Privacy Policy

1. Introduction

This Privacy Policy explains how Purnima Ecommerce Private Limited ("Purnima", "we", "us" or "our") collects, uses, stores, discloses and protects your personal information when you visit purnimaecommerce.in, place an order, contact our support team, or otherwise interact with us (together, the "Services").

We are a company incorporated in India with our registered place of business at 130/B Raja S.C. Mullick Road, Sonar Bangla Market Complex, Shop Room No 48, Ward No 100, Kolkata — 700047, West Bengal, India.

This policy is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and reflects our obligations under India's Digital Personal Data Protection Act, 2023.

By using our Services, you agree to the practices described in this policy. If you do not agree, please do not use the website or share your information with us.

2. Information we collect

a. Information you give us

• Identity & contact details — your full name, email address and mobile number.
• Delivery address — street address, locality, city, state and PIN code, supplied at checkout so we can ship your order.
• Order details — the items, sizes and quantities you buy, and the value of your order.
• Communications — messages you send us by email, WhatsApp, telephone or through any form on the website, including any information you choose to include in them.
• Marketing preferences — the email address you submit if you subscribe to our newsletter.

b. Information collected automatically

• Device & usage data — IP address, browser type and version, operating system, screen size, referring page, the pages you view on our site and the time spent on them.
• Local storage — your shopping bag is saved in your browser's local storage so that it survives a page refresh. This stays on your device and is not transmitted to us until you check out.

c. Information we receive from others

• Payment status from our payment gateway (see section 5) — for example, whether a transaction succeeded, the payment method used, and a transaction reference. We do not receive your full card number.
• Delivery status from our courier partners — tracking updates and delivery confirmation.

3. How we use your information

We use your personal information only for the purposes for which it was collected, namely:

• To create, process, pack and deliver your order, and to notify you about its status.
• To take payment for your order and, where applicable, to issue a refund.
• To respond to your questions, complaints, return requests and support enquiries.
• To send transactional messages — order confirmations, dispatch notices, delivery updates and refund confirmations. These are not marketing messages and cannot be opted out of while an order is active.
• To send promotional emails about new collections, offers and styling tips — only if you have subscribed. You can unsubscribe at any time.
• To understand how the website is used so we can improve our product range, page performance and checkout experience.
• To detect, prevent and investigate fraud, abuse of offers, chargebacks and security incidents.
• To comply with our legal, tax, accounting and regulatory obligations in India.

We do not sell your personal information to anyone. We do not rent, trade or otherwise make your data available to third parties for their own marketing purposes.

4. Consent and legal basis

We process your personal data on the following bases:

• Your consent — given when you submit your details at checkout, subscribe to our newsletter, or contact us. Consent is free, specific, informed and unambiguous, and you may withdraw it at any time (see section 10).
• Performance of a contract — where processing is necessary to fulfil the order you placed with us.
• Legal obligation — where Indian law requires us to retain or disclose information, for example under tax and companies legislation.
• Legitimate business interest — for fraud prevention, network security and improving our Services, balanced against your rights.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and may mean we can no longer fulfil an order that is already in progress.

5. Payment information

Online payments on our website are processed by Cashfree Payments, a payment aggregator authorised by the Reserve Bank of India. When you choose to pay online, you are taken to Cashfree's secure hosted checkout to enter your payment details.

What we do receive and store is limited to: the order reference, the amount, whether the payment succeeded or failed, the payment mode (e.g. UPI, card, net banking) and the gateway's transaction identifier. We need these to reconcile your order, service returns and process refunds.

Cashfree processes your payment data as an independent controller under its own privacy policy and the RBI's directions. We encourage you to read it on their website.

If you choose Cash on Delivery, no payment information is collected by us at all — payment is collected in cash by the delivery partner at your doorstep.

6. Cookies and similar technologies

We use a small number of cookies and browser storage technologies:

• Strictly necessary — to keep your shopping bag intact, maintain your session through checkout, and return you safely from the payment gateway. The site cannot function without these.
• Analytics — to count visits and understand which pages and products are popular, in aggregate. These help us improve the site.
• Preference — to remember choices such as your selected category or sort order.

You can block or delete cookies through your browser settings at any time. Please note that blocking strictly necessary cookies will prevent you from adding items to your bag or completing a purchase.

We honour the "Do Not Track" signal where your browser sends one.

7. Sharing and disclosure

We share your personal information only in the following circumstances, and only to the extent needed:

• Payment gateway — your name, email, phone and order amount are passed to Cashfree so that a payment can be initiated and verified.
• Logistics and courier partners — your name, delivery address and phone number are shared with the courier assigned to your shipment so they can deliver it and contact you if needed.
• Service providers — hosting, email delivery and customer-support tools that process data strictly on our instructions and under confidentiality obligations.
• Legal and regulatory — where disclosure is required by law, court order, or a lawful request from a government or law-enforcement authority, or to establish, exercise or defend legal claims.
• Business transfer — if Purnima is involved in a merger, acquisition, restructuring or sale of assets, your information may transfer to the successor entity, which will remain bound by this policy. We will notify you of any such change.

All our processors are contractually required to keep your data confidential, use it only for the agreed purpose, and apply appropriate security measures.

8. Data retention

We keep your personal information only for as long as it is needed:

• Order and transaction records — retained for the period required under Indian tax, GST and companies law (currently up to eight financial years).
• Delivery address and contact details — retained while your account or order history remains active, and thereafter as part of the order record above.
• Support correspondence — retained for up to 24 months after the issue is resolved.
• Newsletter subscription — retained until you unsubscribe, after which your email is removed from our mailing list.
• Website analytics — retained in aggregated form, which cannot identify you individually.

When information is no longer required, we delete it securely or irreversibly anonymise it.

9. Data security

We apply reasonable security practices and procedures appropriate to the nature of the data we hold, including:

• HTTPS/TLS encryption across the entire website, so information sent between your browser and us is encrypted in transit.
• Payment processing delegated entirely to a PCI-DSS compliant gateway, so card data never touches our systems.
• Access controls that limit personal data to the members of our team who need it to do their job.
• Server-side handling of payment credentials, which are never exposed to the browser.

That said, no method of transmission or storage over the internet is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a breach that is likely to affect you, we will notify you and the competent authority as required by law.

Please help us keep your information safe: do not share your order details or one-time passwords with anyone claiming to be from Purnima. We will never ask you for your card PIN, CVV, UPI PIN, or an OTP over the phone, email or WhatsApp.

10. Your rights and choices

Subject to applicable Indian law, you have the right to:

• Access — ask for a summary of the personal data we hold about you and how we process it.
• Correction — have inaccurate or incomplete information corrected or updated.
• Erasure — ask us to delete your personal data where we no longer need it for the purpose it was collected and no legal retention obligation applies.
• Withdraw consent — withdraw a consent you previously gave, as easily as you gave it.
• Opt out of marketing — unsubscribe from promotional email using the link in any such email, or by writing to us.
• Grievance redressal — raise a complaint with our Grievance Officer (section 14), and to escalate to the competent authority if you are not satisfied.
• Nominate — nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email purnimaecommerceprivatelimited@gmail.com from the address associated with your order. We may ask for information to verify your identity before acting, and will respond within 30 days.

There is no charge for exercising your rights, unless a request is manifestly unfounded or repetitive.

11. Children's privacy

Our Services are intended for users aged 18 and above. We do not knowingly collect personal data from children. If you are under 18, please use the website only with the involvement and consent of a parent or legal guardian, who will be responsible for the transaction.

If we learn that we have collected personal data from a child without verifiable parental consent, we will delete it promptly. If you believe this has happened, please contact us.

12. Third-party links

Our website may link to third-party sites and platforms — for example our Instagram, Facebook, YouTube or WhatsApp pages, and the payment gateway. Those services are operated by others and governed by their own privacy policies. We are not responsible for their content or data practices, and we encourage you to read their policies before sharing information with them.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The revised version will be posted on this page with a new "Last updated" date at the top.

Where the changes are significant, we will take reasonable steps to notify you — for example by email or a prominent notice on the website. Your continued use of the Services after the changes take effect constitutes acceptance of the revised policy.

14. Grievance officer and contact

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the contact details of the Grievance Officer are set out below. If you have any question, concern or complaint about this policy or about how your personal data is handled, please get in touch — we aim to acknowledge every grievance within 48 hours and resolve it within 30 days.