Loading
Version 2026-08-25
This notice explains what personal data [REGISTERED ENTITY NAME] collects when you shop with ZiyaZari, why each piece is collected, how long it is kept, and the rights you have over it. It is written to meet the notice requirement in section 5 of India’s Digital Personal Data Protection Act 2023.
Under that Act we are the Data Fiduciary and you are the Data Principal. In plain terms: we decide what is done with your data, and we answer to you for it.
We ask for the least we can and still run a shop. Every item below is collected for the stated purpose and no other.
| Data | Purpose | Kept for |
|---|---|---|
| Email address | Signing in, and sending order updates you asked for | Until you delete your account |
| Name and phone number | Addressing you, and so the courier can reach you | Until you delete your account |
| Delivery address | Delivering what you bought | Until you delete your account |
| Order and payment records | Fulfilling the order, and the tax invoice the law requires us to issue | 72 months (see Retention) |
| Basket and wishlist | Remembering what you were looking at | Until you delete your account |
| Reviews you write | Showing other shoppers what you thought | Until you delete them or your account |
| Consent records | Proving what you agreed to, and when | Until you delete your account |
We do not collect anything for advertising, we do not build profiles of you, and we do not sell or rent personal data to anyone.
We process your data on the basis of your consent, given by ticking the box when you create your account. That consent is recorded against the version of this notice you saw, so you can always establish what you agreed to.
Some processing is a legitimate use under section 7 of the Act rather than consent — chiefly issuing the tax invoice for an order, which we are legally obliged to do and which you cannot opt out of while still buying something.
You can withdraw consent for anything optional at any time from your privacy settings, and it is as easy to withdraw as it was to give. Withdrawing does not undo anything lawfully done before you withdrew.
Section 8(7) of the Act says we must erase personal data once you withdraw consent or the purpose is served — unless another law requires us to keep it. One law does.
Section 36 of the CGST Act requires us to keep tax invoices and the records behind them for 72 months. So when you delete your account we erase you, but the invoices for orders you already placed stay, including the name and address printed on them, because an invoice without those is not a valid invoice. Those retained records are used for tax purposes only. They are never used to contact you, market to you, or build any profile of you.
Everything else goes at once. What that means in practice is set out below.
The Act gives you these rights. All of them are self-service here except the last.
You must not use these rights to make a false or frivolous complaint. The Act allows the Board to penalise that, and we mention it because the Act requires us to.
Section 9 requires verifiable parental consent before processing the data of anyone under 18, and forbids tracking or targeted advertising to them. We are not set up to verify parental consent, so this shop is not for under-18s and you confirm you are 18 or over when you create an account.
If you believe a child has created an account, tell us at [privacy@example.com] and we will delete it.
Section 8(5) requires reasonable security safeguards. Ours: every table is protected by row-level security so one customer’s data is unreachable from another’s session; card details never touch our servers; access to the admin panel is restricted and role-protected; and passwords do not exist — sign-in is a one-time code, so there is no password of yours for anyone to steal from us.
If a breach happens we will notify the Data Protection Board and every affected person, as section 8(6) requires.
Ask us first. Our Grievance Officer is [GRIEVANCE OFFICER NAME] and answers within 30 days.
[grievance@example.com]
[REGISTERED ADDRESS, INDORE, MADHYA PRADESH]
[+91 XXXXX XXXXX]
You can raise it from privacy settings without writing an email, and you can do so even if you have already deleted your account.
If our answer does not satisfy you, you may complain to the Data Protection Board of India. You have the right to go to the Board and nothing here removes it.
This notice is versioned. When we change it in a way that affects what you agreed to, we ask for your consent again rather than treating silence as agreement. The version you consented to is recorded against your account and shown in your privacy settings.
Current version: 2026-08-25