Privacy policy

This notice explains what Bardhans collects when you use this website, why we collect it, how long we keep it, and what you can ask us to do about it. It is written to the Digital Personal Data Protection Act, 2023.

What we collect

When you shop without an account

You can browse and fill a cart without telling us who you are. To do that we set a small number of cookies in your browser:

• A cart token, so the cart you filled is still there when you come back. It lasts 30 days.
• A delivery location - the pincode you type or allow us to detect, and a label for it. We use it to price delivery and estimate arrival dates before you have given us an address.
• A visitor token, which links the two above to one browser. If you later create an account, the location saved against that token is attached to your account so you do not have to set it again on your next device.
• A session cookie, which is what keeps you signed in, and a security token that protects forms from being submitted by another site.

We record the pincode, the label, the state, how you gave it to us, your IP address and your browser's user-agent string against that visitor token. We do not store your coordinates, even when you use "Detect my location" - the browser gives them to us, we ask a mapping service what pincode they fall in, and we keep only the answer.

When you have an account

• Your mobile number, which is how you sign in. We send a one-time code to it.
• Your name, and an email address if you give us one. Email is optional.
• Delivery addresses you save, including the recipient's name and phone number.
• Your orders - what you bought, what you paid, where it went, and how it was delivered.
• Returns you raise, including any photographs you upload with them.

Payments

We never see or store your card, UPI or bank details. Online payments are handled entirely by our payment gateway, which collects those details on its own systems. What comes back to us is a payment identifier, an amount, a method name such as "UPI", and whether it succeeded.

Why we collect it

• To sell you things and deliver them. Your address goes to the courier carrying your parcel; your number goes with it so they can call you.
• To meet legal obligations. Indian tax law requires us to issue and keep a GST invoice for every sale, which contains your name, address and state.
• To keep the shop safe. We log sign-ins, failed sign-ins and administrative actions with the IP address they came from, so we can investigate if an account is attacked.
• To tell you what is happening to your order - placed, shipped, delivered, refunded - by email and in your account.

We do not sell your data, and we do not share it for anyone else's advertising.

Who else sees it

• Our payment gateway, to take the money.
• Delivery partners, to bring you the parcel - name, address and phone, nothing about what you have bought before.
• Our email and messaging providers, to send you order updates and sign-in codes.
• A mapping service, when you ask us to detect your location - it receives coordinates and returns an address; it does not receive your name or your account.
• Government authorities, where the law requires it.

How long we keep it

• Order and invoice records: as long as tax and company law require us to, which is several years, and we cannot delete these on request.
• Return photographs: kept on private storage with no public address, and served only to you and to the staff reviewing your return.
• Security and administrative logs: retained on a schedule per record type and then archived or deleted automatically.
• Cart and location cookies: 30 days, or until you clear them.
• Your account: until you ask us to close it.

Your rights

Under the DPDP Act you can ask us to:

• tell you what personal data of yours we hold and who we have shared it with;
• correct anything that is wrong or out of date - your name, email and saved addresses you can change yourself from your account at any time;
• delete your data, except where we are legally required to keep it (see above);
• nominate someone to exercise these rights if you die or become incapacitated.

Write to us and we will respond. If we cannot do what you have asked, we will tell you which law stops us.

Children

This shop is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, tell us and we will remove it.

Security

Access to customer data is restricted to staff who need it, and administrative accounts require two-factor authentication. Administrative actions are logged with the person, the time and the address they came from. No system is perfect; if we ever discover a breach affecting you, we will notify you and the Data Protection Board as the Act requires.

Changes

If we change this notice we will change the date at the top. Material changes affecting what we collect or who we share it with will be notified to account holders directly.

Contact

Email support@bardhans.in, or use the contact page. We aim to respond within seven working days.