Privacy Policy

1. Who we are

India Bobbles ("India Bobbles", "we", "us") sells hand-painted collectible bobbleheads and figurines through www.indiabobbles.com (the "Website"). The Website is operated by [Legal entity name], H104, Ajnara Daffodil, Sector 137, Noida, Uttar Pradesh – 201305, India.

For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, we are the Data Fiduciary for the personal data described in this policy. You are the Data Principal.

2. Scope of this policy

This policy applies to personal data we collect when you visit the Website, create an account, place an order, chat with us, comment on our blog, subscribe to emails, contact us by email or WhatsApp, or read our Help Centre at indiabobbles.tawk.help. It does not apply to other websites you reach through links on our Website.

By using the Website, you acknowledge this policy. Where we rely on your consent, we ask for it separately and clearly.

3. Data we collect

a) Data you give us

• Account details: name, email address, mobile number and, if you choose to add them, last name, date of birth, gender and country.
• Login data: one-time passcodes (OTPs) sent to your email. We don't use or store passwords.
• Order details: delivery name, address, PIN code, phone number, the products you buy and your order history.
• Custom bobblehead requests: the photos, descriptions, occasion and deadline you send us. Photos may show you or other people. Please only send photos of others with their permission.
• Communications: messages you send through our chat, email, WhatsApp, contact forms or blog comments, including any files you attach.
• Preferences: whether you want marketing emails, and "notify me" requests for out-of-stock products.

b) Data collected automatically

• Device and usage data: IP address, browser type, device type, pages viewed, time spent, referring website and approximate location (city or region) derived from your IP address.
• Cookies and similar technologies: see section 8.

c) Data from others

• Payment gateway: confirmation of whether your payment succeeded, a transaction reference and the payment method type. We do not receive your full card number or bank login.
• Courier partners: delivery status and proof of delivery.

4. How we use your data

We do not use your data for automated decisions that have legal or similarly significant effects on you.

5. Consent & legal basis

Under the DPDP Act, we process your personal data either:

• with your consent, for example when you create an account, subscribe to marketing emails, send us photos for a custom order or post a blog comment; or
• for certain legitimate uses permitted by law, for example where you voluntarily give us data for a specific purpose (such as delivering an order you placed), or to comply with a law, court order or government request.

Withdrawing consent: you can withdraw your consent at any time, as easily as you gave it, by updating your profile, using the unsubscribe link in any email, or writing to our Grievance Officer (section 18). Withdrawal doesn't affect processing already done, and we may still keep data where the law requires it. If you withdraw consent needed to run your account, we may not be able to continue providing it.

6. Emails & marketing

• We send marketing emails (offers, launches, festival deals, newsletters) only if you opt in, for example by ticking the box when you register, switching it on in your profile, or subscribing on our Website.
• Every marketing email includes an unsubscribe link. You can also turn emails off in your profile.
• Service messages about your account, orders and deliveries will still be sent, because we need them to serve you.
• We may use an email service provider to send emails. They act only on our instructions.

7. Who we share data with

We never sell or rent your personal data. We share it only with service providers (Data Processors) who help us run our business, under contracts that require them to protect it and use it only for our purposes:

We may also disclose data where required by law, a court order or a government authority; to protect our rights, customers or the public from fraud or harm; or to a successor if our business is sold or merged, in which case this policy will continue to apply.

8. Cookies & tracking

Cookies are small files stored on your device. We use:

• Essential cookies: to keep you logged in, remember your cart and keep the Website secure. The Website won't work properly without them.
• Analytics cookies: to count visits and see which pages are popular (for example Google Analytics).
• Third-party cookies: set by services embedded on our pages, such as live chat, blog comments and social media plugins.

You can block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the Website, such as login and cart, from working.

9. Payments

Online payments are processed by our payment gateway partner, PayU. Your card, UPI and bank details are entered on, or securely passed to, the gateway. We do not see or store your full card number, CVV, UPI PIN or net banking password. The gateway handles this data under its own security standards and privacy policy.

10. How long we keep data

• Account data: while your account is active. If you ask us to delete your account, we erase your personal data unless we must keep it by law.
• Inactive accounts: we may delete accounts that haven't been used for 3 years. We'll email you at least 48 hours before deleting, so you can log in to keep it.
• Order and invoice records: as long as tax, accounting and consumer laws require, generally up to 8 years.
• Custom order photos: until your order is complete and any replacement period is over, then deleted, unless you allow us to keep them.
• Marketing preferences: until you unsubscribe. We keep a record of the unsubscribe so we don't email you again.
• Chat and support messages: up to 2 years, to help resolve repeat issues.
• Security and access logs: at least one year, as required by law, to investigate misuse.

11. Security

We use reasonable security safeguards to protect your data, including HTTPS encryption, OTP-based login with no stored passwords, captcha and spam checks, access controls that limit who can see data, and regular review of our systems and service providers. No system is completely secure. If you think your account has been misused, contact us immediately.

12. Your rights

Under the DPDP Act, you have the right to:

• Access: get a summary of the personal data we hold about you, how we use it, and who we've shared it with.
• Correct and update: fix inaccurate or incomplete data. You can update most details yourself in My Profile.
• Erase: ask us to delete your data when it's no longer needed or you withdraw consent, unless we must keep it by law.
• Withdraw consent: at any time (see section 5).
• Grievance redressal: complain to our Grievance Officer, who will respond within the time required by law.
• Nominate: name another person to exercise your rights if you die or become incapacitated.

To use any of these rights, email our Grievance Officer (section 18). We may need to verify your identity first, usually with an OTP to your registered email. If you're not satisfied with our response, you can complain to the Data Protection Board of India.

13. Children

Our Website is meant for adults. Some of our products are suitable for ages 14+, but accounts and orders should be created by a parent or guardian. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or guardian, and we do not track, profile or send targeted ads to children. If you believe a child has given us personal data, contact us and we'll delete it.

14. Data stored outside India

Some of our service providers, such as chat, analytics, comments and email tools, may store or process data on servers outside India. When this happens, we only transfer data as permitted by Indian law, and we choose providers that protect it with appropriate safeguards.

15. Links to other sites

Our Website may contain links to other websites. We do not control, and are not responsible for, the privacy practices of other sites. We encourage you to read the privacy policy of every website that collects personal data. This policy applies only to data collected by India Bobbles.

16. Data breaches

If a personal data breach affects you, we'll inform you without delay, explaining what happened, the likely impact, what we're doing about it and steps you can take to protect yourself. We'll also report it to the Data Protection Board of India and other authorities as required by law.

17. Changes to this policy

We may update this policy from time to time. We'll change the "Last updated" date at the top and, for significant changes, notify you by email or with a notice on the Website. Please check this page regularly.

18. Grievance Officer & contact