Privacy Policy

1. Who we are

Barsa Enterprises (“we”, “our”, “us”) is a handcrafted home décor studio operating in India. We take your privacy seriously and comply with the Digital Personal Data Protection Act 2023 (“DPDP Act”).

2. What data we collect

We collect only the data needed to fulfil your order or respond to your enquiry:

• Name — to address you correctly on your order and delivery.
• Email address — to send order confirmations and OTP verification codes.
• Phone number — to contact you via WhatsApp with payment and shipping details.
• Delivery address — to ship your order through our courier partner.
• Order configuration — to manufacture the product you specified.

We do not collect payment card details, government ID numbers, or any sensitive personal data as defined under the DPDP Act.

3. How we use your data

Your data is used only for the following purposes:

• Processing and fulfilling your order
• Sending transactional emails (order confirmation, OTP, shipping updates)
• Contacting you via WhatsApp to confirm payment and delivery details
• Responding to enquiries you submit through our website

If you join our newsletter, your email address is used to send you occasional studio notes and new arrival announcements. You can unsubscribe at any time.

4. Legal basis for processing

We process your personal data on the basis of your explicit consent given at the time you place an order (DPDP Act §6). You may withdraw consent at any time by contacting us, but this will not affect the lawfulness of processing before withdrawal, and we may need to retain certain records to fulfil our legal obligations.

5. Data sharing

We share your data only where strictly necessary to complete your order:

• Resend Inc. — transactional email delivery.
• Shiprocket (planned) — courier and shipping logistics.
• Razorpay (planned) — payment processing — they hold card data, not us.

We do not sell, rent, or trade your personal data to any third party.

6. Data retention

Order records (including your name, email, phone, and address) are retained for three years after fulfilment to handle any warranty or dispute queries. Newsletter subscriber records are retained until you unsubscribe; they are permanently deleted 90 days after unsubscription. OTP verification codes expire after 10 minutes and are deleted from our systems within 7 days of expiry.

7. Your rights

Under the DPDP Act 2023, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or outdated data
• Request deletion of your data (right to erasure)
• Withdraw consent for future processing
• Nominate a person to exercise these rights on your behalf

To exercise any of these rights, email us at barsa.munger@gmail.com. We will respond within 30 days.

8. Security

Your data is stored on secured servers. Order details are transmitted over HTTPS. We do not store payment card data. Access to order records is restricted to authorised personnel only, protected by strong password hashing and time-limited session tokens.

9. Changes to this policy

If we make material changes to this policy, we will update the effective date at the top of this page. For significant changes affecting your rights, we will notify you by email if we hold your address.

10. Contact

For any privacy-related question or to exercise your rights, contact us at barsa.munger@gmail.com.