1. Who this policy covers
This policy explains how House & Decore handles personal data about visitors, customers and sellers of this website and the seller portals, as a data fiduciary under the Digital Personal Data Protection Act, 2023.
2. What we collect, and why
| What | When | Why |
|---|---|---|
| Name, email address, mobile number | When you create an account | To run your account, verify it, and send you the messages the account produces (a visit confirmation, an order update) |
| Delivery addresses, GSTIN if you give one | When you order décor | To deliver the order and issue a correct tax invoice |
| Your enquiries and visit requests | When you send them | To pass them to the seller of that listing so they can answer you |
| Orders, payments, returns and refunds | When you buy | To run the order, and to keep the records tax law requires |
| Reviews you write | When you post one | To publish it under your first name |
| Contact form messages | When you write to us | To answer you |
| Pages visited, device and browser | As you browse | To keep the site working and safe, and to see which pages are used |
Sellers additionally give us business, identity and bank documents for KYC; those are handled under the seller agreement and are never shown to customers.
3. What we do not do
- We do not sell personal data.
- We do not use it for third-party advertising.
- We do not see or store card or bank details; our payment partner does, under its own policy.
- We do not show a seller anything about a customer beyond the enquiry, visit or order they are part of.
4. Who we share it with
- The seller you are dealing with — your enquiry, visit request or order, with the contact and delivery details it needs.
- Our payment partner — the amount and reference of an online payment.
- The courier — your name, address and phone number for a delivery.
- Service providers who host the site, send email and SMS, and store files, under contracts that allow them to use the data only for us.
- Authorities, where the law requires it.
5. How long we keep it
Account data is kept while your account exists. Orders, invoices and payment records are kept for the period tax and company law require after the order, currently eight years. Enquiries and visit requests are kept for two years so that a dispute can be looked into. Contact form messages are kept for one year. Server logs are kept for ninety days.
6. Your rights
You can see and correct your details, and change or delete your addresses, from your account. You may ask us to delete your account and the data we do not have to keep, to give you a copy of your data, or to withdraw a consent you gave — write to us through the contact page or to the grievance officer named there. We answer within one month. You may also nominate someone to exercise these rights for you.
7. Cookies
The site uses a small number of cookies and browser storage: to keep you signed in, to remember your basket and your theme, and to protect forms from abuse. There are no advertising cookies. Your browser lets you clear or block them; the site still works, but you will be signed out.
8. Children
The site is for people aged 18 and over. We do not knowingly collect data about children; if you believe we have, write to us and we will delete it.
9. Security
Data is sent over encrypted connections and stored on servers with restricted access. Photographs a seller uploads are stripped of camera metadata before they are published. No system is perfectly secure; if we learn of a breach affecting you we will tell you and the Data Protection Board as the law requires.
10. Grievance officer and changes
Complaints about how your data is handled go to our grievance officer, whose details are on the contact page. We may update this policy; the date at the top is the date the current wording took effect, and a material change will be announced on the site.