Privacy policy

Varshell ("we", "us", "our") operates varshell.com (the "Site"). This Privacy Policy
explains how we collect, use, store, and protect your personal data when you visit
our Site, create an account, or make a purchase.

This policy complies with the Digital Personal Data Protection Act, 2023 (DPDP Act)
and the Digital Personal Data Protection Rules, 2025 of India. If you are located
outside India, please note that your data will be processed in accordance with Indian
law, which may differ from the laws of your jurisdiction.

---

1. WHO WE ARE

Data Fiduciary: Varshell
Registered Address: 125 Shivmandir Society, Yogichowk, Surat, Gujarat 395010, India
Email: varshell07@gmail.com
Grievance Officer: Gajera Vasu Ashokbhai
Grievance Officer Email: varshell07@gmail.com
Grievance Officer Phone: 9825163471
Grievance Officer Address: 125 Shivmandir Society, Yogichowk, Surat, Gujarat 395010, India

Our store is hosted on Shopify Inc., which provides us with the online e-commerce
platform that allows us to sell our products to you.

---

2. WHAT PERSONAL DATA WE COLLECT

We collect only the personal data that is necessary for the purposes stated below.
"Personal Data" means any information that can identify you directly or indirectly.

A. Information You Provide Directly:
• Identity Data: Your name
• Contact Data: Email address, phone number
• Address Data: Billing address, shipping address
• Order Data: Products purchased, order value, payment confirmation
• Account Data: Username, password (encrypted), account preferences
• Customer Support Data: Messages, emails, or communications you send us
• Review Data: Product reviews or ratings you submit

B. Information Collected Automatically:
• Device Data: IP address, browser type and version, operating system
• Usage Data: Pages visited, time spent, products viewed, search terms
• Cookie Data: Cookie identifiers, preferences stored in cookies
• Location Data: General location derived from IP address

C. Information from Third Parties:
• Payment Data: Our payment processors (Shopify Payments / Razorpay / Stripe)
collect payment instrument details (credit/debit card, UPI, net banking).
We do NOT store your full card number or CVV.
• Analytics Data: Google Analytics and Shopify Analytics provide aggregated
data about how visitors use our Site.
• Advertising Data: Meta (Facebook/Instagram) and Google may provide data
about ad interactions, but only if you have consented to marketing cookies.

We do NOT collect: Aadhaar number, biometric data, health data, or any sensitive
personal data as defined under the DPDP Act, 2023.

---

3. WHY WE COLLECT YOUR DATA (PURPOSES)

We process your personal data ONLY for the following specific purposes:

| Purpose | Data Used | Legal Basis |
|---------|-----------|-------------|
| Order Fulfillment | Name, address, phone, email, order details | Performance of contract |
| Payment Processing | Payment confirmation, billing address | Performance of contract |
| Shipping & Delivery | Name, shipping address, phone | Performance of contract |
| Customer Support | Name, email, phone, order history, messages | Performance of contract |
| Fraud Prevention | IP address, device info, payment patterns | Legitimate interest |
| Account Management | Username, password, order history, loyalty points | Performance of contract |
| Marketing & Promotions | Email, phone, purchase history | Your explicit consent ONLY |
| Website Analytics | IP address, browsing behavior, device info | Your explicit consent ONLY |
| Personalized Advertising | Email hash, purchase behavior, browsing data | Your explicit consent ONLY |
| Legal Compliance | Order records, tax data | Compliance with law |

We do NOT use your data for any purpose other than those listed above.
We do NOT use automated decision-making that produces legal or similarly
significant effects.

---

4. HOW WE COLLECT YOUR DATA

• Direct Collection: When you fill out forms, place orders, create an account,
or contact us.
• Automated Collection: Through cookies, pixels, web beacons, and similar
technologies when you browse our Site.
• Third-Party Collection: Our service providers (Shopify, payment processors,
shipping partners) collect data on our behalf as necessary to provide their services.

---

5. LEGAL BASIS FOR PROCESSING (DPDP ACT, 2023)

Under the DPDP Act, 2023, we process your personal data based on:

1. Consent: For marketing communications, analytics cookies, advertising cookies,
and sharing data with advertising partners. You have the right to withdraw this
consent at any time.

2. Performance of Contract: For processing orders, payments, shipping, and account
management — necessary to fulfill our contract with you.

3. Compliance with Law: For maintaining tax records, responding to legal requests,
and complying with applicable regulations.

4. Legitimate Uses: For fraud prevention, network security, and ensuring the
integrity of our services.

---

6. YOUR RIGHTS AS A DATA PRINCIPAL

Under the DPDP Act, 2023, you have the following rights:

A. Right to Access
You may request a copy of all personal data we hold about you. We will provide
this in a structured, commonly used format within 30 days of your request.

B. Right to Correction & Erasure
You may request that we correct inaccurate or misleading data, complete incomplete
data, update outdated data, or erase your personal data. We will action this
within 30 days, unless retention is required by law.

C. Right to Grievance Redressal
If you have any concern about how we handle your data, you may contact our
Grievance Officer (details in Section 1). We will acknowledge your complaint
within 24 hours and resolve it within 30 days. If you are unsatisfied with
our response, you may escalate to the Data Protection Board of India.

D. Right to Nominate
You may nominate any other individual who shall exercise your rights in case
of your death or incapacity.

E. Right to Withdraw Consent
Where we rely on your consent, you may withdraw it at any time. Withdrawing
consent will not affect the lawfulness of processing before withdrawal. You can
withdraw consent by:
• Clicking "Withdraw Consent" in our cookie banner
• Clicking "Unsubscribe" in any marketing email
• Emailing varshell07@gmail.com with subject "Withdraw Consent"

---

7. HOW TO EXERCISE YOUR RIGHTS

To exercise any of your rights, please contact us:

Email: varshell07@gmail.com
Subject Line: "DPDP Data Request — [Your Name]"

Please include:
• Your full name
• Email address associated with your account
• Phone number
• Order number (if applicable)
• Specific request (access / correction / erasure / grievance)

We may need to verify your identity before processing your request. We will NOT
discriminate against you for exercising your rights.

---

8. DATA RETENTION

We retain your personal data only for as long as necessary for the purposes
for which it was collected:

• Active Orders: Until delivery is completed + 30 days (for returns/exchanges)
• Order Records: 3 years from the date of your last purchase, after which
personal identifiers are deleted or anonymized
• Account Information: Until you delete your account or request erasure
• Marketing Data: Until you withdraw consent or unsubscribe, after which it
is deleted within 30 days
• Customer Support Records: 1 year from the date of resolution
• Cookie & Analytics Data: 1 year from collection, or until you withdraw consent
• Tax & Legal Records: As required by Indian law (business records retained;
personal identifiers removed where possible)

After the retention period expires, your data is permanently deleted from our
active systems. Backups may retain data for up to 90 additional days before
being overwritten.

---

9. DATA SHARING & DISCLOSURE

We do NOT sell your personal data. We share your data ONLY with the following
categories of recipients, and only for the purposes stated:

A. Service Providers (Data Processors):
• Shopify Inc. — E-commerce platform hosting, payment processing, data storage
(Location: Canada / USA)
• Payment Processors — Razorpay, Stripe, or Shopify Payments for transaction
processing (Location: India / USA)
• Shipping Partners — Delhivery, Shiprocket, or similar for order fulfillment
(Location: India)
• Email Service Providers — For order confirmations and support communication
• Cloud Storage Providers — For secure data backup

These providers process data ONLY on our instructions and are contractually
bound to protect your data.

B. Advertising Partners (With Your Explicit Consent Only):
• Meta Platforms, Inc. (Facebook/Instagram) — For ad targeting and measurement
• Google LLC — For Google Ads and remarketing
• Shopify Audiences — For lookalike audience creation

We share ONLY: Email hash, purchase behavior (anonymized where possible),
and browsing patterns. We do NOT share your name, phone number, or address
with advertising partners.

C. Legal & Regulatory Disclosures:
We may disclose your data if required by law, court order, or government
request, or to protect our rights, property, or safety, or that of our users.

D. Business Transfers:
If Varshell is acquired by or merged with another company, your data may be
transferred to the new owner, who must honor the commitments in this Privacy
Policy.

---

10. CROSS-BORDER DATA TRANSFERS

Your personal data may be transferred to and processed in countries outside India,
including Canada and the United States, where Shopify and some of our service
providers are located.

We ensure appropriate safeguards for such transfers through:
• Standard Contractual Clauses (SCCs) with Shopify
• Shopify's Data Processing Addendum (DPA)
• Google's and Meta's standard data protection terms

The Government of India has not currently notified any restricted countries for
data transfers under the DPDP Act. We monitor notifications from the Data
Protection Board and will update this policy if restrictions change.

---

11. COOKIES & TRACKING TECHNOLOGIES

We use cookies and similar technologies to:
• Enable essential site functionality (shopping cart, checkout, account login)
• Analyze site usage and improve performance
• Deliver personalized advertising (ONLY with your consent)

Cookie Categories:

| Category | Purpose | Consent Required? |
|----------|---------|-------------------|
| Essential | Site functionality, security, checkout | No — Required |
| Analytics | Google Analytics, Shopify analytics | Yes — Explicit consent |
| Marketing | Meta Pixel, Google Ads, retargeting | Yes — Explicit consent |
| Preferences | Language, region, currency | Yes — Explicit consent |

You can manage your cookie preferences at any time by clicking "Cookie Settings"
in the footer of our Site. You may also withdraw consent for non-essential cookies
by clicking "Withdraw Consent."

For more details, see our full Cookie Policy or visit:
https://www.shopify.com/legal/cookies

---

12. CHILDREN'S DATA

Our Site and services are intended for individuals who are **18 years of age or older**.
We do not knowingly collect personal data from children under 18.

If you are under 18:
• You must NOT create an account or make a purchase without verifiable parental
or guardian consent.
• If you believe a child under 18 has provided us with personal data without
parental consent, please contact us immediately at varshell07@gmail.com.
• Upon receiving such notice, we will delete the child's data within 7 days.

We do NOT:
• Track or profile children for advertising purposes
• Send marketing communications to users known to be under 18
• Use children's data for behavioral analysis

---

13. DATA SECURITY

We implement reasonable technical and organizational security measures to protect
your personal data:

• Encryption: All data transmission uses SSL/TLS encryption (HTTPS)
• Password Protection: Account passwords are hashed using industry-standard algorithms
• Access Control: Only authorized personnel (Gajera Vasu Ashokbhai) can access customer data
• Two-Factor Authentication (2FA): Enabled on all admin accounts
• Payment Security: Full card numbers are never stored on our servers; processed
directly by PCI-DSS compliant payment gateways
• Regular Updates: Shopify platform security updates are applied automatically
• Backup: Encrypted backups are maintained for disaster recovery

Please note that no method of transmission over the Internet is 100% secure.
While we strive to protect your data, we cannot guarantee absolute security.

---

14. DATA BREACH NOTIFICATION

In the unlikely event of a personal data breach, we will:

1. Take immediate steps to contain and investigate the breach
2. Notify the Data Protection Board of India without delay (within 72 hours
where feasible)
3. Notify affected users via email with details of:
• What happened
• What data was involved
• Steps we are taking
• Steps you should take
4. Document the breach and our response for at least 1 year

---

15. THIRD-PARTY LINKS

Our Site may contain links to third-party websites (e.g., social media platforms,
payment gateways). We are not responsible for the privacy practices of these
websites. We encourage you to read their privacy policies before providing any
personal data.

---

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our
practices, technology, or legal requirements. If we make material changes, we
will notify you by:
• Posting the updated policy on this page with a new "Last updated" date
• Sending an email to registered users (for significant changes)
• Displaying a notice on our Site

We encourage you to review this policy periodically. Continued use of our Site
after changes constitutes acceptance of the updated policy.

---

17. GOVERNING LAW & JURISDICTION

This Privacy Policy and your use of our Site are governed by the laws of the
Republic of India. Any disputes arising from this policy shall be subject to
the exclusive jurisdiction of the courts in Surat, Gujarat, India.

This policy is drafted in compliance with:
• The Digital Personal Data Protection Act, 2023
• The Digital Personal Data Protection Rules, 2025
• The Information Technology Act, 2000 (as applicable)

---

18. CONTACT US

For any questions, concerns, or requests regarding this Privacy Policy or our
data practices, please contact us:

Varshell
Email: varshell07@gmail.com
Address: 125 Shivmandir Society, Yogichowk, Surat, Gujarat 395010, India

For grievances related to data protection:
Grievance Officer: Gajera Vasu Ashokbhai
Email: varshell07@gmail.com
Phone: 9825163471
Address: 125 Shivmandir Society, Yogichowk, Surat, Gujarat 395010, India

If you are not satisfied with our response, you may escalate your complaint to:
Data Protection Board of India
[Website: dpdpboard.gov.in — check for current contact details]

---