Privacy Policy

[Legal business name] (“Heavenly Handmade”, “we”, “us”) operates this online store, serving customers in India and Tanzania. Registered address: [Registered address]. General contact: [contact email].

For any question about your personal data, contact our Grievance Officer / Data Protection Officer: [Grievance Officer / DPO name], [grievance email].

• Account: your name, email address and password (stored encrypted/hashed).
• Orders: billing & shipping name, address, city, PIN/postal code, and phone number.
• Payments: we receive confirmation of payment from our gateway — we do not store your full card or mobile-money details.
• Newsletter: your email address if you join the “Heavenly Circle”.
• Technical: your IP address (used to detect your store region), browser type and cookies.
• Communications: messages you send us for support or custom orders.

We use only functional cookies needed to run the store:

• hh_region — remembers whether you’re shopping the India or Tanzania store.
• WooCommerce cart/session cookies — keep your basket and checkout working.

We do not use advertising cookies. You can control cookies in your browser, but disabling functional cookies may break the cart and checkout.

We use your data to create and manage your account, process and deliver your orders, take payment, provide customer support, send order/transactional emails, send our newsletter (only with your consent), show the correct regional store and currency, prevent fraud, and meet legal and tax obligations.

Our legal bases are: performing our contract with you, your consent (for marketing), and our legitimate interests in running the store securely.

We share data only with the service providers that help us run the store, and only so they can provide their service:

• Razorpay — card/UPI/netbanking payments (India).
• AzamPay — mobile-money payments (Tanzania).
• Delhivery — order delivery (India).
• Brevo — transactional & newsletter email.
• Google Maps / Places — address autocomplete at checkout.
• MaxMind — approximate location (region detection) from your IP.

We never sell your personal data.

Some of these providers may process data outside your country. Where personal data is transferred across borders, we use providers that apply appropriate safeguards consistent with the DPDP Act and the PDPA.

We keep account data while your account is active, order records for as long as needed for tax, accounting and warranty purposes, and newsletter data until you unsubscribe. We then delete or anonymise it.

Passwords are stored hashed, data is transmitted over encrypted (HTTPS) connections, and access is limited to people who need it. No method of storage or transmission is completely secure, but we take reasonable measures to protect your information.

In India (DPDP Act, 2023): you have the right to access, correct, complete, update and erase your personal data, to grievance redressal, to nominate another person to exercise your rights, and to withdraw consent at any time. If unresolved, you may approach the Data Protection Board of India.

In Tanzania (PDPA, 2022): you have the right to access, rectify and erase your data, to restrict or object to processing, and to withdraw consent. You may lodge a complaint with the Personal Data Protection Commission (PDPC).

To exercise any right, contact [Grievance Officer / DPO name] at [grievance email]. We respond within the timeframes required by law.

Our store is intended for adults and is not directed at children. We do not knowingly collect the personal data of children without verifiable parental/guardian consent as required by the DPDP Act (India) and the PDPA (Tanzania).

The “Heavenly Circle” newsletter uses double opt-in — you confirm your email before we add you. Every newsletter has an unsubscribe link. Unsubscribing stops marketing emails but not essential emails about orders you’ve placed.

We may update this policy from time to time. The “last updated” date above always shows the current version, and we’ll flag material changes where appropriate.

[Legal business name]
[Registered address]
Email: [contact email]
Grievance Officer / Data Protection Officer: [Grievance Officer / DPO name], [grievance email]