Rachana Art Gallery, of Ahmedabad, Gujarat, India (“we”, “us”, “our”, the “Studio”), is the Data Fiduciary in respect of the personal data described in this Policy. You are the Data Principal.
This Policy is issued under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It forms part of our Terms & Conditions.
1.Scope of this Policy
- This Policy applies to personal data we process when you browse this website, submit an enquiry or order through it, message us on WhatsApp, email us, or submit a review.
- It does not apply to any other website, and it does not apply to WhatsApp, Instagram or any other third-party platform, each of which processes your data under its own privacy policy. See clause 6.
- This website has no customer accounts, no login for customers and no checkout. There is nothing for you to register for and no password of yours for us to hold.
- Terms used in this Policy that are defined in our Terms & Conditions carry the same meaning here.
2.Personal Data We Collect
We collect only what an order needs. In practice that falls into five groups:
- Order details. When you place an order we record your name, telephone number, and — where you give them — your email address, delivery address, city, state and PIN code, together with any note you add, the pieces ordered, the size and colour chosen, and the quoted and paid amounts.
- Quotation requests. When you ask for a price for custom work we record your name, telephone number, email address where given, the description of what you want, and any reference image you upload.
- Personalisation content. Where a piece carries a name, a message, a date, a monogram or a photograph, we hold that content for as long as it takes to prepare your proof and make and deliver the piece. Where you send us a photograph of a person, that photograph is personal data of that person as well as of you, and clause 3 applies to it.
- Reviews. Where you submit a review we record the name you give, your city where given, your rating, the text of the review, and any photograph you attach. What we publish is described in clause 3.5.
- Correspondence. We retain the WhatsApp conversation, email or message thread in which your order was discussed, agreed and confirmed, because it is the record of the contract between us.
- We do not collect your date of birth, your gender, your government identity numbers, your financial account details, your biometric data, your health data, or your precise location. Please do not send us any of these; if you do, we will delete them.
- Technical information. Our server logs the internet address of incoming requests in memory in order to apply rate limits and resist abuse. Those addresses are not written to the database against you and are not used to identify or profile you. An internet address is stored only when a member of our own staff signs in to the admin, and then only against that staff account.
3.Content & Photographs You Send Us
- Content you send for personalisation is used for one purpose: to prepare your proof and to make and deliver your order. It is not used to train any model, is not shared with any other customer, and is not sold or licensed to anyone.
- Where you send us a photograph of another person, you confirm under our Terms & Conditions that you have that person’s consent — or that of their parent or guardian where they are a child — for it to be reproduced. We rely on that confirmation.
- Reference images and photographs you upload are stored on the server that runs this website, in a directory not listed publicly, and are reachable only by their own address. Please treat that as unlisted rather than secret, and do not send us anything you would not want a third party to see if that address were shared.
- You may ask us to delete a photograph you have sent us once your order is complete, and we will do so, subject to the record-keeping periods in clause 12.
- We may photograph finished work — including a piece made to your specification — for our catalogue, website and social media. Where a piece carries your family name, your photograph or your personal dates, tell us before dispatch and we will not publish it. Where you have submitted a review, we may publish the name and city you gave alongside it; we do not publish your telephone number, your email address or your delivery address anywhere, at any time.
4.Why We Use Your Data
We use your personal data only for the following purposes:
- To respond to your enquiry and prepare a quotation.
- To prepare your proof, make your piece to it, and keep you informed while it is being made.
- To arrange delivery, which means passing your name, address and telephone number to a courier as described in clause 7.
- To take and reconcile payment, and to issue a GST invoice where you have asked for one.
- To handle a complaint, a damage claim, a replacement or a refund, and to keep the record needed to do so.
- To keep the business records we are required by law to keep, including for tax and accounting purposes.
- To protect the website and the business against fraud, abuse and misuse, including the rate limiting described in clause 2.7.
- We do not use your data for automated decision-making or profiling, and we do not build advertising audiences from it.
5.Our Lawful Basis
- For most processing our basis is your consent, given when you send us an enquiry, an order or a review with the information it needs. Under the Digital Personal Data Protection Act, 2023 that consent is limited to the purposes set out in clause 4.
- Where processing is necessary to perform the contract between us — making and delivering the piece you ordered — we rely on that necessity.
- Where we are required to retain records by law, including under tax legislation, we rely on that legal obligation.
- You may withdraw your consent at any time as described in clause 14. Withdrawing consent does not affect processing already carried out, and where the withdrawn data is necessary to complete an order in progress, we may be unable to complete that order.
6.WhatsApp, Instagram & Messaging
- This Studio takes orders principally over WhatsApp. Every button on this website marked as opening WhatsApp opens the WhatsApp application or website with a message pre-written for your convenience. Nothing is sent until you send it, and no message content reaches us before you press send.
- WhatsApp is operated by Meta. When you message us, Meta processes your telephone number, your message content and associated metadata under its own terms and privacy policy, over which we have no control and for which we are not responsible.
- We hold the resulting conversation on the device or devices used to run the Studio’s WhatsApp account, and we retain it as the record of your order under clause 12.
- The same applies to Instagram: following, messaging or commenting on our Instagram account is processing carried out by Meta under its own policy.
- If you would prefer not to use WhatsApp, email us at hello@rachanaartgallery.com or telephone +919723822587 and we will conduct your order that way instead.
7.Who We Share Your Data With
We do not sell, rent or trade personal data. We share it only where an order cannot be completed without doing so:
8.Payment Information
- This website has no payment gateway and no checkout. You cannot pay on this website, and no payment form of any kind is presented to you here.
- Payment is made by UPI or bank transfer directly to the Studio’s account, using details we send you over WhatsApp or email once your proof is approved.
- The Studio therefore never receives, processes or stores your card number, CVV, UPI PIN, net-banking credentials or any other payment credential. We see only what any payee sees: that a payment arrived, from which account name, and for how much.
- We record the amount of the advance and the balance against your order so that we can reconcile it and issue an invoice. We do not store your bank account number or UPI identifier beyond what appears in that transaction record.
- If a payment gateway is introduced in future, this Policy will be updated before it goes live, and the gateway’s own privacy policy will additionally apply.
9.Cookies, Browser Storage & Analytics
10.Marketing & Newsletters
- We do not send marketing messages to customers who have not asked for them. Placing an order does not add you to a mailing list.
- Our systems retain the ability to record an email address submitted for a newsletter. Where you submit one, it is used only to send occasional updates about new work and offers, and for nothing else.
- You may ask us to remove your email address from that list at any time, by replying to any such message or by writing to hello@rachanaartgallery.com, and we will remove it promptly.
- We may contact you about an order you have placed — a proof, a payment, a dispatch notification, a delivery query or a complaint — regardless of your marketing preferences, because those messages are necessary to perform the contract.
11.Transfers Outside India
- Our database and uploaded files are held on infrastructure selected by us, and we will use servers located in India wherever the provider offers that option.
- Where a service provider we use processes data outside India, that transfer is made only to a country not restricted by the Central Government under section 16 of the Digital Personal Data Protection Act, 2023, and subject to the provider’s contractual commitments.
- WhatsApp and Instagram are global services operated by Meta, and messages sent through them may be processed outside India under Meta’s own terms. This is inherent in your choice to use those services to contact us, and is described in clause 6.
12.How Long We Keep Data
- Enquiries and quotation requests that do not become orders are kept for up to 12 months, so that we can pick up a conversation you return to, and are then deleted.
- Order records — your name, contact details, delivery address, the specification of the piece, and the amounts quoted and paid — are kept for 8 years from the end of the financial year in which the order was completed, which is the period we may need them for tax, audit and warranty purposes.
- Personalisation content and reference photographs are deleted once the order is complete and the replacement window in our Terms & Conditions has closed, unless you have asked us to keep a design on file for a repeat order.
- Our internal audit log records which member of staff changed what, and may contain order data within that record. It is kept for 3 years and is not used for any purpose other than security and accountability.
- Reviews are kept and displayed until you ask us to remove yours, or until we remove it.
- WhatsApp conversations are kept for as long as the order record they relate to.
- Where a dispute, claim or investigation is live or reasonably anticipated, we keep the relevant data until it is finally resolved, even if a period above has expired.
13.How We Protect Your Data
- Access to the admin area of this website requires a password and is limited to authorised Studio staff. Staff passwords are stored only as a one-way hash, never in a readable form.
- Administrative sessions are short-lived, are held in a secure httpOnly cookie that scripts cannot read, and can be revoked. Every change made in the admin is recorded in an audit log against the person who made it.
- Traffic to this website is served over HTTPS in production, standard security headers are applied, and requests are rate-limited to resist automated abuse.
- Database and file backups are taken and are held with the same protections as the live data.
- No system is perfectly secure. We use reasonable security practices proportionate to a small studio, and we do not claim more than that. Where a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by the Digital Personal Data Protection Act, 2023.
- You can help by not sending us identity documents, financial credentials or passwords, none of which we ever need.
14.Your Rights
Under the Digital Personal Data Protection Act, 2023 you have the following rights in respect of your personal data:
- The right to a summary of the personal data we hold about you and of the processing we carry out, together with the identities of those with whom we have shared it.
- The right to correction of inaccurate or misleading data, completion of incomplete data, and updating of data that has changed.
- The right to erasure of your personal data where it is no longer necessary for the purpose for which it was collected, subject to the retention periods in clause 12 and to any legal obligation on us to keep it.
- The right to withdraw your consent, with the consequence described in clause 5.4.
- The right to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
- The right to grievance redressal, which is dealt with in clause 16, and the right to complain to the Data Protection Board of India if you remain dissatisfied.
- To exercise any of these rights, write to hello@rachanaartgallery.com or message +919723822587 with enough information for us to identify your records — ordinarily the telephone number you ordered from, or your order reference. We may ask you to verify your identity before we act, so that we do not disclose your data to somebody else. We respond within 30 days.
- There is no charge for exercising these rights. We may decline a request that is manifestly unfounded, repetitive or that would require us to breach a legal obligation, and we will tell you why.
15.Children’s Data
- This website is not directed at children, and we do not knowingly collect personal data from a child under the age of 18 without the verifiable consent of a parent or lawful guardian, as required by the Digital Personal Data Protection Act, 2023.
- We do not carry out tracking, behavioural monitoring or targeted advertising in respect of any person, and therefore none in respect of children.
- Many of our pieces are gifts recording a child’s name, birth details or photograph. In every such case the customer is an adult, and the customer confirms under our Terms & Conditions that they hold the necessary authority in respect of the child’s details and photograph.
- If you believe a child has given us personal data without that authority, write to hello@rachanaartgallery.com and we will delete it.
16.Grievance Officer & Contact
- For any question about this Policy, any request under clause 14, or any grievance about how we have handled your personal data, contact the Studio’s Grievance Officer:
- By email: hello@rachanaartgallery.com. By WhatsApp or telephone: +919723822587. By post: Rachana Art Gallery, Ahmedabad, Gujarat, India.
- We acknowledge a grievance within 48 hours and aim to resolve it within 30 days of receipt.
- If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to any other authority having jurisdiction.
17.Changes to this Policy
- We may update this Policy to reflect a change in what we do, in the services we use, or in the law. The current version, its version number and the date it took effect are shown at the top of this page.
- Where a change materially reduces your rights or materially widens the purposes for which we process your data, we will seek your consent afresh before applying it to data already collected.
- Superseded versions are retained in our source-control history, so the version in force on any past date can be produced if it is ever needed.
End of document. Privacy Policy, version 1.0, in effect from 6 September 2026.