Privacy Policy
This Privacy Policy explains how Girnaar — operated by [BUSINESS_NAME] (“Girnaar”, “we”, “our”, “us”) — collects, uses, stores and protects the personal data you share when you visit girnaar.in, place an order, or contact us. It is written to meet the requirements of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Consumer Protection (E-Commerce) Rules, 2020. By using this site, you agree to what follows. If anything is unclear, please write to us before you submit your data.
What data we collect and why
| Data | Why we collect it | Legal basis (DPDP Act) |
|---|---|---|
| Name, delivery address, phone, email | Processing and delivering your order; sending order confirmation and tracking updates | Performance of a contract |
| Payment reference / transaction ID | Confirming payment; issuing GST invoice; resolving disputes | Performance of a contract; legal obligation |
| GSTIN (if provided) | Issuing B2B GST invoice | Your consent; legal obligation |
| IP address, browser, device type | Site security; fraud prevention; aggregate analytics | Legitimate interests |
| Browsing and session data via cookies | Improving site performance; understanding how visitors use the site | Your consent (cookie banner) |
| WhatsApp / email messages | Responding to queries; resolving warranty claims and disputes | Performance of a contract; legitimate interests |
| Microsoft Clarity session recordings and heatmaps | Understanding where users encounter friction; improving the site experience | Your consent (cookie banner) |
We collect only what we need. We do not collect sensitive personal data (as defined by the DPDP Act) as part of normal site use.
Cookies and analytics
We use cookies and similar technologies. Some are strictly necessary (the site breaks without them). Others — analytics and behavioural cookies — are optional and activated only if you consent via our cookie banner.
We use Microsoft Clarity for behavioural analytics (heatmaps, session recordings). Clarity data is processed by Microsoft under their privacy policy and DPA. We use Google Analytics (if active) to understand aggregate site traffic. Both services may use cookies to function.
You can withdraw consent for optional cookies at any time by clearing cookies in your browser settings. Withdrawing consent does not affect the lawfulness of any processing that happened before you withdrew it.
How we use your data
- Processing, packing and delivering your order and handling returns.
- Sending transactional messages (order confirmation, dispatch notification, tracking link, invoice).
- Responding to your support, warranty and grievance communications.
- Issuing and maintaining GST invoices as required by Indian tax law.
- Detecting and preventing fraud and abuse.
- Improving the website and our products through aggregate, anonymised analytics.
We do not use your data for automated profiling or algorithmic decision-making that has a significant effect on you.
Who we share your data with
| Recipient | Purpose |
|---|---|
| Payment gateway (e.g. Razorpay) | Processing your payment securely. We never see your full card or UPI credentials. |
| Logistics partner / courier | Delivering your order. We share your name, address and phone. |
| SMS / email service provider | Sending transactional messages. |
| Microsoft (Clarity) | Session analytics (only if you consent via cookie banner). |
| Government / regulatory authorities | Where required by law, court order or a lawful request from a public authority. |
We do not sell your personal data. We do not share it with third parties for their own marketing purposes.
Data storage and retention
Our website and order data are hosted on servers located in India. We retain personal data for as long as necessary to fulfil the purpose for which it was collected, including any applicable legal or accounting requirements. Order records and GST invoices are retained for a minimum of 8 years as required by Indian tax law. Support conversations are retained for [X] years for dispute resolution. Analytics data is aggregated and anonymised on a rolling basis.
Your rights under the DPDP Act 2023
Under the Digital Personal Data Protection Act, 2023 (once the relevant provisions are notified and in force), you have the right to:
- Access — know what personal data we hold about you.
- Correction — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to erase your data, subject to legal retention obligations.
- Grievance redressal — raise a complaint with our Grievance Officer (details below).
- Nominate — nominate an individual to exercise your rights on your behalf in the event of death or incapacity.
To exercise any of these rights, write to our Grievance Officer at [EMAIL]. We will respond within 30 days.
Data security
We implement reasonable technical and organisational measures to protect your personal data from unauthorised access, disclosure, alteration and destruction. Payments are processed through PCI-DSS-compliant gateways; we do not store your full card or UPI credentials on our servers. We use HTTPS across the site. No method of transmission over the internet is 100% secure; if you believe your data has been compromised, please notify us immediately at [EMAIL].
Children
This site is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a child has shared data with us, please contact us and we will delete it.
Grievance Officer
In accordance with the Consumer Protection (E-Commerce) Rules, 2020 and the Information Technology Act, 2000, we have appointed a Grievance Officer:
Grievance Officer: [GRIEVANCE_OFFICER_NAME]
Email: [EMAIL]
Address: [ADDRESS], [CITY], India
Response time: We acknowledge grievances within 48 hours and aim to resolve them within 30 days.
Changes to this policy
We may update this policy from time to time to reflect changes in our practices, technology or applicable law. When we do, we update the “Last updated” note on this page. Significant changes will be notified to registered users by email where practicable. Please check this page before sharing your data or placing an order.
Last updated: June 2026
[REVIEW WITH A LAWYER BEFORE PUBLISHING — template only. Not legal advice.]