Privacy Policy — The Copper Craftsman

Last updated: August 7, 2026

At The Copper Craftsman, trust matters to us as much in how we handle your data as in how we craft our products. This Privacy Policy explains what personal information we collect, why, how we protect it, and the rights you have over it under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and its Rules, and the Information Technology Act, 2000, as applicable.

Quick summary: We collect the information needed to process your order, run our store, and (only with your consent) send you marketing. We don't sell your personal information. You can access, correct, delete, or ask us to stop processing your data at any time — see "Your Rights and Choices" below. If there's a conflict between our [Terms of Service] and this Privacy Policy, this Privacy Policy controls for how we handle your personal information.

By using our Services, you acknowledge that you've read and understood this Privacy Policy.

---

Personal Information We Collect

Depending on how you interact with us, we may collect:

• Contact details — name, billing and shipping address, phone number, email address.
• Financial information — payment details needed to process your order. Card and payment data itself is collected and stored by our PCI-DSS-compliant payment gateway/processor, in line with RBI's card-tokenisation requirements — we do not store your full card number on our own systems.
• Account information — username, password, preferences and settings, if you create an account.
• Transaction information — items viewed, added to cart or wishlist, purchased, returned, or exchanged, and your order history.
• Communications — anything you tell us directly, such as a customer support message.
• Device and usage information — device/browser type, IP address, and how you interact with our site, including via cookies (see "Cookies" below).

Where We Get This Information

• Directly from you — creating an account, placing an order, contacting us.
• Automatically — through your use of the site and cookies/similar technologies.
• From our service providers — e.g., Shopify, our payment gateway, and shipping/fulfilment partners, acting on our behalf.
• From partners or other third parties, where applicable.

How We Use Your Information

• To provide and improve the Services — processing payments, fulfilling and shipping orders, managing your account, handling returns and exchanges, and improving your shopping experience.
• To communicate with you — order updates, customer support, and responses to your queries.
• For marketing, only where you've given us your consent — you can withdraw this at any time (see "Your Rights and Choices"). We do not send marketing communications on an opt-out basis; we ask first.
• For security and fraud prevention — protecting your account and our store from fraudulent or unsafe activity.
• To meet legal obligations — such as tax, accounting, or law enforcement requirements under Indian law.

How We Disclose Your Information

We share personal information only where necessary, with:

• Shopify and service providers who help us run the store (payment processing, analytics, cloud storage, fulfilment and shipping).
• Marketing partners, only for campaigns you've consented to receive.
• Parties involved in a business transaction (such as a merger), where legally required, or to enforce our policies and protect our rights and yours.

We do not sell your personal information.

Cookies

We use cookies and similar technologies to run our store, remember your preferences, and (with your consent) measure and personalise marketing. You can manage cookie preferences through your browser settings or our cookie banner where available.

Children's Data

Our Services are not directed at children, and under the DPDP Act, anyone under 18 years of age is considered a child. We do not knowingly collect personal information from children without verifiable parental or guardian consent, and we do not use children's data for tracking, behavioural monitoring, or targeted advertising. If you're a parent or guardian and believe your child has provided us with personal information, contact us using the details below and we'll delete it.

Security and Retention

We use reasonable technical and organisational measures to protect your information, consistent with the IT Act, 2000 and applicable rules. No system is perfectly secure, and we recommend not sharing sensitive information with us over unsecured channels.

We retain personal information for as long as needed to fulfil the purposes described here — for example, order and transaction records are generally retained for the period required under Indian tax and accounting law, after which we delete or anonymise them.

Your Rights and Choices

As a Data Principal under the DPDP Act, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information, subject to our legal retention obligations.
• Withdraw consent at any time, as easily as you gave it — this won't affect processing already carried out before withdrawal.
• Receive a copy of your information in a portable format, where applicable.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — raise a complaint with us directly (see below), and if unresolved, with the Data Protection Board of India.
• Manage marketing preferences — unsubscribe from promotional emails at any time; we may still send non-promotional messages about your account or orders.

To exercise any of these rights, contact us using the details below. We may need to verify your identity first. You can also authorise someone to act on your behalf, subject to us verifying that authorisation.

We will not discriminate against you for exercising any of these rights.

Data Breaches

In the event of a personal data breach affecting your information, we will notify the Data Protection Board of India and affected individuals as required under the DPDP Act, without undue delay.

International Transfers

Where your information is processed or stored outside India — for example, through Shopify's global infrastructure — we do so in compliance with the DPDP Act, which permits such transfers except to countries specifically restricted by the Government of India.

Relationship with Shopify

Our Services are hosted by Shopify, which also processes personal information to provide and improve the platform for us and other merchants. Shopify is separately responsible for certain processing, including in connection with its own enhanced features. You can learn more, and exercise certain rights, via Shopify's own privacy resources linked from our [FAQ].

Third-Party Links

Our site may link to third-party websites we don't control. We're not responsible for their privacy practices — please review their policies before sharing information with them.

Complaints

If you have a complaint about how we handle your personal information, contact us using the details below. We aim to acknowledge your complaint within 48 hours and resolve it within 1 month. If you're not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We'll post the revised policy here and update the "Last updated" date above.

Contact

For any questions about this Privacy Policy, or to exercise your rights:

Grievance Officer / Privacy Contact: Seema Vaza, Co-Founder Email:   contact@thecoppercraftsman.com Phone: +91-9316496848 Address: Vankar Vas, Devli Dedani, Taluka Kodinar, Gujarat 362720, India

(Address reconstructed from the source text, which appeared to contain a duplicated copy-paste — please confirm this is correct before publishing, and fix the source field in Shopify so it doesn't recur elsewhere, e.g. on invoices or shipping labels.)