This Privacy Policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000.

Rangoli Sareewale (operated by Kishor Kumar Pathela, trading as RANGOLI-2, a Proprietorship registered under GST No. 10AURPP7535N2ZZ), having its principal place of business at GT Road, Punjabi Market, Sasaram, Rohtas, Bihar — 821115, is the Data Fiduciary responsible for processing your personal data.

We collect the following categories of personal data:

• Identity Data: Full name, gender (optional)
• Contact Data: Mobile number, email address, shipping and billing addresses
• Transaction Data: Order history, payment method used (we do not store card/UPI details directly)
• Device & Usage Data: IP address, browser type, device type, pages visited, time spent, referring URLs
• Communication Data: WhatsApp messages, customer support interactions

We process your data based on your informed consent and for the following legitimate purposes:

• Processing and fulfilling your orders
• Sending OTP codes for authentication via WhatsApp/SMS
• Communicating order updates, shipping notifications, and delivery status
• Personalizing your shopping experience and showing relevant product recommendations
• Responding to your queries and providing customer support
• Improving our platform, services, and user experience
• Preventing fraud and ensuring platform security
• Complying with legal obligations

By creating an account, placing an order, or using our services, you provide informed, explicit, and unambiguous consent for us to collect and process your personal data for the purposes stated above. You may withdraw consent at any time by contacting our Grievance Officer (see Grievance Officer section below). Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

We do not sell your personal data. We may share it with the following categories of trusted third parties:

• Payment Processors: Razorpay / other payment gateways for secure transaction processing
• Logistics Partners: Delivery companies (e.g., Delhivery, India Post) for order fulfillment
• Communication Services: WhatsApp Business API, SMS gateways for OTP and order notifications
• Analytics: Google Analytics for understanding usage patterns (anonymized)
• Legal Authorities: When required by law, court order, or government directive

All third parties are contractually bound to protect your data and use it only for the specified purpose.

We use cookies and similar technologies to:

• Keep you logged in (session cookies — httpOnly, secure)
• Remember your cart and wishlist items
• Analyze site traffic and performance

You can manage cookie preferences through your browser settings. Disabling cookies may affect some functionality of the platform.

We retain your personal data for the following periods:

• Account data: Until you delete your account or request erasure
• Order & transaction data: 8 years from the date of transaction (as required under the Income Tax Act and GST regulations)
• Communication logs: 3 years for customer support quality and dispute resolution
• Analytics data: 26 months in anonymized form

After the retention period, data is securely deleted or anonymized.

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• Secure, httpOnly cookies for session management
• JWT-based authentication tokens with expiry
• Encrypted database storage for sensitive information
• Access controls limiting employee access to personal data

In the event of a personal data breach that is likely to cause harm, we will notify the Data Protection Board of India and affected users without undue delay, in accordance with the DPDPA, 2023. Notifications will include the nature of the breach and recommended protective measures.

Under the DPDPA, 2023, you have the right to:

• Right to Access: Request a summary of your personal data and processing activities
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Grievance Redressal: File a complaint with our Grievance Officer or the Data Protection Board of India
• Right to Nominate: Nominate another person to exercise your rights in case of death or incapacity

To exercise any of these rights, contact our Grievance Officer at the details below. We will respond within 30 days of receiving your request.

Rangoli Sareewale does not knowingly collect personal data from individuals under 18 years of age. If we become aware that a minor has provided personal data, we will take steps to delete it promptly.

Complaints will be acknowledged within 48 hours and resolved within 30 days from the date of receipt.

We may update this Privacy Policy from time to time. Material changes will be notified via WhatsApp, email, or a prominent notice on our platform. Continued use of our services after updates constitutes acceptance of the revised policy.

For any privacy-related queries, reach out via:

• Email: [email protected]
• WhatsApp: +91-9560160177
• Help Center: Available through your profile