Privacy Policy

1. Who we are (Data Fiduciary)

MyMalls.in (“MyMalls”, “we”, “us”) is the Data Fiduciary under India’s Digital Personal Data Protection Act 2023 for any personal data you share with us through https://mymalls.in.

Registered address: 43, Bhestan Char Rasta, Surat Navsari Main Road, Surat, Gujarat — 394230
Email: support@mymalls.in
Phone: +918530054200

2. Grievance Officer

As required under DPDP Act 2023 and Rule 5 of the IT (Reasonable Security Practices) Rules 2011, we have designated a Grievance Officer to address any concern about how your personal data is processed.

Name: Vishal Singh
Email: grievance@mymalls.in
Address: 43, Bhestan Char Rasta, Surat Navsari Main Road, Surat, Gujarat — 394230

We acknowledge every grievance within 24 hours and resolve it within 15 days of receipt.

3. Personal data we collect

• Identity & contact: name, email, phone, shipping and billing address (collected at account creation and checkout).
• Payment data: processed by our payment partners (Razorpay, Cashfree). We never see or store card numbers, CVVs or UPI PINs — only the order amount and a one-way payment reference.
• Order data: the products you bought, customisations you uploaded, delivery address, dispatch and tracking events.
• Customer-uploaded images: when you design a custom case, the photo you upload is stored to enable printing and reorder.
• Account preferences: wishlist, recently viewed, newsletter consent state, theme preference.
• Technical: IP address, device, browser type, referrer, session and cookies.
• Communications: the content of your messages to us (contact form, WhatsApp, email) and our replies.

4. Purposes and lawful basis

We process the data above for the following specified purposes:

• Order fulfilment (necessary for contract) — taking payment, printing, packing, shipping, returns, refunds and customer support.
• Account management (necessary for contract) — authentication, order history, saved addresses, wishlist.
• Marketing communications (consent) — newsletter, promotional WhatsApp/SMS/email. You can withdraw consent any time via the unsubscribe link in every email or by replying STOP.
• Fraud prevention & RTO control (legitimate interest) — COD-OTP verification, pincode-risk scoring, repeated- refusal flagging.
• Analytics (consent) — aggregated, de-identified statistics about how the storefront is used so we can improve it.
• Legal & tax (legal obligation) — GST invoicing, income-tax record-keeping, complying with lawful demands.

5. Sharing with third parties

We share the minimum personal data necessary with the following service providers, each bound by a Data Processing Agreement and to processing your data only on our instructions:

• Payment — Razorpay, Cashfree (India). They receive your payment-tokenisable identifiers, not card numbers.
• Logistics — Shiprocket and the underlying carrier (Delhivery, Bluedart, Ekart, India Post, etc.). They receive your shipping address, phone and order weight.
• Email & SMS — Brevo / SendGrid / Mailmodo for transactional and marketing email; MSG91 / Fast2SMS for SMS; Interakt / Gupshup for WhatsApp Business API.
• Analytics & ads — Meta (Facebook), Google Analytics, Google Ads. We share hashed identifiers via Meta Conversions API and Google Measurement Protocol; aggregated event data only. You can opt out of marketing cookies via our cookie banner.
• Cloud infrastructure — Cloudflare R2 for asset storage, AWS / GCP for compute. Data at rest is encrypted.

6. How long we keep your data

• Order records: 5 years from the last transaction, per the Companies Act 2013, Income Tax Act 1961 and GST law.
• Account data: for as long as your account is active. You can request deletion at any time (see ‘Your rights’ below).
• Custom-print uploads: retained for 24 months so you can reorder, then deleted automatically.
• Marketing consent records: the consent itself and the time it was given are retained for 2 years after withdrawal, to demonstrate compliance.
• Server / access logs: 30 days, except where retained longer for fraud investigation.

7. Your rights as a Data Principal

Under DPDP Act 2023, you have the right to:

• Access the personal data we hold about you.
• Correct or update inaccurate or incomplete data.
• Erase data that is no longer needed.
• Withdraw consent for processing based on consent (e.g. marketing).
• Nominate a person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — raise a complaint with our Grievance Officer, and if unsatisfied, escalate to the Data Protection Board of India.

To exercise any of these rights, email privacy@mymalls.in from the email address on your account. We will respond within 30 days as required by law.

8. Cross-border transfer

Most of your personal data is stored in India. Some service providers (Meta, Google, Cloudflare) may process data in other jurisdictions approved by the Government of India for transfer under section 16 of the DPDP Act. Where transfer occurs, it is governed by Standard Contractual Clauses and equivalent safeguards.

9. Children's data

Our services are not directed at individuals under 18. We do not knowingly collect personal data from a child without verifiable parental consent. If you believe a minor has provided us data, please contact privacy@mymalls.in and we will delete it.

10. Cookies and tracking

We use three categories of cookies:

• Essential — login session, cart contents, fraud prevention. These cannot be disabled.
• Analytics — anonymised usage statistics (Google Analytics). Opt out via the cookie banner.
• Marketing — Meta Pixel, Google Ads remarketing tags. Used only with your consent.

You can adjust your choice any time by clicking “Cookie Settings” in the site footer.

11. Security measures

We take reasonable security precautions to protect your data:

• HTTPS / TLS 1.3 in transit for all traffic.
• Passwords hashed with bcrypt / argon2id; OTPs single-use, expiring within 10 minutes.
• Card data never touches our servers — PCI-DSS Level 1 partners only.
• Encrypted backups, principle-of-least-privilege access control, role-based admin permissions.
• Rate-limiting and bot detection on authentication endpoints.

12. Breach notification

If a personal-data breach occurs that is likely to result in significant harm, we will notify the Data Protection Board of India and affected users without undue delay, as required under section 8(6) of the DPDP Act 2023.

13. Changes to this policy

We may update this policy as our services evolve or the law changes. We'll post any material change on this page with a new “Last updated” date and, where appropriate, by email to your account.