction over [BUSINESS LOCATION / CITY, STATE], subject to applicable law.

Quick Setup Before Publishing

Replace these placeholders before putting the policy on your Shopify store:

  • [STORE NAME] → Your brand/store name

  • [LEGAL ENTITY NAME] → Your legal business/entity name

  • [BUSINESS ADDRESS] → Your business address

  • [EMAIL ADDRESS] → Your customer/privacy email

  • [PHONE NUMBER] → Your customer-service number

  • [WEBSITE URL] → Your store URL

  • [EFFECTIVE DATE] → Date you publish the policy

  • [PRIVACY CONTACT / GRIEVANCE OFFICER NAME] → Appropriate contact person

  • Remove payment gateways, courier companies, analytics tools, and advertising services that you do not actually use

  • Add every third-party service that does receive customer information

Because India's DPDP Act and Rules have a phased commencement timeline, the exact obligations applying to your store can depend on when particular provisions become effective. The government notified the DPDP Rules in November 2025 with staggered commencement dates.

Important: This template is intended as a practical starting point, not a guarantee of legal compliance. Before launch—particularly if you collect marketing consent, use Meta/Google advertising, sell internationally, or use multiple payment/courier providers—consider having an Indian lawyer review the final version.