Privacy Policy

1. Who we are

Kashmir Online Store is a sole proprietorship operated by Umar Sami Bhat, with its principal place of business at Namblabal, Pampore, District Pulwama, Jammu & Kashmir – 192121, India.

• GSTIN (Jammu & Kashmir): 01DBGPB6214P1ZU
• GSTIN (Delhi): 07DBGPB6214P1ZU
• FSSAI Licence: 11022470000118

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for the personal data described here — meaning we decide why and how it is processed, and we are accountable for it.

2. Personal data we collect

Data you give us directly

• Order details: name, delivery address, phone number, email address.
• Account details: username and password, if you create an account.
• Billing details: billing address and GSTIN, where you request a GST invoice.
• Garment measurements: where you order made-to-measure apparel.
• Bank details: account number and IFSC, only where a Cash on Delivery order has to be refunded.
• Correspondence: messages, photographs and attachments you send us by email, WhatsApp or the contact form — including photos submitted for damage or quality claims.
• Reviews and submissions: ratings, written reviews and any images you choose to publish.
• Marketing consent: your email address or phone number if you subscribe.

Data collected automatically

• IP address, approximate location derived from it, browser type, device type and operating system.
• Pages viewed, referring website, search terms used on our site, time spent, and cart activity.
• Cookie and similar identifiers, as described in section 7.

Data we never receive

We do not see or store your full card number, CVV, UPI PIN or net-banking credentials. Online payments are processed entirely by our payment gateway on PCI-DSS compliant infrastructure. We receive only confirmation that a payment succeeded or failed, the method used, and the last few digits for reconciliation.

A note on health information

Some of our products relate to wellness. If you volunteer information about a health condition while asking for a product recommendation, we use it solely to answer that question. We do not build health profiles, tag your customer record, or use it for advertising or segmentation. Please do not send us medical records, prescriptions or test reports — we have no need for them.

3. Why we process your data, and on what basis

Under the DPDP Act we process personal data either with your consent, or for certain legitimate uses such as performing the contract you entered into when ordering and complying with law.

• Fulfilling your order — processing payment, packing, sharing your address and phone number with the courier, and sending order, dispatch and delivery updates. Basis: performance of contract.
• Customer support — answering questions and handling returns, refunds, exchanges and complaints. Basis: performance of contract.
• Statutory compliance — GST invoicing, tax records, and any disclosure required by law. Basis: legal obligation.
• Improving the store — understanding which products and pages are useful, in aggregate. Basis: consent, via analytics cookies.
• Marketing — newsletters, offers and harvest updates, only to people who opted in. Basis: consent, withdrawable at any time.
• Fraud prevention and security — identifying suspicious orders and protecting the store. Basis: legitimate use.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.

4. Who we share your data with

• Shopify Inc. — our e-commerce platform, which hosts this store and stores order, account and browsing data on our behalf. Shopify also processes some data as an independent controller.
• Payment gateways — to process online payments securely.
• Courier partners — including Delhivery, Ecom Express and India Post, who receive your name, delivery address and phone number in order to deliver the parcel.
• Communication providers — the email and WhatsApp services we use to send order updates and reply to you.
• Analytics providers — such as Google Analytics, in aggregated or pseudonymised form.
• Advertising platforms — such as Google and Meta, where you have accepted advertising cookies.
• Professional advisers and authorities — our accountant for tax filings, and any court, regulator or law-enforcement body where disclosure is legally required.
• A successor entity — if the business is ever sold or restructured, customer data would transfer as part of it, subject to this policy.

5. International transfers

Some of our service providers, including Shopify and our analytics providers, operate servers outside India. Your personal data may therefore be stored or processed abroad. Where that happens we rely on providers who apply contractual and technical safeguards, and we comply with any restrictions the Central Government notifies on transfers to particular territories under the DPDP Act.

6. How long we keep it

• Order and invoice records: at least 8 years, as required under GST and income tax law.
• Account details: until you ask us to delete the account.
• Marketing consent records: until you unsubscribe, plus a suppression record so we do not contact you again by mistake.
• Support correspondence: generally up to 3 years after the query is closed.
• Measurements for made-to-measure orders: up to 2 years, so repeat orders do not require re-measuring. Ask and we will delete them sooner.
• Website analytics: typically up to 26 months.

Where you withdraw consent or your data is no longer needed for the purpose it was collected, we erase it unless retention is required by law.

7. Cookies and tracking

Cookies are small files stored on your device. We use three kinds:

• Strictly necessary — keeping your cart, checkout, login and security working. The store cannot function without these.
• Analytics — understanding which pages and products people use, so we can improve them.
• Advertising — set by Google or Meta to measure campaigns and show relevant ads.

You can block or delete cookies in your browser settings, though blocking the strictly necessary ones will break checkout. You can opt out of Google's advertising cookies at policies.google.com/technologies/ads, and manage ad personalisation on our Your Privacy Choices page.

8. Your rights

As a Data Principal under the DPDP Act, you have the right to:

• Access — obtain a summary of the personal data we hold about you, how it has been processed, and the identities of others it has been shared with.
• Correction and completion — have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated.
• Erasure — have data deleted where it is no longer needed for the purpose it was collected, subject to our legal retention duties.
• Withdraw consent — as easily as you gave it. Withdrawal does not affect processing already lawfully carried out.
• Nominate — appoint another person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — raise a complaint with us and, if unresolved, escalate to the Data Protection Board of India.

To exercise any right, email contact@kashmironlinestore.com from the address linked to your order, or WhatsApp +91 88999 37924. We may need to verify your identity first. There is no charge, and we respond within 30 days.

If you are in the EU or UK, you additionally have rights of access, rectification, erasure, restriction, objection and data portability under the GDPR, and may complain to your local supervisory authority.

9. Your duties as a Data Principal

The DPDP Act asks that you provide authentic information when exercising your rights, and that you do not raise false or frivolous complaints or impersonate another person. We mention this only because it forms part of the law — in practice, we would simply rather help you.

10. Security

The store runs over HTTPS. Order data is held on Shopify's PCI-DSS compliant infrastructure. Access to customer information within our team is limited to those who need it to pack orders and answer queries, and staff accounts are individually credentialled. No system is perfectly secure, and data sent to us over ordinary email or WhatsApp is not encrypted end to end by us — please do not send sensitive documents through those channels.

If a personal data breach affecting you occurs, we will notify you and the Data Protection Board of India as required under the DPDP Act.

11. Children

Our store is intended for adults. We do not knowingly collect personal data of anyone under 18, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided us personal data, write to us and we will delete it.

12. Third-party websites

Our site links to other websites, including payment gateways, courier tracking pages and social media platforms. Those operate under their own privacy policies, and we are not responsible for their practices. Anything you post on a public platform may be visible to others.

13. Changes to this policy

We may update this policy as our business, our providers or the law changes. The date at the top shows when it was last revised, and significant changes will be flagged on the website. The version in force when you place an order applies to that order.

14. Grievance redressal

If you have a question or complaint about how we handle your personal data, contact us first — we would rather resolve it directly than have you chase a regulator.

• Grievance contact: Umar Sami Bhat, Proprietor
• Email: contact@kashmironlinestore.com
• Phone & WhatsApp: +91 88999 37924 (alternate +91 70060 01998)
• Post: Kashmir Online Store, Namblabal, Pampore, Pulwama, Jammu & Kashmir – 192121
• Response time: within 30 days

If our response does not satisfy you, you may escalate the matter to the Data Protection Board of India established under the DPDP Act, 2023.