Privacy policy

Privacy Policy

ChicChac™ ("Add that chic to your look.") respects your privacy. This Privacy Policy explains what personal data we collect, why, how we use and protect it, and your rights. It is intended to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and rules thereunder.

Data Fiduciary: Anandeshwar Ventures (a Partnership firm), GSTIN 06ABYFA4402D1ZM, operating the store chicchac.in.
Registered office (per GST): Plot No. 35, Sheetla Colony, Gurugram, Haryana 122015.
Operating address: Basement, Plot No. 57, Sector 61, Mahendra Showroom, Ullahawas Village, Gurugram, Haryana 122003.

By using chicchac.in and providing your data, you consent to the practices described here.

1. Personal Data We Collect

Identity & contact: name, email address, phone number, shipping and billing addresses.
Order & transaction data: items purchased, order value, order history, and payment status. We do not store full card numbers, CVV, or UPI PINs — payments are processed by our payment gateway (see Section 4).
Account data: login credentials (if you create an account), wishlist, and saved addresses.
Communications: messages, support tickets, WhatsApp/SMS/email correspondence (including COD confirmation replies).
Technical & usage data: IP address, device/browser type, pages viewed, and interactions, collected via cookies and analytics.
Marketing preferences: consent status for emails/SMS/WhatsApp.

2. How We Use Your Data (Purposes)

To process, fulfil, and deliver your orders, including shipping and returns.
To take and confirm payment, including COD confirmation calls/messages before dispatch.
To provide customer support and handle exchanges, returns, and refunds.
To create and manage your account and wishlist.
To send transactional messages (order, shipping, and refund updates).
To send marketing communications where you have consented (you can opt out anytime).
To improve our website, catalogue, and services, and for analytics.
To detect and prevent fraud, reduce COD return-to-origin (RTO) risk, and ensure security.
To comply with legal, tax (GST), and regulatory obligations.

3. Legal Basis / Consent

We process your personal data based on your consent and/or to perform the contract (your order), to comply with legal obligations, and for legitimate uses permitted under the DPDP Act. You may withdraw consent at any time (see Section 8); withdrawal does not affect processing already carried out, and some processing may continue where required by law.

4. Data Processors & Third Parties We Share With

We share the minimum data necessary with trusted service providers who process it on our behalf:

Shopify — e-commerce platform hosting our store, catalogue, checkout, and customer/order records.
Razorpay — payment gateway that processes card, UPI, netbanking, wallet, and COD-related transactions. Card/UPI credentials are handled by Razorpay under PCI-DSS standards; we do not receive or store them.
Shiprocket and Delhivery (and their courier partners) — shipping, fulfilment, tracking, and COD confirmation/remittance.
Analytics and advertising tools — for website analytics and advertising measurement.
Communication providers — to send transactional and marketing messages by email, SMS, and WhatsApp.

We may also disclose data where required by law, court order, or government authority, or to protect our rights and prevent fraud. We do not sell your personal data.

5. Cookies & Tracking

We use cookies and similar technologies to keep you logged in, remember your cart/wishlist, analyse usage, and personalise content and ads. You can control cookies via your browser settings; disabling some cookies may affect site functionality.

6. Data Retention

We retain personal data only as long as necessary for the purposes above and to meet legal, accounting, and tax (GST) obligations. When no longer required, data is deleted or anonymised.

7. Data Security

We implement reasonable technical and organisational safeguards to protect your data. Our platform and payment partners maintain industry-standard security (e.g. encryption in transit, PCI-DSS for payments). However, no method of transmission over the internet is fully secure, and we cannot guarantee absolute security.

8. Your Rights (under the DPDP Act)

Subject to the Act, you have the right to:

Access a summary of the personal data we process about you.
Correction, completion, or updating of inaccurate or incomplete data.
Erasure of your personal data where no longer required.
Withdraw consent at any time.
Grievance redressal (see Section 11) and to nominate another individual to exercise your rights in case of death or incapacity.

To exercise any right, contact our Grievance Officer (Section 11). We may need to verify your identity before acting.

9. Children's Data

Our store is intended for users 18 years and older. We do not knowingly collect data of children (under 18) without verifiable parental/guardian consent as required by the DPDP Act. If you believe a child has provided us data without such consent, contact our Grievance Officer and we will delete it.

10. Data Transfers

Our processors (e.g. Shopify) may store or process data on servers located outside India. Where this occurs, we take steps consistent with applicable Indian law and the DPDP Act.

11. Grievance Officer & Contact

In accordance with the DPDP Act and the IT Act/rules, you may contact our Grievance Officer for any privacy concern or to exercise your rights:

Grievance Officer: The Grievance Officer, Anandeshwar Ventures (ChicChac™)
Email: chicchac.aar25@gmail.com
Address: Anandeshwar Ventures, Basement, Plot No. 57, Sector 61, Mahendra Showroom, Ullahawas Village, Gurugram, Haryana 122003.
Response commitment: we aim to acknowledge grievances within 24–48 business hours and to resolve them within the timelines required under applicable law.