Privacy Policy

Introduction and scope

This Privacy Policy ("Policy") explains how GroveCart ("GroveCart", "we", "us", "our") collects, uses, discloses, retains and otherwise processes personal information when you visit, browse, register with, purchase from, or otherwise interact with our online store at grovecart.shop and any associated pages, storefronts, communications and services (together, the "Services").

GroveCart is operated from Building No. 3, Patel Nagar, New Delhi, Delhi 110008, India. Where required by applicable law, GroveCart acts as the "data controller", "business", or "data fiduciary" in respect of the personal information described in this Policy.

By accessing or using the Services, placing an order, creating an account, subscribing to communications, submitting a review, or contacting us, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must discontinue use of the Services.

This Policy forms part of, and should be read together with, our Terms of Service, Refund Policy and Shipping Policy.

Eligibility and age restriction

The Services are intended solely for individuals aged 18 years or older. We do not knowingly collect personal information from anyone under 18. By using the Services you represent and warrant that you are at least 18 years of age and legally capable of entering into a binding contract.

If we become aware that we have collected personal information from a person under 18, we will take reasonable steps to delete that information. If you believe a minor has provided us with personal information, contact support@grovecart.shop.

Information we collect

3.1 Information you provide directly

Category	Examples
Identity data	First and last name, salutation
Contact data	Email address, billing address, shipping address, country, postal code, telephone number where you choose to provide it
Order data	Products ordered, quantities, sizes, variants, order value, currency, order history, discount and gift-card codes used
Account data	Account identifier, saved addresses, saved preferences, login and session records
Transaction data	Partial payment card details (such as card type and last four digits), billing address, transaction identifiers, payment status
Communications data	Messages you send us via our contact form, email, or other channels, including any information you voluntarily include
User-generated content	Product reviews, ratings, review photographs, review author name, and any content you submit publicly
Marketing data	Newsletter subscription status, marketing preferences, consent records and timestamps

3.2 Information collected automatically

When you interact with the Services, we and our service providers automatically collect:

• Device and technical data — IP address, browser type and version, operating system, device type, device identifiers, screen resolution, language and locale settings, time zone
• Usage data — pages viewed, products viewed, referring and exit pages, search terms entered on our site, click and scroll behaviour, session duration, timestamps
• Order and cart behaviour — items added to cart, items removed, abandoned carts, checkout steps reached
• Cookie and identifier data — cookies, pixels, tags, local storage entries, session identifiers and similar technologies (see Section 6)

3.3 Information from third parties

We may receive personal information about you from:

• Payment processors, confirming payment authorisation, fraud signals and chargeback data
• Fulfilment and supplier partners, confirming dispatch, tracking and delivery status
• Shipping carriers, providing delivery status and delivery exceptions
• Advertising and analytics providers, providing aggregated or pseudonymised audience, attribution and conversion data
• Fraud prevention services, providing risk scores and fraud indicators
• Social media platforms, where you interact with our content or link an account, in accordance with their settings and policies

How we use your information

We process personal information for the following purposes:

Order fulfilment and service delivery

• Processing, confirming, fulfilling and delivering orders
• Transmitting your name, shipping address and order details to suppliers and carriers so that goods can be dispatched to you
• Processing payments, refunds, exchanges and returns
• Sending transactional communications including order confirmations, dispatch notices, tracking updates and delivery notifications
• Providing customer support and responding to enquiries, complaints and requests

Account and platform operation

• Creating, authenticating and maintaining your account
• Operating, maintaining, securing and improving the Services
• Diagnosing technical faults, debugging and restoring service

Commercial and analytical purposes

• Understanding how customers use the Services, including analytics, measurement and performance reporting
• Developing, testing and improving products, ranges, pricing, merchandising and site functionality
• Conducting internal research, statistical analysis, trend analysis and business planning
• Personalising and customising content, product recommendations, search results and offers presented to you

Marketing and advertising

• Sending marketing communications where you have subscribed or where otherwise permitted by applicable law
• Delivering, measuring and optimising advertising, including retargeting and lookalike audience advertising on third-party platforms
• Measuring campaign effectiveness, attribution and conversion

Legal, security and risk purposes

• Detecting, investigating, preventing and addressing fraud, unauthorised transactions, chargebacks, abuse of promotions, and other unlawful or prohibited activity
• Enforcing our Terms of Service and other agreements
• Establishing, exercising or defending legal claims
• Complying with applicable laws, regulations, legal process, tax obligations and lawful requests from public authorities

Corporate transactions

• Evaluating, negotiating or completing a merger, acquisition, financing, reorganisation, sale of assets, insolvency or similar transaction

We may combine information collected from different sources and across your interactions with the Services for any of the purposes above. We may also process personal information in de-identified, pseudonymised or aggregated form, which is not subject to this Policy and which we may use and disclose for any lawful purpose without restriction.

Legal bases for processing

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

Purpose	Legal basis
Processing and delivering your order; providing customer support	Performance of a contract with you
Account creation and operation	Performance of a contract with you
Fraud prevention, security, site improvement, analytics, direct marketing to existing customers, defending legal claims	Our legitimate interests in operating, protecting and growing our business, balanced against your rights
Marketing to new subscribers; non-essential cookies and advertising technologies	Your consent, where required
Tax, accounting, regulatory and record-keeping obligations	Compliance with a legal obligation
Protecting vital interests in exceptional circumstances	Vital interests

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect processing carried out on another lawful basis.

Where processing is necessary to perform our contract with you, failure to provide the required information may mean we are unable to accept or fulfil your order.

Cookies, pixels and similar technologies

We and our service providers use cookies, pixels, tags, software development kits, local storage and similar technologies to operate the Services, remember your preferences, keep your cart and session, measure performance, and deliver and measure advertising.

Categories used:

• Strictly necessary — required for the site to function, including cart, checkout, session, authentication, load balancing and security. These cannot be disabled through our site.
• Functional — remember your preferences such as language, region, currency and previously viewed items.
• Analytics and performance — help us understand how the Services are used and how they perform.
• Advertising and targeting — used to deliver relevant advertising, to build audiences, and to measure the effectiveness of campaigns across third-party platforms.

Technologies currently or prospectively in use include: Shopify platform and checkout cookies; Judge.me review widget; Hulk Form Builder; Google Analytics and Google Ads; Meta (Facebook and Instagram) Pixel; and email marketing platform tracking.

Most browsers allow you to refuse or delete cookies through their settings. Blocking or deleting cookies may degrade or break parts of the Services, including cart and checkout. Where required by applicable law, we will obtain consent before setting non-essential cookies, and you may change or withdraw your cookie preferences at any time through the mechanism provided on our site.

We do not currently respond to browser "Do Not Track" signals, as no consistent industry standard exists. Where required by law, we honour recognised opt-out preference signals such as Global Privacy Control for applicable jurisdictions.

Disclosure of your information

We do not sell personal information for money. We do, however, share personal information as described below, and certain sharing for advertising purposes may be treated as a "sale" or "sharing" under some United States privacy laws (see Section 11.2).

We disclose personal information to:

Platform and infrastructure providers

• Shopify Inc., which hosts our store, processes checkout and orders, and provides core commerce infrastructure

Payment processors

• Payment service providers who process transactions. Full payment card numbers are collected and processed directly by these providers and are not stored by us.

Suppliers, fulfilment partners and carriers

• EPROLO and CJ Dropshipping, and other fulfilment partners, who receive your name, shipping address, contact details and order contents in order to pick, pack and dispatch goods to you
• Shipping carriers and logistics providers who deliver your order and provide tracking
• Customs, postal and border authorities where required for international shipments

Application and service providers

• Judge.me, which collects, stores, publishes and administers product reviews
• HulkApps (Hulk Form Builder), which processes contact form submissions
• Email marketing, analytics, advertising, customer support, fraud prevention and IT service providers

Advertising and analytics partners

• Google and Meta Platforms, and comparable providers, for analytics, measurement, audience building, retargeting and advertising

Professional advisers and authorities

• Accountants, auditors, insurers, bankers and legal advisers
• Law enforcement, regulators, courts, tax authorities and other public bodies where we believe in good faith that disclosure is necessary or appropriate to comply with law or legal process, to respond to lawful requests, or to protect our rights, property, safety or that of our customers or others

Corporate transactions

• Actual or prospective buyers, investors, lenders and their advisers in connection with any merger, acquisition, financing, restructuring, sale of assets or insolvency, in which case personal information may be transferred as a business asset

With your direction

• Any other party where you direct or authorise us to share your information

Our suppliers and service providers are located in multiple countries, including China, the United States, Canada, the European Union and India. Some of these parties act as independent controllers of your information under their own privacy policies, which we do not control and for which we are not responsible.

International data transfers

Because our Services are offered worldwide and our providers operate globally, your personal information may be transferred to, stored in and processed in countries other than your own, including countries which may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, adequacy decisions, or other lawful transfer mechanisms. You may request further information about these safeguards using the contact details in Section 18.

By using the Services or submitting personal information to us, you acknowledge that such international transfers will occur.

Data retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, including:

• Order and transaction records — retained for the duration of our relationship and thereafter for the period required by applicable tax, accounting, customs and commercial law, which is typically at least eight (8) years in India and may be longer in other jurisdictions
• Account data — retained while your account remains active, and for a reasonable period afterwards
• Marketing data and consent records — retained until you unsubscribe or withdraw consent, and thereafter as evidence of consent and of your suppression preference
• Support correspondence — retained for a reasonable period to handle recurring issues and defend potential claims
• Fraud, abuse and security records — retained for as long as necessary for fraud prevention, risk management and legal defence
• Reviews and user-generated content — retained indefinitely unless removed by us or at your validated request, and may remain published in anonymised form

Where we no longer require personal information, we will delete, anonymise or aggregate it. We may retain de-identified, anonymised or aggregated information indefinitely. We may also retain limited personal information after a deletion request where retention is necessary to comply with legal obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements.

Security

We maintain administrative, technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include encryption of data in transit, access controls, and reliance on PCI-DSS compliant payment infrastructure operated by Shopify and our payment processors.

However, no method of transmission over the internet and no method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security, and any transmission of personal information to us is at your own risk. To the fullest extent permitted by applicable law, we disclaim liability for any unauthorised access to, alteration of, or disclosure or loss of your personal information arising from circumstances outside our reasonable control.

You are responsible for maintaining the confidentiality and security of any credentials, one-time codes or devices used to access your account, and for all activity that occurs under your account.

If we become aware of a personal data breach affecting your personal information, we will notify you and the relevant supervisory authority where and to the extent required by applicable law.

Your rights

Rights differ by jurisdiction. We apply the rights below to the extent they apply to you under applicable law.

11.1 European Economic Area and United Kingdom (GDPR / UK GDPR)

Subject to conditions and exemptions in law, you have the right to: request access to your personal information; request rectification of inaccurate information; request erasure; request restriction of processing; object to processing carried out on the basis of legitimate interests, including profiling; object at any time to processing for direct marketing purposes; request data portability; and withdraw consent where processing is based on consent.

You also have the right to lodge a complaint with your local supervisory authority. We would appreciate the opportunity to address your concerns before you approach a regulator.

11.2 United States (including California — CCPA / CPRA)

Subject to applicable law, residents of certain US states have the right to: know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties to whom it is disclosed; request deletion; request correction; opt out of the "sale" or "sharing" of personal information and of targeted advertising; limit the use of sensitive personal information; and not receive discriminatory treatment for exercising these rights.

We do not sell personal information for monetary consideration. Our use of advertising and analytics technologies, including the Meta Pixel and Google advertising products, may constitute "sharing" or "selling" for cross-context behavioural advertising under certain US state laws. To opt out, use the cookie preference mechanism on our site or contact support@grovecart.shop with the subject line "Do Not Sell or Share My Personal Information".

We do not knowingly sell or share the personal information of consumers under 16 years of age.

11.3 India (Digital Personal Data Protection Act, 2023)

Subject to applicable law, Data Principals have the right to: obtain a summary of personal data processed and the processing activities undertaken; request correction, completion, updating and erasure; nominate another individual to exercise rights in the event of death or incapacity; and access a grievance redressal mechanism.

You also have the duty, under that Act, not to submit false or misleading particulars, impersonate another person, or file frivolous or false complaints.

Grievance Officer: grievances may be submitted to support@grovecart.shop with the subject line "Grievance — DPDP". We will acknowledge and respond within the period prescribed by applicable law.

11.4 Exercising your rights

To exercise any right, contact support@grovecart.shop with the subject line "Privacy Request", stating the right you wish to exercise and the jurisdiction in which you reside.

Verification. To protect your information, we will take reasonable steps to verify your identity before acting on a request. We may ask you to provide additional information, including details matching those already held by us such as an order number and the email address used at checkout. We may decline to act on requests where we are unable to verify your identity to a reasonable degree of certainty. Requests submitted from an email address not associated with our records will generally be refused.

Authorised agents. Where permitted by law, an authorised agent may submit a request on your behalf. We may require written proof of authorisation and independent verification of your identity.

Timeframes. We will respond within the period required by applicable law. Where permitted, we may extend that period, and will inform you of any extension and the reasons for it.

Refusals and fees. We may refuse, or charge a reasonable fee for, requests that are manifestly unfounded, repetitive or excessive, and we may refuse requests to the extent an exemption applies, including where compliance would adversely affect the rights and freedoms of others, prejudice the prevention or detection of fraud, or conflict with a legal obligation. Where we refuse a request, we will explain why, except where prohibited by law.

Retention despite deletion requests. Certain information will be retained after a deletion request where necessary to complete a transaction, comply with legal or tax obligations, detect and prevent fraud, resolve disputes, or enforce our agreements.

Marketing communications

We may send you marketing communications where you have subscribed, or where you have purchased from us and applicable law permits marketing to existing customers.

You may unsubscribe at any time using the unsubscribe link in any marketing email, or by contacting support@grovecart.shop. Please allow a reasonable processing period for suppression to take effect across our systems.

Unsubscribing from marketing does not stop transactional and service communications, including order confirmations, dispatch and delivery notifications, payment and refund notices, security alerts, service announcements and policy updates. These are necessary to our relationship with you and cannot be opted out of while you hold an account or an open order.

Automated processing and profiling

We and our service providers use automated systems to screen orders and transactions for fraud, payment risk and abuse of promotions, and to personalise the content, recommendations and advertising you see.

An automated fraud assessment may result in an order being flagged, delayed, subjected to additional verification, cancelled or refunded. Where required by applicable law, you may request human review of a decision that produces legal or similarly significant effects, express your point of view, and contest the decision by contacting support@grovecart.shop.

Third-party links and services

The Services may contain links to, or embedded content from, third-party websites, applications, platforms and payment providers. We do not control these third parties, and this Policy does not apply to their processing of your information.

We are not responsible for the content, privacy practices, security, or acts or omissions of any third party, including our suppliers, carriers, payment processors and application providers, except to the extent such responsibility cannot be excluded under applicable law. We encourage you to review the privacy policies of any third party before providing information to them.

Changes to this Policy

We may amend this Policy at any time and in our sole discretion to reflect changes in our practices, technologies, services, legal requirements or business circumstances.

The revised Policy will be posted on this page with an updated "Last updated" date and takes effect immediately upon posting, unless applicable law requires otherwise. Where a change is material and applicable law requires it, we will provide additional notice or seek your consent.

Your continued use of the Services after a revised Policy is posted constitutes your acceptance of that Policy. We recommend you review this page periodically. Archived versions are not maintained.

Limitation of liability

To the fullest extent permitted by applicable law, GroveCart and its owners, operators, employees, agents, suppliers and service providers shall not be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, goodwill, data or business opportunity, arising out of or relating to the collection, use, disclosure, loss, corruption or unauthorised access to personal information, whether based in contract, tort, negligence, strict liability or otherwise, and whether or not we have been advised of the possibility of such damages.

Nothing in this Policy excludes or limits any liability that cannot be excluded or limited under applicable law, including liability for fraud, wilful misconduct, or statutory liabilities under applicable data protection legislation.

Governing law and disputes

This Policy and any dispute or claim arising out of or in connection with it, its subject matter or formation, shall be governed by and construed in accordance with the laws of India, without regard to conflict of law principles.

Subject to any mandatory rights you have to bring proceedings in your country of residence, the courts of New Delhi, India shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

If any provision of this Policy is held to be invalid, illegal or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.

Contact us

For any question, request or complaint concerning this Policy or your personal information:

GroveCart

Email: support@grovecart.shop

Postal address: Building No. 3, Patel Nagar, New Delhi, Delhi 110008, India

For privacy rights requests, please use the subject line "Privacy Request".

For grievances under India's DPDP Act, please use the subject line "Grievance — DPDP".

We aim to acknowledge all privacy enquiries within a reasonable period and to respond substantively within the timeframes required by applicable law.