Privacy policy

SkinShop 24/7 (skinshop247.com) is run by [To confirm: registered legal name of the company], a [To confirm: company type, e.g. private limited company] with its registered office at [To confirm: registered office address] ("we", "us"). We decide why and how your personal data is used, so under the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for it.

This policy explains what we collect when you browse or shop with us, why, who we share it with, how long we keep it and the rights you have. It applies to our website and any app or service that links to it.

We only collect what we need to sell and deliver your order:

• Account details: your name, email address, mobile number and password (stored only in scrambled, hashed form).
• Delivery addresses: name, mobile number, flat or house number, area, landmark, city, state and pincode. If you use "Use my current location" or move the map pin, we also save the pin's position (latitude and longitude) with that address so the courier can find your door.
• Orders and payments: what you bought, prices, GST invoices, delivery status, returns and refunds. Card, UPI and net banking details are entered on our payment partner's secure page; we never see or store your full card number, CVV or UPI PIN.
• Your shopping activity: products you view, searches you make, items you add to or remove from your cart, and products you save to your wishlist, with the date and page. This is linked to a random visitor ID kept in a cookie and, when you are signed in, to your account. We only record it if you choose "Allow" when we ask; until then, and if you choose "No thanks", nothing is recorded.
• Messages: what you write to our support team, including any photos or videos you send for a damaged or wrong item.
• Technical data: your IP address, browser and device type, and the pages you request, which our servers record to keep the site running and secure.

We do not ask for health records or prescriptions, and we only sell products that don't need one. Please don't send us medical records through support; describe the issue in your own words instead.

We do not sell your personal data, and we do not use it to make decisions about you that have legal or similarly significant effects.

We share only what each partner needs to do its job for us. They act on our instructions as Data Processors under contract.

We may also share data with government authorities, courts or law enforcement when Indian law requires it, and with a buyer of our business if it is ever sold, who must then honour this policy.

Some partners may store data outside India. When they do, we only use countries the Government of India has not restricted under the DPDP Act.

Cookies are small files your browser keeps for our site. We use only the ones below and no third-party advertising cookies.

To change your choice about shopping activity, use Cookie settings at the bottom of any page. Choosing "No thanks" there stops the tracking, deletes the activity recorded from that browser and removes the visitor ID.

You can delete cookies in your browser settings. If you block the sign-in or cart cookies, those features won't work.

Under the DPDP Act you can:

• Know what personal data we hold about you, how we use it and who we have shared it with.
• Correct, complete or update it. Most details can be changed in your account.
• Erase it, unless we must keep it by law (for example GST invoices).
• Withdraw consent at any time, as easily as you gave it. This doesn't affect what we did before, but we may no longer be able to offer some services.
• Nominate someone to exercise these rights if you die or become unable to.
• Complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.

To use any of these rights, email [To confirm: privacy contact email, e.g. privacy@skinshop247.com] from the email address on your account. We will reply within the time the DPDP Rules set, and may ask you to confirm your identity first.

• Account, addresses and wishlist: while your account is open. If you don't sign in or order for [To confirm: inactivity period, e.g. 3 years], we will tell you and then delete it.
• Orders, invoices and payments: as long as Indian tax and company law requires, currently up to 8 years.
• Shopping activity: 24 months, then deleted.
• Marketing-email choice: your latest yes or no, with when and where you gave it, while you shop with us, so we can show what you agreed to. Cart reminders sent to you: [To confirm: reminder history retention, e.g. 12 months].
• Support messages and photos: 2 years after the issue is closed.
• Server logs: [To confirm: log retention period, e.g. 180 days].

We use reasonable security safeguards, including encrypted connections (HTTPS), hashed passwords, and access to customer data only for staff who need it for their work.

If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Act requires, along with what happened and what you can do.

Our accounts are for adults aged 18 or over. We don't knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as our services or the law change. The date at the top shows the latest version. If a change affects how we use data you have already given us, we will tell you by email or on the site before it takes effect, and ask for your consent again where needed.

Questions about your data: [To confirm: privacy contact email, e.g. privacy@skinshop247.com].

Complaints: our Grievance Officer, [To confirm: Grievance Officer's full name], at [To confirm: grievance email, e.g. grievance@skinshop247.com]. See grievance redressal for how complaints are handled.