Privacy Policy

1. Who we are

This policy applies to CREDHILL CLOHTHING STUDIO ("we", "us"), operating the website at https://crredhill.com, which sells men's and boys' clothing in India. Our registered office is at GROUND FLOOR, 01 GF-23A, 821 MAJESTIC TOWER, Vikaspuri Banks Road, Ansals Majestic Tower, Vikaspuri, New Delhi, South West Delhi, Delhi, 110018.. Our GSTIN is 07AAWFC6106D1ZH. We act as the data fiduciary for the personal data described below, under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules made under it.

2. What we collect

We collect only what an order or an account actually needs.

• Order data — your name, email address, mobile number and delivery address, including city, state and pincode.
• Account data (if you create an account) — the same contact details, a securely hashed password, your saved addresses and your wishlist.
• Transaction data — the items ordered, amounts, coupon used, payment method and payment status. We never see or store your card, UPI PIN or bank credentials; those stay with the payment gateway.
• Technical data — IP address, browser and device type, and pages visited, collected through cookies and analytics.
• Correspondence — anything you send us through the contact form, email, phone or WhatsApp.

We do not knowingly collect data from children. Boys' clothing is bought by adults; we ask only for the purchaser's details.

3. Why we use it

Purpose	Data used	Basis
Processing and delivering your order	Order & transaction data	Performance of contract
Order updates, tracking and receipts	Contact data	Performance of contract
Returns, refunds and support	Order & correspondence data	Performance of contract
Fraud prevention and abuse blocking	Order & technical data	Legitimate interest
Tax, invoicing and statutory records	Transaction data	Legal obligation
Improving the site	Technical data	Consent (cookies)
Marketing emails	Email address	Consent — opt in, opt out any time

4. Who we share it with

We do not sell your personal data. We share it only with the service providers that make an order work, and only to the extent each one needs:

• Payment gateway — to authorise and settle your payment and to process refunds. Card and UPI credentials are handled by them under RBI rules, never by us.
• Courier partners — your name, address and phone number so the parcel can be delivered.
• Email and hosting providers — to send transactional email and to run this website.
• Analytics providers — aggregated and pseudonymised usage data, where you have accepted analytics cookies.
• Government authorities — where we are legally required to disclose.

5. Cookies

Essential cookies keep you signed in and hold your bag together; the site cannot work without them. Analytics and marketing tags (Google Analytics, Google Tag Manager and Meta Pixel) only load when the store owner has configured them, and can be blocked from your browser settings. Your shopping bag and guest wishlist are kept in your browser's local storage, not on our servers.

6. How long we keep it

Order and invoice records are retained for eight years, as required by Indian tax law. Account data is kept while your account is open and for a reasonable period afterwards. Correspondence is kept for up to three years. Analytics data is retained per the provider's default period.

7. Security

The site runs over HTTPS. Passwords are stored as one-way bcrypt hashes and are never recoverable in plain text — a reset link is the only route back in. Administrative access is restricted and payment credentials are stored outside the codebase. No system is perfectly secure, but we take reasonable technical and organisational measures proportionate to the data we hold.

8. Your rights

• Access the personal data we hold about you, and ask for a copy.
• Correct anything inaccurate — most of it you can edit yourself under Account Details.
• Ask us to erase your data, subject to records we must retain by law.
• Withdraw consent for marketing at any time; every marketing email carries an unsubscribe link.
• Nominate someone to exercise these rights on your behalf in the event of death or incapacity.
• Complain to us first, and to the Data Protection Board of India if you remain dissatisfied.

To exercise any of these, write to info@crredhill.com. We respond within 30 days.

9. Grievance officer

Aryan Rokaya and Mahesh Bhandari
Email: grievance@crredhill.com
Phone: 7836042257
Appointed under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Complaints are acknowledged within 48 hours and resolved within 30 days. See the grievance page for the escalation path.

10. Changes

We may update this policy as the business or the law changes. The revision date at the top always reflects the current version, and material changes are announced on this page.