Privacy policy
Version 0.9 · Effective 19 Oct 2026
Draft for legal review. This document is a starting template and must be reviewed by a qualified lawyer before launch.
This policy explains how [Girivana legal entity name] (“Girivana”, “we”) collects and uses personal data when you visit girivana.com, subscribe to updates or contact us. It is written to meet the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
What we collect, and why
| Data | Purpose | Retention |
|---|---|---|
| Email (newsletter, if you subscribe) | Send the updates you asked for | Until you unsubscribe; unconfirmed sign-ups deleted after 30 days |
| Name, email, phone, message (contact form) | Reply to your enquiry | 24 months after the enquiry is closed |
| Business details, GSTIN (wholesale form) | Assess a trade relationship | 24 months after closure, or for the trade relationship |
| Cookie choices, IP address, browser | Record your consent; security and abuse prevention | As long as needed to prove consent |
| Analytics data (only with consent) | Understand how the site is used | As set in Google Analytics / Microsoft Clarity (max 14 months) |
Consent and withdrawal
Every form shows an itemised notice and records your consent with the notice version and time. You can withdraw consent as easily as you gave it: use the unsubscribe link in any email, change your cookie preferences from the footer, or write to grievance@girivana.com.
Your rights
You may request access to, correction of, or erasure of your personal data, and nominate another person to exercise your rights. Use the contact form (topic: “Data request”) or email grievance@girivana.com. We respond within the period required by law.
Sharing
We do not sell personal data. We use service providers (hosting, email delivery, analytics with consent) bound by contract to process data only on our instructions.
Security and breaches
Data is encrypted in transit, access is restricted by role and protected by two-factor authentication. If a personal-data breach occurs we will notify affected users and the Data Protection Board as the DPDP Rules require.
Grievance officer
[Name], Grievance Officer, [Girivana legal entity name], [address]. Email: grievance@girivana.com.