Privacy Policy

We are the Data Fiduciary for the personal data described here — that is, we decide why and how it is processed. You are the Data Principal.

Entity

Matadee Traders

Website

matadeetraders.com

We collect only what a purchase and an account actually require. Each item below is tied to the purpose it serves; we do not collect data speculatively.

• Account details — your name, email address and, if you give one, your phone number. Used to identify you, to sign you in and to contact you about your orders. Your password is never stored; only a bcrypt hash of it is.
• Delivery addresses — recipient name, phone, street address, city, state and PIN code. Used to deliver your order and to print the invoice.
• Order and payment records — items, quantities, prices, order status, payment method, payment status and the transaction reference returned by our payment gateway. Used to fulfil the order, to issue a tax invoice, to process refunds and to meet our accounting and tax obligations.
• Cart and wishlist contents — including for visitors who are not signed in, held against a cookie so the basket survives a page reload.
• Reviews — the rating and comment you submit, shown publicly with your display name.
• Communication records — the fact that an order confirmation, invoice, status update, cancellation notice or password-reset code was sent to you, when, and whether it was delivered. We keep the subject line and delivery outcome, not a copy of the message body.
• Support messages and bulk enquiries — anything you write to us through the contact form, the bulk enquiry form (including a company name, if you give one) or by email, so that we can answer it.

• We never see or store your card, UPI, netbanking or wallet credentials. Payments are taken on the payment gateway’s own secure page. We receive only a payment reference, an amount and a success or failure result.
• We do not sell, rent or trade your personal data to anyone, for any purpose.
• We do not build advertising profiles, and we do not run third-party advertising or tracking pixels on this site.
• We do not ask for data we have no use for — no date of birth, no gender, no identity documents, no biometric information.

We use the smallest set of cookies the site can work with. None of them are advertising cookies.

• Session cookie — set when you sign in, so that you stay signed in. It is httpOnly (script on the page cannot read it), SameSite=Lax, signed by our server, and it carries only an account reference — never your role, your email or your password.
• Cart cookie — lets a basket built before signing in survive a page reload, and is merged into your account when you sign in.
• Password-reset cookie — short-lived, issued only while you are resetting a password, and discarded as soon as the reset finishes.

You can clear cookies in your browser at any time. Doing so signs you out and empties a guest basket.

Under section 4 of the DPDP Act we process personal data either with your consent or for a legitimate use permitted by the Act.

• Consent — given when you create an account, place an order, submit a review or write to us. The purpose is stated at the point of collection, and you may withdraw consent at any time (see section 8).
• Performance of your order — processing necessary to accept, pack, deliver, invoice and refund what you bought.
• Legal obligation — keeping invoices and transaction records as required by tax, GST and company law, and responding to lawful requests from a court or authority.

Withdrawing consent does not make earlier lawful processing unlawful, and does not remove records we are legally required to keep.

We share personal data only with the service providers needed to run the shop, and only so far as each of them needs it. Each acts as a Data Processor on our instructions.

• Payment gateway — to take payment and issue refunds. They receive the order amount and the contact details required to process the transaction, and they hold the card or UPI details we never see.
• Delivery partners — to deliver the parcel. They receive the recipient’s name, address and phone number, and nothing about what you paid.
• Email provider — to deliver order confirmations, invoices, status updates and password-reset codes to your address.
• Hosting and storage providers — the infrastructure this site and its database run on.
• Professional advisers and authorities — our accountants and auditors, and any authority to which disclosure is required by law.

• Account data — while your account is open. If you ask us to erase your account we do so, except for records we must retain by law.
• Orders, invoices and payment records — retained for the period required by Indian tax and company law, which is currently up to eight years from the end of the relevant financial year. We keep these even after an account is closed, because we are obliged to.
• Password-reset codes — valid for five minutes and discarded once used. Only a hash of the code is ever stored.
• Guest baskets — cleared when the cookie expires or the basket is abandoned.
• Support messages — kept while the matter is open and for a reasonable period afterwards so that we can deal with any follow-up.

As a Data Principal you have the following rights. Write to the Grievance Officer in section 12 to use any of them; we will verify that the request is yours before acting on it.

• Right to access (s.11) — a summary of the personal data we hold about you, what we are doing with it, and who we have shared it with.
• Right to correction and erasure (s.12) — to have inaccurate data corrected, incomplete data completed, and data erased where it is no longer needed for the purpose it was collected for and we are not required to keep it.
• Right to withdraw consent (s.6(4)) — as easily as it was given. You can close your account, or ask us to stop processing for a purpose you consented to.
• Right of grievance redressal (s.13) — to complain to us first, and to receive a response within the period set out in section 12.
• Right to nominate (s.14) — to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Right to complain to the Board — if our answer does not resolve the matter, you may complain to the Data Protection Board of India.

You can already see and change much of this yourself: your profile, saved addresses and order history are on your account pages.

Section 15 of the DPDP Act places some duties on you as well: not to impersonate another person when providing data, not to suppress material information when providing it where legally required, not to register a false or frivolous grievance, and to furnish only authentic information when asking for correction or erasure.

This shop is intended for adults. We do not knowingly process the personal data of a child under 18 without the verifiable consent of a parent or lawful guardian, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children — both prohibited by section 9 of the DPDP Act. If you believe a child has given us personal data, tell the Grievance Officer and we will delete it.

• Security — passwords are stored only as bcrypt hashes; the site is served over HTTPS; administrative functions are restricted by role and checked on the server for every action, not merely hidden in the interface; payment credentials never reach our systems.
• Transfers outside India — some of our service providers operate infrastructure outside India. Where that happens we transfer data only as permitted by section 16 of the DPDP Act and never to a territory restricted by the Central Government.
• Breach notification — in the event of a personal data breach we will notify the Data Protection Board of India and every affected Data Principal, as required by section 8(6), with what happened and what you should do.

No method of transmission or storage is perfectly secure, and we do not claim otherwise. What we can promise is that we collect little, keep it no longer than we must, and tell you promptly if something goes wrong.

In accordance with section 13 of the DPDP Act, rule 5(3) of the Consumer Protection (E-Commerce) Rules, 2020, and the Information Technology Act, 2000, the following officer answers questions and complaints about your personal data.

Designation

Grievance Officer

Hours

Monday to Saturday, 10:00 to 18:00 IST

We acknowledge every complaint within 48 hours of receiving it and resolve it within one month, as required by the Consumer Protection (E-Commerce) Rules, 2020. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India.

If we change what we collect or why, we will revise this page and update the date at the top. Where the change materially affects how your data is used, we will tell you directly rather than relying on you to re-read the page.