Draft for legal review. This text is a starting point, not legal advice. Highlighted [items] must be completed by the business, and a qualified lawyer should review it before launch.
1. Who we are
[registered business name], [registered business address], operates this website and decides why and how your personal data is used (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023). Contact: [support email].
2. Data we collect
- Identity and contact: name, email address, mobile number.
- Delivery details: shipping and billing address.
- Order information: items bought, order value, order and payment status. Card, UPI and bank details are handled by our payment provider; we do not store them.
- Enquiries and reviews: messages you send us and reviews you submit.
- Account data, if you create an account: login details and saved addresses.
- Technical data: device and browser information, IP address, pages viewed and referral source, collected through cookies and similar tools.
- Marketing preferences: whether you have agreed to receive promotional messages.
3. How and why we use your data
- To process and deliver your orders, take payment, issue refunds and provide order updates and support.
- To respond to your enquiries and manage complaints.
- To keep our website secure, prevent fraud and keep records required by law (for example tax and accounting records).
- To send you promotional messages about OVEDAA, only if you have given consent. You can withdraw consent at any time.
- To understand how the site is used and improve it, using analytics.
We process your data on the basis of your consent or for purposes the law allows, such as fulfilling a request you made or complying with legal obligations.
5. Storage and transfers
Your data may be stored and processed on servers located in [country / region]. [Describe any transfer outside India and safeguards, if applicable.]
7. How long we keep data
We keep personal data only as long as needed for the purposes above. Order and invoice records are kept for [period] to meet legal and accounting requirements, even if you ask us to delete your account. Marketing data is kept until you withdraw consent. Enquiries are kept for [period].
8. Your rights
Under applicable law you may:
- ask for a summary of the personal data we hold about you and how it is used;
- ask us to correct inaccurate or incomplete data and to update it;
- ask us to erase your data, subject to records we must keep by law;
- withdraw consent for marketing or other consent-based processing at any time;
- nominate another person to exercise your rights if you die or become unable to do so;
- make a complaint to our Grievance Officer, and to the Data Protection Board of India if you are not satisfied.
To exercise these rights, email [support email]. We may need to verify your identity first.
9. Marketing messages
Marketing emails, SMS and WhatsApp messages are sent only with your consent. Every message includes a way to opt out. Order and service messages are separate and are sent even if you opt out of marketing.
10. Children
Our website is not intended for children under 18. We do not knowingly collect personal data of children without verifiable parental consent. If you believe a child has given us data, please contact us.
11. Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections, access controls and limited access for staff and providers. No system is completely secure, and we will notify you and the authorities of a data breach where required by law.
12. Grievance Officer
Name: [grievance officer name]. Email: [grievance email]. Address: [address]. We aim to acknowledge complaints within [X] and resolve them within [Y].
13. Changes to this policy
We may update this policy. The version and effective date above show when it last changed, and we will tell you about material changes where required.