TAALAPATRA VIBES — PRIVACY & DATA PROTECTION POLICY

Last Reviewed: 23rd February 2026

This Privacy & Data Protection Policy describes how Taalapatra Vibes ("Taalapatra," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you visit www.taalapatra.com (the "Site") or use our services ("Services"). This Policy applies to all visitors, customers, and users of the Site.

By using our Services, you agree to the collection, use, and disclosure of your information as described in this Policy. If you do not agree, please do not access or use the Site. This document should be read alongside our Terms of Use, Disclaimer, Cookie Policy, and Return & Refund Policy.

1. Hosted Platform — Shopify

Our online store is hosted on Shopify Inc., which provides us with the e-commerce platform to sell our products and services. Your personal data is stored on Shopify's servers, protected by firewalls, encryption, and industry-standard security protocols. For Shopify's privacy practices, visit: https://www.shopify.com/legal/privacy

2. Taalapatra as Data Fiduciary

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), Taalapatra Vibes is the Data Fiduciary — the entity that determines the purpose and means of processing your personal data. We process your data lawfully, fairly, and transparently, and only for the purposes described in this Policy. Our named Data Protection & Grievance Officer is identified in Section 16.

3. Changes to This Policy

We may update this Policy periodically to reflect changes in technology, law, or our business operations. The most current version will always be posted on this page with an updated "Last Reviewed" date. Continued use of the Site after any update constitutes your acceptance of the revised Policy.

4. How We Collect Your Information

a) Directly from You

When you place an order, create an account, contact our support team, or subscribe to our newsletter, we collect: your name, billing and shipping address, phone number, email address, account login credentials, and order or support-related details.

b) Automatically (Usage Data)

Using cookies and similar technologies, we automatically collect: your IP address, browser and device data, approximate time zone and location, and your site activity and interaction history. For full details, please refer to our Cookie Policy.

c) From Third Parties

We may receive data from Shopify (our platform provider), payment gateways such as Razorpay and PayPal, logistics, marketing, and analytics providers, and social platforms if you interact via widgets or login tools.

5. What Personal Information We Collect

Depending on your interaction with our Services, we may collect the following categories of data:

We do not knowingly collect sensitive personal data such as health, religious, financial, or biometric information.

6. How We Use Your Information

a) Fulfilling Orders and Deliveries

We use your data to process transactions and payments, provide invoices and shipping updates, and manage order history, returns, and refunds.

b) Customer Service and Support

We use your data to respond to queries and requests, notify you of order issues or status updates, and send account or service-related communications.

c) Marketing and Promotions

With your consent, we use your data to send newsletters and promotional offers, tailor communications based on your preferences, and run social media and web campaigns.

d) Improving Site Performance

We analyse user behaviour to improve your experience, detect issues, and test new features and functionality.

e) Fraud Prevention and Legal Compliance

We use your data to monitor suspicious activity, enforce our Terms of Use, and comply with all applicable legal and regulatory obligations.

7. Cookies and Tracking Technologies

We use cookies and similar tools to power key site features such as your cart and login session, track site performance, and personalise your shopping experience. You can manage or disable cookies via your browser settings; however, certain features may stop functioning if cookies are disabled. For full details, please refer to our Cookie Policy.

8. Sharing Your Personal Data

We do not sell your personal information. We may share it with the following parties for the purposes indicated:

All third parties are bound by strict data protection and confidentiality obligations.

9. Your Rights Under India's DPDP Act 2023

If you are an Indian resident, you have the following rights under the Digital Personal Data Protection Act, 2023:

a) Right to Access — You may request a summary of your personal data and the purposes for which it is being processed.

b) Right to Correction — You may request correction of inaccurate or incomplete personal data held by us.

c) Right to Erasure — You may request deletion of your personal data, subject to our legal retention obligations under applicable law.

d) Right to Grievance Redressal — You may lodge a complaint with our Data Protection & Grievance Officer (see Section 16). We will respond within 30 business days of receipt.

e) Right to Nominate — You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. This right is unique to the DPDP Act and applies to Indian residents.

f) Right to Withdraw Consent — You may withdraw your consent for data processing at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please email care@taalapatra.com with the subject line: "DPDP Rights Request — [Your Name]"

10. Your Rights Under GDPR (EU/EEA Users)

If you reside in the EU or EEA, you have the following rights under the General Data Protection Regulation (GDPR):

a) Right to Access — Request a copy of your personal data held by us.

b) Right to Rectification — Request correction of inaccurate or outdated data.

c) Right to Erasure — Request deletion of your personal data ("right to be forgotten").

d) Right to Restrict Processing — Request that we limit how we use your data.

e) Right to Data Portability — Request transfer of your data to another service provider.

f) Right to Object — Decline marketing communications or profiling.

g) Right to Withdraw Consent — Opt out of consent-based processing at any time.

To exercise any of these rights, email care@taalapatra.com. You may also lodge a complaint with your local Data Protection Authority.

11. Data Transfers Outside Your Country

Your data may be transferred to and stored in India, Canada, or the USA, where Shopify and our service providers operate. Where required, we ensure such transfers comply with applicable international frameworks including Standard Contractual Clauses (SCCs), binding corporate rules, and recognised adequacy decisions.

12. Data Retention

We retain your personal data only for as long as necessary for the following purposes:

a) Order and transaction data is retained for 7 years to comply with Indian tax and accounting obligations under the Income Tax Act and GST regulations.

b) Account data is retained until you request deletion of your account or personal data.

c) Marketing consent data is retained until you withdraw your consent.

d) Customer support records are retained for up to 3 years from the date of the last interaction.

You may request data deletion at any time by emailing care@taalapatra.com with the subject line: "Data Deletion Request — [Your Name]". We will process your request within 30 business days, subject to any legal retention obligations.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in risk to your rights or interests, Taalapatra Vibes will notify affected users within 30 business days of becoming aware of the breach, in accordance with the DPDP Act 2023 and applicable international standards. Notification will be sent to the email address associated with your account.

14. Children's Privacy

For Indian users: Our Site and Services are not intended for individuals under 18 years of age, in accordance with the DPDP Act 2023.

For international users: Our Site is not directed at children under 13 years of age, in accordance with applicable international standards including COPPA (USA).

If we learn that we have unknowingly collected personal data from a minor below the applicable age threshold, we will promptly delete it. Parents or guardians who believe their child's data has been collected may contact us at care@taalapatra.com.

15. Security of Your Data

We implement strong technical and organisational security measures including SSL encryption, PCI-DSS compliance via Shopify, access controls limited to authorised personnel only, and regular platform security updates. While we take every reasonable precaution, no internet system is 100% secure. Please avoid sending sensitive data through unsecured channels.

16. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the content, privacy practices, or security of these external platforms. Please review their individual privacy policies before providing any personal data.

17. Dispute Resolution Framework

We always prefer an amicable resolution. If you have a concern related to your personal data or this Policy, please contact us first — most issues are resolved quickly once we speak.

17a. Direct Dialogue

We will aim to resolve the matter by email, WhatsApp, or phone within five (5) business days. Direct negotiation is the quickest and least costly path for all parties.

17b. Voluntary Mediation

If resolution through direct dialogue is not achieved, either party may invite a neutral mediator accredited by the Odisha State Legal Services Authority. Mediation is voluntary, confidential, and typically faster than formal legal proceedings.

17c. Binding Arbitration

Should mediation not resolve the dispute, it may be referred to sole arbitration seated in Bhubaneswar, Odisha, under the Indian Arbitration & Conciliation Act, 1996.

i) Rules & Language: Proceedings shall follow the Act's Part I defaults. All hearings and filings shall be conducted in English.

ii) Award: The arbitrator's decision is final and enforceable in any competent court.

iii) Costs: The arbitrator may apportion fees and expenses as deemed fair.

17d. Small-Claims Carve-Out

Either party may opt for the civil judge (small-cause court) if the amount in dispute falls below the monetary ceiling fixed for such courts in Odisha. This route does not require prior mediation or arbitration.

17e. Collective Actions

All proceedings must be brought on an individual basis. Class, collective, or representative actions are waived to the extent permitted by Indian law.

17f. Governing Law & Jurisdiction

This Policy — and any dispute not resolved through the steps above — shall be governed by the laws of India. Subject to the arbitration clause in 17c, the courts at Bhubaneswar, Odisha (India) hold exclusive jurisdiction.

18. Contact Us

For any questions, requests, or complaints related to this Policy, please contact:

Customer Support:

Email: care@taalapatra.com
Call & WhatsApp Support: +91-9777108304
Timing: Mon–Sat, 11 AM–5 PM IST (excluding public holidays)

Grievances:

S Dash
Chief Grievance & Data Protection Officer
Email: hello@taalapatra.com
Call Support: +91-9777108304