KARTKAKA – Privacy Policy

Last updated: 21-10-2026 · Effective from: 21-10-2026

This Privacy Policy explains how KARTKAKA COMMERCE LLP (PAN ABGFK3440F), Bld No. C/7, Flat No. 504, Royal Township, Kamrej, Valak, Surat – 395006, Gujarat ("KARTKAKA", "we") collects, uses, shares, stores and protects your personal data when you use the KARTKAKA website [Website URL] and mobile apps (the "Platform").

We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025. This policy is also published under the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (until replaced by the DPDP regime), the IT Intermediary Rules, 2021, and the Consumer Protection (E-Commerce) Rules, 2020.

By using the Platform, you agree to this policy. Where we rely on your consent, we ask for it separately through a clear consent notice, and you can withdraw it at any time.

1. Personal data we collect

We do not knowingly collect sensitive data such as health, biometric, religious or caste information, except where you choose to share it (for example, a prescription for a medicine order).

2. Why we use it

We process your personal data for these specific purposes:

1. Account and orders: create and manage your account, process orders, payments, delivery, returns, refunds and warranty claims.
2. Customer support and grievances: respond to queries and complaints, and comply with the 48-hour acknowledgement and one-month resolution duties.
3. Fraud prevention and security: verify users, detect fake accounts, payment fraud, return abuse, COD abuse, coupon abuse and fake reviews, and protect Users, Sellers and the Platform.
4. Legal compliance: tax and GST records, invoices, responding to lawful requests from government agencies, courts and regulators, and meeting consumer-protection and intermediary obligations.
5. Platform improvement: analytics, testing, troubleshooting and improving search and recommendations.
6. Personalisation and marketing (with consent): personalised recommendations, offers, newsletters, push notifications, SMS and WhatsApp messages. You can opt out at any time.
7. Advertising (with consent): showing relevant ads on and off the Platform.

Under the 2026 E-Commerce Amendment, we will not use information collected from you to promote any seller as associated with KARTKAKA, or to sell goods bearing a KARTKAKA brand, without your express, affirmative consent.

3. Legal basis

We process personal data on the basis of:

• your consent, given through a clear, itemised consent notice; and
• legitimate uses permitted by Section 7 of the DPDP Act, such as data you voluntarily give for a specific purpose (for example, your address to deliver an order), compliance with law, court orders, and responding to medical emergencies.

4. Who we share it with

We share only what each party needs:

• Sellers: your name, shipping address and phone number, to fulfil your order. Sellers may not use it for any other purpose.
• Logistics partners: name, address, phone and order details, for delivery and returns.
• Payment gateways and banks: transaction data, for payments, refunds and fraud checks.
• Service providers (data processors): cloud hosting, SMS, email, WhatsApp, analytics, customer-support and fraud-detection vendors, under written contracts requiring confidentiality and security.
• Financing partners: only if you choose EMI or pay-later options.
• Government and law enforcement: when required by law, court order, or a lawful request under the IT Act, 2000, the Bharatiya Nagarik Suraksha Sanhita, 2023, tax laws or other laws, including within the timelines of the IT Intermediary Rules, 2021.
• Business transfers: to a successor in a merger, acquisition or restructuring, under the same protections.

We do not sell your personal data.

5. Cookies and tracking

We use essential cookies to run the Platform, and analytics and advertising cookies only with your consent. You can manage cookies in the cookie banner, your browser or app settings. Blocking essential cookies may break parts of the Platform.

6. Retention

We keep personal data only as long as needed for the purpose it was collected for, or as required by law:

7. Security

We use reasonable security safeguards, including encryption in transit (TLS) and at rest, tokenised card payments through RBI-compliant gateways, access controls, logging and monitoring, regular security reviews, and confidentiality obligations on staff and vendors.

If a personal data breach occurs, we will inform affected users without delay in plain language, explaining what happened, the likely impact, the steps taken and what you can do. We will report the breach to the Data Protection Board of India within the prescribed time (72 hours for the detailed report) and to CERT-In within 6 hours where required.

No system is fully secure. Keep your password and OTPs private; KARTKAKA will never ask for your OTP, PIN or CVV by phone, email or message.

8. Your rights

As a Data Principal, you have the right to:

• access a summary of your personal data and how it is processed;
• correct, complete or update inaccurate or outdated data;
• erase data no longer needed, subject to legal retention duties;
• withdraw consent at any time, as easily as you gave it (withdrawal does not affect processing already done, and may stop some services);
• nominate another person to exercise your rights in case of death or incapacity; and
• grievance redressal through our Data Protection contact, and then complain to the Data Protection Board of India.

To exercise these rights, use [Privacy settings in the app] or email [privacy@kartkaka.com]. We may verify your identity first. We will respond within the time prescribed, and in any case within 90 days.

Your duties: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints (Section 15, DPDP Act).

9. Children

The Platform is meant for adults. We do not knowingly process the personal data of a child (under 18) without verifiable consent from a parent or lawful guardian. We do not track, behaviorally monitor or target ads at children. If you believe we hold a child's data without consent, contact us and we will delete it.

10. Data transfers outside India

Your data is primarily stored on servers in India [or: with cloud providers in India]. Where data is transferred abroad (for example to a service provider), we will do so only to countries not restricted by the Central Government and with appropriate safeguards.

11. Third-party sites

Links to third-party sites, payment pages or apps are governed by their own privacy policies. We are not responsible for their practices.

12. Changes

We may update this policy. We will post the new version with a revised date and, for material changes, notify you by email or in-app notice. Where a change needs fresh consent, we will ask for it.

13. Contact

Data Protection Officer / Designated contact for personal data queries 

Email: privacy@kartkaka.com - Address: KARTKAKA COMMERCE LLP, Bld No. C/7, Flat No. 504, Royal Township, Kamrej, Valak, Surat – 395006, Gujarat

Grievance Officer (IT Rules and Consumer Protection Rules): 

grievance@kartkaka.com 

 Complaints are acknowledged within 48 hours and resolved within one month.

If you are not satisfied with our response, you may complain to the Data Protection Board of India through its online portal.