1. Introduction

Kavi Kuyil Sarees is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains what personal data we collect when you visit or use our website and services, why we collect it, how we use and protect it, your rights, and how to contact us. By using our website and services, you agree to the collection and use of information in accordance with this policy.

2. Scope and applicability

This policy applies to personal data collected via:

• our website (www.kavikuyilsarees.com) and related subdomains;
• our mobile interfaces, social media pages, and customer support channels;
• offline channels linked to your account (orders placed by phone, events, trade shows);

and to customers in India and other countries, including export markets (for example, Singapore, EU). If you are located outside India, additional data protection laws may apply.

3. Data we collect

We collect only the personal data necessary to deliver our services and improve customer experience. Categories include:

• Account and identity data: name, username, date of birth (optional), gender (optional).
• Contact data: email address, postal address, billing and shipping addresses, phone number.
• Transaction and order data: order history, product and sizing preferences, payment details (payment token or masked info), invoices, return/exchange records.
• Payment and financial data: card tokenization data provided by payment gateways; we do not store raw card numbers unless explicitly required and secured via PCI-compliant providers.
• Device and usage data: IP address, browser, device type, operating system, pages visited, referral source, clickstream and browsing behavior.
• Communications data: customer service messages, chat transcripts, emails, feedback, reviews.
• Marketing and preference data: marketing consent, communication preferences, wishlists, saved addresses.
• Photos and user-generated content: product reviews with photos, styling images, or contest submissions (only with your consent).
• Sensitive data: we do not deliberately collect sensitive personal data (e.g., health, religious beliefs). If you choose to share sensitive information in messages, we will process it only to the extent necessary and with your consent.

4. How we collect data

• Directly from you when you: register an account, place an order, subscribe to newsletters, contact customer support, participate in promotions, or upload content.
• Automatically when you use our site: via cookies, analytics, and server logs.
• From third parties: payment processors, logistics and courier partners, social media platforms (if you log in via a social login), marketing platforms, publicly available sources, or business partners where legal.

5. Purposes for which we use personal data

We process personal data to:

• Provide and manage your account, orders, payments, refunds, deliveries, returns, and exchanges.
• Authenticate users and secure accounts.
• Communicate about orders, promotions, changes to policies, and customer service.
• Personalize shopping experience, product recommendations, and marketing (with consent where required).
• Improve our website, product listings, merchandising, and user experience through analytics.
• Prevent fraud, disputes, and abuse; to detect and investigate security incidents.
• Comply with legal and regulatory obligations (tax, export/import documentation, customs, accounting).
• Conduct market research, surveys, and product development.
• Manage third-party logistics, delivery scheduling, and export documentation.

6. Legal bases for processing (where applicable)

• For customers in jurisdictions like the EU (GDPR): we rely on legal bases including performance of a contract (orders, deliveries), legitimate interests (fraud prevention, site improvement), consent (marketing), and compliance with legal obligations.
• For customers in India and other jurisdictions: processing is done to fulfill contracts, meet legal obligations, and based on your consent for marketing or optional services.

7. Cookies and similar technologies

We use cookies and similar technologies to:

• enable core site functionality and account sessions;
• remember preferences and shopping cart contents;
• analyze site usage (analytics) and improve features;
• deliver personalized ads (with consent where required).

You can manage cookie preferences via our cookie banner or browser settings. Blocking cookies may affect site functionality (e.g., staying logged in).

8. Sharing and disclosure of personal data

We do not sell your personal data. We may share data with:

• Service providers and partners: payment gateways, logistics/couriers, hosting, email and SMS providers, marketing and analytics vendors, customs brokers — on a need-to-know basis and under contract.
• Third-party platforms: social login providers, marketplaces where you choose to transact.
• Legal and regulatory authorities: to comply with laws, court orders, tax requirements, or to respond to lawful requests.
• Business transfers: in the event of a merger, acquisition, reorganization, or sale of assets, customer information may be transferred; notice will be provided where required.

All third parties we use must maintain appropriate security and confidentiality and may process data only according to our instructions.

9. Data retention and “use and throw” protection

We retain personal data only as long as necessary for the purpose it was collected or as required by law.

• Account and transaction data: retained for the duration of your account plus statutory accounting/tax retention period (usually 7 years in India) or as required by local law for export customers.
• Order, delivery, and warranty information: retained for the period required for returns, warranty, disputes, and regulatory compliance (commonly 2–7 years).
• Marketing data: retained until you withdraw consent or opt out.
• Analytics, log, and security data: retained for a limited period to support security, troubleshooting, and improvement (commonly 6–24 months).

Use-and-throw protection (data minimization and deletion):

• We minimize data collection to what’s necessary.
• Upon your request, we will delete or anonymize your personal data where there is no legal or business reason to retain it.
• For exported order records needed for customs or accounting, we will retain only what is legally required.

Please note: deletion requests may affect your ability to access past orders, warranties, or account features.

10. Your rights

Depending on local law, you may have rights including:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Deletion: request erasure of your personal data (subject to legal retention requirements).
• Restriction or objection: request restriction of processing or object to certain processing (e.g., direct marketing).
• Portability: request transfer of your data to another provider in a commonly used format.
• Withdraw consent: withdraw marketing or other consent at any time.

To exercise your rights, contact us at the details below. We will respond within applicable timeframes and may require identity verification. For EU residents, you may also lodge a complaint with your supervisory authority.

11. Security measures

We take reasonable technical and organizational measures to protect your data, such as:

• SSL/TLS encryption for data in transit.
• Secure hosting and firewalls.
• Role-based access controls, data minimization, and logging.
• Working with PCI-compliant payment processors and vetted third-party providers.

While we strive to protect data, no online system is perfectly secure. If a data breach affects your personal data, we will notify you and regulators as required by law.

12. International transfers

If you are located outside India, your personal data may be transferred to, processed, or stored in India or other countries where our service providers operate. We will ensure appropriate safeguards (contractual clauses, security practices) are in place to protect your personal data where required.

13. Children

Our services are not intended for children under 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us to request deletion.

14. Marketing and promotional communications

We will contact you for marketing only with your consent where required. You can opt out at any time by:

• Clicking “unsubscribe” in marketing emails.
• Changing preferences in your account.
• Contacting customer support.

Even if you opt out, we may still send non-promotional transactional messages (order confirmations, shipping updates, refunds).

15. Links to other websites

Our site may contain links to third-party sites. We are not responsible for their content or privacy practices. Review their privacy policies before providing personal data.

16. Changes to this Privacy Policy

We may update this policy from time to time. We will post the updated policy on our website with the revised “Last updated” date. For material changes, we will provide notice via email or prominent notice on our website.

17. Contact and data protection officer

If you have questions, requests concerning this policy, or wish to exercise your data rights, contact:

For customers in export markets (e.g., Singapore or EU), you may also contact local data protection authorities if you believe your rights have not been respected.

18. How to request deletion or data export (quick steps)

• Deletion: Email kavikuyilsarees@gmail.com with subject “Request: Delete my data,” include your registered email and order reference (if any). We will verify identity and confirm deletion or provide reasons for retention.
• Data export: Email kavikuyilsarees@gmail.com with subject “Request: Export my data.” We will provide a downloadable copy in a common format (CSV/JSON) within the legally required timeframe.

19. Additional notes for export customers (example — Singapore & EU)

• Singapore (PDPA): We will obtain consent where required and ensure data handling meets PDPA principles.
• EU (GDPR): For EU customers, we will honor GDPR rights. If you wish to designate an EU representative or have specific requests, contact our DPO.