Privacy Policy

KASHMIRCART respects your privacy. This policy explains, in plain language, what personal information we collect when you use our website, why we collect it, who we may share it with, how long we keep it and what choices and rights you have. It has been written so that an ordinary customer in India can read and understand it without legal training.

Who this policy applies to

This policy applies to everyone who interacts with KASHMIRCART through our website and our official support channels — visitors who only browse, customers who place an order (whether registered or as a guest), account holders, people who contact us by phone, WhatsApp, email or our enquiry form, and people who write to us about an existing order.

When it becomes relevant

It becomes relevant the moment you open our website, and continues to apply whenever you create an account, place an order, make a payment, contact customer care, subscribe to any update we send, or otherwise use our services. It also applies where a service provider processes your information on our behalf to deliver any of these things.

How to read it

This policy should be read together with our Terms & Conditions, Shipping & Delivery Policy and Returns & Refunds Policy. Those documents explain the rules of purchase and delivery; this one explains what happens to your personal information.

KASHMIRCART is the brand and trade name used by Kashmir Cart Private Limited, a private limited company registered with the Registrar of Companies, Jammu & Kashmir, on 23 September 2013. The brand name and the legal entity are not the same thing: when this policy says “KASHMIRCART”, “we”, “us” or “our”, it means Kashmir Cart Private Limited, operating the website kashmircart.in.

The company is a family-run, farm-rooted house. The family’s agricultural roots in Kashmir go back to 1977; the company was incorporated in 2013; and KASHMIRCART has been selling online since 2016. Our roots and work are anchored in Lethpora, Pampore and Nowpora, Tral, in the Pulwama district of Jammu & Kashmir, and we serve customers across India.

Registered office

2nd Floor, Sheikh Complex, Shiraz Chowk, Khanyar,
Srinagar, Jammu & Kashmir – 180001, India.

Registrations on record

Our role with your personal data

Kashmir Cart Private Limited decides why and how personal data is processed for the purposes described in this policy. In the language of Indian data-protection law, that makes us the Data Fiduciary and you the Data Principal. Where another company processes personal data only on our instructions — for example, a payment gateway or a courier company — that company acts as a service provider or processor on our behalf, and this policy explains what that means in practice.

What we collect depends on how you use KASHMIRCART. A person who only browses the store gives us far less than a person who places an order. The table below sets out the main categories, when we collect them and why.

Collected directly by KASHMIRCART

Everything you type into our website — the enquiry form, the checkout fields, your account details, your messages to customer care — is collected by us directly, together with the records of the orders and payments that follow.

Processed by third parties on our behalf

Some information is collected or processed by the service providers we use to operate the store. For example, payment details are handled by the payment service provider through which you pay; delivery details are passed to the courier partner that carries your parcel; and our hosting provider processes the traffic that reaches the website. In those cases the third party processes the information for us and under our instructions, and we describe the arrangement in sections 8 and 9.

What we do not collect

We do not ask for government identification numbers, biometric data, health information, financial-account credentials or any other sensitive personal data or information in order to browse or buy from KASHMIRCART. If a future legal or verification requirement ever makes it necessary to collect such information, we will say so clearly at the point of collection, explain why it is needed and handle it in accordance with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and any other applicable law.

Personal information reaches KASHMIRCART in four broad ways: because you give it to us, because you place an order, because you talk to us, and because the website generates it automatically.

1. Because you give it to us

• Browsing the store — pages you visit, products you view and the searches you run generate technical information.
• Creating an account or signing in — name, email, phone number, password and any address you save.
• Checking out — billing and delivery details, order contents and delivery instructions, whether you check out as a registered customer or as a guest.
• Using optional features — a wishlist, a product review, or a saved address, where those features are enabled on the website.
• Sending our enquiry form — the form on our Contact page asks for your name, email address, phone number, enquiry type, order ID (optional), subject and message, and shows you a short privacy notice before you send it.

2. Because you place an order

An order creates a record: what you bought, at what price, where it is going, how it was paid for, when it was dispatched and delivered, and what happened if you returned it or asked for a refund. Some of that record comes from the courier partner’s tracking updates and from the payment service provider’s confirmation.

3. Because you talk to us

You can reach us by telephone, by WhatsApp, by email or through the enquiry form. We keep a record of what you told us and what we told you, including your name, contact details, order number and the content of the conversation, so that any team member who picks up the matter later can help you without making you repeat everything.

4. Because the website generates it automatically

Like most online stores, our website records technical information in server and security logs — for example, the internet protocol (IP) address your connection used, the browser and device you were on, the pages that were requested, the time of the request, and error or security events. These logs help us keep the store available, detect misuse and investigate problems. Where cookies or similar technologies are used, they are described in section 7.

5. From our service providers

We also receive information from the providers who help us run the store: payment confirmations and settlement records from payment service providers, delivery and tracking updates from courier partners, and hosting, security and maintenance information from the companies that keep the website online.

We use personal information only for the purposes for which it was collected, or for a purpose that is reasonably related to it and that you would expect. We do not use it for anything unrelated without telling you first.

Order processing and fulfilment

To receive your order, confirm it, pick and pack it, weigh and seal it in the valley, dispatch it and tell you where it is.

Payment coordination

To process the payment method you chose, reconcile the transaction with the payment service provider, issue refunds where they are approved, and keep the financial records that go with them.

Delivery and logistics

To pass the necessary details to our courier and delivery partners, share tracking information, and resolve delivery problems such as a wrong or incomplete address.

Customer support

To answer your questions about products, orders, delivery, returns and refunds, and to keep a record so that the matter does not have to be explained again.

Returns, refunds and claims

To handle cancellation requests, damaged-item claims and refunds in line with our Returns & Refunds Policy, and to prevent abuse of those processes.

Account management

To create and maintain your customer account, saved addresses and order history, and to respond when you ask us to update or close them.

Security and fraud prevention

To protect the website, our systems and our customers against unauthorised access, fraudulent orders, misuse of offers, chargeback abuse and other security incidents, and to investigate them when they occur.

Legal, tax and accounting compliance

To meet our obligations under the laws that apply to us — including accounting, goods and services tax, food-safety labelling, consumer-protection and e-commerce rules — and to respond to lawful requests from authorities.

Business administration

To run the day-to-day business: supplier and grower records, bulk and institutional enquiries, correspondence and internal record-keeping.

Website improvement

To understand how the store is used, fix errors, improve navigation and product information, and keep the catalogue accurate.

Analytics and marketing, where applicable

To measure how the website performs and, where we have a lawful basis to do so, to send you information about KASHMIRCART products and offers. See sections 7 and 15 for how this is limited and how to opt out.

Two Indian frameworks matter here, and they are at different stages.

The law that applies today

The Information Technology Act, 2000 and the rules made under it — including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) — currently apply to us. Under that framework, a body corporate that handles personal information must publish a privacy policy, must obtain consent in writing before collecting sensitive personal data or information, must use the information only for the purpose collected, must keep it secure, and must allow a person who gave information to review and correct it. The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, as amended from time to time, additionally govern how we must present ourselves, our products and our grievance channels to online buyers.

The law that is being phased in

The Digital Personal Data Protection Act, 2023 (the “DPDP Act”) received Presidential assent on 11 August 2023, and the Digital Personal Data Protection Rules, 2025 were notified by the Ministry of Electronics and Information Technology on 13 November 2025. Both come into force in stages, and it is important to be precise about what is in force and what is not:

Dates are as appointed by the commencement notification and are computed from the date of publication of the Rules; they may be read as a day later depending on how the computation is applied. Where a date or provision changes, this policy will be updated.

Consent

Where the DPDP Act requires consent, it must be free, specific, informed, unconditional and unambiguous, with clear notice, and it must be limited to the personal data reasonably necessary for the specified purpose. Where we rely on consent — for example, for a non-essential cookie, an analytics tool or a promotional message — we will ask for it in a clear and affirmative way, and we will not make your purchase conditional on consent to something unrelated to it.

Other lawful grounds

Consent is not the only basis on which we may process personal information. Under the DPDP Act, processing is also permitted for certain “legitimate uses” — for example, where you voluntarily provide your information for the purpose you have asked us to fulfil, where processing is necessary to comply with a legal or regulatory obligation, where it is necessary to respond to a medical emergency, or where it is necessary to provide assistance or services to another person during an epidemic or similar situation. In practice, most of what we do — receiving your order, delivering it, refunding it and keeping the records the law requires — falls into these categories rather than resting on marketing-style consent.

Withdrawing consent

Where processing is based on your consent, you may withdraw it at any time, in the same easy way that you gave it, by emailing yourordertkc@gmail.com, calling or messaging us on WhatsApp at +91 70061 54418, or telling us in writing. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it, and it does not stop us from processing information we are otherwise required or entitled to process — for example, keeping the accounting record of an order you placed, or delivering a parcel you have already bought.

Cookies are small text files that a website places in your browser so that the site can recognise you as you move from page to page. Similar technologies include local storage, session identifiers and pixel tags. We use them, and so do the service providers described in sections 8 and 9.

The cookies that the store sets by default are the ones WooCommerce and WordPress use to make an online shop work — cart, session, checkout, security and login cookies. Cookie names and behaviour can change when the platform or its plugins are updated, so we describe them by purpose rather than by a fixed list of names. If we switch on an analytics or advertising service in future, we will update this section at or before the time it is switched on.

Third-party cookies

Service providers used on the website — for example a payment service provider, a messaging platform, or an analytics or advertising service where enabled — may set or process their own cookies or similar technologies. Those cookies are governed by the provider’s own privacy policy and cookie settings, not by us.

How to manage cookies

1. Use your browser controls. Every mainstream browser (Chrome, Firefox, Safari, Edge and others) lets you see the cookies stored on your device, delete them, and block cookies for some or all websites. Look for the cookie or privacy settings in your browser’s menu.
2. Block or delete by category. You can usually delete cookies after each visit, or block third-party cookies only, which is often a good balance.
3. Understand the trade-off. If you block essential cookies, parts of the store will not work — your cart may empty itself between pages, you may not be able to check out, and you may be asked to sign in again on every page.
4. Opt out of third-party tracking. Where an analytics or advertising service is enabled, its own opt-out mechanism and your browser’s “do not track” or Global Privacy Control signal can be used. We cannot guarantee that every third party will honour those signals, because that depends on the provider.
5. Clear your device. If you share a device, signing out of your account and clearing cookies when you finish is the simplest way to protect your session.

We do not sell or rent personal data. We share it only where it is needed to give you the service you asked for, to run the website, or because the law requires it — and then only the minimum necessary.

Payment service providers

The payment gateways and payment service providers available on our website process the payment details you enter and tell us whether a payment succeeded. They receive the transaction amount, the reference and the information needed to authorise or reconcile the payment.

Courier and delivery partners

To deliver your order we give the courier or delivery partner your name, phone number, delivery address, PIN code, order contents and weight, and any delivery instruction you gave. They give us tracking and delivery status in return.

Hosting and infrastructure providers

The companies that host the website, store its files and keep it online process the traffic and data that pass through the store, including the information described in sections 3 and 4.

Website maintenance and support providers

Developers, designers and technical support providers who maintain, secure or improve the website may access personal data where it is genuinely necessary to do the work, and we ask them to keep it confidential.

Customer communication services

Email, messaging and telephony services that carry our conversations with you — including WhatsApp — process your messages and contact details in order to deliver them.

Analytics and advertising services

Only if and when such services are enabled on the website. Where they are, they may receive device, usage and cookie information. Section 7 explains how to control this.

Professional advisers

Accountants, auditors, tax advisers, lawyers and similar professionals, where disclosure is reasonably necessary for the advice, audit or proceeding in question and subject to confidentiality.

Government and regulatory authorities

Where we are required or permitted by applicable law, a valid legal process or a lawful request from a government, tax or law-enforcement authority. This can include tax and accounting authorities, food-safety authorities, consumer-protection authorities and courts.

If the business or the website is ever transferred to, or merged with, another entity, personal data may be passed to that entity as part of the transaction, subject to the same protections described in this policy.

KASHMIRCART runs on a standard e-commerce platform (WordPress with WooCommerce) and uses external services to make that possible. Those services fall into two kinds.

Services that act on our behalf

Hosting, payment processing, courier and delivery, technical maintenance and customer-communication services process personal data on our instructions to deliver our service to you. Our contracts and settings with them are intended to limit what they may do with the data, and we ask them to protect it and not to use it for their own unrelated purposes.

Services that are independent of us

Some things you do on our website happen on someone else’s platform. If you message us on WhatsApp, that conversation takes place on WhatsApp’s service, and WhatsApp’s own privacy policy governs how that platform handles your information. If you click a link to another website, that website’s privacy policy governs what you do there — we do not control the privacy practices of sites and services that operate independently of us, and we encourage you to read their policies.

What we do and do not say about providers

We deliberately do not publish a list of provider names on this page. Provider arrangements change, and an out-of-date list is worse than an accurate description of categories. What we can say is this: the categories of provider we use are the ones listed in section 8; each is given only the information it needs for the task; and if you want to know which provider handled a particular part of your order — for example, which courier carried your parcel — ask us and we will tell you for that order.

Some of the technology services that keep an online store running — hosting, content delivery, email delivery, messaging and similar services — may process data on infrastructure located outside India, even though the business, the family and the packing table are all in Kashmir.

Under the DPDP Act, 2023, personal data may be transferred to a country or territory outside India except to territories that the Central Government has restricted by notification. As at the date of this policy, no such restriction list has been notified, and the detailed provisions on cross-border processing in Rule 15 of the DPDP Rules, 2025 come into force on 13 May 2027. We will comply with the requirements that apply to us as and when they come into force.

Where a service provider processes data outside India on our behalf, we expect it to apply safeguards appropriate to the nature of the data. Where a transfer is restricted or conditioned by applicable law, we will not make it unless the condition is met.

We keep personal information only for as long as it is reasonably necessary for the purpose it was collected for, or for as long as a law or a genuine dispute requires. We do not publish a single fixed retention period, because different categories of information genuinely need to be kept for different lengths of time — and a single number that applies to everything would be both inaccurate and misleading.

When information is no longer needed for a lawful purpose, we delete it, anonymise it or otherwise dispose of it in a controlled way. Please note that copies may remain for a period in backup systems until those backups cycle out, and that we may retain specific records where we are legally required to do so or where they are genuinely needed to establish, exercise or defend a legal claim.

We take reasonable technical and organisational measures, appropriate to the nature of the personal data and the processing involved, to protect it against unauthorised access, use, disclosure, alteration, loss or destruction. What that means in practice for KASHMIRCART:

• Encryption in transit. The website is served over HTTPS, which encrypts information travelling between your browser and the website.
• Payment handling by specialists. Card, net-banking, UPI and wallet credentials are entered on the payment service provider’s own secure interface rather than being held by us.
• Access control. Access to customer and order data is limited to the people in the family and the team who need it to do their work, and account access is protected by individual credentials.
• Hosting and platform security. The website runs on a mainstream, actively maintained e-commerce platform, and we keep it and its components updated.
• Monitoring and logging. Server and security logs help us detect and investigate misuse, repeated failed logins and other anomalies.
• Minimum sharing. Service providers are given only the information needed for the task they perform.

How you can help

• Use a strong, unique password for your customer account and do not reuse it elsewhere.
• Never share one-time passwords (OTPs), card numbers, CVVs or UPI PINs with anyone — including anyone claiming to be from KASHMIRCART. We will never ask you for them.
• Keep your device, browser and apps updated, and sign out of shared devices when you finish.
• Check your order confirmations and tell us straight away if you see an order or a message that you do not recognise.

You have rights today under the law currently in force, and further rights under the DPDP Act, 2023 once those provisions commence. Rather than tell you that you have rights that cannot yet be enforced, we set out both clearly.

Rights available now

• To know what we hold. You can ask us what personal information we hold about you and how we are processing it.
• To review and correct. Under the SPDI Rules you may review the information you have provided to us and ask us to correct any inaccuracy or remove information that is no longer needed.
• To withdraw consent where processing is based on it, as described in section 6.
• To complain and be heard. You can raise a grievance about how your information has been handled, through the channels in section 17, and you may also approach the consumer grievance mechanisms available under the Consumer Protection Act, 2019.

Rights under the DPDP Act, 2023 — from 13 May 2027

When the substantive provisions of the DPDP Act commence, Data Principals will have the following rights, and we intend to honour them in full from that date:

• Right to access information about your personal data, including a summary of what is processed, the activities carried out on it and the identities of anyone it has been shared with.
• Right to correction of inaccurate or misleading personal data, and to erasure where it is no longer needed for the specified purpose or where consent has been withdrawn.
• Right of grievance redressal — to have a complaint about processing answered.
• Right to nominate another person to exercise your rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent where processing is based on consent, with withdrawal as easy to give as consent was.

These rights are subject to the exceptions provided in the Act, and they do not override a legal obligation on us to keep particular records. Where a request falls within an exception, we will tell you why.

How to make a request

1. Write to us. Email yourordertkc@gmail.com or message us on WhatsApp at +91 70061 54418, with the subject line “Privacy request”.
2. Tell us what you need. Say whether you want access, a correction, erasure, withdrawal of consent or something else, and give enough detail for us to find the relevant records — an order number or the email address used on the order is usually enough.
3. Verify who you are. To protect you from someone else asking for your data, we may ask you to confirm details we already hold, such as the email address, phone number or order reference associated with the record.
4. We respond. We will act on the request, or tell you clearly why we cannot, within a reasonable period and in line with any timeline that applicable law requires.
5. If you are not satisfied. Escalate as described in section 17.

KASHMIRCART is a general online store selling food and household goods. It is not directed at children, and it is not designed to be used by them. Under the DPDP Act, 2023 a “child” means a person under the age of eighteen years.

We do not knowingly collect personal data from children. Placing an order, creating an account and making a payment are adult activities, and we ask that they be done by an adult. If a young person uses the website, it should be with a parent or guardian.

We do not operate an age-verification system on this website, and we do not claim to have one. What we do instead is avoid collecting children’s data in the first place: we do not run advertising or behavioural tracking directed at children, we do not offer child-directed content or promotions, and we do not ask for a date of birth or school details.

When the children’s-data provisions of the DPDP Act and the DPDP Rules, 2025 commence on 13 May 2027, they will prohibit tracking and behavioural advertising directed at children and will require verifiable parental consent before a child’s personal data is processed. We will comply with those requirements from that date.

If you believe that a child has given us personal data without the consent of a parent or lawful guardian, please write to yourordertkc@gmail.com. We will look into it and, where the law requires it, take steps to delete that information.

We separate the messages you need from the messages we would like to send.

Essential, order-related messages

These are part of buying from us: order confirmation, payment confirmation, dispatch and tracking updates, delivery notification, and messages about a return, refund or a problem with your order. They also include replies to a question you asked us. We send these because they are necessary to perform our contract with you and to meet our legal obligations — they are not marketing, and they continue even if you have opted out of everything else.

Promotional messages

From time to time we may send information about new products, seasonal harvests, offers and news from the valley, by email, SMS, WhatsApp or telephone. We send these only where we have a lawful basis to do so — for example, where you have asked to hear from us, where the message relates to a similar product or service and you have not opted out, or where the law otherwise permits. We keep promotional messages infrequent and relevant, and we do not pass your contact details to other businesses for their own marketing.

How to opt out

• Email: use the unsubscribe link in the message, or reply asking to be removed.
• WhatsApp or SMS: reply “STOP” or tell us to stop.
• Any channel: email yourordertkc@gmail.com or call +91 70061 54418 and we will remove you from promotional lists.

Opting out of promotional messages does not affect order-related messages, and it does not affect anything we are required to keep for legal or accounting reasons.

A personal data breach means any accident or deliberate act that leads to the loss, destruction, alteration, unauthorised disclosure of, or unauthorised access to, personal data. Examples include a compromised account, a misdirected parcel or email containing someone else’s details, a lost device with order data on it, or an intrusion into the website.

What we do if one happens

1. Contain and assess. We secure what we can, work out what happened and what information was affected, and preserve the evidence needed to investigate.
2. Reduce the harm. We take the steps reasonably available to limit the damage — for example, forcing a password reset, revoking access or correcting a misdirected record.
3. Tell the people affected. Where the law requires it, and where we can identify and contact the people concerned, we will tell them in clear language what happened, what information was involved, what we are doing and what they can do to protect themselves.
4. Tell the authorities where required. We will notify the bodies that applicable law requires us to notify, including under the cyber-incident reporting directions issued by the Indian Computer Emergency Response Team (CERT-In) where they apply to us, and the Data Protection Board of India once the breach-intimation provisions commence.
5. Learn and record. We keep a record of the incident and what we changed afterwards.

The position under Indian law

At present, the Information Technology Act, 2000 and the CERT-In directions provide the framework for reporting cyber security incidents where they apply. The detailed breach-intimation regime in Rule 7 of the DPDP Rules, 2025 — which requires a Data Fiduciary to inform affected Data Principals and the Board without delay and to provide a detailed report within the prescribed period — commences on 13 May 2027. We will follow those requirements from that date, and in the meantime we treat any suspected incident as serious regardless of whether a notification is legally required.

Privacy questions, complaints about how your information has been handled, requests to access or erase data, and requests to withdraw consent can all be raised through the same channels. A member of the KASHMIRCART team — not an automated system — reads what you send.

What to include

So that we can find the record and answer you properly, please include: your name; the email address or phone number you used with us; the order number, if your request relates to an order; a short description of your concern or request; and how you would like us to reply.

What happens next

1. Acknowledgement. We confirm that we have received your request.
2. Verification. We check that you are the person the information belongs to before we disclose or change anything.
3. Review and response. We look into the matter, act on the request where we can, and explain clearly where we cannot.
4. Escalation. If you are not satisfied with our response, you may approach the consumer grievance mechanisms available under the Consumer Protection Act, 2019, and — once the Data Protection Board of India is operational and the rights under the DPDP Act, 2023 have commenced — the mechanisms provided under that Act.

We may update this Privacy Policy when our services, the website’s technology, our data-processing practices, our service providers or applicable law change — for example, when the substantive provisions of the DPDP Act and the DPDP Rules, 2025 commence on 13 May 2027.

How updates are published

• The current version is always the one published at https://www.kashmircart.in/privacy-policy/. There is no duplicate or competing privacy page.
• Every update changes the “Last updated” date shown at the top of this page, and the effective date where the change is not immediate.
• Where a change is material — for example, a new category of information collected, a new category of recipient, or a change in how you exercise a right — we will give reasonable notice on the website and, where we have your contact details and the change is significant, by email.
• Where a change would require your consent under applicable law, we will ask for it at that point rather than assuming it.
• Previous versions are kept on record and are available on request.

We encourage you to check this page occasionally. Continuing to use the website after an update has been published means you have had the opportunity to read the current version.

KASHMIRCART is a family business. If something in this policy is unclear, if you want to know what we hold about you, or if you have a complaint, write to us and a member of the team will answer.