# Privacy Policy How Karigarh collects, uses and protects your personal data, in line with the DPDP Act, 2023 and Indian law. ## Introduction **Karigarh** — Jaipur **Last updated: 11 October 2026** This Privacy Policy describes how **E-New Bharat Services Pvt. Ltd.** ("Karigarh", "we", "us", "our"), which owns and operates the website and marketplace "Karigarh" (the "Platform"), collects, uses, shares, and protects your personal data when you visit or make a purchase from the Platform. We are committed to protecting your privacy in accordance with the **Digital Personal Data Protection Act, 2023 ("DPDP Act")**, the **Information Technology Act, 2000**, and the **Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")**, each as amended from time to time. By using the Platform, creating an account, or placing an order, you consent to the collection and processing of your personal data as described in this Policy. If you do not agree with this Policy, please do not use the Platform. ## 1. Who We Are - **Legal entity:** E-New Bharat Services Pvt. Ltd. - **Registered address:** 301-303, Suncity Trade Tower, Sector 21, Gurugram, Haryana 122016 - **Support email:** support@enewbharat.com For the purposes of the DPDP Act, E-New Bharat Services Pvt. Ltd. is the **Data Fiduciary** in respect of the personal data you provide to us, and you are the **Data Principal**. ## 2. Personal Data We Collect **2.1 Information you provide to us** - **Account information:** your name, email address, mobile number, and password (stored only in encrypted/hashed form) when you register an account. - **Order and delivery information:** billing and shipping addresses, recipient name and contact number, order history, and any delivery instructions you provide. - **Communications:** messages, emails, reviews, ratings, survey responses, and records of correspondence with our customer support team. - **Optional profile information:** any additional details you voluntarily provide (e.g., preferences, wishlist items). **2.2 Information collected automatically** - **Device and usage data:** IP address, browser type and version, device identifiers, operating system, pages viewed, time spent, referring URLs, and clickstream data. - **Cookies and similar technologies:** see Section 6 below. **2.3 Payment information — handled by Razorpay** All payments on the Platform are processed by our payment gateway partner, **Razorpay Software Private Limited ("Razorpay")**, a PCI-DSS compliant payment processor authorised under applicable Reserve Bank of India regulations. - **We do not collect, store, or have access to your card numbers, CVV, UPI PIN, net-banking credentials, or any other payment instrument details.** These are entered directly on Razorpay's secure interface and are governed by Razorpay's own privacy policy (available at razorpay.com). - We receive from Razorpay only limited transaction information (such as payment status, transaction ID, payment method type, and amount) necessary to confirm and fulfil your order and to process refunds. **2.4 Data we do not knowingly collect** We do not knowingly collect sensitive personal data such as financial account passwords, biometric data, or health information, and we request that you do not submit such information through the Platform. ## 3. Purposes for Which We Use Your Data We process your personal data only for the following purposes: - To create and manage your account and authenticate you. - To process, confirm, fulfil, ship, and deliver your orders, and to process returns, exchanges, refunds, and cancellations. - To communicate with you about your orders (confirmations, invoices, dispatch and delivery updates). - To provide customer support and resolve grievances. - To detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms and Conditions. - To comply with legal obligations, including tax, accounting, and consumer protection laws, and to respond to lawful requests from government authorities. - To improve the Platform, our product catalogue, and user experience through analytics (in aggregated or de-identified form wherever feasible). - With your consent, to send you promotional communications about new collections, artisan stories, ODOP/GI-tagged products, and offers. **You may opt out of promotional communications at any time** via the unsubscribe link in our emails or by writing to support@enewbharat.com; transactional communications about your orders will continue. We do not use your personal data for automated decision-making that produces legal effects concerning you, and **we do not sell your personal data to any third party**. ## 4. Legal Basis for Processing We process your personal data on the basis of: - **Your consent**, given when you provide your data for a specified purpose (e.g., account creation, order placement, marketing opt-in); and - **Certain legitimate uses** recognised under the DPDP Act, such as processing necessary for a purpose for which you have voluntarily provided your data, compliance with law, and responding to legal obligations. You may withdraw your consent at any time as described in Section 8. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and may limit our ability to provide certain services (for example, we cannot deliver an order without a shipping address). ## 5. Sharing and Disclosure of Personal Data We share your personal data only with the following categories of recipients, and only to the extent necessary: - **Sellers/artisan partners on the Platform:** limited order and delivery details necessary to fulfil orders you place for their products. - **Logistics and courier partners:** your name, delivery address, contact number, and order details, solely for shipping, delivery, and return pickup. - **Payment gateway (Razorpay):** transaction information necessary to process payments and refunds. - **Service providers:** hosting, cloud infrastructure, analytics, communication (email/SMS/WhatsApp notifications), and customer-support tool providers who process data on our behalf under contractual confidentiality and data-protection obligations. - **Government and law enforcement authorities:** where required by law, court order, or legal process, or to protect our rights, safety, or property or that of our users. - **Business transfers:** in connection with a merger, acquisition, or sale of assets, subject to the acquiring entity honouring commitments substantially similar to this Policy. We require all third parties who process personal data on our behalf to use it only for the specified purpose and to maintain reasonable security safeguards. ## 6. Cookies and Analytics The Platform uses cookies and similar technologies to: - keep you signed in and remember your cart; - remember your preferences; - measure site traffic and understand how visitors use the Platform (analytics); and - secure the Platform against fraudulent activity. Essential cookies (sign-in, cart, security) are always on, because the Platform cannot work without them. Analytics is optional and off by default: we use Google Analytics 4 only if you choose "Accept analytics" in the cookie banner. Until then no analytics script is loaded and no analytics cookies are set. Google Analytics data is used in aggregate to improve the Platform; advertising features are switched off. You can change your choice at any time from "Cookie settings" in the footer; declining removes the Google Analytics cookies from your browser. Browsing history on your device: your browser keeps a short list of the products you have opened and the categories you have browsed (at most 20 of each, for up to 90 days) in its local storage. It is used only to show "Recently Viewed", "Picked for You" and the order of "Featured" listings. It is not a cookie, is not stored on our servers, is not linked to your account and is not shared with anyone. You can delete it at any time with "Clear history" under Recently Viewed, or by clearing this site's data in your browser. You can also control or delete cookies through your browser settings; however, disabling essential cookies may affect core functionality such as login and checkout. ## 7. Data Security We employ reasonable security practices and procedures consistent with the IT Act, the SPDI Rules, and the DPDP Act, including: - HTTPS/TLS encryption for data in transit; - encrypted (hashed) storage of passwords; - role-based access controls limiting employee access to personal data on a need-to-know basis; and - periodic review of our security practices. While we take commercially reasonable measures to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach affecting you, we will notify you and the Data Protection Board of India as required under the DPDP Act. Please protect your account password and notify us immediately at support@enewbharat.com of any suspected unauthorised use of your account. ## 8. Your Rights Under the DPDP Act, 2023 As a Data Principal, you have the following rights: - **Right to access:** obtain a summary of the personal data we process about you, the processing activities, and the identities of persons with whom your data has been shared. - **Right to correction and updating:** request correction of inaccurate or misleading data and updating of incomplete data. - **Right to erasure:** request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, unless retention is required by law. - **Right to withdraw consent:** withdraw previously given consent at any time, with ease comparable to the manner in which consent was given. - **Right to grievance redressal:** raise a grievance with our Grievance Officer (Section 12), and, if unresolved, escalate to the **Data Protection Board of India**. - **Right to nominate:** nominate another individual to exercise your rights in the event of your death or incapacity. **How to exercise your rights:** email support@enewbharat.com from your registered email address, or write to the Grievance Officer at the address in Section 12, describing your request. We may need to verify your identity before acting on a request. We will respond within the timelines prescribed under the DPDP Act and rules thereunder, and in any event within 90 days. Please note your corresponding duties under the DPDP Act, including not impersonating another person and not furnishing false particulars while exercising these rights. ## 9. Data Retention We retain personal data only for as long as necessary for the purposes stated in this Policy, and thereafter as required by applicable law: - **Account data:** for as long as your account is active, and for a reasonable period thereafter to handle residual queries, unless you request earlier erasure. - **Order, invoice, and transaction records:** retained as required under Indian tax, accounting, and company-law requirements (generally up to 8 years). - **Grievance and dispute records:** retained until resolution and for the period required for legal compliance. When personal data is no longer required, we delete it or irreversibly anonymise it. ## 10. Children's Data The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal data from children (persons under 18 years of age). Purchases by minors may be made only through a parent or legal guardian's account and under their supervision. If you believe a child has provided us personal data without verifiable parental consent, please contact us at support@enewbharat.com and we will delete it. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. ## 11. Third-Party Links The Platform may contain links to third-party websites (including artisan partner pages, social media, and Razorpay's payment pages). We are not responsible for the privacy practices or content of such third parties, and we encourage you to review their privacy policies. ## 12. Grievance Officer In accordance with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, 2023, the details of our Grievance Officer are: - **Name:** [GRIEVANCE OFFICER NAME] - **Designation:** Grievance Officer, E-New Bharat Services Pvt. Ltd. - **Address:** 301-303, Suncity Trade Tower, Sector 21, Gurugram, Haryana 122016 - **Email:** support@enewbharat.com The Grievance Officer will **acknowledge your complaint within 48 (forty-eight) hours** and endeavour to **resolve it within 1 (one) month** of receipt. Data-protection grievances will be addressed within the timelines prescribed under the DPDP Act. If you are not satisfied with the resolution of a data-protection grievance, you may approach the **Data Protection Board of India**. ## 13. Changes to This Policy We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. The revised Policy will be posted on this page with an updated "Last updated" date, and material changes will be notified via the Platform or email. Your continued use of the Platform after such changes constitutes your acceptance of the revised Policy. ## 14. Contact Us For any questions about this Privacy Policy or your personal data, contact us at: **E-New Bharat Services Pvt. Ltd.** 301-303, Suncity Trade Tower, Sector 21, Gurugram, Haryana 122016 Email: support@enewbharat.com --- This is the markdown version of [Privacy Policy](https://www.karigarh.com/Privacy). Contact: support@enewbharat.com · 0141-237-2974 · +91 98998 88847.