Complimentary delivery across India Worldwide shipping available

Shipping details
NANDARAS
0
Home / Privacy Policy

Privacy Policy

How we collect, use and protect your information.

Last updated: 18 September 2026

1. About this policy

Nandaras ("we", "us", "our") operates nandaras.com. This policy explains what personal information we collect when you use our website, why we collect it, how we store it, and the rights you have over it under India’s Digital Personal Data Protection Act, 2023.

2. Information we collect

  • Contact details — name, mobile number (E.164 format), email address, delivery addresses, and any communication you send us (contact form, WhatsApp, phone).
  • Account details — mobile number is your primary identifier. We store a hashed one-time password (OTP) during verification; the OTP itself is never stored in plaintext.
  • Order history — items, prices, GST breakdown, shipping snapshot, payment status. Retained for 8 financial years as required by Indian tax law.
  • Usage information — anonymized IP network, browser type, pages viewed, product attributes, non-sensitive search terms, referrer, campaign tags, and a one-way-hashed session identifier. Searches resembling emails, phone numbers, or security tokens are not retained. Used to measure visits and product interest, prevent fraud, and improve the experience.
  • Marketing preferences — separate opt-ins for SMS and email marketing. You can change these anytime from “My account”.

We do not collect card details or bank information. Payments are processed by Razorpay Software Pvt. Ltd. on their PCI-DSS compliant infrastructure; we only receive the payment ID and status.

3. How we use your information

  • Fulfil orders, generate GST invoices, and coordinate delivery through our courier partners.
  • Send transactional messages (order confirmation, dispatch, delivery, refund) via SMS and email.
  • Comply with legal obligations under the CGST/SGST/IGST Acts, the Consumer Protection Act 2019, and lawful requests from Indian authorities.
  • Send marketing communications only if you have explicitly opted in.
  • Detect and prevent fraud, misuse, and security incidents.

4. Cookies

We use a first-party session cookie (named PHPSESSID) to keep you signed in and to count one site visit per browser session. Our first-party traffic measurement records an anonymized IP network, pages viewed, non-sensitive search terms, referrer, and campaign tags; it does not use advertising cookies or expose raw IP addresses in admin reports. The session cookie expires when you close your browser or after account inactivity. If we add third-party analytics (such as Google Analytics 4) or advertising pixels (Meta) in future, this section will be updated and you will see a cookie consent banner where required.

5. Sharing with third parties

  • Razorpay — for payment processing (name, email, mobile, amount, order id).
  • MSG91 — for sending OTP and transactional SMS (mobile number only).
  • Courier partners (Shiprocket / Delhivery / Bluedart etc.) — for delivery (name, address, mobile, order id).
  • Transactional email service (Zoho ZeptoMail / Amazon SES) — for order emails (name, email, order summary).

Each partner is contractually bound to use your data only for the stated purpose. We do not sell or rent your data to anyone.

6. Data retention

  • Order + invoice records: 8 financial years (GST law).
  • Account profile: until you request deletion, or 3 years after your last activity, whichever is later.
  • Marketing lists: until you unsubscribe.
  • OTP verification rows: 5 minutes (auto-expiry).

7. Your rights

Under India’s DPDP Act you can:

  • Access a copy of the personal data we hold about you.
  • Ask us to correct any information that is inaccurate.
  • Ask us to delete your account and any personal data not required for tax records.
  • Withdraw your marketing consent at any time.
  • Nominate someone to exercise these rights on your behalf.

Write to care@nandaras.com. We’ll respond within 30 days.

8. Data security

The site is served over TLS 1.2+ with HSTS. Passwords are bcrypt-hashed; OTPs are stored as SHA-256 hashes with a server-side pepper. Access to the customer database is restricted to authorised staff on need-to-know basis and is logged. We take reasonable steps to safeguard your data but no online service is 100% secure — if we become aware of a breach affecting your data, we will notify you within 72 hours.

9. Children

Our site is intended for adults (18+). We do not knowingly collect data from children. If you believe a minor has provided us data, contact us and we’ll delete it.

10. Grievance officer

Grievance Officer: Store Owner
Email: grievance@nandaras.com
Phone: Available on request via email.
Response time: within 30 days as mandated by the IT Rules 2011 and DPDP Act 2023.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will change and, for material changes, we will notify you by email if we have one on file.