1. Introduction and Scope
1.1. This Privacy Policy ("Policy") governs the collection, storage, processing, use, disclosure and transfer of Personal Data by Mithila Hosieries, a proprietorship having its principal place of business at 46.A(6) Kumaran Colony Extension, Rakkiyapalayam Road, Ammapalayam, Tiruppur, Tamil Nadu 641652, India ("Company", "we", "us" or "our").
1.2. This Policy applies to all Personal Data collected through the website www.mithilahosieries.in, including its online store, order forms, enquiry forms and customer support channels (collectively, the "Platform").
1.3. The Company is a Data Fiduciary within the meaning of the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Personal Data is processed in accordance with the DPDP Act, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
1.4. By accessing the Platform, placing an order, or otherwise providing Personal Data to the Company, the User consents to the practices described in this Policy. A User who does not agree to this Policy must refrain from using the Platform.
1.5. This Policy is published in accordance with Rule 4 of the SPDI Rules and constitutes an electronic record under the Information Technology Act, 2000. It does not require any physical or digital signature.
2. Definitions
2.1. "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
2.2. "Data Principal" or "User" means the individual to whom the Personal Data relates.
2.3. "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, sharing, disclosure, erasure or destruction.
2.4. "Data Processor" means any person who processes Personal Data on behalf of the Company.
2.5. Capitalised terms not defined herein shall carry the meaning assigned to them under the DPDP Act.
3. Categories of Personal Data Collected
3.1. The Company collects the following categories of Personal Data furnished directly by the User:
| Category of data | Point of collection | Purpose of collection |
|---|---|---|
| Name, email address and telephone number | Placement of an order, registration of an account, or correspondence with the Company | Identification of the User and communication relating to the order |
| Billing address, delivery address and postal code | Checkout | Fulfilment of the order and issuance of a valid tax invoice |
| Order particulars, including products, sizes and quantities | Checkout | Fulfilment of the order and processing of any exchange or refund |
| Account password | Registration of an account | Authentication. Stored solely as a one way cryptographic hash and not retrievable in plain text by the Company or by any third party. |
| Business name and Goods and Services Tax Identification Number | Wholesale enquiry form only | Verification of trade status and provision of trade pricing |
| Contents of correspondence | Email, telephone, messaging services and contact forms | Response to the User and maintenance of a record of the interaction |
3.2. The Company additionally collects the following technical data automatically upon access to the Platform: internet protocol address, browser type and version, device type, operating system, screen resolution, referring website and pages accessed. Such data is collected by means of cookies and comparable technologies described in Clause 8.
3.3. The Company does not collect, store or have access to any payment credential, including card numbers, card verification values, Unified Payments Interface personal identification numbers, or internet banking credentials. All payment credentials are collected directly by the payment partner on its own systems. The Company receives only the transaction status, the transaction amount and a transaction reference number.
3.4. The Platform is intended for use by persons who have attained the age of eighteen years. The Company does not knowingly collect Personal Data of children. Where the Company becomes aware that Personal Data of a child has been collected, such data shall be erased forthwith. A parent or lawful guardian who believes that a child has furnished Personal Data may notify the Company at the address in Clause 14.
4. Purposes of Processing
4.1. Personal Data is processed only for the following purposes:
(a) fulfilment of orders, including processing of payment, packing, dispatch, delivery, and the handling of returns, exchanges, cancellations and refunds;
(b) communication in relation to a live order, comprising order confirmations, dispatch and tracking notifications, delivery notifications and responses to queries. Such communications are transactional in nature and are not subject to withdrawal while an order remains in progress;
(c) compliance with statutory obligations, including the issuance of tax invoices and the maintenance of books of account under applicable tax, company and commercial law;
(d) maintenance, administration and improvement of the Platform, including the analysis of aggregate usage patterns;
(e) prevention, detection and investigation of fraud, abuse of the cash on delivery facility, and other unlawful activity; and
(f) delivery of promotional communications, strictly subject to the prior consent of the User in accordance with Clause 7.
4.2. Personal Data shall not be processed for any purpose incompatible with those specified in Clause 4.1 without obtaining fresh consent from the User.
4.3. The Company does not subject Users to automated decision making or profiling that produces legal effects concerning them or similarly significantly affects them.
5. Disclosure of Personal Data
5.1. The Company engages Data Processors to perform functions necessary for the operation of the Platform. Personal Data is disclosed to such Data Processors only to the extent required for the performance of the relevant function. The categories of recipients are set out below.
| Category of recipient | Personal Data disclosed | Purpose of disclosure |
|---|---|---|
| Payment partners, comprising the payment gateway and the banks and card networks operating through it | Name, email address, telephone number, transaction amount and transaction reference | Processing of payment. Payment credentials are collected by such partners directly under their own privacy policies and are not disclosed to the Company. |
| Courier and logistics partners, comprising the shipping aggregator and the courier assigned to a consignment | Name, delivery address, telephone number, consignment weight and, in the case of cash on delivery, the sum to be collected | Delivery of the consignment and provision of tracking facilities |
| Hosting and technology providers | Data stored on the Platform | Hosting of the Platform and its database and maintenance of backups |
| Analytics providers | Pseudonymous usage data and truncated internet protocol address | Measurement of Platform traffic and improvement of Platform content |
| Communication providers, comprising electronic mail, short message service and messaging platforms | Name, email address, telephone number and the content of the communication | Transmission of order confirmations, dispatch and tracking notifications and responses to queries |
| Chartered accountants and auditors | Invoice and transaction records | Statutory accounting, audit and Goods and Services Tax compliance |
5.2. The recipients specified in Clause 5.1 are identified by category and not by name for the reason that the Company may substitute a Data Processor from time to time in the ordinary course of business. Each Data Processor is bound by contract to process Personal Data solely for the purpose for which it was disclosed, to apply reasonable security safeguards, to retain the data no longer than necessary, and not to disclose it to any further party.
5.3. In accordance with Section 11 of the DPDP Act, a User is entitled to obtain the identity of every Data Fiduciary and Data Processor with whom the User's Personal Data has been shared, together with a description of the Personal Data so shared. Such information shall be furnished by the Company upon written request addressed to the contact particulars in Clause 14, within thirty days of receipt of the request and without charge.
5.4. The Company may further disclose Personal Data where such disclosure is required by law, by order of a court or tribunal, or by a governmental, tax, regulatory or law enforcement authority acting under lawful authority, or where such disclosure is necessary for the establishment, exercise or defence of a legal claim.
5.5. In the event of a merger, acquisition, reorganisation or sale of the business or any part thereof, Personal Data may be transferred to the successor entity. Users shall be notified prior to any such transfer, and this Policy shall continue to apply to the transferred data until superseded by notice to the User.
5.6. The Company does not sell, rent, trade or otherwise make available Personal Data to advertisers, data brokers or any other third party for consideration.
6. Storage and Cross Border Transfer
6.1. The Platform and its database are hosted on servers situated in India.
6.2. Certain Data Processors, in particular analytics and communication providers, may process Personal Data on servers situated outside India. Where such transfer occurs, the Company relies upon the contractual data protection undertakings furnished by the relevant Data Processor and transfers Personal Data only to territories that are not restricted by the Central Government by notification under Section 16 of the DPDP Act.
7. Promotional Communications
7.1. Promotional communications by electronic mail, short message service or messaging platform are transmitted only where the User has furnished prior affirmative consent. The placement of an order does not by itself constitute consent to receive promotional communications.
7.2. Consent may be withdrawn at any time, by the unsubscribe facility contained in each communication, by replying with the word STOP, or by written notice to the Company. Withdrawal shall be given effect within three business days of receipt.
7.3. Withdrawal of consent under Clause 7.2 does not affect transactional communications relating to a live order, which are necessary for performance of the contract.
8. Cookies and Comparable Technologies
8.1. Cookies are small text files placed on the User's device by the Platform. The Company employs the following categories:
(a) Strictly necessary cookies, which maintain the contents of the shopping cart, preserve the authenticated session, and secure the checkout process. These cookies are essential to the functioning of the Platform and cannot be disabled;
(b) Analytics cookies, placed by the analytics provider for the purpose of measuring visits and page performance. These cookies are placed only with the consent of the User; and
(c) Preference cookies, which retain User selections such as postal code or recently viewed products.
8.2. A User may block or delete cookies through the settings of the User's browser. Blocking strictly necessary cookies will render the cart and checkout functions inoperative.
8.3. The Company honours "Do Not Track" signals transmitted by a User's browser to the extent the analytics provider supports the same.
9. Retention of Personal Data
9.1. Personal Data is retained only for so long as is necessary for the purpose for which it was collected, or for such longer period as is required by law.
| Category of data | Retention period |
|---|---|
| Order records, invoices and books of account | Six years from the end of the relevant financial year, as required under the Central Goods and Services Tax Act, 2017 and the Income-tax Act, 1961 |
| Registered account particulars | Until deletion of the account is requested by the User |
| Customer support correspondence | Three years from the date of the last communication |
| Records of consent and withdrawal of consent | Until withdrawal of consent, and one year thereafter as evidence of the withdrawal |
| Analytics data | Fourteen months |
9.2. Upon expiry of the applicable retention period, Personal Data shall be erased or irreversibly anonymised.
10. Security Safeguards
10.1. The Company implements reasonable security practices and procedures within the meaning of Rule 8 of the SPDI Rules and Section 8(5) of the DPDP Act, including:
(a) transmission of all data over the Platform by means of Transport Layer Security encryption;
(b) storage of passwords solely as one way cryptographic hashes;
(c) restriction of administrative access to authorised personnel, subject to strong authentication credentials and two factor authentication;
(d) exclusion of payment credentials from the Company's systems, such credentials being collected directly by a payment partner certified to the Payment Card Industry Data Security Standard; and
(e) timely application of software updates and maintenance of daily backups of the database.
10.2. Notwithstanding Clause 10.1, no method of transmission or storage is entirely secure, and the Company does not warrant absolute security of Personal Data.
10.3. In the event of a personal data breach, the Company shall notify each affected User and the Data Protection Board of India in the manner and within the period prescribed under the DPDP Act.
11. Rights of the Data Principal
11.1. Subject to the DPDP Act, a User has the following rights:
(a) Right to access information, being the right to obtain a summary of the Personal Data processed by the Company, the processing activities undertaken, and the identities of the Data Fiduciaries and Data Processors with whom the Personal Data has been shared, in accordance with Clause 5.3;
(b) Right to correction and erasure, being the right to have inaccurate or misleading Personal Data corrected, incomplete Personal Data completed, Personal Data updated, and Personal Data erased where retention is no longer necessary for the purpose for which it was collected and is not required to be retained by law;
(c) Right to withdraw consent, being the right to withdraw consent at any time with the same ease with which it was given, provided that the lawfulness of processing carried out prior to withdrawal is not affected;
(d) Right of grievance redressal, being the right to a readily available means of registering a grievance with the Company in accordance with Clause 12; and
(e) Right to nominate, being the right to nominate another individual to exercise these rights in the event of the death or incapacity of the User.
11.2. A right under Clause 11.1 may be exercised by written request to the contact particulars in Clause 14, containing sufficient particulars to identify the User and the right sought to be exercised. The Company shall respond within thirty days of receipt and shall not levy any charge.
11.3. The Company may require verification of the identity of the requesting person prior to giving effect to a request, in order to prevent unauthorised disclosure.
11.4. A User is under a duty, pursuant to Section 15 of the DPDP Act, to furnish only authentic and verifiably correct particulars and not to impersonate another person or suppress material information.
12. Grievance Redressal
12.1. The Company has appointed a Grievance Officer in accordance with Section 13 of the DPDP Act and Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020. The particulars of the Grievance Officer are published on the Contact Us page of the Platform.
12.2. Every grievance shall be acknowledged within forty eight hours of receipt and disposed of within one month of receipt.
12.3. A User who remains aggrieved following the disposal of a grievance under Clause 12.2 may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act.
13. Third Party Links
13.1. The Platform contains links to external websites, including social media pages operated by the Company and the partner portal. This Policy does not extend to such external websites. The Company is not responsible for the privacy practices or the content of any external website, and Users are advised to review the privacy policy of each such website.
14. Contact Particulars
14.1. All notices, requests and communications under this Policy shall be addressed to:
Mithila Hosieries
46.A(6) Kumaran Colony Extension
Rakkiyapalayam Road, Ammapalayam
Tiruppur, Tamil Nadu 641652, India
Email: mithilahosieries@gmail.com
WhatsApp: +91 88073 64519
15. Amendment of this Policy
15.1. The Company may amend this Policy from time to time. The effective date stated at the head of this Policy denotes the date of the current version.
15.2. Where an amendment materially affects the manner in which Personal Data is processed, the Company shall give notice to Users by electronic mail or by prominent notice on the Platform prior to the amendment taking effect.
15.3. Continued use of the Platform following the effective date of an amendment constitutes acceptance of the amended Policy.
16. Governing Law
16.1. This Policy is governed by and construed in accordance with the laws of India. Subject to the rights conferred upon consumers under the Consumer Protection Act, 2019, the courts at Tiruppur, Tamil Nadu shall have exclusive jurisdiction in respect of any dispute arising out of or in connection with this Policy.