Draft notice: This policy is a template and must be reviewed by a qualified legal professional and completed with the business's details before the website goes live.
Last updated: [date]
Reshi Saffron and Dryfruits ("we", "us", "our"), operated by [Registered business name], [registered address], respects your privacy. This policy explains how we collect, use, store, share and protect your personal data when you use our website and services, in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made under it.
1. Information we collect
- Account details: name, email address, mobile number and password (stored only as a secure one-way hash).
- Order details: delivery addresses, items purchased, order history, cancellation and refund requests, and any photos you upload with a request.
- Payment information: payments are processed by our payment partner (Razorpay). We receive a payment reference and status; we never receive or store your full card number, CVV, UPI PIN or net-banking credentials.
- Support communications: contact form enquiries, live-chat messages and attachments.
- Technical data: IP address, browser type and essential cookies needed to keep you signed in, maintain your cart and protect the site.
2. How we use your information
We use your data to process and deliver orders, take payments, handle cancellations and refunds, provide customer support, send transactional emails (order, payment, shipping, refund and account notifications), prevent fraud and abuse, comply with legal obligations, and — only if you opt in — send marketing emails, which you can unsubscribe from at any time.
3. Legal basis and consent
We process personal data on the basis of your consent, for the performance of your order, and for legitimate uses permitted by law. You may withdraw consent at any time; this will not affect processing already carried out.
4. Sharing your information
We share only what is necessary with: payment processors (Razorpay), courier and logistics partners (name, phone and address for delivery), email delivery providers, cloud hosting and storage providers, and authorities where required by law. We do not sell your personal data.
5. Data storage and security
Your data is stored on secure servers with encryption in transit (HTTPS), hashed passwords, role-based staff access, and audit logs for sensitive administrative actions. No method of transmission is completely secure, but we take reasonable measures to protect your information.
6. Data retention
We keep account data while your account is active. Order and invoice records are retained for the period required by tax and accounting laws ([e.g. 8 years]). Support conversations are retained for [period]. You may request deletion of your account; we will delete or anonymise data that we are not legally required to retain.
7. Your rights
You have the right to access, correct, update and erase your personal data, to withdraw consent, and to nominate another person to exercise your rights. Most details can be updated in My Account; for other requests, contact our Grievance Officer.
8. Cookies
We use essential cookies for sign-in sessions, shopping cart and security. We do not use third-party advertising cookies.
9. Children
Our services are intended for users aged 18 and above. We do not knowingly collect data from children.
10. Grievance Officer
Name: [Grievance Officer name] Email: [grievance@yourdomain.com] Phone: [phone] Address: [address]
We acknowledge complaints within 48 hours and aim to resolve them within 30 days.
11. Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page.