Privacy policy

1. Introduction

AKSHNAM (a brand of Akshit Creations, hereinafter referred to as “we”, “us”, “our”, or the “Data Fiduciary”) is committed to protecting your privacy and personal data. This Privacy Policy describes how we collect, use, store, disclose, and protect your personal information when you visit or make a purchase from our website (hereinafter the “Website”), hosted on Shopify.

This Policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”).

By accessing or using the Website, you agree to the collection and use of your information in accordance with this Policy. We encourage you to read this Policy carefully before using the Website. If you do not agree with the terms of this Policy, please do not access or use the Website.

2. Information We Collect

2.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us when you register an account, place an order, or contact us. This includes:

(a) Full name

(b) Email address

(c) Phone number

(d) Shipping and billing address

(e) Any other information you choose to provide through forms or correspondence

Your name, phone number, and delivery address are shared with our order fulfilment and shipping partners (Shiprocket and Delhivery) solely for the purpose of dispatching your order and enabling delivery tracking.

2.2 Payment Information

When you make a purchase, your payment information (such as credit/debit card details, UPI IDs, net banking credentials, and wallet details) is collected and processed directly by Razorpay, our third-party payment gateway provider. We do not store your complete payment card details on our servers. Your purchase transaction data is stored only as long as necessary to complete the transaction. Razorpay maintains industry-standard security practices for payment processing and is compliant with PCI DSS standards. For details on how Razorpay handles your data, please refer to Razorpay's Privacy Policy at https://razorpay.com/privacy/

Additionally, when you click Buy Now on the Website, Razorpay's checkout application verifies your details to enable a seamless and secure checkout experience. During this process, Razorpay may collect and process your name, phone number, email address, and order details in accordance with their privacy policy. This verification is carried out on Razorpay's secure platform and is not stored on our servers.

2.3 Automatically Collected Information

When you visit the Website, certain information is collected automatically through cookies, server logs, and similar technologies. This includes:

(a) Internet Protocol (IP) address

(b) Browser type and version

(c) Operating system

(d) Referring URLs and pages visited

(e) Time spent on pages and other browsing behaviour data

(f) Device identifiers

3. Purpose of Processing

We process your personal data only for specified, clear, and lawful purposes with your consent. The following sets out the purposes for which we collect and use your data:

(a) Order fulfilment: To process and fulfil your orders, including payment processing and shipping.

(b) Account management: To create and manage your account on the Website.

(c) Communication: To communicate with you regarding your orders, account, or enquiries.

(d) Website improvement: To improve our Website, products, and customer experience through analytics.

(e) Legal compliance: To comply with applicable laws, regulations, and legal processes.

(f) Fraud prevention: To detect and prevent fraud or other unauthorised activities.

We do not process your personal data for any purpose beyond what has been specified at the time of collecting your consent. Should we need to process your data for a new purpose, we will seek your fresh consent before doing so.

4. Consent and Withdrawal of Consent

4.1 How We Obtain Consent

In accordance with Section 6 of the DPDP Act, we obtain your specific and informed consent before processing your personal data. At the time of collecting your data, we provide you with a notice containing:

(a) An itemised description of the personal data being collected

(b) The specific purpose for which the data is being processed

(c) A description of the goods and services enabled by such processing

(d) A link to this Privacy Policy and to the mechanism for withdrawing consent

This notice and consent request is provided in English. Consent requests are specific to the purpose stated and are presented through a clear affirmative action (such as ticking a checkbox or clicking an “I Agree” button). Pre-ticked boxes or bundled consent requests are not used.

4.2 How to Withdraw Consent

You may withdraw your consent at any time by:

(a) Emailing us at privacy.akshnam@gmail.com

(b) Using the consent withdrawal mechanism available in your account settings on the Website

Upon receiving your withdrawal request, we will cease processing your personal data for the purposes for which consent was given, as soon as reasonably practicable. Please note that withdrawal of consent may affect our ability to provide certain services to you, including the fulfilment of pending orders. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

5. Cookies and Tracking Technologies

5.1 What Are Cookies

Cookies are small data files placed on your device that help us recognise your browser, remember your preferences, and understand how you use the Website. Our Website also uses pixel tags, web beacons, and similar technologies for analytics purposes.

5.2 Types of Cookies We Use

Essential cookies: These are necessary for the Website to function properly, including maintaining your session and storing your cart contents. These cannot be disabled.

Analytics cookies: These help us understand how visitors interact with the Website by collecting information anonymously. These are activated only with your consent.

Functional cookies: These remember your preferences and choices to provide a more personalised experience. These are activated only with your consent.

5.3 Cookie Consent

When you first visit the Website, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies. You may also manage your cookie preferences at any time through the cookie settings on the Website or through your browser settings. Disabling non-essential cookies will not affect the core functionality of the Website.

Since the Website is hosted on Shopify, certain essential cookies are set by Shopify for operational purposes such as session management, cart storage, and visit tracking. For details, please refer to Shopify’s Privacy Policy available on their website.

5.4 Do Not Track

Some web browsers offer a “Do Not Track” feature that signals to websites that you do not wish to be tracked. As there is no uniform standard for this feature across browsers, our Website is not currently configured to respond to Do Not Track signals. However, you may manage your cookie preferences as described above.

6. Disclosure of Your Information

We may share your personal information with third parties only in the following circumstances:

(a) Service providers: We work with third party service providers who assist us with website hosting (Shopify), payment processing (Razorpay), order fulfilment and shipping (Shiprocket, Delhivery), and other operational services. These providers have access to your personal information only to the extent necessary to perform their services. We ensure through contractual provisions that all such service providers implement reasonable security safeguards in accordance with the DPDP Act.

(b) Analytics and tracking: Our Website and any associated mobile application may use third party analytics tools and software development kits (SDKs) to understand usage patterns, improve performance, and enhance your experience. These tools may collect anonymised or aggregated data about your browsing behaviour. No personally identifiable information is shared with these third party analytics providers beyond what is necessary for these purposes.

(c) Legal requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe such disclosure is necessary to protect our rights, your safety, or the safety of others, enforce our Terms of Service, or investigate fraud.

(d) Business transfers: In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change through the Website or by email before your personal data is transferred and becomes subject to a different privacy policy.

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

7. Data Storage and Cross-Border Transfers

Your data is stored through Shopify’s data storage systems and databases. As Shopify’s servers may be located outside India (including in the United States and Canada), your personal data may be transferred to and stored on servers outside the territory of India.

We ensure that any such cross-border transfer of your personal data is carried out in compliance with the DPDP Act. We will not transfer your personal data to any country that the Central Government of India has restricted through notification. We take reasonable steps to ensure that the third party or the jurisdiction to which the data is transferred provides a level of data protection comparable to the standards under Indian law.

8. Data Retention and Erasure

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention periods are as follows:

(a) Account data: Retained for as long as your account remains active on the Website. You may request deletion of your account at any time by contacting us.

(b) Transaction data: Retained for a minimum period of 7 (seven) years from the date of the transaction, as required under applicable Indian tax and financial record-keeping laws, even if your account is deleted.

(c) Communication records: Retained for a period of 3 (three) years from the date of the last communication, or longer if required for dispute resolution or legal proceedings.

(d) Automatically collected data: Retained for a period of 1 (one) year for analytics and security purposes, after which it is anonymised or deleted.

(e) Security logs: Retained for a minimum of 1 (one) year for investigation, remediation, and continuity purposes, in accordance with the DPDP Rules.

Upon deletion of your account or upon expiry of the applicable retention period, we will erase your personal data from our active systems. Where erasure is scheduled under the DPDP Act, we will notify you at least 48 hours before the scheduled erasure, giving you an opportunity to log in to your account or otherwise contact us if you wish to retain your data. Some residual data may remain in encrypted backup systems for a limited period but will not be actively processed.

9. Data Security

9.1 Security Measures

We take the security of your personal data seriously and implement reasonable security safeguards in accordance with the DPDP Act and DPDP Rules. Our security measures include:

(a) Encryption of personal data in transit (SSL/TLS) and at rest

(b) Access controls to restrict access to personal data to authorised personnel only

(c) Regular review of access logs to detect unauthorised access

(d) Data backups to ensure continuity of processing in the event of data loss

(e) Contractual provisions with all service providers and data processors requiring them to implement equivalent security safeguards

While we take reasonable precautions and follow industry best practices, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security of your data, but we are committed to taking all reasonable measures to protect it.

9.2 Fraud Prevention Disclaimer

AKSHNAM will never contact you by phone, email, SMS, or any other means to ask for your OTP, CVV, PIN, card number, bank account details, or passwords. We will never call you with unsolicited offers, free gifts, or requests to install any application. If you receive any such communication claiming to be from AKSHNAM, please do not share any personal or payment information and report the incident to us immediately at privacy.akshnam@gmail.com.

We shall not be liable for any loss, damage, or expense incurred by you where you have shared personal or payment-sensitive information with any unauthorised person or fraudulent entity claiming to represent us.

10. Data Breach Notification

In the event of a personal data breach that affects your data, we will:

(a) Notify the Data Protection Board of India without undue delay, along with a description of the breach

(b) Submit a detailed report to the Data Protection Board within 72 hours of becoming aware of the breach

(c) Notify you (the affected Data Principal) without undue delay, informing you of the nature of the breach, the data affected, and the steps we are taking to address it

(d) Take immediate remedial action to contain and mitigate the impact of the breach

We maintain incident response procedures and retain breach-related records, logs, and traffic data for a minimum of 1 (one) year to support investigation, remediation, and prevention of recurrence.

11. Your Rights as a Data Principal

Under the DPDP Act, you (as a Data Principal) have the following rights in relation to your personal data:

(a) Right to access: You have the right to obtain a summary of the personal data we hold about you, including the processing activities being carried out on your data.

(b) Right to correction and completion: You have the right to request correction of inaccurate personal data and completion of incomplete personal data.

(c) Right to erasure: You have the right to request deletion of your personal data, subject to our legal obligations regarding data retention.

(d) Right to withdraw consent: You have the right to withdraw your consent for the processing of your personal data at any time, as described in Section 4 of this Policy.

(e) Right to grievance redressal: You have the right to register a complaint with our Grievance Officer if you believe we have failed to fulfil our obligations under this Policy or under the DPDP Act.

(f) Right to nominate: You have the right to nominate any other individual to exercise your rights under this Policy in the event of your death or incapacity.

To exercise any of these rights, please contact us at privacy.akshnam@gmail.com or write to our Grievance Officer at the address provided in Section 16 of this Policy. We will endeavour to respond to your request within 30 days of receiving it.

12. Children’s Data

The Website is intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal data from children under the age of 18. If you are under 18, please do not register an account, make a purchase, or provide any personal data through the Website.

In accordance with the DPDP Act, we do not engage in tracking, behavioural monitoring, or targeted advertising directed at children. If we become aware that we have inadvertently collected personal data from a child under 18 without verifiable parental consent, we will take immediate steps to delete such data from our systems.

If you are a parent or guardian and believe that your child has provided personal data to us, please contact us at privacy.akshnam@gmail.com and we will promptly delete such information.

13. Third Party Links

The Website may contain links to third party websites or services that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third party websites or services. We encourage you to read the privacy policy of every website you visit.

14. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Changes will take effect immediately upon posting on the Website. The “Last Updated” date at the top of this Policy will be revised accordingly. In the event of material changes to this Policy, we will make reasonable efforts to notify you by posting a prominent notice on the Website or by sending you an email notification.

Your continued use of the Website after any changes constitutes your acceptance of the revised Policy. We encourage you to review this page periodically to stay informed about how we protect your data.

15. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India, including the DPDP Act and the rules framed thereunder. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts in Amritsar, Punjab, India.

16. Grievance Redressal

We are committed to addressing your concerns promptly and fairly. If you have any grievance regarding the processing of your personal data or any aspect of this Privacy Policy, you may follow the escalation process set out below.

16.1 Step 1: Contact Customer Support

For general queries or concerns, please write to us at privacy.akshnam@gmail.com. Our support team will acknowledge your query within 24 hours and work towards resolving it at the earliest.

16.2 Step 2: Escalate to the Grievance Officer

If you are not satisfied with the response from our support team, or if your concern relates specifically to data protection and privacy, you may escalate the matter to our Grievance Officer appointed in accordance with the Information Technology Act, 2000 and the DPDP Act, 2023:

The Grievance Officer will acknowledge your complaint within 24 hours and endeavour to resolve it within 30 days of receipt.

16.3 Step 3: Data Protection Board of India

If you are not satisfied with the resolution provided by the Grievance Officer, you have the right to file a complaint with the Data Protection Board of India as established under the DPDP Act.

17. Contact Us

For any questions or concerns about this Privacy Policy, you may reach us at: