Privacy Policy

This Privacy Policy explains how Photorbit, operated from Photorbit, Ashiyana Building, Ground Floor, Bylane 2, Vivekananda Road, Sonarpur, Kolkata, West Bengal 700150, India ("we," "us," or "our"), collects, uses, discloses, and protects your personal information when you visit www.photorbit.in, create an account, browse our catalogue, place an order, or otherwise interact with us. It is written to be consistent with India's Information Technology Act, 2000 and associated rules, the Digital Personal Data Protection Act, 2023 (DPDP Act), and the Consumer Protection (E-Commerce) Rules, 2020. By using this website, you consent to the practices described here.

1. Who this policy covers

This policy applies to visitors, registered account holders, and customers of Photorbit. If you are under 18, please use this website only with the involvement of a parent or guardian.

2. Information we collect

We collect information in the following ways:

• Information you provide directly: name, email address, phone number, delivery and billing addresses, account password (stored only as a salted hash, never in plain text), order history, product reviews and ratings, and any message content you send us via the contact form, WhatsApp, phone, or email.
• Payment confirmation data: when you check out, Razorpay (our payment gateway partner) processes your card, UPI, net-banking, or wallet details directly. We never receive, transmit, or store your full card number, CVV, UPI PIN, or net-banking credentials. We only receive a payment status, a payment reference ID, and the last few digits of a card where applicable, for order reconciliation and support purposes.
• Account data from third-party sign-in: if you register or sign in with Google, we receive your name, email address, and profile photo from Google as permitted by your Google account settings. We do not receive your Google password.
• Technical and usage data: IP address, browser type and version, device identifiers, referring/exit pages, pages viewed, time spent, and approximate location (derived from IP), collected automatically via server logs and essential cookies for security, fraud prevention, diagnostics, and to keep your cart and session working correctly.

3. Legal basis and purposes of processing

We process your personal data for the following purposes:

• To create and manage your account and authenticate you at login.
• To process, fulfil, and deliver your orders, including sharing your name, phone number, and delivery address with our courier and logistics partners solely for delivery purposes.
• To process payments and refunds through Razorpay, and to detect and prevent fraud.
• To send transactional communications — order confirmations, shipping and delivery updates, password reset emails, and responses to your support requests.
• To maintain, secure, debug, and improve the performance of this website.
• To comply with applicable tax, accounting, and legal record-keeping obligations under Indian law.
• To respond to lawful requests from courts, regulators, or law-enforcement authorities.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you, and we do not sell your personal data to third parties.

4. Payments

All payments on this website are processed by Razorpay Software Private Limited, a PCI-DSS Level 1 compliant payment aggregator regulated by the Reserve Bank of India. When you pay, you are also bound by Razorpay's own privacy policy and terms. We store only the payment status, a Razorpay order/payment reference ID, and the amount — never your full card, UPI, or bank account credentials.

5. Cookies and similar technologies

We use the following categories of cookies:

• Strictly necessary: session and authentication cookies required for login, cart persistence, and checkout to function. These cannot be disabled without breaking core site functionality.
• Functional: cookies that remember your preferences, such as theme (light/dark) selection.
• Analytics (where enabled): privacy-conscious, aggregated analytics to understand traffic sources and page performance. We do not use third-party advertising or cross-site tracking cookies.

You can block or delete cookies through your browser settings at any time; doing so may affect your ability to use the cart, checkout, or your account.

6. Who we share information with

We do not sell, rent, or trade your personal information. We share personal data only with the following categories of service providers, strictly to operate the website and fulfil your orders, under contractual confidentiality obligations:

• Razorpay — payment processing and fraud prevention.
• Courier and logistics partners — name, phone number, and delivery address, to deliver your order.
• Resend — transactional email delivery (order confirmations, password resets).
• Cloud hosting infrastructure — to store account, order, and catalogue data securely.

We may also disclose information where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Photorbit, our customers, or the public.

7. Data retention

We retain account and order data for as long as your account is active, and thereafter for as long as necessary to comply with tax, accounting, and consumer-protection record-keeping obligations under Indian law (typically up to 8 years for financial records). Cart data for guests is retained only in your browser (local storage) and is not stored on our servers until an order is placed.

8. Data security

We apply reasonable security practices and procedures as required under Section 43A of the Information Technology Act, 2000, including encrypted connections (HTTPS/TLS) for all traffic, salted password hashing, role-based access controls for our team, and secure cloud infrastructure. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to protect your information using industry-standard measures.

9. Your rights

Subject to applicable law (including the DPDP Act, 2023), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request erasure of your personal data, subject to our legal obligation to retain order and financial records for the periods described above.
• Withdraw consent for optional processing (such as marketing emails) at any time.
• Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity, as permitted under the DPDP Act.
• Lodge a grievance with our Grievance Officer (see Section 12) or a data protection authority.

You can access and update most of your account information directly from your account settings. For other requests, contact us using the details in Section 12.

10. Children's privacy

This website is intended for a general audience and is not directed to children under 18. We do not knowingly collect personal data from children without verifiable parental or guardian consent. If you believe a child has provided us personal data without such consent, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Effective" date at the top of this page reflects the latest version. Material changes will be highlighted on this page or communicated to registered users by email.

12. Grievance Officer & contact

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Consumer Protection (E-Commerce) Rules, 2020, the Grievance Officer for Photorbit is:

• Name: Somsubhra Roy
• Designation: Founder & Grievance Officer
• Email: [email protected]
• Phone: +91 86978 15372
• Address: Photorbit, Ashiyana Building, Ground Floor, Bylane 2, Vivekananda Road, Sonarpur, Kolkata, West Bengal 700150, India

We will acknowledge your complaint within 2 business days and aim to resolve it within 30 days of receipt.