Privacy Policy, GDPR & Data Governance

1. Data Controller Information

IndiFash ("we," "our," or "us"), headquartered in Mumbai, Maharashtra, India, acts as the primary Data Controller for all personal data collected through https://indifash.com, subdomains, and associated digital services in accordance with the European Union General Data Protection Regulation (EU 2016/679, "GDPR"), the UK Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA, and applicable international privacy frameworks.

2. Categories of Personal Data We Collect

We process personal data that you voluntarily provide to us or that is captured automatically during your store visit:

• Identity & Profile Data: First name, last name, honorific, preferred language, and account login identifiers.
• Contact Data: Shipping address, billing address, email address, and mobile/telephone number for order fulfillment and courier tracking dispatch.
• Made-to-Measure & Bespoke Records: Sizing specifications, custom garment measurements, height, chest, sleeve, and shoulder dimensions submitted via our bespoke concierge forms to craft tailored leather garments.
• Transaction & Purchase Data: Order history, items purchased, currency, invoice numbers, tax identifiers, and payment method summaries. (Note: Complete card numbers, CVV security codes, and banking passwords are never accessed or stored on our servers; they are processed securely by PCI-DSS Level 1 certified gateways).
• Technical & Telemetry Data: Anonymized IP address, browser type and version, operating system, device screen resolution, time zone offset, referring URLs, and diagnostic logs.
• Communications Data: Direct inquiries, WhatsApp support messages, emails sent to our concierge, and product reviews.

3. Legal Bases for Data Processing (EU GDPR Art. 6)

We only collect and process personal data when permitted by applicable legal grounds under EU GDPR Article 6:

• Contractual Performance (Art. 6(1)(b)): Fulfilling your leather order, manufacturing made-to-measure garments, managing shipment with international couriers (DHL, FedEx, UPS), and communicating order updates.
• Legal & Statutory Obligation (Art. 6(1)(c)): Complying with mandatory accounting, tax, customs clearance filings, and export-import regulations.
• Legitimate Interests (Art. 6(1)(f)): Protecting store infrastructure from fraudulent transactions, securing customer accounts, optimizing site performance, and refining user experience.
• Consent (Art. 6(1)(a)): Sending promotional journal newsletters, personalized tailoring recommendations, or storing non-essential cookies where explicit opt-in has been granted.

4. Payment Security & Third-Party Processors

All financial transactions on IndiFash are encrypted via 256-bit Secure Socket Layer (TLS 1.3) protocols. Payment processing is facilitated by globally accredited partners:

• Razorpay Software Private Limited: A certified PCI-DSS Level 1 service provider handling international credit/debit cards, netbanking, and UPI with bank-grade 3D Secure verification.
• Digital Wallets: Apple Pay and Google Pay using end-to-end device tokenization, preventing any merchant exposure to card credentials.

5. Cookie Policy & Web Tracking Technologies

Our website utilizes cookies and similar local storage technologies to deliver essential functionality and enhance your atelier experience:

• Essential / Strictly Necessary Cookies: Required for shopping bag persistence, active checkout sessions, CSRF security verification, and currency/language preferences. These cannot be disabled without impairing core site operations.
• Performance & Analytics Cookies: Anonymous telemetry through Google Analytics 4 to evaluate store traffic patterns, server latency, and popular garment collections.
• Marketing & Conversion Tags: Configured privacy-respecting conversion pixels (Google Ads, Meta Pixel, Pinterest Tag) to evaluate marketing campaign efficiency and assist customers with relevant styling recommendations.

You may customize or disable cookies at any time via your browser preferences. We honor automated Global Privacy Control (GPC) signals transmitted by compatible modern browsers.

6. California Consumer Privacy Rights (CCPA / CPRA Notice)

For residents of California, the California Consumer Privacy Act provides specific rights regarding personal information:

• Right to Know / Access: You may request the categories and specific pieces of personal information collected over the preceding 12 months.
• Right to Deletion: You have the right to request deletion of personal information collected from you, subject to legal exceptions (such as completed transaction tax records).
• Right to Correct: You may request correction of inaccurate personal data.
• Notice of Non-Sale & Non-Sharing: IndiFash does not sell personal data, nor do we disclose sensitive personal data for cross-context behavioral advertising.
• Right to Non-Discrimination: We will never discriminate against you, alter product prices, or deny service quality for exercising your CCPA privacy rights.

7. International Data Transfers & Cross-Border Safeguards

As IndiFash operates its master artisan studio in Mumbai, India and serves clients worldwide (including North America, Europe, Australia, and the Middle East), your data may be transferred to and stored on secure cloud servers globally. All cross-border transfers from the EEA or UK are governed by the European Commission's Standard Contractual Clauses (SCCs) to guarantee an equivalent degree of privacy and protection.

8. Data Retention Schedule

We retain personal data strictly for the period necessary to fulfill the purposes outlined in this policy:

• Order & Invoicing Records: Retained for 7 years in compliance with international taxation, export auditing, and commercial statutory laws.
• Made-to-Measure Profiles: Retained in your private atelier account until requested for deletion to expedite repeat bespoke orders.
• Marketing Subscriptions: Retained until you opt out or unsubscribe via the one-click unsubscribe link provided in every newsletter.

9. Your Data Rights & The "Right to be Forgotten"

Under EU GDPR (Articles 15 through 22), you are entitled to access, rectify, port, restrict, or completely erase ("Right to be Forgotten") your personal data.

10. Data Protection Officer & Corporate Contact