1. Data Fiduciary Identity
The data fiduciary responsible for all personal data collected on vastrakriti.shop is Vastrakriti Retail Private Limited, having its registered office at:
Office No 215, A-Wing Deodhar Market Apt,Badlapur E.D., Ambarnath,
Thane, Maharashtra — 421503, India.
2. Personal Data We Collect
| Category | Information Collected | Purpose & Storage |
|---|---|---|
| Account Info | Full Name, Email Address, Salted Hashed Password, Phone Number, Saved Delivery Addresses. | Account management & order processing. Passwords are encrypted with one-way hashing & unique salt. |
| Order & Transaction | Billing/Shipping Name, Address, Phone, Items Purchased, Sizes, Prices, Discount Codes, Payment Method Type. | Order fulfilment, GST compliance, invoice generation. Full card/CVV details are never stored by us. |
| Technical & Device | IP Address, Browser Type, Operating System, Referring URL, Page View Duration, Clickstream Paths. | System diagnostics, security logging, aggregate performance analytics. |
| Cookies & Storage | Session Tokens, Cart State, Analytics Cookies (anonymised). | Keep sessions active, retain cart items. Users can manage cookies in browser settings. |
3. Purposes of Data Processing
We process your personal data exclusively to:
- Process, pack, ship, and deliver your orders.
- Send transactional notifications (order confirmation, tax invoice, shipping tracking, return receipts).
- Send promotional updates, sales alerts, or style recommendations via Email/WhatsApp/SMS (only if explicit opt-in consent is given).
- Prevent fraudulent transactions, security breaches, and platform abuse.
- Comply with statutory tax and accounting mandates (e.g., GST invoice retention).
- Resolve consumer complaints under the Consumer Protection (E-Commerce) Rules 2020.
4. Lawful Basis for Processing (DPDP Act 2023)
- Performance of Contract: Necessary to deliver ordered goods and service your account.
- Consent: Required for marketing communications and non-essential analytics (consent can be withdrawn at any time).
- Legitimate Uses & Compliance: Statutory obligations under Companies Act 2013, GST laws, IT Act 2000, and fraud prevention.
5. Third-Party Data Sharing & Processors
We do not sell your personal data to third parties. Data is shared strictly on a need-to-know basis with authorised service providers:
- Payment Gateway (Razorpay): Transaction amounts and reference tokens. Payments are processed on PCI-DSS Level 1 certified infrastructure.
- Logistics Partners (Delhivery, Bluedart, India Post): Name, delivery address, PIN code, and phone number for shipping execution.
- Statutory Authorities: Disclosed only when mandated by court orders, law enforcement, or statutory tax audits under Indian law.
6. Data Retention Schedule
- Order Records & Invoices: Retained for 7 years to satisfy GST and statutory corporate audit requirements.
- Account Profiles: Retained while active. Upon account deletion request, marketing data is purged within 30 days.
- Marketing Consent: Retained until opt-out; communications cease within 5 business days of unsubscription.
7. Your Statutory Rights under DPDP Act 2023
You hold the following rights regarding your personal data:
- Right to Access: Obtain a summary of personal data held and processing activities.
- Right to Correction & Erasure: Correct inaccurate data or request deletion (subject to statutory retention laws).
- Right to Withdraw Consent: Opt-out of marketing communications at any time.
- Right of Grievance Redressal: Submit data complaints to our Grievance contact.
- Right to Nominate: Designate an individual to exercise data rights in event of incapacity.
To exercise these rights, email grievances@vastrakriti.shop.
8. Security Measures & Breach Notification
- Data in Transit: Enforced TLS 1.2+ / HTTPS encryption across all web pages.
- Data at Rest: Sensitive database fields encrypted with AES-256 encryption.
- Breach Notification: In the event of a personal data breach impacting your rights, notification will be sent to impacted users and the Data Protection Board of India in accordance with DPDP regulations.
9. Grievance Contact Details
In compliance with Rule 5(9) of the IT Rules 2011 and Section 10 of the DPDP Act 2023, queries or complaints regarding data privacy may be directed to:
- Email: grievances@vastrakriti.shop
- Response Address: Vastrakriti Retail Private Limited, Office No 215, A-Wing Deodhar Market Apt, Badlapur E.D., Ambarnath, Thane, Maharashtra — 421503, India
- Phone: +91 22 6800 4391
*Grievances are acknowledged within 48 hours and resolved within 30 days.*