Privacy Policy

Last updated: January 2025. Governed by the Digital Personal Data Protection Act, 2023 (India).

Kosha (“we”, “our”, “us”) operates koshaco.shop. This policy explains what personal data we collect, why we collect it, how we use it, and your rights as a data principal under Indian law.

1. What data we collect

  • Order data: Name, delivery address (including pincode and landmark), phone number, email address, and order details when you place an order.
  • Payment data: Payments are processed by Razorpay. We do not store card numbers or UPI credentials on our servers. Razorpay’s privacy policy applies to payment processing.
  • GST invoice data: If you provide a GSTIN at checkout, we store it to issue a valid tax invoice.
  • Account data: If you create an account, we store your login email and order history.
  • Analytics data: We use Google Analytics to understand site usage (pages visited, device type, location at city level). This data is anonymised and not linked to your identity.
  • Communications: If you contact us via email or WhatsApp, we retain those messages to resolve your query.

2. Why we collect it and legal basis

  • Order fulfilment: We need your address and phone number to ship your order and coordinate delivery. This is necessary to perform our contract with you.
  • GST compliance: Indian tax law (GST Act) requires us to retain invoice data for 7 years.
  • Customer support: We use your contact details to resolve queries and process returns.
  • Marketing emails: Only if you explicitly opt in at checkout or via our newsletter form. You can unsubscribe at any time.
  • Fraud prevention: We may use order data to detect and prevent fraudulent transactions.

3. Who we share your data with

  • Razorpay: Payment processing. They are a PCI-DSS compliant payment gateway.
  • Shiprocket / Delhivery: Our logistics partner receives your name, address, and phone number to deliver your order.
  • Google Analytics: Anonymised usage data. No personal identifiers shared.

We do not sell your personal data. We do not share it with advertising networks.

4. How long we keep your data

  • Order and invoice data: 7 years (mandatory under GST Act).
  • Account data: Until you request deletion, or 3 years of inactivity.
  • Marketing preferences: Until you unsubscribe or request erasure.
  • Support communications: 2 years after resolution.

5. Cookies

We use essential cookies (for cart and session management) and analytics cookies (Google Analytics). We do not use advertising or tracking cookies. You can disable non-essential cookies in your browser settings.

6. Your rights under the DPDP Act, 2023

As a data principal under the Digital Personal Data Protection Act, 2023, you have the right to:

  • Access: Request a summary of the personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data, subject to legal retention obligations.
  • Grievance redressal: Raise a complaint with our Grievance Officer (details below).
  • Withdraw consent: Withdraw consent for marketing communications at any time.

To exercise any of these rights, email our Grievance Officer. We will respond within 30 days.

7. Grievance Officer

In accordance with the IT Act, 2000 and the DPDP Act, 2023, the details of our Grievance Officer are:

Name: [Founder Name]
Email: grievance@koshaco.shop
Response time: Within 30 days of receipt of complaint.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified via email to registered customers. The date at the top of this page reflects the most recent update.

9. Contact

For any privacy-related questions: support@koshaco.shop or WhatsApp at +91-XXXXXXXXXX.