Privacy Policy

1. Introduction & Data Fiduciary

Welcome to The Trail Tales ("we", "our", "us"). We craft and retail luxury long-lasting fragrances across India. We are deeply committed to respecting your privacy, safeguarding your personal data, and maintaining complete transparency regarding how we handle your information.

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), The Trail Tales acts as the Data Fiduciary for personal data collected through this website (thetrailtales.com). Our operations and primary fulfillment base are situated in Palghar, Maharashtra 401404, India.

2. Data Minimization: What We Collect & Why

In accordance with the principle of data minimization, we strictly collect only the personal information necessary to fulfill our contractual and statutory obligations to you:

• Identity & Contact Details: Full name, email address, mobile/telephone number. Purpose: Order confirmations, shipping notifications via SMS/WhatsApp/Email, and customer support queries.
• Delivery Information: Physical shipping address, pincode, city, state. Purpose: Accurate order dispatch and logistics fulfillment via authorized courier services.
• Account Credentials: Hashed passwords and secure session identifiers if you choose to register an account. Purpose: Enabling access to order tracking and saved preferences. We never store plain-text passwords.
• Technical & Session Identifiers: IP address, browser type, and essential session cookies. Purpose: Maintaining your shopping cart, CSRF attack prevention, and detecting fraudulent transactions.

We DO NOT collect: We do not collect government identity numbers, biometric data, religious beliefs, health records, or any sensitive personal data outside the scope of e-commerce commerce fulfillment.

3. Payment Security & Financial Information

We do not collect, process, or store your debit card numbers, credit card numbers, CVVs, net banking credentials, or UPI PINs. All online payments are handled directly by Razorpay, a certified PCI-DSS Level 1 compliant payment aggregator.

When you make an online payment, your financial details are encrypted and transmitted directly to Razorpay and your banking institution. We only receive a transaction verification token, payment status, and order reference ID.

4. Third-Party Disclosures & Service Providers

We do not sell, rent, monetize, or trade your personal data with third-party advertisers, brokers, or marketing networks. We only share necessary data with trusted service providers strictly to perform essential operations:

• Logistics Partners: We transmit your shipping address, recipient name, and contact number to ShipRocket and its verified courier partners (such as Delhivery, Bluedart, Xpressbees) to pick up and deliver your parcels.
• Payment Processors: Transaction parameters are shared with Razorpay for payment processing and fraud detection.
• Legal Authorities: We may disclose data if required to do so by applicable Indian law, court order, or official governmental decree.

5. Your Rights as a Data Principal (DPDP Act, 2023)

Under the DPDP Act 2023, you hold comprehensive rights regarding your personal data:

• Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Completion: You may request the rectification of inaccurate or incomplete personal information in your profile.
• Right to Erasure: You may request the deletion of your personal data where its retention is no longer necessary for the original purpose or required by taxation/accounting laws.
• Right to Grievance Redressal: You have the right to readily accessible grievance resolution directly with our designated officer.
• Right to Nominate: You may designate an individual who, in the event of death or incapacity, shall exercise your privacy rights.

To exercise any of these statutory rights, please send an email from your registered email ID to [email protected].

6. Data Retention & Security Standards

We implement industry-standard administrative, physical, and technological security controls (including TLS encryption, password hashing, parameterized database queries, and role-based access control) to protect your personal data against unauthorized access, alteration, disclosure, or loss.

We retain transaction and invoice records for a period mandatory under Indian commercial, taxation (GST), and accounting compliance statutes (typically 7-8 years). Personal details associated with inactive user accounts are purged or anonymized upon receipt of an erasure request.

7. Cookies & Tracking Technologies

We only deploy essential cookies and local preferences (such as your shopping cart, dark/light theme choice, CSRF security tokens, and login status) needed to provide a seamless shopping experience. We do not use third-party tracking pixels or covert marketing trackers. Please review our Cookie Policy for full details.

8. Statutory Grievance Redressal Officer

In compliance with Rule 5(9) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act 2023, the details of our designated Grievance Officer are provided below: