Privacy Policy

This Privacy Policy describes how CRAFTED FABRICS & CO (referred to as "Crafted Fabrics", "we", "us", or "our") collects, uses, stores, and protects the personal data of users ("you", "your") who visit our website craftedfabrics.shop or purchase from us. We are committed to safeguarding your privacy in compliance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and applicable rules.

1. Data Fiduciary Details

2. Information We Collect

2.1 Information You Provide

• Identity & Contact Data: Full name, email address, phone number, billing address, shipping address
• Order Information: Items purchased, order history, sizes, preferences, special instructions
• Communication Data: Messages sent through our contact forms, emails, or customer support channels

2.2 Information Collected Automatically

• Device & Usage Data: IP address, browser type, operating system, device identifiers, pages visited, time spent
• Cookies: Session tokens, cart contents (stored locally in your browser), analytics IDs
• Analytics: Aggregated behaviour data via Google Analytics 4 to understand site performance

2.3 Payment Information

We do not store your credit/debit card numbers, UPI PINs, OTPs, or banking credentials. All payments are processed through our payment partner, MMADPay (PCI-DSS compliant). We only retain a transaction reference number for reconciliation.

3. Purpose of Collection

We process your personal data only for specified, lawful purposes:

• To process and fulfil your orders (shipping, payment, delivery confirmation)
• To send transactional communications (order confirmation, shipping updates, refund notifications)
• To respond to your inquiries, returns, complaints, and grievances
• To improve our products, website, and customer experience
• To send promotional offers and updates (only with your consent, with opt-out option)
• To prevent fraud, unauthorised access, and ensure platform security
• To comply with applicable laws, GST regulations, and respond to lawful requests

4. Legal Basis for Processing

Under the DPDP Act 2023, we process your data based on:

• Consent: You provide explicit consent during account creation, checkout, or newsletter signup
• Performance of Contract: To fulfil orders you have placed with us
• Legal Obligation: Compliance with tax laws, accounting standards, and regulatory requirements
• Legitimate Interest: Fraud prevention, security, and improving our services

5. Sharing of Information

We do not sell, rent, or trade your personal data. We may share necessary information with:

• Logistics Partners (Delhivery, DTDC, Bluedart, India Post, etc.): For order delivery — limited to name, address, phone, and order details
• Payment Gateway (MMADPay): For securely processing your transactions
• Government Authorities: When required by law, court order, or for tax compliance
• Service Providers: Email/SMS service, analytics, hosting (Hostinger) — under strict confidentiality agreements

6. Data Retention

We retain personal data only for as long as necessary:

• Order data: 7 years (as required under GST and tax laws)
• Account data: Until you request deletion
• Marketing data: Until you unsubscribe
• Inquiry/support data: 2 years from last interaction

7. Your Rights Under DPDP Act 2023

As a Data Principal, you have the right to:

• Access: Request a copy of personal data we hold about you
• Correction: Request rectification of inaccurate or incomplete data
• Erasure: Request deletion of your data (subject to legal retention requirements)
• Withdraw Consent: At any time, with effect going forward
• Grievance Redressal: File a complaint with our Grievance Officer (see Section 9)
• Nominate: Designate another person to exercise these rights in case of death or incapacity

To exercise any of these rights, email us at grievance@craftedfabrics.shop with your full name, registered email/phone, and the request. We will respond within 30 days.

8. Data Security

We use industry-standard security measures including:

• HTTPS encryption for all data transmission (SSL/TLS)
• Secure password hashing (bcrypt) for all account credentials
• Restricted access to personal data on a need-to-know basis
• PCI-DSS compliant payment processing through MMADPay
• Regular security audits and updates

While we take reasonable measures, no internet transmission is 100% secure. In the unlikely event of a data breach, we will notify affected users and the Data Protection Board within the timelines required by law.

9. Grievance Officer

We acknowledge complaints within 48 hours and resolve them within 30 days. If unresolved, you may escalate to the Data Protection Board of India.

10. Cookies & Tracking

We use cookies and similar technologies for: session management, shopping cart functionality (stored in your browser's localStorage as "crafted_cart"), analytics (Google Analytics 4 — anonymised IPs), and security. You can disable cookies in your browser settings; however, this may affect site functionality.

11. Children's Privacy

Our services are intended for users aged 18 and above. We do not knowingly collect data from minors. If we learn that a child's data has been collected without verified parental consent, we will delete it immediately.

12. Cross-Border Transfers

Your data is primarily stored on servers within India. If we transfer data outside India for processing (e.g., analytics, email delivery), we ensure such transfers comply with DPDP Act provisions and adequate safeguards are in place.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on our website. Continued use of our services after changes implies acceptance.

14. Contact Us

For any privacy-related questions, write to us at support@craftedfabrics.shop or call +91 74006 49227.