Privacy policy and cookies

This policy explains how Bacoola ("Bacoola", "we", "us") handles personal data collected through this website and the services offered on it.

Bacoola
Centura Square, IT Park
7th Floor, Road Number 27
Wagle Industrial Estate
Thane West, Thane
Maharashtra 400604
India

For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary in respect of the personal data described below. You are the Data Principal.

We collect only what the service actually needs:

Information you give us. Your name, email address, telephone number, and billing and delivery addresses when you create an account or place an order. Your date of birth or sizing preferences, where you choose to provide them.

Order information. The items you buy, order value, delivery status, returns and refunds.

Payment information. Card and other payment instrument details are collected and processed directly by our payment gateway, Razorpay. We do not receive or store your full card number, CVV or UPI credentials on our systems. We receive only the outcome of the transaction and a reference to it.

Technical information. IP address, browser and device type, and pages visited, collected through cookies and similar technologies as described below.

We process your personal data on the basis of the consent you give when you create an account, place an order, or subscribe to our newsletter, and for the certain legitimate uses recognised under the Digital Personal Data Protection Act, 2023.

Your consent is sought for a specified purpose, is limited to the personal data necessary for that purpose, and may be withdrawn at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and we may continue to retain data where a law requires us to.

To create and manage your account; to process, deliver and invoice your orders; to handle returns, exchanges, refunds and cancellations; to provide customer support; to detect and prevent fraud and misuse of the website; to meet our tax, accounting and other legal obligations; and, where you have opted in, to send you marketing communications.

We do not use your personal data for any purpose incompatible with the purpose for which it was collected, and we do not sell your personal data.

Logistics partners. Your name, delivery address and telephone number are shared with Shiprocket and the courier assigned to your order, solely so that the order can be delivered.

Payment gateway. Razorpay processes your payment and receives the data necessary to do so.

Service providers. Hosting, email delivery and analytics providers who process data on our instructions and are bound to use it only for the purposes we specify.

Legal disclosure. Where we are required to disclose data by law, by a court, or to a government agency lawfully authorised to demand it.

Cookies are small files stored on your device. We use cookies that are strictly necessary for the website to function — keeping you signed in, remembering the contents of your bag, and preserving your selected region — and, where you allow them, cookies that help us understand how the website is used so we can improve it.

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent parts of the website, including checkout, from working.

We retain your personal data for as long as your account remains active, and thereafter for the period required to meet our legal, tax and accounting obligations — in particular records relating to orders and invoices, which must be retained under applicable tax law.

When personal data is no longer needed for the purpose it was collected for and no law requires us to retain it, we erase it.

We implement reasonable security practices and procedures as required under Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include encryption of data in transit, access controls limiting staff access to what their role requires, and keeping card data off our systems entirely by delegating payment processing to Razorpay.

No method of transmission or storage is completely secure. In the event of a personal data breach we will notify you and the Data Protection Board of India as required under the Digital Personal Data Protection Act, 2023.

As a Data Principal you have the right to:

— obtain confirmation of whether we are processing your personal data, and a summary of that data and the processing;
— require correction of inaccurate or misleading data, and completion or updating of incomplete data;
— require erasure of your personal data, where we are not required by law to retain it;
— nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
— withdraw a consent you have given; and
— have your grievance addressed by the officer named below.

To exercise any of these rights, write to us at yash.mishra@datacircles.in. You may be asked to verify your identity before we act on a request.

This website is not directed at children. We do not knowingly collect the personal data of anyone under the age of 18 without the verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, as required under the Digital Personal Data Protection Act, 2023.

We ship only within India, and your personal data is processed in India save where a service provider named above processes it elsewhere under contractual safeguards.

In accordance with the Consumer Protection (E-Commerce) Rules, 2020 and the Information Technology Act, 2000 and the rules made thereunder, the contact details of our Grievance Officer are set out below.

Name: Yash Mishra
Designation: Grievance Officer
Email: yash.mishra@datacircles.in
Telephone: +91 88794 38577
Address: Bacoola, Centura Square, IT Park
7th Floor, Road Number 27
Wagle Industrial Estate
Thane West, Thane
Maharashtra 400604
India

We will acknowledge your complaint within forty-eight (48) hours of receipt and endeavour to resolve it within one (1) month from the date of receipt, in line with the timelines prescribed under those rules.

We may update this policy. The version in force is the one published on this page, and the date it last changed is shown at the top. Where a change materially affects how we use your data, we will bring it to your attention.

Questions about this policy can be sent to yash.mishra@datacircles.in or raised through our Contact page. Our GSTIN is [TO BE COMPLETED: GSTIN].