Privacy Policy

1. Who We Are

This Privacy Policy explains how [LEGAL ENTITY NAME] (“SANATAANI”, “we”, “us”), operator of sanataani.com, collects, uses, shares and protects your personal data. Our registered office is at [REGISTERED ADDRESS]. This Policy is designed to align with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, and the Consumer Protection (E-Commerce) Rules, 2020. It is effective from [EFFECTIVE DATE].

2. What Data We Collect

2.1 Data you give us at checkout

• Full name
• Delivery address and PIN code
• Mobile number (used for order confirmation, COD verification and delivery coordination)
• Email address (optional, for order updates)
• Any delivery instructions you choose to add

Because we accept Cash on Delivery only, we do not collect card numbers, bank details or wallet credentials at checkout. If you are later due a refund (for example, for a damaged item), we will ask you separately for your UPI ID or bank account details, used only to process that refund.

2.2 Data collected automatically

• Device and browser information, IP address, and approximate location (city level)
• Pages viewed, time spent, and how you arrived at our site (for example, via an advertisement)
• Cookie identifiers, as described in Section 6 and our Cookie Policy

2.3 Data from your communications with us

When you contact us by phone, WhatsApp or email — for example, with a delivery query or a damage claim including photos or an unboxing video — we keep a record of that correspondence to resolve your issue and maintain a service history.

3. Why We Use Your Data (Purposes)

• To fulfil your order: confirming the order, verifying COD orders by call/SMS/WhatsApp, packing, dispatching and delivering it, and collecting payment on delivery.
• To support you: answering queries, processing cancellations, replacements and refunds, and handling grievances.
• To enforce fair-use limits: campaign products such as Kumbh Amrit have per-order and per-mobile-number limits; we use your mobile number and address to apply these limits and to prevent fraudulent or abusive ordering.
• To improve our website: analytics on how visitors use the site.
• To measure and run advertising: as described in Section 6, only with your cookie consent.
• Marketing (only if you opt in): see Section 4.
• Legal compliance: maintaining records required under tax, consumer protection and other applicable laws.

4. Marketing Consent — Opt-In Only, Withdrawable Anytime

We will send you promotional messages (new products, campaigns, festival offers) by SMS, WhatsApp or email only if you actively opt in. The consent checkbox at checkout is never pre-ticked, and choosing not to opt in has no effect on your order.

You can withdraw your consent at any time, free of charge, by:

• replying STOP (or the indicated keyword) to any promotional SMS or WhatsApp message;
• clicking “unsubscribe” in any promotional email; or
• writing to [SUPPORT EMAIL] or messaging [SUPPORT PHONE].

Withdrawal takes effect within a reasonable time (normally within 7 days) and does not affect service messages about orders you have already placed (such as dispatch and delivery updates), which we must send to fulfil your order.

5. Who We Share Your Data With

We never sell your personal data. We share it only with:

• Courier partners ([COURIER PARTNERS]): your name, address, PIN code and mobile number, so they can deliver your order and collect the COD amount.
• Service providers: our website hosting, order management, SMS/WhatsApp messaging and customer-support providers, who process data only on our instructions.
• Analytics and advertising platforms: Google (Analytics 4) and Meta (Pixel), as described in Section 6, subject to your cookie choices.
• Authorities: where required by law, court order or a lawful request from a government agency.

We require our service providers to protect your data and use it only for the purpose we share it for.

6. Cookies, Google Analytics 4 and Meta Pixel

Our website uses cookies and similar technologies. In brief:

• Essential cookies make the website and checkout work. These cannot be switched off.
• Google Analytics 4 (GA4) helps us understand how visitors use our site — which pages are viewed, and where visitors come from — in aggregated form.
• Meta Pixel helps us measure whether our advertisements on Facebook and Instagram lead to visits and orders, and may be used to show relevant advertisements to people who visited our site.

Non-essential cookies (analytics and advertising) are set only in line with the choices you make in our cookie notice — nothing is pre-ticked. You can change your choices at any time and can also control cookies through your browser settings. Full details, including how to opt out of GA4 and Meta’s tools, are in our Cookie Policy.

7. How Long We Keep Your Data (Retention)

• Order and transaction records: kept for up to 8 years, as required for tax and statutory record-keeping.
• Support and grievance correspondence: kept for up to 3 years after the matter is closed.
• Refund payment details (UPI/bank): kept only as part of the refund transaction record, and not used for any other purpose.
• Marketing data: kept until you withdraw consent, after which you are removed from marketing lists.
• Analytics data: retained per the platform’s settings (GA4 retention is configured to the shortest practical period).

When data is no longer needed for the purpose it was collected for, or a legal retention period ends, we delete it or anonymise it.

8. Your Rights

In line with the DPDP Act, 2023, you have the right to:

• Access: ask for a summary of the personal data we hold about you and how it is used;
• Correction: ask us to correct inaccurate or incomplete data;
• Erasure: ask us to delete your data, subject to legal retention requirements (for example, tax records of completed orders);
• Withdraw consent: withdraw any consent you have given, as easily as you gave it;
• Grievance redressal: complain to us (Section 10) and, if unsatisfied, approach the Data Protection Board of India;
• Nominate: nominate a person to exercise these rights on your behalf in case of death or incapacity.

To exercise any right, write to [SUPPORT EMAIL] from the contact details linked to your order, or call/WhatsApp [SUPPORT PHONE]. We may verify your identity before acting on a request.

9. Data Security

We use reasonable technical and organisational safeguards to protect your data, including encrypted (HTTPS) connections on our website, restricted access to order data on a need-to-know basis, and contractual obligations on our service providers. No method of transmission or storage is completely secure, but we work to protect your data proportionate to its sensitivity. In the event of a personal data breach affecting you, we will notify you and the authorities as required under the DPDP Act.

10. Children

Our website is intended for adults. We do not knowingly collect personal data of children under 18 for marketing, and we do not undertake tracking or behavioural advertising directed at children. If you believe a child has provided us personal data, please contact us and we will delete it.

11. Grievance Contact for Privacy Matters

For any privacy question, request or complaint, contact our Grievance Officer:

[GRIEVANCE OFFICER NAME & DESIGNATION]
[LEGAL ENTITY NAME], [REGISTERED ADDRESS]
Email: [SUPPORT EMAIL]
Phone: [SUPPORT PHONE]

We will acknowledge your complaint within 48 hours and resolve it within one month. If you remain unsatisfied, you may approach the Data Protection Board of India once it is operational for your grievance category.

12. Changes to This Policy

We may update this Policy from time to time. The current version, with its effective date, will always be available on this page. Material changes will be highlighted on the website. Continued use of the website after an update indicates acceptance of the revised Policy; where the law requires fresh consent for a new purpose, we will ask for it.

Effective date: [EFFECTIVE DATE]