Privacy policy

PRIVACY POLICY

This Privacy Policy explains how we collect, use, share and protect your personal data. Please read it together with the notice we show you at the point of collecting your consent. We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. When we make material changes, we will post the updated Policy on this page with a revised “Last updated” date and, where required, seek your fresh consent. We encourage you to review this page periodically.

1. Personal Data Collected and Usage

We collect only the personal data we need, and use each item only for the specific purpose for which it was collected. The following describes what we collect and why:

Identity and contact details (name, email address, phone number) to create and manage your account, fulfil your orders, provide customer support, and send you order-related updates.

Order and delivery details (shipping address, billing address, order history, product preferences) to process and deliver your orders and handle returns, exchanges and refunds.

Transaction details (payment status, order value) to confirm and record your purchases (see Section 3 for what we do not collect).

Communications (the content of your messages, queries, reviews or feedback) to respond to you and improve our products and service.

Marketing contact details (email address) to send newsletters and promotional offers, only where you have opted in. Opting out of marketing does not affect transactional emails.

Technical and usage data (browser type, device type, operating system, IP address, referring website, pages viewed, cart activity) to operate, secure and improve our website and analyse usage trends.

Legal basis. We process your personal data on the basis of the consent you give us at the point of collection. Some processing necessary to fulfil an order you have placed may be carried out as a “legitimate use” permitted under the Digital Personal Data Protection (DPDP) Act. Marketing communications are always sent on the basis of your separate, opt-in consent, which you may withdraw at any time. We do not knowingly collect any sensitive category of data beyond what is listed above; if that changes, we will update this Policy and obtain fresh consent where required.

2. Data Collection and Consent

We collect personal data directly from you when you create an account, place an order, subscribe to our newsletter or contact us, and automatically through cookies and similar technologies when you browse our website (see Section 5).

Before or at the time we collect your personal data, we present a clear, plain-language notice describing the specific data we collect and the purpose of each use. Where we rely on your consent, you provide it through a clear affirmative action. You may withdraw your consent at any time by emailing us at the address in Section 10 or using the unsubscribe link in our emails. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer provide certain services (for example, completing a pending order).

3. Payments and Information We Do Not Store

All online payments are processed by secure, PCI-DSS compliant third-party payment gateways. We do not collect, store or have access to your card number, CVV, UPI PIN, net-banking credentials, or wallet login details. This information is provided by you directly to the payment gateway and is never retained on our servers. We receive only confirmation of whether a payment succeeded or failed, together with a reference for your order.

4. How We Share Your Personal Data

We do not sell, rent or trade your personal data, customer list or newsletter subscriptions to anyone. We share personal data only with the following recipients, and only to the extent necessary:

Service providers (data processors) who help us operate our business; for example, payment gateways, logistics and courier partners, IT and hosting providers, and email or marketing tools. They may process your data only on our instructions and under a written contract requiring them to keep it secure and use it only for the agreed purpose.

Authorities and legal recipients, where we are required to disclose personal data to comply with a law, court order or lawful request, or to establish, exercise or defend legal claims.

Where any of our processors are located outside India, we transfer personal data only in accordance with the restrictions and conditions permitted under the DPDP Act and applicable government notifications.

5. Cookies and Tracking Technologies

Like most e-commerce websites, we use cookies, pixel tags and similar technologies. These help us keep items in your cart during a visit, remember your preferences, keep the website secure, measure performance, and understand how visitors use our website. Our cookies do not store payment or other sensitive information.

We may use selected third parties for analytics and marketing, who may set their own cookies. You can control or disable cookies through your browser settings, or opt out via the relevant third-party opt-out pages. Disabling some cookies may affect how parts of the website function.

6. How Long We Keep Your Data

We keep your personal data only for as long as necessary to fulfil the purpose for which it was collected, or for as long as required to comply with legal, tax or accounting obligations. When your personal data is no longer required, and you have not otherwise consented to its retention, we will securely delete or anonymise it.

7. Children’s Data

Our website and services are intended for users aged 18 and above, and we do not knowingly offer our services to children. We do not knowingly collect the personal data of anyone under 18 without verifiable parental or lawful-guardian consent, and we do not undertake behavioural tracking, profiling, or targeted advertising directed at children. If you believe we have inadvertently collected a child’s data, please contact us and we will delete it.

8. How We Protect Your Data

We maintain reasonable security safeguards to protect your personal data against unauthorised access, use, alteration, disclosure or loss. These include appropriate technical and organisational measures such as encryption of data in transit using Secure Sockets Layer (SSL) technology, access controls, and secure processing arrangements with our service providers.

If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals in the manner and within the timelines required under the DPDP Act. However, no method of transmission over the internet or electronic storage is completely secure, and while we strive to protect your data, we cannot guarantee absolute security.

9. Consequences of Non-compliance

In case of non-compliance with rules and regulations under the Information Technology (IT) Act, 2000, privacy policy or user terms, by whatever name called, the user’s access or usage rights to the computer resource or non-compliant information may be suspended or terminated.

Where such non-compliance relates to the creation, generation, modification, alteration, hosting, displaying, uploading, publishing, transmitting, storing, updating, sharing or otherwise disseminating of information in contravention of any law for the time being in force, the user responsible may be liable to any penalty or punishment under the provisions of the IT Act or any other applicable law.

Where such violation relates to the commission of an offence under any law for the time being in force, such as the Bharatiya Nagarik Suraksha Sanhita, 2023 or the Protection of Children from Sexual Offences Act, 2012, such offence will be reported to the mandated authority under the applicable laws.

10. Contact Us and Grievance Redressal

If you have any questions about this Policy, wish to exercise your rights, or want to raise a privacy-related grievance, please contact us

The Crafts Expressions

 

      info@craftsexpressions.com