Our commitment to your privacy
Gir Store ("we", "our", or "us") operates girstore.in and is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use it, and the rights you have over it.
This policy applies to all visitors, customers, traders, and transporters who use our website, mobile experience, or any services we provide. By using Gir Store, you agree to the practices described in this policy.
1. Information we collect
Information you provide directly
- Account registration: name, email address, mobile number, and password
- Role-specific details: business name and GST number (Traders); vehicle registration and transport company name (Transporters)
- Order information: delivery address, order contents, and payment details (processed securely by Stripe — we never store card numbers)
- Communications: messages sent via our contact form or customer support channels
- Subscription preferences: chosen products, delivery intervals, and schedule preferences
Information collected automatically
- Device and browser information: IP address, browser type, operating system, and device identifiers
- Usage data: pages visited, time spent, links clicked, and navigation paths
- Session data: login timestamps, session duration, and authentication tokens stored in secure HttpOnly cookies
- Cart data: items added to cart, stored locally in your browser (localStorage) and not transmitted until checkout
Information from third parties
- Stripe: payment confirmation status, transaction reference IDs, and fraud-prevention signals. Stripe's own privacy policy governs their data handling.
- Delivery partners: fulfilment status updates and delivery confirmation data shared by our logistics network
2. How we use your information
- To process and fulfil your orders, subscriptions, and delivery requests
- To create and manage your account, including role-based access (Customer, Trader, Transporter)
- To operate the EBUXX cashback rewards programme — calculating, crediting, and redeeming tokens
- To send transactional communications: order confirmations, delivery updates, and subscription reminders
- To send promotional communications, only with your explicit consent, which you may withdraw at any time
- To improve our website, product range, and service quality through aggregated analytics
- To detect, prevent, and investigate fraud, abuse, or security incidents
- To comply with applicable laws, regulations, and lawful requests from government authorities
3. Cookies and tracking technologies
We use cookies and similar technologies to operate our website and improve your experience. You can control non-essential cookies through our cookie consent banner.
Essential cookies
Required for the website to function. These include authentication session tokens (HttpOnly, Secure, SameSite) and CSRF protection tokens. These cannot be disabled.
Functional cookies
Remember your preferences such as language settings and cart contents. Disabling these may affect your experience.
Analytics cookies
Help us understand how visitors use our site through aggregated, anonymised data. Only set with your consent.
Payment cookies
Set by Stripe to enable secure payment processing and fraud prevention. Governed by Stripe's cookie policy.
4. Sharing your information
We do not sell your personal data. We share it only in the following limited circumstances:
- Service providers: Stripe (payments), delivery partners (fulfilment), and cloud infrastructure providers — all bound by data processing agreements
- Legal compliance: when required by law, court order, or to protect the rights and safety of Gir Store, our users, or the public
- Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred with appropriate notice to you
- With your consent: for any other purpose, only with your explicit prior consent
5. Data retention
- Account data: retained for the duration of your account and for 3 years after closure, unless a longer period is required by law
- Order and transaction records: retained for 7 years to comply with Indian tax and accounting regulations
- EBUXX reward transaction history: retained for 5 years from the date of each transaction
- Marketing consent records: retained for 3 years from the date of consent or withdrawal
- Session and authentication logs: retained for 90 days for security and fraud-prevention purposes
6. Your rights
Under the Indian Information Technology Act, 2000 (and its 2011 Rules on Sensitive Personal Data), and where applicable the EU/UK General Data Protection Regulation (GDPR), you have the following rights:
Right to access
Request a copy of the personal data we hold about you.
Right to correction
Ask us to correct inaccurate or incomplete personal data.
Right to deletion
Request deletion of your personal data, subject to legal retention obligations.
Right to portability
Receive your data in a structured, machine-readable format (GDPR users).
Right to object
Object to processing based on legitimate interests, including direct marketing.
Right to withdraw consent
Withdraw consent for marketing or analytics at any time without affecting prior processing.
Right to grievance redressal
Under the IT Act, raise a grievance with our designated Grievance Officer (details below).
7. Data security
- All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
- Passwords are hashed using industry-standard algorithms — we never store plaintext passwords
- Authentication sessions use HttpOnly, Secure, SameSite cookies to prevent XSS and CSRF attacks
- Payment card data is processed exclusively by Stripe and never touches our servers
- Access to personal data is restricted to authorised personnel on a need-to-know basis
- We conduct regular security reviews and promptly address identified vulnerabilities
8. Children's privacy
Gir Store is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us immediately at [email protected] and we will delete it promptly.
9. International data transfers
Your data is primarily stored and processed in India. Some of our service providers (including Stripe) may process data outside India. Where this occurs, we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent protections recognised under applicable law.
10. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting a notice on our website and, where appropriate, by email. The "Last updated" date at the top of this page always reflects the most recent revision.
Contact us & Grievance Officer
For privacy-related queries, data requests, or to reach our Grievance Officer as required under the Indian IT Act:
Grievance Officer
The Founder, Gir Store
Address
Gir Store, Gujarat, India
Response time
Within 30 days of receiving your request
Related pages