Privacy Notice
Version 2026-10-01.1 · Issued under section 5 of the Digital Personal Data Protection Act, 2023
This notice tells you what personal data Sara Stores (“we”, “us”) collects about you, exactly what we do with it, who else sees it, how long we keep it, and what you can require us to do about it. We are the Data Fiduciary for that data. You are the Data Principal.
It is written to satisfy section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules made under it. Nothing here takes away a right the Act gives you.
1. What we collect, and why
We collect only what a specified purpose actually needs. Each row below is a purpose; we do not reuse data for a purpose that is not listed without asking you first.
| Data | Purpose | Needed? |
|---|---|---|
| Name, email address and password | Creating and securing your account | Required to have an account |
| Phone number, delivery and billing address | Delivering your order, installation, invoicing and returns | Required to place an order |
| Order contents, amounts, payment status | Fulfilling the order, refunds, warranty and GST invoicing | Required to place an order |
| Cart, wishlist, comparison list, recently viewed items | Operating those features for you | Required for the feature |
| Reviews, complaints, enquiries, service requests | Answering you and handling the issue | Required to respond |
| IP address, device and browser details, security logs | Keeping accounts secure, preventing fraud and abuse | Required for security |
| Pages viewed, clicks, site performance measurements | Understanding and improving the site | Optional — only with your consent |
| Purchase history used to build a marketing profile | Recommending products and sending offers | Optional — only with your consent |
| Email address and phone number for promotional messages | Marketing by email, SMS and WhatsApp | Optional — only with your consent |
Card details are never stored by us. They go straight to our payment gateway.
We do not sell your personal data, and we do not buy personal data about you from data brokers.
2. Our lawful basis
We process personal data on exactly two bases under the DPDP Act:
- Your consent (section 6) — for everything marked optional above. You gave it by a clear affirmative action, and you can take it back at any time.
- Certain legitimate uses (section 7) — where you voluntarily gave us data for a purpose and have not objected, and where a law requires us to keep records, such as GST invoicing.
We rely on consent for marketing, analytics, advertising and personalisation. We do not rely on consent to send you an order confirmation or a delivery update — those are part of the purchase you asked for, and you cannot be opted out of them while an order is live.
3. Giving and withdrawing consent
Your consent is free, specific, informed, unconditional and unambiguous, given for the purposes listed above and nothing else. Where you have not consented, we do not process.
Withdrawing consent is as easy as giving it. Go to Account → Privacy & My Data, use the cookie preferences control, or click unsubscribe in any marketing email. There is no form to fill in and no need to contact us.
Withdrawal takes effect immediately for the future. It does not make lawful processing we already carried out unlawful, and it does not remove records we are legally required to keep. If withdrawing consent makes a feature impossible to provide, we will tell you which one.
We keep a dated record of every consent you give and every one you withdraw, because the Act puts the burden of proving consent on us. You can see that record in your data download.
5. How long we keep it
We erase personal data once the purpose it was collected for is served and no law requires us to keep it. This is enforced automatically, not by hand.
| What | Kept for | Why |
|---|---|---|
| Order and invoice records | 72 months from the date of invoice | Mandatory under GST law. Identity fields are anonymised on account deletion; the financial record is kept. |
| Account details | Until you delete your account | Needed to operate your account. |
| Website usage events | 14 months | Consent-based analytics. Deleted automatically. |
| Page performance metrics | 90 days | Technical performance monitoring only. |
| Marketing and consent activity log | 26 months | Retained to evidence consent decisions. |
| Email opt-out link verifiers | Until you delete your account | Hash-only verifiers keep previously emailed opt-out links usable. Removed on account deletion. |
| Abandoned shopping carts | 180 days after last update | Purpose served once the cart is stale. |
| Enquiry and callback requests | 24 months | Sales follow-up. |
| Consent audit trail | 7 years after the consent ends | Needed to demonstrate lawful processing to the Data Protection Board. |
Invoices are the one thing we cannot delete on request. GST law requires us to keep invoice and payment records for 72 months. If you delete your account we keep the financial record but erase your name, email address, phone number and street address from inside it, so it no longer identifies you. This is the legal-compliance exception in section 12(3) of the Act.
6. Your rights, and how to use them
| Right | What it means | How to use it |
|---|---|---|
| Access (s.11) | A summary of the personal data we process about you, what we do with it, and the identity of everyone we have shared it with | Download my data — instant, no request needed |
| Correction and completion (s.12(1)) | Fix anything inaccurate, complete anything incomplete, update anything stale | Account → Profile |
| Erasure (s.12(3)) | Delete your data, except where a law requires us to keep it | Delete my account |
| Withdraw consent (s.6(4)) | Stop any optional processing, at any time | Account → Privacy, cookie preferences, or any unsubscribe link |
| Grievance redressal (s.13) | Have a complaint answered by a named, accountable person | Raise a data privacy grievance |
| Nominate (s.14) | Name someone to exercise these rights for you if you die or become incapacitated | Write to the Grievance Officer with the nominee's name and contact details |
Exercising a right is free. We may ask you to verify your identity first — we will not hand someone else's data to a person who cannot prove they are that person.
Section 15 of the Act also places duties on you: give accurate information, do not impersonate anyone, and do not file a false or frivolous grievance.
7. Grievance redressal and the Data Protection Board
If you are unhappy with anything we do with your personal data, contact our Grievance Officer first. We will acknowledge you and respond within 30 days.
Grievance Officer
Naba Ratan Patra
Email: nabaratanpatra@bytewiseconsulting.in
Address: Systech IT Solutions, #23/1, 1st Floor, J.C. 1st Cross, JC Rd, Near Poornima Theatre, Bengaluru, Karnataka 560027
If our answer does not satisfy you, you have a statutory right to complain to the Data Protection Board of India, established under Chapter V of the DPDP Act. You should normally use our grievance process first. The Board is approached through the digital channel notified by the Government of India; details are published by the Ministry of Electronics and Information Technology at meity.gov.in. We will not restrict or penalise you for complaining.
8. Children and persons with a guardian
Under the DPDP Act a child is anyone under 18. The Act requires verifiable parental consent before a child's personal data is processed, and prohibits tracking a child, monitoring their behaviour, or directing advertising at them — even with consent.
We therefore do not allow anyone under 18 to create an account or buy from this site. By creating an account or placing an order, you confirm that you meet this age requirement. We do not ask for your date of birth during sign-up and do not knowingly collect a child's personal data.
If you believe a child has given us personal data, tell the Grievance Officer and we will delete it and close the account. If you are the lawful guardian of a Data Principal with a disability, contact the Grievance Officer to exercise their rights on their behalf.
9. Security and data breaches
Section 8(5) requires reasonable security safeguards. We use TLS in transit, access controls restricting data to staff who need it, hashed passwords, signed session tokens, rate limiting and bot protection on authentication, server-side recalculation of all prices and payments, and a content security policy on the site.
No system is perfectly secure. If a personal data breach occurs we will notify you and the Data Protection Board of India without delay, in the form and manner the Rules require, including what happened, the likely consequences, and what we are doing about it.
10. Transfers outside India
Your personal data is primarily stored and processed in India. Some service providers listed in section 4 operate outside India, including our website host and parts of Google's services. Section 16 of the Act permits such transfers except to a country the Central Government restricts by notification; we comply with any such restriction and apply contractual safeguards to every transfer.
12. Changes to this notice
We will update this notice when what we do changes, and the version number at the top changes with it. If a change materially affects processing we rely on your consent for, we will ask you again rather than assume the old answer still applies — a previously given consent is automatically treated as expired when the notice version changes.
13. Who we are
Data Fiduciary: Sara Stores
Registered address: Systech IT Solutions, #23/1, 1st Floor, J.C. 1st Cross, JC Rd, Near Poornima Theatre, Bengaluru, Karnataka 560027
This notice is available in English and, on request to the Grievance Officer, in any language listed in the Eighth Schedule to the Constitution of India, as required by section 5(3).
© 2026 Sara Stores. All rights reserved.