Privacy policy

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the data fiduciary is the seller below. In this policy, "we" means them. "You" is the person whose data it is (the data principal).

Trading as

FuzzBall Factory

Legal name

[Legal business name]

Registered address

[Legal business name]
[Registered address, line 1]
[City, State, PIN code]
India

GSTIN

[GSTIN, or a note that the seller is not registered]

Email

hello@fuzzballfactory.example

Phone

[Business phone number]

Country of origin

India. Every piece is handmade in India.

• Account: your name, email address, phone number and a password (stored only as a one-way hash).
• Orders: delivery and billing address, the items you ordered, gift notes, order and payment status, and the payment reference from Razorpay. We do not receive or store your full card number, UPI PIN, CVV or OTP.
• Custom work orders: what you describe, reference images you upload, colours, measurements, budget, needed-by date, and the messages and quotes exchanged with us.
• Messages to us: what you send through the contact form, by email or on WhatsApp, including your name, number and anything you tell us.
• Reviews: if you write a review, the text and any photos you add.
• Technical data: basic information your browser sends (IP address, device and browser type, pages requested) that our hosting keeps in server logs, and the small items stored in your browser (see cookies and local storage).

Please do not send us sensitive data we do not need, such as government ID numbers or health details, in a work order or a message.

We use your data only for these purposes. If we want to use it for something new, we will ask you first where the law requires it.

We rely on your consent when you give us your data for a stated purpose: by creating an account, placing an order, submitting a form, or ticking a box. Marketing emails are only sent if you say yes, and every message has an unsubscribe link.

In some cases the law lets us use data without fresh consent, for example to complete an order you asked for, or to keep records that tax law requires.

You can withdraw consent at any time by writing to us (see "Your rights"). Withdrawing does not undo what we did before, and if the data is needed to deliver something you have already ordered, we may not be able to finish that order.

This notice is in English. You may ask us for it in any other language listed in the Eighth Schedule to the Constitution of India.

We do not sell your personal data. We share it only with the people who help us serve you:

These providers process data on our behalf and under their own privacy terms. Some of them, and our international couriers, may handle data outside India. We will make sure any transfer follows the DPDP Act and the rules made under it.

We keep data only as long as we need it for the purpose it was collected, or as the law requires:

• Account data: until you delete your account or ask us to.
• Order and payment records, invoices: for [retention period, e.g. 8 years, confirm with the accountant], because tax and accounting law requires us to keep them.
• Custom work order messages and reference images: for [retention period, e.g. 2 years] after the work order closes, in case of questions or claims about the piece.
• Contact form messages and emails: for [retention period, e.g. 2 years].
• Server logs: for a short period, then deleted.

After that, we delete the data or make it anonymous.

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct or complete data that is wrong or out of date;
• ask us to erase your data, when it is no longer needed for the purpose or for a legal reason;
• withdraw your consent;
• nominate another person to exercise these rights if you die or cannot act for yourself;
• get your complaint about your data looked into.

To use any of these, email hello@fuzzballfactory.example or write to our grievance officer. Tell us what you want and the email or phone number on your account so we can confirm it is you. We acknowledge within 48 hours and respond within one month. You can delete your account details from your account page where that option is shown.

If you are not satisfied with our response, you can complain to the Data Protection Board of India once you have used our grievance process.

Please give us true and complete data, and do not give us anyone else's data without their permission.

We keep to a minimum what we store in your browser. It is used to run the shop, not to follow you across other sites.

We do not currently use advertising trackers. If we add analytics that use cookies, we will update this page and ask for your consent where needed. You can clear or block browser storage in your browser settings, but the cart and sign-in will then not work.

The site uses an encrypted (HTTPS) connection. Passwords are stored as hashes, and access to customer data is limited to the people who need it. No system is perfectly secure. If a breach affecting your data happens, we will tell you and the authorities as the law requires.

The shop is for adults. We do not knowingly collect data from anyone under 18 without a parent or guardian's consent. If you think a child has given us data, tell us and we will delete it.

When we change this policy, we update the date at the top and, for significant changes, tell you by email. Questions or requests: hello@fuzzballfactory.example or the grievance officer.