Data We Collect

How We Use Your Data

• Process orders, payments, refunds, and deliveries; provide customer support.
• Operate, secure, debug, and improve our website and apps.
• Personalize your experience and remember preferences.
• Run analytics to understand performance and detect fraud/abuse.
• Send service messages (order updates, policy notices). With your consent, send marketing via email, SMS, or push—unsubscribe anytime.
• Comply with legal obligations and enforce our Terms, Refund Policy, and Shipping Policy.

Legal Bases

Where applicable (e.g., EU/UK), we rely on:

• Contract – to fulfill your orders and provide services.
• Legitimate interests – to secure, improve, and market our services in a balanced way.
• Consent – for optional cookies/marketing; you can withdraw anytime.
• Legal obligation – to meet tax, accounting, and compliance requirements.

For India, we align with the Digital Personal Data Protection Act, 2023 (DPDP) and applicable rules.

Cookies & Similar Technologies

We use:

• Essential – required for site and checkout to work.
• Analytics – to measure traffic and performance (e.g., Google Analytics/GA4 with IP masking where supported).
• Marketing – to show relevant offers and limit ad frequency.

Control cookies via our banner and your browser settings. You may also clear cookies using your browser’s Clear browsing data option. Disabling non-essential cookies may affect personalization but not core checkout.

Sharing & Processors

We do not sell your personal data. We share limited data with trusted service providers (“processors”) under contracts that protect your information, such as:

• Payment gateways (e.g., Razorpay/Stripe/PayPal) for secure transactions and fraud checks.
• Logistics & fulfillment partners for packing, shipping, and delivery updates.
• Cloud hosting, security, analytics, crash reporting, and customer support tools.
• Marketing platforms for opt-in communications and advertising measurement.
• Authorities, auditors, or advisors when required by law or to protect rights.

Data Retention

We keep data only as long as necessary for the purposes above, including:

• Orders & invoices: typically 8 years (accounting/tax laws may vary).
• Support chats/emails: typically 24 months after last interaction.
• Marketing data: until you unsubscribe or your consent is withdrawn.
• Cookies: per cookie lifespan (see banner) or until you clear your browser data.

Security

We use administrative, technical, and physical safeguards (including encryption in transit via HTTPS, access controls, and logging). No method is 100% secure; we continuously improve our measures.

Your Privacy Rights

You may have rights to:

• Access, correct, update, or delete your personal data.
• Object to or restrict processing; withdraw consent for optional processing.
• Port your data (machine-readable copy) where applicable.
• Lodge a complaint with a supervisory authority.

Submit a request via /privacy-request or email cozyteaofficial@gmail.com. We may verify your identity before acting.

Region-specific

• EU/UK (GDPR): rights of access, rectification, erasure, restriction, objection, portability, and complaint to your DPA/ICO.
• California (CCPA/CPRA): rights to know, delete, correct, and opt out of certain data sharing. We do not knowingly sell personal information.
• India (DPDP, 2023): rights to access, correction, erasure, grievance redressal, and consent withdrawal.

International Data Transfers

Your data may be processed outside your country. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) and assess partner protections.

Children’s Privacy

Our services are not directed to children under the minimum age required by law in your region. We do not knowingly collect data from such children. If you believe a child provided data, contact us to delete it.

Marketing Communications

With your consent (where required), we may send emails, SMS, or push notifications about offers and new products.

• Email: use the “unsubscribe” link at the bottom of any email.
• SMS: reply STOP (where supported) to opt out.
• Push/browser: disable in your device or browser settings.

Payments

Payments are processed by third-party gateways. We receive confirmation and limited metadata; full card details are handled by the gateway under PCI-DSS standards. For issues, contact both us and your payment provider.

Reviews & User Content

Content you post (e.g., reviews) may be public. Do not include sensitive personal information in public content.

Automated Decision-Making

We may use automated systems (e.g., fraud detection, basic personalization). You can contact us to request human review of decisions that significantly affect you, where required by law.

Quick FAQs

Changes to This Policy

We may update this policy to reflect changes in laws, technologies, or our practices. Material changes will be highlighted here with a new “Last updated” date.