Privacy Policy

1 Introduction & Data Fiduciary Details

This Privacy Policy describes how Ecom Plus E-Commerce Pvt. Ltd. (“Ecom Plus”, “we”, “us”, or “our”), operating as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDPA”), collects, uses, stores, processes, and protects your personal data when you visit, browse, create an account, or make purchases on ecomplus.in (“Website” / “Storefront”).

By accessing or using our platform, you explicitly consent to the collection and processing of your personal data in accordance with the terms of this Policy.

2 Categories of Personal Data Collected

We collect only the minimum necessary personal data required to fulfill our e-commerce services:

• Identity & Contact Data: Full name, shipping address, billing address, email address, mobile phone number.
• Transactional & Order Data: Items purchased, order value, order ID, payment status, invoice details, delivery tracking milestones, returns and replacement records.
• Technical & Device Data: IP address, browser type and version, operating system, time zone settings, referral URLs, and session access timestamps.
• Customer Support Communications: Transcripts of customer inquiries, WhatsApp messages, emails, and feedback regarding product issues or returns.

3 Purpose & Lawful Basis of Processing

We process your personal data on the lawful basis of Consent and Contractual Necessity for the following explicit purposes:

• To process, pack, dispatch, and track your doorstep product shipments.
• To verify customer identity and validate Cash on Delivery (COD) or online payments.
• To facilitate 48-Hour hassle-free returns, replacements, and instant refunds.
• To comply with statutory financial, taxation (GST), and auditing requirements under Indian law.
• To send transactional order confirmations, dispatch tracking SMS/WhatsApp alerts, and customer care responses.

4 Payment Gateway & Financial Security

Ecom Plus does NOT collect, store, or have access to your full credit card numbers, debit card numbers, CVVs, or NetBanking passwords.

All payment transactions are processed through RBI-authorized, PCI-DSS Level 1 certified third-party payment gateways utilizing 256-bit SSL encryption and tokenization.

5 Data Sharing & Third-Party Processors

We strictly enforce a Zero Third-Party Data Selling Policy. We share data only with verified Data Processors bound by confidentiality and security obligations:

• Logistics & Courier Partners: (e.g., Delhivery, BlueDart, DTDC, India Post) — Name, delivery address, phone number for physical package transit.
• Communication Service Providers: Automated SMS and WhatsApp gateways for real-time dispatch updates and OTP verifications.
• Law Enforcement & Legal Authorities: Only when strictly mandated by applicable Indian statutes, court orders, or law enforcement notices.

6 Cookies & Tracking Technologies

Our storefront uses essential first-party cookies to manage shopping cart contents, session authentication, and wishlists.

You can configure your browser settings to reject non-essential cookies; however, certain shopping features (such as guest wishlist saving or real-time cart counts) may be affected.

7 Data Retention & Storage Policies

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Order Invoices & Tax Records: Retained for a period of 7 years in compliance with the Central Goods and Services Tax Act, 2017 and Companies Act, 2013.
• User Account Profile Data: Retained until account closure or until a verified Right to Erasure request is fulfilled.
• Support & WhatsApp Inquiries: Retained for 180 days after resolution for quality assurance and warranty tracking.

8 Data Principal Rights under DPDPA 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following enforceable rights:

• Right to Access: Request a summary of personal data and processing activities carried out by Ecom Plus.
• Right to Correction & Erasure: Correct inaccurate records or request deletion of obsolete personal data.
• Right of Grievance Redressal: Submit complaints regarding data mishandling directly to our Grievance Officer.
• Right to Nominate: Nominate another individual to exercise data rights in the event of death or incapacity.

To exercise your rights, visit our Data Subject Request Portal or view our Quick Privacy Notice.

9 Protection of Children’s Data

Ecom Plus does not knowingly collect or process personal data from individuals under 18 years of age without verifiable parental consent. We do not engage in behavioral monitoring or targeted advertising directed at children.

10 Grievance Redressal & Appellate Mechanism

In accordance with the Information Technology Act, 2000 and DPDPA 2023, you may address any privacy concerns or grievances to:

If you are not satisfied with the resolution provided by our Grievance Officer, you may file an appeal before the Data Protection Board of India (DPBI).