Privacy Policy — Klick2Kart

Last updated: 1 November 2026

This Privacy Policy explains what personal information Klick2Kart ("we", "us", "our") collects when you visit klick2kart.co.in or buy from us, why we collect it, and the choices you have about it. It is written to be consistent with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023.

1. Information we collect

Account details — your name, email, phone number, password (stored as a salted hash, never in plain text).
Address book — shipping and billing addresses you add to your account.
Order history — items ordered, amounts paid, invoices, returns and refunds.
Payment details — we do not store card numbers, UPI IDs or net-banking credentials. Payments are processed by Razorpay; we receive only a payment confirmation and a tokenised reference.
Usage information — pages visited, products searched, cart contents, device/browser type, IP address (used for rate limiting, fraud detection and account security; see §6 for how long it is kept).
Communications — emails or messages you send us, newsletter opt-ins, contact-form submissions.

2. How we use it

To fulfil your orders — payment, packing, shipping, returns and customer support.
To issue GST-compliant tax invoices, as required by law.
To send transactional emails (order updates, password resets) and, only with your consent, marketing emails.
To detect and prevent fraud, abuse and unauthorised access.
To improve the site — analytics on traffic, conversion and product performance, always on aggregated data.
To comply with legal, regulatory and tax obligations.

3. Who we share it with

Logistics partners (e.g. our courier of record) receive your name, shipping address and phone number to deliver the order.
Razorpay processes your payment instructions; their privacy policy applies to that flow.
Government & regulators when required by valid legal process or tax filings.
We do not sell or rent your personal data to advertisers or data brokers.

4. Cookies

We use a small number of cookies — strictly necessary cookies for login, cart and CSRF protection, plus optional analytics cookies that you can decline via the cookie banner. The site continues to work fully without optional cookies.

5. How we secure your data

All traffic to the site is encrypted in transit (HTTPS, HSTS).
Passwords are stored as PBKDF2 hashes (ASP.NET Identity default).
Sessions use HTTP-only, Secure, SameSite cookies. Login is rate-limited and locks the account after repeated failed attempts.
Access to production systems is restricted, audited and revoked on role change.

6. Retention

We keep order and invoice data for as long as required by Indian tax law (currently eight financial years). Account data is kept while your account is active; you can delete it yourself at any time (see below). Search logs (any IP address in them is stored only as a one-way hash) are kept for about fourteen days. Server logs, which record the pages requested and any errors, are kept for up to 180 days. Messages you send us through the Contact page, including quote requests, are kept for 24 months after our last reply (or after you sent them, if we didn't reply), so we can deal with follow-ups and any later complaint, and are then deleted.

Our security log records sign-ins and failed sign-in attempts (including two-step verification), password and two-step verification changes, and account actions such as placing, cancelling or returning an order. For these entries we keep your email address, IP address and the entry's details for 12 months (longer than the 180 days required by the CERT-In directions), so that fraud and unauthorised access can be investigated. After 12 months these are deleted. What remains (the date, the action, an order number where there is one, and an internal account number) stays linked to your account record; if you close your account, that record is anonymised. If you close your account sooner, these entries are still kept until their 12 months are up. Records of actions our staff take on your account or order (for example a refund, unlocking your account, or a delivery note) are kept as a long-term business record and may include your email address and notes about the order or account.

7. Your rights

Access & portability — download a copy of your data (profile, addresses, orders, returns, reviews, consents, messages you sent us from a confirmed email address, notification devices and security log entries) as a JSON file from your account.
Correction — edit your name, phone and addresses yourself from My Account.
Deletion / erasure — close your account to erase your personal data, including your profile photo and any messages you sent us through the Contact page from the same email address. If an order, return or refund is still in progress, you can close your account once it is finished, because we need your details to complete it. Messages are erased only once your email address is confirmed, so that nobody can erase someone else's messages by signing up with their address. Past order and invoice records are retained in anonymised form as required by tax law: your personal details, and notes typed into the order (such as delivery or return comments), are removed, but the note recorded with each refund is kept as part of the financial record, and it can repeat a comment our staff wrote about the return or cancellation. Security log entries are kept until their 12-month period ends (see §6).
Withdraw consent — turn marketing emails on or off any time from My Account → Privacy & your data.

You can exercise Access, Correction, Deletion and consent withdrawal yourself from your account. For anything else, or if you need help, write to our Grievance Officer (see §10).

If you want your account erased but can't sign in (for example you've lost access to its email address), write to our Grievance Officer. To check it's really you, we call the phone number on your account and ask about one of your orders. We then email your account's address and erase the account at the end of the seventh day, unless the request is cancelled from that email, or an order is placed on the account before then.

8. Children

The site is intended for users aged 18 and above. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the current version. Material changes will be highlighted on the site for a reasonable period after they take effect.

10. Contact us

Grievance officer / data protection contact: support@klick2kart.co.in · +91 7875378752. We aim to respond to privacy queries within 30 days.