Who we are
Agarwal Online, Nagothane, Raigad ("the store", "we") runs this website. We decide why and how your personal data is used, so under the Digital Personal Data Protection Act, 2023 (the DPDP Act) we are its Data Fiduciary.
This policy covers the website, your account, orders, support, school accounts and the store's staff and delivery partners. It is published under the Information Technology Act, 2000, the DPDP Act and the rules made under them.
Questions or complaints go to our grievance officer, listed on Contact & Grievance.
What we collect
Only what each part of the shop needs:
- Your account
Name, mobile number, email, password (stored only as a one-way hash, never readable), language, your preferred payment method and what to do if an item is unavailable.
- Google sign-in
If you choose it: the name, email address, profile picture link and account ID Google shares with us, and the sign-in tokens Google issues for your account.
- Delivery addresses
Recipient's name, mobile number, address, landmark, PIN code and delivery instructions.
- Orders
Items, prices, offer used, delivery time, payment method, order and delivery status, the version of our Terms you agreed to, and the delivery code (stored only as a hash).
- Support and complaints
Chat messages, complaint and return details, and photos you upload.
- Reviews and ratings
Product reviews (shown publicly), order ratings and comments (seen only by the store).
- Shared lists
List names, items and who added them.
- School accounts
School name, contact person, phone, email, address and GSTIN; your request to join; quotations and your replies.
- Family accounts
If you create or join one: the family's name, the adults in it, and for each child their first name, school and class. Children have no login or account of their own.
- Notifications on your device
If you turn them on: your browser's push address and encryption keys, and a label such as "Chrome on Android".
- Staff and delivery partners
Name, phone, work email and role, and the work done: packing, deliveries, cash collected and customers' ratings of deliveries.
- Security records
For signed-in sessions and to stop repeated sign-in attempts: IP address and browser details. Changes made in the shop are logged with who made them.
We do not collect dates of birth, government ID numbers or your precise location (GPS). About children we keep only what a parent adds to a family account: first name, school and class.
Why we use it
- To create your account and keep it secure, including one-time sign-in codes.
- To take, pack, deliver and bill your orders, and to collect cash on delivery.
- To make refunds.
- To answer chats, sort out complaints and arrange returns.
- To show product reviews and to learn from order ratings.
- To send messages you need: sign-in codes, delivery codes, account emails and school quotations.
- To show "Buy it again" and "Picked for you" from your own past orders, on this site only.
- To let a family share its orders, and to tell parents when their child's school kit is ready.
- To send the notifications you turned on, such as order updates, in the app and on your device.
- To prevent fraud and misuse and to keep the site secure.
- To meet legal duties, such as GST and accounting records and consumer law.
We do not sell your personal data, we do not use it for advertising, and we do not send marketing messages.
Your consent
When you create an account, place an order or send a form that links to this policy, you agree to us using the data you give for the purpose described there and in this policy. Some uses need no consent because the law allows them, for example records we must keep for tax, or data you give us yourself for something you asked for.
You can withdraw your consent at any time, as easily as you gave it (see Your rights). Withdrawing doesn't undo what was done before, and we may then be unable to keep your account or complete open orders.
What other people can see
- A product review you write is shown publicly with your account name.
- On a shared list, members see your first name and what you add.
- School representatives of the same school see each other's names on the school basket and quotations.
- Your delivery partner sees what they need to deliver your order.
- In a family account, the other adults see the family's orders and invoices (with delivery addresses) and the children's details. An order you mark private at checkout stays yours.
Everything else is seen only by you and the store's staff, each according to their role.
How long we keep it
- Sign-in codes
Valid for 5 minutes, deleted within a day.
- Sign-in sessions, with IP address and browser
30 days after you last use the site, or until you sign out.
- Sign-in attempts, with IP address
1 day.
- Basket before sign-in
30 days.
- Complaint, packing and delivery photos
90 days.
- Notifications
180 days.
- Activity records (who changed what)
730 days.
- Children's details
Until an adult in the family removes them, or the family is deleted.
- Notification devices
Until you turn notifications off, or the push service says that browser is gone. At most 8 browsers per person.
- Account, addresses, chats, complaints and reviews
While your account is open, or until you ask us to delete them.
- Orders, bills, payments and refunds
As long as tax and accounting laws require (GST records must be kept for at least six years), even after an account is closed.
When data is no longer needed, we delete it or remove what identifies you.
Your rights
Under the DPDP Act you can:
- Get a summary of the personal data we hold about you and who we've shared it with.
- Correct or update it. You can edit your name, preferences and addresses yourself on Your account.
- Ask us to delete your account and data. We'll delete it, or remove what identifies you, within 30 days, except records the law makes us keep.
- Withdraw consent you gave us.
- Nominate someone to use these rights for you if you die or can't act yourself.
- Complain to our grievance officer, and if you're not satisfied, to the Data Protection Board of India.
To use any of these, write to us in Talk to the store or to the grievance officer on Contact & Grievance. We may ask you to confirm it's really you before we act.
How we protect it
- Passwords are stored only as one-way hashes. Sign-in and delivery codes expire within minutes and allow only a few tries.
- Repeated attempts to sign in or send forms are blocked for a while.
- The site uses secure (HTTPS) connections.
- Staff see only what their role needs, and their actions are logged.
The store will never ask for your password or sign-in code. Don't share them with anyone, including people who say they're from the store.
No system is perfectly secure. If a breach affects your data, we'll tell you and the Data Protection Board as the law requires.
Children
The shop is meant for adults. If you are under 18, a parent or guardian must create the account and place orders for you. Children never get an account.
In a family account, a parent or guardian can add a child's first name, school and class, so the family can find and buy the right school kit and be told when it's ready. We use these details only for that: never for advertising, tracking or profiling. Any adult in the family can change or remove a child, and deleting the family removes them all.
School accounts are for adult school staff and hold no student details. If we learn that we hold a child's data without a parent's consent, we'll delete it.
Changes to this policy
When we change this policy we update the version and date at the top of this page. For important changes we'll show a notice on the site before they apply, and checkout will ask you to agree to the current terms.