Privacy notice

This notice explains how Persian Knots collects and uses personal data when you visit our website, buy a rug, send a wholesale enquiry or contact us. It is written to meet India's Digital Personal Data Protection Act, 2023 and, for visitors in the European Union and the United Kingdom, the EU and UK General Data Protection Regulation.

Who we are

The website is run by [[CLIENT TO CONFIRM]] (legal entity name), [[CLIENT TO CONFIRM]] (registered address), India. We are the data fiduciary (under Indian law) and the controller (under the GDPR) for the personal data described here. You can reach our grievance officer at hello@persianknots.com [[CLIENT TO CONFIRM]].

What we collect

• When you order: your name, email, phone number, delivery and billing addresses, an optional GSTIN, the rugs you buy, and the payment status and amounts. Card and bank details are entered on PayGlocal's payment page and never reach us.
• When you create an account: your name, email, optional phone number and a password, which we store only as a one-way hash. Also your saved addresses, wishlist and preferences.
• When you send a wholesale enquiry: your company, contact details, country and city, the quantities and products you are interested in, your message and any files you attach.
• When you contact us: your name, email, optional phone number, order number and message.
• When you browse: the pages you visit, your approximate country (from your connection, to choose a currency and units), and technical data such as your browser and a shortened record of your IP address, kept for security.

We do not collect sensitive data such as health or biometric information, and we do not knowingly collect data from children.

Why we use it

Under the DPDP Act we process your data for the purpose you give it to us for, or with your consent. We do not sell personal data, and we do not use it for automated decisions that affect you.

Who we share it with

Only with the service providers we need, under contracts that protect it [[CLIENT TO CONFIRM]]:

• PayGlocal to process payments;
• couriers (such as Delhivery, Blue Dart, DHL, FedEx or UPS) to deliver your order and contact you about it;
• our email provider to send order and account emails, and the WhatsApp Business service to send messages you ask for;
• our hosting and security providers, who store and protect the website and its database; and
• professional advisers, and authorities where the law requires it, such as tax and customs authorities.

Some of these providers process data outside India or your country. Where data leaves the EU or UK, we rely on the safeguards the GDPR requires, such as standard contractual clauses.

How long we keep it

• Orders and tax invoices: for as long as Indian GST law requires, currently 72 months from the due date of the annual return for the year concerned.
• Wholesale enquiries: 3 years from the last contact.
• Contact messages: 2 years [[CLIENT TO CONFIRM]].
• Accounts: until you ask us to delete them, apart from order records we must keep.
• Security logs: 90 days.

Cookies and local storage

We use only what the site needs to work. The cookie policy lists each cookie by name:

• Preferences: your currency, units and country, and the colour theme, each kept for up to a year.
• Session: secure, HTTP-only cookies that keep you signed in and let you see orders you placed as a guest.
• Your browser's storage: your cart, wishlist and recently viewed rugs, kept on your device.

We do not use advertising or tracking cookies. If we add analytics later, we will ask for your consent first where the law requires it.

Your rights

You can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or complete it;
• delete it, apart from records we must keep by law;
• stop using it for a purpose based on consent, such as our monthly email (every email has an unsubscribe link); and
• in the EU and UK, object to processing based on legitimate interest, or receive your data in a portable format.

Under the DPDP Act you may also nominate someone to exercise your rights if you die or become unable to. To use any of these rights, including deleting your account, contact us; we reply within 30 days. You may complain to the Data Protection Board of India or, in the EU or UK, to your data protection authority.

Security

The site uses encrypted connections (HTTPS) throughout. Passwords are stored only as strong one-way hashes, access to order data is limited to the staff who need it, and payment details are handled only by PayGlocal. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Changes

We will update this notice when our practices change, and show the date of the latest version at the top. For significant changes we will tell account holders by email.