Last updated: 12 October 2026. Effective from: 12 October 2026.
Kabbu Mart (Navneet Sogani, Proprietorship, GSTIN 08AGCPS3507N1Z2) respects your privacy. This policy explains what personal data we collect when you use kabbumart.com, why we collect it, who we share it with and what rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian laws. For the purposes of the DPDP Act, Kabbu Mart is the Data Fiduciary.
1. Personal data we collect
- Identity and contact data: your name, mobile number, email address and, if you create an account, your password (stored only in encrypted, hashed form).
- Delivery and billing data: delivery and billing addresses, pincode, and your GSTIN if you ask for a business invoice.
- Order data: the products you buy, order value, payment method used (for example UPI, card or COD), payment status and the transaction reference given by the payment gateway.
- Shopping activity: items in your cart, wishlist, price alerts, searches and reviews.
- Communication data: messages you send to our support team, and your delivery and WhatsApp, SMS or email message history with us.
- Device and usage data: IP address, browser and device type, pages viewed, referring website and approximate location derived from your IP address or pincode.
- Cookies and similar technologies, described in our Cookie Policy.
We do not collect or store your card number, CVV, UPI PIN, or net banking credentials. These are entered directly on the secure page of the RBI-authorised payment gateway.
2. Why we use your data
| Purpose | Examples |
|---|---|
| Fulfil your order | Confirm and process orders, arrange payment, pack and ship, share tracking updates, issue invoices, handle returns and refunds |
| Customer support | Reply to queries, resolve complaints |
| Security and fraud prevention | Verify OTPs, detect suspicious orders, prevent misuse of COD and coupons |
| Legal compliance | GST records, accounting, responding to lawful requests from authorities |
| Reminders you have chosen | Left-over cart reminders, wishlist price-drop alerts, back-in-stock alerts |
| Marketing | Offers and new arrivals by WhatsApp, SMS or email, only where you have opted in |
| Improving the website | Understanding which pages work well, fixing errors, measuring performance |
3. Legal basis: your consent and legitimate uses
We process your personal data on the basis of your free, specific, informed and unambiguous consent, which you give when you tick the consent box, create an account, or place an order. For some purposes the DPDP Act allows processing without consent, for example to perform what you asked us to do (such as delivering your order), to comply with the law (such as keeping GST invoices) or to prevent fraud. Marketing messages and non-essential cookies are sent or used only with your consent, and you can withdraw that consent at any time.
4. Who we share your data with
We never sell or rent your personal data. We share only what is needed with service providers who process it on our behalf:
- Payment gateways (RBI-authorised gateways such as Razorpay, Cashfree or PhonePe) to take payments and process refunds.
- Courier and logistics partners (directly or through a shipping aggregator) to deliver your order. They receive your name, address and phone number.
- Partner suppliers who ship from their own warehouses, where your product is dispatched by them. They receive only the delivery details needed to ship.
- Messaging providers (for example WhatsApp Business Platform, SMS and email service providers) to send order updates and reminders.
- Hosting, security and analytics providers who run the website.
- Accountants and professional advisers, and government authorities when the law requires.
These providers are allowed to use your data only for the service they perform for us and must protect it.
5. Transfers outside India
Some of our service providers, such as cloud, email and messaging platforms (including WhatsApp, which is operated by Meta), may store or process data on servers outside India. We transfer data only to the extent permitted by the DPDP Act and the rules made under it, and we use providers that apply appropriate security safeguards.
6. How long we keep your data
- Account and profile data: until you ask us to delete your account, or after a long period of inactivity.
- Order, invoice and payment records: for as long as tax and accounting laws require us to keep them (generally at least six years under GST law).
- Support messages: up to three years after the query is closed.
- Marketing consent records and message logs: until you withdraw consent, plus a reasonable period to prove compliance.
- Left-over cart and browsing data: a short period, typically not more than 90 days.
When the retention period ends, we delete the data or remove everything that identifies you.
7. Children's data
Our website is meant for adults. We do not knowingly collect personal data of anyone under 18 years of age without the verifiable consent of a parent or lawful guardian, and we do not track, monitor the behaviour of, or target advertising at children. If you believe a child has given us data, please contact us and we will delete it.
8. Your rights
Under the DPDP Act you have the right to:
- access a summary of the personal data we hold about you and the third parties we have shared it with;
- correct inaccurate data and complete or update incomplete data;
- erase your personal data, unless we must keep it to comply with a law;
- withdraw your consent at any time, as easily as you gave it (you can also use the unsubscribe link or reply STOP to a message);
- get your grievance redressed; and
- nominate another person to exercise your rights if you die or become unable to do so.
You can download or delete your data from your account page, or email info.kabbumart@gmail.com with the subject "Privacy request". We may ask you to verify your identity first. We respond within 30 days.
9. Security and data breaches
We use encrypted connections (HTTPS), hashed passwords, access controls, activity logs and regular backups to protect your data. No system is completely secure. If a personal data breach occurs, we will inform the Data Protection Board of India and the affected users in the manner required by law.
10. Cookies
We use cookies to keep you signed in, remember your cart, and (with your consent) understand how the website is used. Please read our Cookie Policy for the list and for how to control them.
11. Grievance and contact
For any privacy question or complaint, contact our Grievance Officer: Navneet Sogani, Proprietor, Kabbu Mart, F.No. 141/C-106, Rama Krishna Apartment, Shipra Path, Mansarovar, Jaipur, Rajasthan 302020. Email: info.kabbumart@gmail.com. Phone: +91 98290 00051. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it is operational under the DPDP Act.
12. Changes to this policy
We may update this policy when our practices or the law change. The latest version, with its date, is always on this page. Where a change is significant, we will tell you by email or a notice on the website.