Privacy Policy | Siliguri Pataka

1. Who we are

Siliguri Pataka is operated by Siliguri Pataka, Siliguri, West Bengal, India. We decide how and why your personal data is used (we are the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023). Contact: dipakh810@gmail.com.

2. What we collect

Order details: your name, phone number, email (optional), delivery address and landmark, the products you order, coupon used and order notes.
Account: your email address when you sign in with an email code, and the orders linked to it.
Payment information: the amount, payment status and UPI transaction reference (UTR). When your payment reaches our bank account, our bank's credit alert can include your UPI ID or name, which we use only to match the payment to your order. We never see or store your UPI PIN, card details or bank login.
Verification: your phone number when we send you a WhatsApp verification code, and your email when we send you a sign-in code. Codes are stored only in scrambled (hashed) form and expire after 10 minutes.
Technical data: your IP address and basic request information, used to prevent abuse (for example, limiting how often codes can be requested) and to keep the site secure.
Messages: anything you send us by email or WhatsApp, such as support requests and photos of a damaged parcel.

We do not use advertising trackers or sell your data.

3. How we use your data

to take, confirm, pack and deliver your order, and to contact you about it;
to verify and match your payment, and to process refunds;
to sign you in and show your orders under My Orders;
to send order emails (confirmation and updates) when you give us your email;
to prevent fraud, fake orders and misuse of codes or coupons;
to handle support requests, returns and complaints;
to keep records required by tax, accounting and other laws.

4. Your delivery data

We use your name, phone number, address and landmark only to deliver your order within Siliguri and to contact you about it.
Our delivery person sees these details only for the deliveries assigned to them.
We may call or message you to confirm your location, or a same-day or next-day delivery time.
We don't use your delivery details for advertising, and we don't sell them.

5. Our basis for using your data

We process your data with your consent, which you give when you place an order, sign in or contact us, and for purposes the law allows without consent, such as meeting legal obligations. You can withdraw consent at any time (see Your rights below). Withdrawing does not affect orders already completed, and we may still need to keep some records by law.

6. Who we share it with

We share only what each party needs to do its job:

Delivery partners: your name, phone and address, to deliver your order.
Website hosting and database providers: to run this website and store orders.
Google (Gmail): to send sign-in codes and order emails.
WhatsApp (Meta): to send phone verification codes.
Government or law enforcement: when required by law or to protect against fraud.

We do not sell, rent or trade your personal data to anyone.

7. Cookies and local storage

We use a few cookies and browser storage items. All of them are needed for the store to work:

Name	Type	Purpose	Kept for
sp_customer_session	Cookie	Keeps you signed in after the email code	30 days or until you sign out
sp_pay_phone	Cookie	Remembers a phone number you verified by WhatsApp code, so you aren't asked again	30 days
sp_customer_user	Local storage	Shows your sign-in state and fills your email at checkout	Until you sign out
Cart and recent orders	Local storage	Keeps your cart and lets you reopen recent order pages on this device	Until you clear them

You can clear these in your browser settings at any time. You will be signed out and your cart will be emptied.

8. How long we keep it

Order and payment records: as long as Indian tax and accounting laws require, usually up to 8 years.
Sign-in and verification codes: expire after 10 minutes and are deleted within 2 days.
Your account email: until you ask us to delete your account.
Support messages: as long as needed to resolve your request and any follow-up.

9. How we protect it

We use encrypted connections (HTTPS), store sign-in codes only in hashed form, encrypt stored access keys and limit access to order data to the people who run the store. No system is perfectly secure; if a data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

10. Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

ask what personal data we hold about you and how we use it;
ask us to correct or update it;
ask us to delete it, where we don't have to keep it by law;
withdraw your consent;
nominate someone to exercise these rights on your behalf;
raise a complaint with our Grievance Officer, and then with the Data Protection Board of India.

Email dipakh810@gmail.com from the email address on your orders, or include your order number and phone number. We may ask you to verify your identity before acting on the request.

11. Children

Our store is meant for adults. If you are under 18, please shop with a parent or guardian's consent. We do not knowingly collect data from children without it; if you think we have, contact us and we will delete it.

12. Where your data is stored

Our hosting, database and email providers may store or process data on servers outside India. When they do, we use providers that protect it with security standards at least as strong as described here, and transfers follow Indian law.

13. Grievance Officer

Name: Customer Care, Siliguri Pataka
Email: dipakh810@gmail.com
Address: Siliguri, West Bengal, India

We acknowledge complaints within 48 hours and aim to resolve them within one month.

14. Changes to this policy

If we change this policy, we will update it here with a new “last updated” date. For important changes, we will also let you know by email if you have an account.