Privacy Policy

1. Who We Are

The data fiduciary for all personal data collected through this website is Vidhi Vidhan Enterprises Private Limited(CIN: U47912MH2026PTC123456, GSTIN: 27AAACV1234N1Z5), with its registered office at Office 412, Trade World, Kamala Mills Compound, Senapati Bapat Marg, Lower Parel, Mumbai — 400013, Maharashtra, India. Our operating brand is Karigari and our domain is karigaricraft.shop. References to "we", "us", or "our" throughout this policy mean Vidhi Vidhan Enterprises Private Limited.

2. Information We Collect

• Account information: When you create an account, we collect your full name, email address, and a password (stored as a salted hash — never in plain text). You may optionally add a phone number and shipping addresses to your profile.
• Order and transaction data: When you place an order, we collect your billing name, delivery address (street, city, state, PIN code), phone number, and a record of items purchased, quantities, sizes, prices, coupon codes applied, and the payment method type (card, UPI, net banking, or cash on delivery). We do not store full card numbers or CVV values; these are handled exclusively by our payment gateway partners.
• Device and usage data: Our servers and analytics tools automatically record your IP address, browser type, operating system, referring URL, pages visited, time on page, and click paths. This data is used in aggregate form to improve site performance and cannot on its own identify you.
• Cookies: We use strictly necessary cookies to keep your session active and your cart intact. We also use analytics cookies (via anonymised tools) to understand how visitors navigate the site. You may disable non-essential cookies via your browser settings; doing so will not prevent you from placing orders, but may affect certain features such as personalised product recommendations.

3. How We Use Your Information

We use your personal data to: (a) process and fulfil your orders, including communicating dispatch, tracking updates, and delivery confirmations; (b) manage your account and allow you to view order history; (c) send transactional emails (order confirmation, invoice, return confirmation) that are necessary for the service; (d) send marketing emails, WhatsApp messages, or SMS about new collections, sales, and events — only if you have opted in; (e) detect and prevent fraud, chargebacks, or abuse of our platform; (f) comply with legal obligations such as GST invoice retention, consumer grievance redressal, and statutory reporting; and (g) improve our website, product catalogue, and customer experience through anonymised analytics.

4. Lawful Basis for Processing

Under the DPDP Act, 2023, we process your personal data on the following grounds: Contract performance — processing necessary to deliver the goods you ordered and to manage your account; Consent — for marketing communications, which you may withdraw at any time; Legitimate interests — for fraud prevention, security, and aggregate analytics that do not override your fundamental rights; and Legal obligation — for GST record-keeping, statutory audits, and grievance redressal as mandated by the Consumer Protection (E-Commerce) Rules, 2020. We adhere to the reasonable security practices prescribed under Rule 8 of the IT (Sensitive Personal Data) Rules, 2011.

5. Sharing with Third Parties

• Payment gateways: We integrate with Razorpay and Cashfree Payments to process card, UPI, and net banking transactions. When you complete a payment, your transaction data is processed directly on their PCI-DSS-compliant servers. We receive only a transaction reference ID and payment status.
• Courier and logistics partners: We share your name, delivery address, and phone number with our shipping partners — Delhivery, Bluedart, and India Post — solely to complete delivery of your order. These partners are contractually obligated not to use your data for any other purpose.
• Analytics: We use analytics tools configured to anonymise IP addresses before storage. No personally identifiable profile is created with third-party analytics providers. Aggregate traffic reports do not contain individual user data.
• Legal disclosure: We may disclose your personal data if required to do so by a court order, statutory authority, law enforcement agency, or other government body under applicable Indian law.

6. Data Retention

Order records and associated personal data are retained for a minimum of seven years from the date of transaction, as required under the Companies Act, 2013 and GST regulations. Account information is retained for as long as your account is active. If you delete your account, we will remove marketing data within 30 days; order records will be retained for the statutory period in anonymised form. Marketing consent is retained until you withdraw it; upon withdrawal, we will cease communications within five business days.

7. Your Rights

Under the DPDP Act, 2023, you have the right to: (a) access a summary of the personal data we hold about you; (b) correct inaccurate or incomplete data; (c) erase your personal data, subject to our statutory retention obligations; (d) data portability — receive your order and account data in a machine-readable format; (e) withdraw consent for marketing at any time using the unsubscribe link in any email or by contacting us; and (f) nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. To exercise any of these rights, email our Grievance Officer at grievance@karigaricraft.shop. We will respond within 72 hours of receipt and resolve your request within 30 days.

8. Children's Privacy

Our platform is not directed at children below 18 years of age. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal information without consent, please contact us immediately at grievance@karigaricraft.shop. Upon verification, we will delete all such data promptly.

9. Cookies and Analytics

Session cookies are placed on your device when you visit our website and are deleted when you close your browser. Persistent cookies remember your preferences (e.g., cart contents, login state) for up to 30 days. Analytics cookies, which are anonymised, may persist for up to 13 months in line with industry standard retention for statistical purposes. You can manage your cookie preferences through your browser's privacy settings. Our site does not respond to Do Not Track signals at this time; however, we do not build individual profiles for advertising purposes.

10. Cross-Border Data Transfers

Some of our analytics and infrastructure service providers store data on servers located in the European Union or the United States. Where such transfers occur, we ensure adequate safeguards are in place — typically through standard contractual clauses or service providers certified under applicable data transfer frameworks. Your order data and payment data are processed and stored within India by our primary service providers.

11. Security Measures

We implement industry-standard security measures including TLS 1.2+ encryption for all data in transit, AES-256 encryption for sensitive stored data, access controls restricted to authorised personnel, and regular security audits. Passwords are stored using a one-way hashing algorithm with a unique salt per account. Despite these measures, no system is completely secure; in the event of a data breach that is likely to result in harm to you, we will notify you and the Data Protection Board as required under the DPDP Act within the prescribed timelines.

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where the change significantly affects your rights, notify you via email. Continued use of the website after any update constitutes your acceptance of the revised policy. We encourage you to review this page periodically.