Privacy policy

 

 

 

 

Below is a Shopify-ready Privacy Policy template for an Indian e-commerce store. I’ve kept it readable while incorporating concepts relevant to India’s Digital Personal Data Protection Act, 2023 and the notified DPDP Rules, 2025. Note that the DPDP framework has a phased commencement schedule, so your final policy and actual practices should be reviewed against the provisions applicable to your business when you launch. (MeitY)

Privacy Policy

Last Updated: [DATE]

Welcome to [STORE NAME] ("we," "us," "our"). We respect your privacy and are committed to protecting the personal information you provide when you visit or purchase from [STORE WEBSITE].

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the choices available to you.

By using our website or purchasing our products, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

We may collect information that you provide directly to us when you browse our website, create an account, place an order, contact us, subscribe to marketing communications, or otherwise interact with our services.

Personal Information

Depending on how you interact with us, we may collect:

  • Full name

  • Billing and shipping address

  • Email address

  • Mobile/telephone number

  • Account login information, where applicable

  • Order and purchase history

  • Payment and transaction information

  • Information you provide when contacting customer support

  • Product reviews, feedback, or other information you voluntarily submit

We generally do not store complete payment card details. Payments may be processed directly by third-party payment providers that handle payment information according to their own privacy and security practices.

Automatically Collected Information

When you visit our website, certain technical information may be collected automatically, including:

  • IP address

  • Browser type and version

  • Device type

  • Operating system

  • Pages viewed and links clicked

  • Approximate location derived from technical information

  • Referring website

  • Date and time of visits

  • Website usage and interaction information

We use this information primarily to operate, secure, improve, and understand how our website is used.

2. How We Use Your Information

We may use personal information for purposes including:

  • Processing and delivering your orders

  • Confirming purchases and providing order updates

  • Processing payments and refunds

  • Providing customer support

  • Managing customer accounts

  • Responding to questions, requests, and complaints

  • Improving our website, products, and services

  • Personalising your shopping experience

  • Detecting and preventing fraud, abuse, and security incidents

  • Maintaining website functionality and security

  • Sending service-related communications

  • Sending promotional communications where permitted and where you have provided the required consent

  • Complying with applicable legal, regulatory, tax, accounting, and law-enforcement requirements

  • Establishing, exercising, or defending legal claims

We aim to collect and use only information that is reasonably necessary for the relevant purpose.

Where consent is required, we will seek consent in a clear and understandable manner. Under India's DPDP framework, consent is intended to be specific, informed, and given through clear affirmative action, and withdrawal should be as easy as giving consent. (MeitY)

3. Legal Basis and Consent

Depending on the circumstances and applicable law, we may process personal information:

  • With your consent;

  • To provide products or services you have requested;

  • To process and fulfil an order;

  • To comply with applicable legal obligations;

  • For legitimate operational, security, fraud-prevention, or business purposes where permitted by applicable law; or

  • For other purposes permitted under applicable law.

When processing is based on consent, you may withdraw your consent by contacting us using the details provided in this Privacy Policy or through the relevant unsubscribe or preference mechanism.

Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. It may, however, affect our ability to provide certain services that require the relevant information. (MeitY)

4. Cookies and Similar Technologies

Our website may use cookies, pixels, tags, web beacons, and similar technologies.

Cookies are small files stored on your device that help websites remember information and understand how visitors use the website.

We may use cookies to:

  • Keep our website functioning properly

  • Remember shopping-cart and browsing preferences

  • Maintain account and session functionality

  • Understand website traffic and usage

  • Improve website performance

  • Measure advertising effectiveness

  • Provide relevant advertising or marketing, where applicable

Some cookies may be placed by third-party service providers that operate on our behalf.

You may be able to manage or disable cookies through your browser settings. However, disabling certain cookies may affect the functionality of our website.

Where required by applicable law, we will obtain the appropriate consent before using non-essential cookies or similar technologies.

5. Third-Party Services

We may use third-party companies and service providers to operate our business and provide services to you.

These may include:

  • Shopify and website hosting providers

  • Payment processors and payment gateways

  • Shipping and logistics providers

  • Order fulfilment providers

  • Customer-support platforms

  • Email and SMS communication providers

  • Analytics providers

  • Advertising and marketing platforms

  • Fraud-prevention and security providers

  • IT and technical service providers

These providers may process personal information on our behalf or independently as described in their own privacy policies.

We seek to use reputable service providers and require appropriate safeguards where applicable.

You should review the privacy policies of third-party services for information about how they handle personal information.

6. Shopify

Our online store is powered by Shopify, which provides the technology used to operate our e-commerce website.

Shopify and its service providers may process information in connection with website operation, shopping-cart functionality, payments, analytics, security, and other services.

For more information about how Shopify handles personal information, please review Shopify's applicable privacy documentation.

7. Payments

When you make a purchase, payment information may be processed by a third-party payment gateway.

Depending on the payment method you select, this may include information necessary to process the transaction, such as payment credentials, transaction identifiers, and billing information.

We do not intentionally collect or store complete payment card numbers or security codes on our own systems unless specifically stated otherwise.

Payment providers are responsible for processing payment information according to their applicable terms, privacy policies, and security requirements.

8. Sharing of Information

We do not sell your personal information merely as a source of revenue.

We may share information when reasonably necessary with:

  • Payment providers

  • Shipping and delivery partners

  • Fulfilment providers

  • Technology and hosting providers

  • Customer-support providers

  • Analytics and advertising providers

  • Professional advisers, such as accountants, lawyers, or auditors

  • Government authorities or law-enforcement agencies where legally required

  • Parties involved in a merger, acquisition, restructuring, financing, or sale of business assets

We may also share information where necessary to protect our rights, customers, website, property, or users, or to detect and prevent fraud and other unlawful activity.

9. International Data Transfers

Some third-party service providers we use may process or store information outside India.

Where personal information is transferred or processed outside India, we will take reasonable steps to ensure that such processing is carried out in accordance with applicable Indian law and our contractual or other legal obligations.

10. Data Security

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

Depending on the nature of the information and processing, safeguards may include:

  • Access controls

  • Authentication and account protections

  • Encryption or secure transmission where appropriate

  • Monitoring for suspicious activity

  • Security updates

  • Backups

  • Restricted access to personal information

  • Appropriate contractual protections for service providers

However, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure.

India's DPDP Rules contemplate reasonable security safeguards, including measures such as encryption, access controls, monitoring, backups, and breach-response measures. (MeitY)

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

  • Provide our products and services;

  • Maintain business and transaction records;

  • Resolve disputes;

  • Prevent fraud and abuse;

  • Enforce agreements; and

  • Comply with legal, tax, accounting, and regulatory requirements.

When information is no longer required, we may delete, anonymise, or securely dispose of it, subject to applicable legal requirements.

12. Customer Rights and Choices

Subject to applicable law, you may have rights relating to your personal information, including the ability to:

  • Request information about how your personal information is processed;

  • Request access to personal information we hold about you;

  • Request correction or updating of inaccurate or incomplete information;

  • Request deletion or erasure where permitted by applicable law;

  • Withdraw consent where processing is based on consent;

  • Opt out of promotional communications;

  • Raise a complaint regarding our handling of your personal information; and

  • Exercise other rights available under applicable data-protection law.

India's DPDP Act provides rights including access to information about personal data, correction/erasure in applicable circumstances, grievance redressal, and nomination. (MeitY)

To exercise an applicable right, contact us using the information in the Contact Us section below.

We may need to verify your identity before completing certain requests. We will handle valid requests within the time periods required by applicable law.

13. Marketing Communications

If you subscribe to our promotional communications, we may send you information about:

  • New products

  • Special offers

  • Discounts

  • Promotions

  • Store updates

  • Other marketing messages

You can unsubscribe from promotional emails by clicking the unsubscribe link in the relevant email or by contacting us.

Transactional or service-related communications, such as order confirmations, shipping updates, payment notices, and important account messages, may still be sent when necessary to provide our services.

14. Children's Privacy

Our website is not intended to knowingly collect personal information from children in circumstances where such collection is prohibited by applicable law.

If you believe that a child has provided personal information to us improperly, please contact us at [EMAIL ADDRESS].

We will take appropriate steps as required by applicable law.

15. Fraud and Security

We may process information to identify, investigate, and prevent:

  • Fraudulent transactions

  • Payment abuse

  • Account misuse

  • Unauthorised access

  • Spam

  • Other illegal or harmful activity

Where reasonably necessary, we may share relevant information with payment providers, fraud-prevention services, professional advisers, law-enforcement authorities, or other appropriate parties.

16. Data Breaches

If we become aware of a personal data breach affecting your information, we will take appropriate steps to investigate, contain, mitigate, and address the incident.

Where required by applicable law, we will provide notifications to affected individuals and relevant authorities within the applicable timeframes.

The DPDP Rules, 2025 contain specific requirements concerning personal-data breach notifications, including notification to affected individuals and the Data Protection Board in circumstances covered by the Rules. (MeitY)

17. Third-Party Links

Our website may contain links to websites, applications, social-media platforms, or services operated by third parties.

We are not responsible for the privacy, security, or content practices of third-party websites.

We recommend reviewing the privacy policy of any third-party service before providing personal information.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, services, technology, legal requirements, or privacy practices.

When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy.

Where required by law, we will provide additional notice or obtain consent for material changes.

19. Contact Us

If you have questions about this Privacy Policy, want to exercise an applicable privacy right, or have a complaint regarding our handling of personal information, please contact us:

Store Name: [STORE NAME]
Website: [STORE WEBSITE]
Email: [EMAIL ADDRESS]
Phone: [PHONE NUMBER]
Business Address: [BUSINESS ADDRESS]

Privacy/Grievance Contact

Name: [PRIVACY CONTACT NAME]
Email: [PRIVACY EMAIL ADDRESS]
Phone: [PRIVACY PHONE NUMBER]

We will review and respond to privacy requests and complaints in accordance with applicable law.

20. Governing Law

This Privacy Policy is intended to be governed by the laws applicable in India.

Nothing in this Privacy Policy limits any rights or remedies that you may have under applicable Indian law.

Important: This Privacy Policy is a general template and is not a substitute for advice from a qualified Indian lawyer. Before publishing it, replace every placeholder and make sure the policy accurately reflects the services, payment gateways, advertising platforms, analytics tools, shipping partners, cookies, retention periods, and other technologies your store actually uses. The DPDP Act and Rules impose obligations that depend on the nature and circumstances of the processing, so your operational practices should match the wording of your policy. (MeitY)