Privacy Policy

Chamkiley Store (A Brand of Kalakavya Ecommerce LLP)

Chamkiley Store (“Company,” “we,” “our,” or “us”), a brand operated by Kalakavya Ecommerce LLP (LLP Identification Number: pending), is committed to protecting the privacy and personal data of our customers (“Data Principal,” “you,” “your”).

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you visit our website chamkileystore.in and its subdomains (collectively, the “Website”), in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian laws.

By using our Website and providing your personal data, you consent to the collection and processing described in this Policy. Marketing communications require your explicit opt-in and can be withdrawn at any time.

1. Information We Collect

We collect the following categories of personal data:

1.1 Information You Provide Directly

• Purchase Information: Name, billing address, shipping address, email address, phone number.
• Account Registration: Name, email address, password, and communication preferences.
• Newsletter Subscription: Email address (explicit opt-in required).
• Customer Support: Any details you voluntarily provide in communications with our support team, including via the WhatsApp chat widget.
• Contact Form: Name, email, phone number, and message content when you use our contact form.

1.2 Information Collected Automatically

• IP address, browser type, device details, operating system, and browsing behaviour.
• Pages visited, time spent, referral source, and interaction patterns.
• Cookies and similar technologies (see Section 3 below).
• Purchase Metadata: At the time of purchase, we record your IP address, device/browser identifier (user-agent), and timestamp alongside your order for fraud prevention, invoice generation, and regional analytics.

1.3 Payment Information

Payments are processed securely by Razorpay (a PCI DSS Level 1 certified payment gateway). Your card details, UPI IDs, and wallet credentials are handled entirely by Razorpay's infrastructure and never touch or are stored on our servers. Razorpay's payment checkout may load embedded fraud-prevention services including Sardine.ai, hCaptcha, and Human Security for transaction verification.

2. How We Use Your Information

We process your personal data for the following specific purposes:

• Order Fulfilment: To process, ship, and deliver your orders, and to communicate order status.
• Customer Support: To respond to inquiries, resolve issues, and process returns/refunds.
• Marketing (Opt-in Only): To send promotional offers, newsletters, and updates — only with your explicit consent, withdrawable at any time.
• Website Improvement: To analyse usage patterns and enhance user experience.
• Business Analytics & Reporting: To generate aggregated sales, regional, and inventory reports for internal business operations, investor reporting, and strategic planning. Individual data is never shared externally; only aggregate statistics are used.
• Fraud Prevention: To detect and prevent fraudulent transactions by analysing purchase patterns, IP addresses, and device information recorded at checkout.
• Legal Compliance: To comply with applicable laws (including the Income Tax Act, GST Act, and DPDP Act), prevent fraud, and enforce our Terms & Conditions.
• Tax & Accounting: To maintain books of account and comply with GST filing requirements.

3. Cookies & Tracking Technologies

We use the following cookies and tracking technologies:

Opt-Out: Essential cookies cannot be disabled as they are required for the Website to function. You can disable analytics cookies through your browser settings. We do not currently run marketing/retargeting cookies.

4. Data Sharing & Service Providers

We do not sell, rent, or trade your personal data. We share data only with the following service providers for specific, disclosed purposes:

We may also disclose your data if required by law, court order, or government authority, or to prevent fraud and enforce our Terms & Conditions.

5. Data Storage & Location

Your personal data is stored on servers located in India, managed via our self-hosted infrastructure with Cloudflare as the CDN and security layer. Payment data is processed by Razorpay's PCI-compliant infrastructure in India. Any cross-border data disclosure (e.g., Cloudflare's global CDN network) follows the norms prescribed under the DPDP Act, 2023.

6. Data Retention Schedule

We retain your personal data only as long as necessary for the purposes stated. Specific retention periods:

7. Data Security

We implement the following security measures to protect your personal data:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2/1.3 (HTTPS), enforced via Cloudflare.
• Payment Isolation: Card data, UPI, and wallet credentials never touch our Medusa commerce server — all payment processing is handled entirely by Razorpay's PCI DSS Level 1 certified infrastructure.
• Access Controls: Personal data access is restricted to authorised personnel only, with role-based access controls.
• Infrastructure Security: Our backend infrastructure is protected by Cloudflare's WAF (Web Application Firewall), DDoS mitigation, and bot management.
• Regular Reviews: We conduct periodic security reviews and update our systems to address vulnerabilities.

Despite our measures, no system is completely immune to security threats. We encourage you to use strong passwords and protect your account credentials.

8. Your Rights (Under DPDP Act, 2023)

As a Data Principal under the DPDP Act, you have the following rights:

• Right to Access: Request confirmation of whether your personal data is being processed and obtain a summary.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements listed in Section 6).
• Right to Withdraw Consent: Withdraw consent for data processing at any time, as easily as it was given. For marketing emails, use the “unsubscribe” link. For all other data, email our Grievance Officer.
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer (see Section 12). We will respond within 30 days.
• Right to Nominate: Under Section 14 of the DPDP Act, you may nominate a representative to exercise your rights on your behalf in the event of your death or incapacity.

How to exercise your rights: Email [email protected] with your request. We will verify your identity and respond within 30 days. No fee is charged for exercising your rights.

9. Consent & Withdrawal

Your consent to this Privacy Policy is obtained through clear affirmative actions — placing an order, creating an account, or subscribing to our newsletter. Marketing communications specifically require your explicit opt-in.

Withdrawal of consent is as easy as giving it:

• Marketing emails: Click “Unsubscribe” in any email we send.
• Account & data deletion: Email [email protected].
• Cookie consent: Adjust your browser privacy settings.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, nor does it affect processing required for legal obligations (e.g., tax records).

10. Breach Notification

In the event of a personal data breach that is likely to cause significant harm to you, we will:

• Notify affected Data Principals without unreasonable delay, as required by Section 8(6) of the DPDP Act, 2023.
• Notify the Data Protection Board of India as prescribed by the Act.
• Provide details of the breach, its likely consequences, and measures taken to mitigate it.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that a child's data has been collected without verifiable parental consent, we will delete it promptly.

We do not engage in tracking, behavioural monitoring, or targeted advertising directed at children. If you believe a minor has provided us with their information, please contact our Grievance Officer immediately for removal.

12. Grievance Officer / Data Protection Contact

In compliance with the DPDP Act, 2023, we have appointed the following Grievance Officer:

13. Third-Party Links

Our Website contains links to third-party platforms including Instagram and Facebook. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before interacting with them.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and rules made thereunder. Any disputes shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or a prominent notice on the Website. The “Last Updated” date at the top of this page indicates when the policy was last revised.

We commit to updating this policy whenever a new data processor is added or an existing one is changed.

16. Contact Us

For privacy-related questions, data requests, or complaints:
Grievance Officer: Pratik Moitra
Email: [email protected]
General Support: [email protected]
Website: chamkileystore.in