Privacy Policy & GDPR Compliance

Data Controller Information

IndiFash ("we," "our," or "us"), headquartered in Mumbai, MH, India, acts as the Data Controller for all personal data collected through https://indifash.com in accordance with the General Data Protection Regulation (EU 2016/679, "GDPR") and applicable global privacy laws.

Categories of Personal Data We Collect

We process personal data that you provide directly to us or that is collected automatically during store browsing:

• Identity Information: Full name, title.
• Contact Data: Shipping address, billing address, phone number, email address.
• Transaction Records: Orders placed, items purchased, invoice details. (Note: Financial account credentials are processed securely via PCI-DSS certified payment processors and are never stored on our servers).
• Technical Data: Anonymized IP addresses, browser version, device category, time zone settings, and essential cookie identifiers.

Legal Bases for Data Processing (EU GDPR Art. 6)

We process your personal information under the following recognized legal grounds:

• Contractual Performance (Art. 6(1)(b)): Necessary to process your order, deliver products, and send order notifications.
• Legal Compliance (Art. 6(1)(c)): To maintain tax, accounting, and anti-fraud statutory compliance.
• Legitimate Interests (Art. 6(1)(f)): To maintain store security, prevent unauthorized transactions, and improve user experience.
• Consent (Art. 6(1)(a)): For optional promotional communications and non-essential analytics cookies.

Payment Security & Third-Party Processors

We do not collect or store raw credit card numbers or banking passwords. All online payments are handled directly by PCI-DSS Level 1 certified gateways including Razorpay Software Private Limited using 256-bit SSL encryption.

International Data Transfers

Data transfers outside the European Economic Area (EEA) are conducted under European Commission Standard Contractual Clauses (SCCs) and robust technical encryption measures to guarantee data security.

User Rights Under EU GDPR

EU/EEA and international users possess the following rights regarding their personal data:

• Right of Access (Art. 15): Obtain a copy of the personal data held about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten", Art. 17): Request deletion of your personal data.
• Right to Restrict Processing (Art. 18): Request temporary suspension of data processing.
• Right to Data Portability (Art. 20): Receive your personal data in a structured format.
• Right to Object (Art. 21): Object to processing based on legitimate interest or marketing.

Interactive GDPR Data Request & Erasure Form

You may exercise your privacy rights or submit a data erasure request using the automated form below or by contacting our Data Protection Concierge at info[at]indifash.comCopy.

Corporate Contact & Data Protection Officer