Privacy Policy

1. Who we are

This site, gabayalegacy.com, is operated by [PLACEHOLDER: registered legal entity name, e.g. "GABAYA Lifestyle Pvt. Ltd."] ("GABAYA", "we", "us"), with its registered office at [PLACEHOLDER: full registered address], Jaipur, Rajasthan, India. GSTIN: [PLACEHOLDER: GSTIN]. CIN: [PLACEHOLDER: CIN, if incorporated].

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), GABAYA is the Data Fiduciary for the personal data described here. You are the Data Principal.

2. Scope

This policy covers personal data we collect through gabayalegacy.com, through orders placed on it, and through direct correspondence with us. It does not cover our listings on third-party marketplaces (Flipkart, Amazon) or on Instagram, each of which is governed by that platform's own privacy policy.

3. What we collect, and why

Data	Why we collect it	Lawful basis (DPDP Act)
Name, email address, phone number	To identify your order, confirm it, and contact you about it	Consent, and performance of the purchase you requested
Shipping and billing address	To deliver your order and to raise a tax invoice	Consent; legal obligation for invoicing
Order history and contents	To fulfil, track, and support your order; returns and refunds	Consent; legal obligation for record-keeping
Payment confirmation (payment ID and status only)	To confirm your order was paid	Performance of the transaction
IP address, browser type, pages viewed	Security, fraud prevention, and understanding site use	Legitimate use; consent for analytics cookies
Email address, where you subscribe	To send occasional updates about new pieces	Consent, withdrawable at any time

What we do not collect

• Card, UPI and bank details. These are entered on Razorpay's own secure page. They never reach our servers and we never store them.
• Accounts and passwords. Checkout is guest-only at present; we do not ask you to create an account or set a password.
• Sensitive personal data. We do not knowingly collect data about health, religion, caste, sexual orientation, or biometrics.

4. Cookies and tracking

We use a small number of cookies and tracking tools:

Category	What it does	Can you refuse it?
Strictly necessary Session cookie, cart token, CSRF token	Keeps you signed into your session, remembers your bag between pages, and protects forms against cross-site request forgery	No — the site cannot function without these
Analytics Google Analytics 4	Tells us, in aggregate, which pages are visited and how people move through the site	Yes — see opt-out below
Marketing Meta (Facebook) Pixel	Measures whether our Instagram and Facebook advertising leads to orders, and allows us to show ads to people who have visited the site	Yes — see opt-out below

Opting out

• Google Analytics: install the Google Analytics opt-out browser add-on.
• Meta Pixel: adjust your ad preferences in your Facebook or Instagram account settings.
• All non-essential cookies: block or delete cookies in your browser settings. Strictly necessary cookies will still be set, as the site cannot operate without them.

5. Who we share your data with

We do not sell your personal data, and we do not share it for anyone else's marketing. We share it only with the processors we need to run the shop:

Recipient	Purpose	Data shared
Razorpay Software Pvt. Ltd. (India)	Processing online payments	Order amount, order reference, name, email, phone
Courier partners [PLACEHOLDER: name your courier partners, e.g. Delhivery, Blue Dart, India Post]	Delivering your order	Name, delivery address, phone number
Hostinger	Website and database hosting, and email	All data stored on the site, at rest
Google LLC	Analytics	Pseudonymous usage data, IP address
Meta Platforms, Inc.	Advertising measurement	Pseudonymous usage and conversion data

We may also disclose personal data where we are required to by law, by a court, or by a government authority acting within its powers.

Transfers outside India

Google and Meta process data on servers outside India. Such transfers are made in accordance with Section 16 of the DPDP Act and are not made to any territory restricted by the Central Government.

6. How long we keep it

• Order and invoice records: eight years, as required by Indian tax and companies legislation.
• Enquiries sent through the contact form: 24 months from your last message.
• Newsletter subscription: until you unsubscribe.
• Abandoned carts: 90 days, then deleted.
• Analytics data: per Google's and Meta's own retention settings — [PLACEHOLDER: confirm your GA4 data-retention setting, default is 14 months].

Once a retention period ends, we delete the data or irreversibly anonymise it.

7. How we protect it

• The whole site is served over TLS (HTTPS).
• All database queries use parameterised statements, so order data cannot be extracted by injection.
• Every form is protected by a CSRF token.
• Administrative access is password-protected with a modern hashing algorithm and rate-limited against repeated login attempts.
• Card data never touches our servers — PCI DSS scope sits with Razorpay.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act.

8. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correction and completion of inaccurate or incomplete data.
• Erasure of your data, except where we must keep it for a legal purpose (for example, tax records relating to an order).
• Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out.
• Nominate another person to exercise your rights in the event of your death or incapacity.
• Grievance redressal — see below.

To exercise any of these, write to our Grievance Officer. We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else.

9. Grievance Officer

In accordance with the DPDP Act and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer is:

• Name: [PLACEHOLDER: Grievance Officer full name]
• Designation: [PLACEHOLDER: designation]
• Email: [PLACEHOLDER: grievance@gabayalegacy.com]
• Phone: [PLACEHOLDER: contact number]
• Address: [PLACEHOLDER: full postal address]

We acknowledge every complaint within 48 hours and aim to resolve it within one month of receipt, as the Rules require.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Children

This site is not directed at children. We do not knowingly collect the personal data of anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

11. Changes to this policy

We may update this policy as our operations or the law change. The "Last updated" date at the top of this page always reflects the current version. Where a change materially affects how we use your data, we will tell you directly before it takes effect.

12. Contact

GABAYA
Email: hello@gabayalegacy.com
Address: [PLACEHOLDER: full postal address], Jaipur, Rajasthan, India