Privacy policy

Effective Date: 8 September 2026 Last Updated: 8 September 2026

Important: This document is a website-ready privacy policy template prepared for an India-based online apparel business. Before publishing, replace the bracketed placeholders with ShiVastra’s actual legal/business and contact details. It is not a substitute for advice from an Indian privacy/cyber-law professional.

1. Who We Are

This Privacy Policy explains how ShiVastra (“ShiVastra”, “we”, “us”, or “our”) collects, uses, stores, shares and protects personal data when you visit our website, create an account, place an order, contact us, subscribe to communications, or otherwise use our online services.

Data Fiduciary / Business Name: [LEGAL ENTITY / PROPRIETOR NAME]

Brand: ShiVastra

Business Address: [A44 Novel Park, Sector16B, Gautambuddha Nagar, Uttar Pradesh, INDIA]

Privacy Contact / Grievance Contact: [Mrs Shivangi]

Email: [contact.shivastra@gmail.com]

Website: [www.shivastra.co]

2. Scope

This Policy applies to personal data collected through the ShiVastra website, checkout and customer-support channels, and related online services. It applies to customers, website visitors, account holders, and individuals who contact us.

3. Personal Data We May Collect

Depending on how you use our services, we may collect:

  • Identity and contact information such as name, mobile number, email address and delivery/billing address.
  • Order information such as products purchased, sizes, quantities, order history, returns, refunds and delivery information.
  • Account information such as login-related information and preferences.
  • Payment-related information. Payments may be processed by third-party payment providers. ShiVastra generally does not need to store your full card, UPI or banking credentials when the payment provider processes them directly.
  • Communications, including messages, reviews, feedback and customer-support interactions.
  • Technical and usage information such as IP address, browser/device information, approximate location derived from IP, pages viewed, cookies and similar technologies, where applicable.
  • Marketing preferences and information about whether you interact with our communications.

4. How We Collect Personal Data

We may collect information directly from you when you register, place an order, enter information at checkout, contact customer support, subscribe to marketing, submit a review or otherwise interact with ShiVastra. Some information may also be received from service providers involved in payment, delivery, analytics, website hosting, fraud prevention or customer communications.

5. Why We Use Personal Data

We may process personal data to:

  • create and manage customer accounts;
  • process, confirm, package and deliver orders;
  • process payments, refunds, cancellations and returns;
  • communicate with you about orders, deliveries, support requests and service updates;
  • provide customer support and resolve complaints;
  • improve our website, products, services and customer experience;
  • prevent fraud, abuse, unauthorized transactions and security incidents;
  • comply with applicable legal, tax, accounting and regulatory requirements;
  • send promotional communications where permitted and according to your preferences; and
  • perform other purposes described to you at the time of collection or otherwise permitted by applicable law.

6. Consent and Withdrawal

Where processing is based on consent, we will seek consent in a manner permitted by applicable law and provide information about the purpose of processing. You may withdraw consent where the law provides for such a right. Withdrawal will not affect processing that has already occurred lawfully before withdrawal, and some services may not be possible if information necessary for that service is withdrawn.

7. Children’s Personal Data

ShiVastra sells children’s apparel, but our online services are intended to be used by adults and parents/guardians. Where information relates to a child, ShiVastra will handle it in accordance with applicable Indian law, including requirements concerning children’s personal data and parental/guardian consent or verification where applicable. We do not knowingly seek to create independent customer accounts for children where prohibited by applicable law.

8. Cookies and Similar Technologies

We may use cookies, pixels, local storage and similar technologies to keep the website functioning, remember preferences, understand website usage, measure performance, improve security and, where applicable, support marketing. You may be able to manage cookies through your browser or device settings. Disabling certain cookies may affect website functionality.

9. Sharing Personal Data

We may share personal data only as reasonably necessary for legitimate business and service purposes, including with:

  • payment gateways and financial/payment service providers;
  • courier, logistics and delivery partners;
  • website hosting, cloud, IT, security and infrastructure providers;
  • customer-support, communications and email/SMS service providers;
  • analytics, advertising and marketing service providers, where applicable and permitted;
  • professional advisers, insurers, auditors and legal/tax service providers;
  • government authorities, courts, regulators or law-enforcement agencies when legally required; and
  • a successor, buyer or acquiring entity in connection with a merger, restructuring, sale or transfer of business or assets, subject to applicable law.

10. Payments

Payments may be handled by third-party payment providers. You should review the applicable payment provider’s privacy terms before completing a transaction. ShiVastra will use payment information only as reasonably necessary to facilitate transactions, refunds, reconciliation, fraud prevention and legal/accounting requirements.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide services, resolve disputes, maintain business and transaction records, prevent fraud, comply with tax/accounting/legal obligations, and otherwise meet applicable legal requirements. When personal data is no longer required, we may delete it or anonymize it, subject to lawful retention requirements.

12. Data Security

We take reasonable technical and organisational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse or destruction. However, no internet transmission or storage system can be guaranteed to be completely secure. You are responsible for keeping account credentials and one-time authentication information confidential and should notify us promptly if you suspect unauthorized account activity.

13. Your Rights and Choices

Subject to applicable law and the manner in which the relevant provisions are in force, you may have rights regarding your personal data, including the right to obtain information about processing, request correction or updating of inaccurate data, request erasure where legally applicable, withdraw consent where processing is based on consent, and raise a grievance. You may also have the right to nominate another individual where provided by applicable law.

14. How to Exercise Rights or Raise a Grievance

To make a privacy request or complaint, contact:

Privacy / Grievance Contact: [Mrs. Shivangi]

Email: [contact.shivastra@gmail.com]

Postal Address: [A44 Novel Park, Sector 16B, Gautambuddha Nagar, Uttar Pradesh, India 201306]

Please provide enough information for us to identify the relevant account or transaction and understand your request. We may need to verify the requester’s identity or authority before acting on a request, where permitted or required by law.

15. International Data Transfers

Some service providers used by ShiVastra may process information outside India. Where personal data is transferred or processed outside India, ShiVastra will do so in accordance with applicable Indian law and any applicable restrictions or requirements concerning cross-border transfers.

16. Third-Party Websites and Services

Our website may contain links to third-party websites, payment pages, social-media services or other external services. Their privacy practices are governed by their own policies. ShiVastra is not responsible for the privacy practices of third parties that it does not control.

17. Marketing Communications

Where permitted, we may send promotional messages by email, SMS, WhatsApp or other communication channels. You can opt out of marketing communications by using the unsubscribe mechanism provided in the message or by contacting us. Transactional and service communications, such as order confirmations and delivery updates, may continue where necessary to provide the service.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, business practices or applicable law. The updated version will be posted on our website with a revised “Last Updated” date. Material changes may be communicated through appropriate channels where required.

19. Applicable Law

This Privacy Policy is intended for an online business operating in India and will be interpreted in accordance with applicable laws of India, including applicable data-protection and information-technology laws and regulations, as amended or replaced from time to time.

20. Contact Us

For privacy questions, requests or complaints, please contact ShiVastra using the details below:

ShiVastra

Legal Entity / Proprietor: [ShiVastra]

Business Address: [A44 Novel Park, Sector16B, Gautambuddha Nagar, Uttar Pradesh, INDIA]

Email: [contact.shivastra@gmail.com]

Phone / WhatsApp: [+91-9540106889]

Website: [https://www.shivastra.co]

Regulatory note: This policy is drafted with reference to India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The DPDP framework has a phased commencement timeline, so ShiVastra should keep its notices, consent mechanisms, children’s-data processes, grievance process and operational controls aligned with the provisions that are in force at the relevant time.