DRAFT — NOT LEGAL ADVICE. This is a skeleton to write over, not a policy. Nothing here has been reviewed by a lawyer and nothing on this page states a fact about this business. Consult a qualified lawyer for a legal opinion before you publish it.
Privacy Policy
1. Who is responsible for your data
Your registered business is the Data Fiduciary under the DPDP Act 2023. Name it, and give an address someone can write to.
2. What we collect
Three lists: what a shopper gives you, what is recorded as they use the site, and what your payment and delivery partners tell you.
3. Why we use it
Separate what you do to fulfil an order from what you do because the law requires it, and from what you only do with consent.
4. Cookies and tracking
A sentence, and a link to your cookie policy.
5. Who else sees it
Your payment provider, couriers, email provider, hosting, and any analytics or advertising tools. Say plainly whether you sell personal data.
6. Where it lives, and for how long
Where it is stored, whether any of it leaves India, and how long you keep orders and invoices. Confirm the retention period with your accountant.
7. What you can ask us to do
Access, correction, erasure, withdrawing consent, and nominating someone. Give an address for these and say how long you take.
8. Children
Whether you sell to anyone under eighteen, and what you do if you find you have their data.
9. Keeping it safe
What you actually do — not what sounds reassuring. Say what happens if there is ever a breach.
10. Changes, and how to reach us
How a reader learns this changed, and the address for a complaint about it.