Account

Cart

Your cart is empty

Continue shopping

Privacy Policy

I. Basic Provisions

  • The controller of personal data, as defined under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (hereinafter 'SPDI Rules'), is the owner and operator of 243yba-pk.myshopify.com (hereinafter referred to as 'Data Controller' or 'we' or 'us').
  • Contact details of the Data Controller:

          Store Name: Stone Aware
          Website: 243yba-pk.myshopify.com
          Email: ankush@stoneaware.com
          Phone: ‪+91 72597 57007‬

  1. 'Personal Data' means any information that relates to a natural person and which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such a person. This includes but is not limited to name, address, email address, phone number, IP address, location data, payment information, and browsing behaviour.

  2. This Privacy Policy is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDPA), to the extent applicable and notified.

  3. We have not appointed a formal Data Protection Officer at this time. For all privacy-related queries, you may contact us at: [Insert Support Email].

II. Sources and Categories of Personal Data Processed

  1. We collect and process personal data that you directly provide to us, as well as data generated automatically when you use our Store.

  2. The categories of personal data we process include:

  • Identification data: Full name, date of birth (for age verification)
  • Contact data: Email address, phone number, delivery address
  • Transaction data: Order details, purchase history, payment method (excluding full card details, which are processed by third-party payment gateways)
  • Technical data: IP address, browser type, device information, cookies, and usage data collected via our website
  • Communication data: Messages, queries, or feedback you send us
  • Marketing data: Your preferences regarding receiving marketing communications from us

III. Legal Basis and Purpose of Processing

  1. We process your personal data on the following lawful grounds under Indian law:

  • Performance of contract: To process and fulfil your orders, manage payments, and provide customer support (Section 43A, IT Act, 2000 and DPDPA, 2023).
  • Consent: For sending promotional emails, newsletters, and marketing communications, where you have opted in. You may withdraw consent at any time.
  • Legitimate interest: To operate, maintain, and improve our Store, prevent fraud, and ensure the security of our systems.
  • Legal obligation: To comply with applicable Indian laws, including tax and financial regulations, and age verification requirements under COTPA.

  1. The purposes for which we process your personal data include:

  • Processing your orders and managing the contractual relationship with you.
  • Verifying your age (18+ requirement) as mandated under COTPA and related laws.
  • Facilitating secure payment processing through authorised payment gateways.
  • Delivering your orders through our logistics and courier partners.
  • Sending transactional communications such as order confirmations, dispatch notifications, and delivery updates.
  • Sending promotional offers, newsletters, and product updates (only with your consent).
  • Improving our website, product offerings, and customer experience.
  • Detecting, preventing, and addressing fraud, security breaches, or illegal activity.
  • Complying with applicable legal and regulatory obligations.

  1. We do not engage in automated individual decision-making or profiling that produces legal or similarly significant effects on you without your prior consent.

IV. Data Retention Period

  1. We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, and in accordance with applicable Indian laws.

  2. Specifically:

  • Order and transaction data is retained for a period of 7 years from the date of the transaction, in compliance with applicable Indian tax and financial record-keeping requirements (as per the Income Tax Act, 1961 and GST laws).
  • Personal data processed for marketing purposes will be retained until you withdraw your consent or unsubscribe, whichever is earlier.
  • Technical and usage data (such as server logs) may be retained for up to 90 days for security and operational purposes.
  • Age verification records may be retained for the duration required by applicable regulatory obligations.

  1. Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised so that it can no longer be associated with you.

V. Recipients of Personal Data (Third-Party Service Providers)

  1. We may share your personal data with trusted third-party service providers strictly to the extent necessary for fulfilling our services to you. These include:

  • Logistics and courier partners: For order delivery and age verification at the point of delivery.
  • Payment gateway providers: For processing payments securely (e.g. Razorpay, PayU, Paytm, or similar authorised payment aggregators regulated by the Reserve Bank of India).
  • E-commerce platform (Shopify): For operating and managing our online Store.
  • Marketing and analytics service providers: For sending communications and analysing website usage (only where you have consented to marketing).
  • Legal and regulatory authorities: Where we are required by law to disclose your data to government agencies, courts, or law enforcement authorities in India.

  1. We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes.

  2. We do not transfer your personal data outside India except where necessary to operate our e-commerce platform (e.g. Shopify infrastructure), and only where adequate data protection safeguards are in place as required under Indian law.

VI. Your Rights as a Data Principal

  1. Under the Digital Personal Data Protection Act, 2023 and applicable Indian law, you have the following rights with respect to your personal data:

  • Right to Access: You have the right to obtain confirmation of whether we process your personal data and to access a copy of the data we hold about you.
  • Right to Correction: You have the right to request correction of inaccurate or incomplete personal data.
  • Right to Erasure: You have the right to request deletion of your personal data, subject to applicable legal retention obligations.
  • Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.
  • Right to Grievance Redressal: You have the right to raise a complaint or grievance with us regarding the processing of your personal data.
  • Right to Nominate: Under the DPDPA 2023, you have the right to nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
  • To exercise any of the above rights, please contact us in writing at [Insert Support Email]. We will respond to your request within 30 days in accordance with applicable law.

  1. If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India, once established under the DPDPA 2023, or approach the appropriate authority under the IT Act, 2000.

VII. Personal Data Security

  1. We are committed to protecting your personal data and have implemented appropriate technical and organisational security measures to safeguard it against unauthorised access, disclosure, alteration, or destruction.

  2. Our security measures include:

  • Use of SSL/TLS encryption for all data transmissions on our Store.
  • Secure storage of personal data using industry-standard encryption practices.
  • Restricted access to personal data — only authorised personnel with a legitimate business need may access your data.
  • Regular review of our data collection, storage, and processing practices.
  • Use of PCI-DSS compliant payment gateways for processing financial transactions.

  1. While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we will notify you and the relevant authorities in the event of a data breach as required by law.

VIII. Cookies and Tracking Technologies

  1. Our Store uses cookies and similar tracking technologies to improve your browsing experience, analyse usage patterns, and serve relevant content.

  2. Types of cookies we use:

  • Essential cookies: Necessary for the Store to function properly (e.g. cart, session management).
  • Analytics cookies: Help us understand how visitors interact with our Store (e.g. Google Analytics).
  • Marketing cookies: Used to deliver targeted promotional content, only where you have consented.

  1. You may manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our Store.

  2. By continuing to use our Store after being presented with our cookie notice, you consent to our use of cookies as described in this Policy.

IX. Data of Minors

  1. Our Store and its products are strictly intended for individuals aged 18 years and above. We do not knowingly collect or process personal data of minors (persons under 18 years of age).

  2. If you believe that we have inadvertently collected personal data of a minor, please contact us immediately at [Insert Support Email] and we will take prompt steps to delete such data.

X. Final Provisions

  1. By submitting an order through our Store or checking the consent box on our registration or checkout form, you confirm that you have read, understood, and agree to this Privacy Policy.

  2. We reserve the right to update or amend this Privacy Policy at any time to reflect changes in our practices, technology, or applicable Indian law. Any changes will be posted on this page with an updated effective date. Where required by law, we will notify you of material changes by email.

  3. We encourage you to review this Privacy Policy periodically. Continued use of our Store after any changes constitutes your acceptance of the updated Policy.