Privacy Policy

Data Fiduciary

Craftingwoods Atelier Private Limited is the Data Fiduciary responsible for the personal data processed through woodeon.in. GSTIN 09AANCC6568K1ZV, PAN AANCC6568K.

What we collect

• Identity & contact data — name, email address, phone number, billing and shipping address, and (where you provide it) date of birth or gender.
• Order & transaction data — items purchased, order value, tax invoice information, payment method, GSTIN (for B2B invoices) and transaction identifiers.
• Payment data — processed directly by our PCI-DSS certified payment gateway (Razorpay). We do not store your full card number, CVV or UPI PIN on our servers.
• Account data — hashed password, saved addresses, wishlist and cart contents.
• Behavioural & device data — pages viewed, referrer, IP address, device type, browser and cookie identifiers used for analytics and fraud prevention.
• Support data — messages, photos and other content you share with our support or grievance team.

Lawful basis & purpose

We process your personal data on the basis of your consent (obtained at checkout, registration or where you provide data) and, where applicable, for the performance of the contract of sale, for compliance with legal obligations (e.g. tax and accounting), and for our legitimate interest in operating a secure, reliable storefront. Purposes include order fulfilment, payments, shipping, returns & refunds, customer service, fraud prevention, personalisation, marketing communications you have opted into, and analytics.

Retention periods

• Order, invoice and tax records — 8 years, as required by the Income Tax Act, 1961 and the Companies Act, 2013.
• Account data — retained for the life of the account and up to 5 years after the account becomes inactive, after which the account is deleted or anonymised.
• Marketing consent & preferences — retained until you withdraw consent, plus a 30-day suppression record so we do not re-message you.
• Grievance and support tickets — 3 years from resolution.
• Website analytics — aggregated and anonymised after 26 months.

Sharing with third parties

We share the minimum personal data required with the following processors, each bound by contractual confidentiality and data-protection obligations:

• Razorpay Software Private Limited — payment processing (LIVE mode).
• MSG91 (Walkover Web Solutions Pvt. Ltd.) — transactional SMS and OTP delivery.
• Resend, Inc. — transactional email delivery.
• Shiprocket (Kartrocket Ecomm Pvt. Ltd.) and its downstream courier partners — shipping and reverse pickup.
• Cloudinary Ltd. — image hosting and delivery for product and user-uploaded images.
• Government authorities, courts and law-enforcement agencies where disclosure is required by Indian law.

Cookies & consent

We use first-party cookies to keep your cart, remember your session and secure your login. We use analytics cookies only after you accept them through the cookie banner. You can withdraw consent at any time from your browser settings or by clearing site data — some site features (such as remembered cart) may then not work.

Cross-border transfers

Some of our processors listed above host data outside India (for example, Resend and Cloudinary). Such transfers are only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and are protected by contractual safeguards.

Your rights under the DPDP Act

• Right to access a summary of the personal data we process about you and the processing activities.
• Right to correction of inaccurate or misleading data, completion of incomplete data, and updating of out-of-date data.
• Right to erasure of data no longer required for the purpose it was collected, subject to statutory retention.
• Right to nominate another individual who may exercise your rights in the event of your death or incapacity.
• Right of grievance redressal — see contact block below.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email grievance@woodeon.in from the email address associated with your account, with the subject line "DPDP request — <access | correction | erasure | withdrawal>". We may request additional information to verify your identity before acting on your request.

Grievance Officer & response SLA

In accordance with Rule 5(9) of the SPDI Rules, 2011 and Section 8(9) of the DPDP Act, the Grievance Officer is Tarun Gupta, reachable at grievance@woodeon.in. We acknowledge every grievance within 48 hours and resolve it within 30 days.

Data breach notification

In the event of a personal-data breach, we will notify the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under Section 8(6) of the DPDP Act, as soon as practicable after we become aware of the breach.

Children's data

Woodeon does not knowingly collect personal data of any individual under 18 years of age without verifiable consent of a parent or lawful guardian. If we learn we have inadvertently done so, we will delete the data. If you believe a child has submitted information to us, please contact grievance@woodeon.in.

Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in law, technology or our operations. Material changes will be communicated via email to registered users and a notice on the website at least 15 days before they take effect.