1. Scope and who is responsible

This Policy applies to KochasKart’s storefront, customer accounts, orders, pickup, delivery and support interactions. The seller identified on the Contact page and your invoice acts as the Data Fiduciary for personal data it determines how and why to process.

Services reached through external links have their own privacy notices. Product manufacturers may separately process warranty or service requests submitted to them.

2. Personal data we collect

• Identity and contact data: name, mobile number, email, and support correspondence.
• Account and verification data: login tokens, OTP verification results, preferences and saved addresses.
• Shopping and transaction data: searches, cart, wishlist, reviews, order items, discounts, invoices, cancellations, returns and refunds.
• Fulfilment data: delivery address, pincode, location label, recipient instructions, pickup selection and proof of delivery or handover.
• Payment data: method, amount, status, provider reference and limited masked details returned by the payment provider. KochasKart does not collect your card PIN, CVV, UPI PIN or OTP.
• Technical and security data: IP address, browser/device information, session identifiers, request and error logs, timestamps and suspected-fraud signals.
• Content you provide: product reviews, return evidence, complaint details and customer-care communications.

3. Why we use personal data

• Create and secure accounts, authenticate sessions and remember essential preferences.
• Maintain carts and wishlists, check serviceability, calculate prices and fulfil orders.
• Process and reconcile payments, COD, invoices, cancellations, returns and refunds.
• Communicate confirmations, delivery updates, security notices and support responses.
• Prevent fraud, abuse and security incidents; diagnose errors; keep audit records.
• Comply with tax, accounting, consumer-protection, legal-metrology and lawful government requirements.
• Send promotional communication only where permitted and provide a practical opt-out.
• Improve catalogue, search, availability and customer experience using proportionate data.

4. Who receives personal data

We do not sell personal data. If a provider processes data outside India, we use it subject to applicable transfer restrictions and reasonable contractual and security safeguards.

• Payment providers such as Razorpay for payment initiation, verification, reconciliation and refund processing.
• Delivery, logistics and pickup personnel to fulfil and prove handover of an order.
• Hosting, storage, security, email, SMS, WhatsApp and customer-support providers acting under appropriate instructions.
• Manufacturers or authorised service centres when you request warranty support and are informed of the transfer.
• Professional advisers, insurers, auditors or a successor business where necessary and subject to confidentiality.
• Courts, regulators, law-enforcement or other authorities when disclosure is legally required or needed to protect legal rights.

5. Cookies and device storage

We use essential cookies or similar browser storage for authentication, cart continuity, security and selected pincode/location. Optional analytics or advertising technologies, if introduced, will be described in the Cookie Policy and presented with any consent choice required by law.

6. Retention and security

We keep personal data only as long as reasonably necessary for the stated purpose, an active relationship, transaction records, fraud prevention, warranty, dispute handling, or tax and legal obligations. Retention periods differ by record; we delete or anonymise data when the purpose and lawful retention need end.

We use access controls, encryption in transit, credential protection, logging, backups and service-provider controls appropriate to the risk. No online system is completely secure; if a personal-data breach requires notice, we will notify affected individuals and the competent authority as required.

7. Your choices and rights

We may verify your identity before acting on a request. A request may be limited where law requires retention, another person’s rights would be affected, or an applicable exception applies. We will explain the response where required.

• Request a summary of personal data being processed and the processing activities, where the right applies.
• Ask us to correct inaccurate or misleading data, complete incomplete data, or update changed data.
• Ask for erasure when retention is no longer required or authorised.
• Withdraw consent as easily as it was given, understanding that this does not make earlier lawful processing invalid.
• Opt out of promotional messages through the method in the message or by contacting us.
• Raise a grievance and, where applicable, nominate another individual to exercise rights in the event of death or incapacity.

8. Children

KochasKart is intended for persons capable of making a purchase. A child should use it only through a parent or lawful guardian. We do not knowingly use children’s data for tracking, behavioural monitoring or targeted advertising. If you believe a child submitted data without appropriate authority, contact us.

9. Requests, grievances and policy changes

Send a privacy request through the Contact page with the subject “Privacy Request”. If unresolved, follow the Grievance Redressal Policy. You may pursue remedies available under applicable data-protection law after using the required grievance process.

We may update this Policy to reflect law, technology or operations. Material changes will be communicated through an appropriate storefront or direct notice, and the current version and effective date will remain displayed here.