Privacy Policy

MAAGEMSHOUSE (“we”, “us”) is an online gemstone retailer based in Kolkata, West Bengal, India. We are the controller of the personal data described here, and we process it to run our store: taking orders, taking payment, shipping pieces, and supporting you afterwards.

For anything relating to your data, write to us at [email protected] or call +91 70440 08558.

We only collect what an order actually needs. Depending on how you use the site, that includes:

• Account details — your name, email address, and a securely hashed password. If you add a phone number to your account we store it. Optional profile details you choose to give us are stored with your account.
• Saved addresses — a delivery address you save may include a label, full name, address lines, city, state, postal code, country, and phone number. You can remove a saved address at any time from your account.
• Order details — the products, quantities, and amounts you order, plus the delivery address, phone number, email address, and any order note you write. Order notes are kept with the order so our team can act on your instructions.
• Payment information — which method you chose (cash on delivery, UPI, or bank transfer) and the provider reference for the transaction. We never see or store full card or UPI credentials. For UPI and bank transfers we record the payment status and reference so we can confirm your order.
• Reviews and wishlist — anything you post as a product review, and the products you save to a wishlist, so you can return to them.
• Account and order notifications — messages we send you about your account, orders, and the status of your delivery.
• Technical and security records — an admin session cookie so a signed-in staff member stays signed in, and an audit trail of staff actions in the admin area. We also keep server logs needed to keep the site running and to investigate abuse.

We do not collect sensitive personal data such as health, biometrics, or government identity documents, and we do not ask for card numbers for any payment we process.

We use your information for the following purposes, and no others:

• To take, confirm, and deliver your order, including sharing your address and phone number with the delivery partner so the parcel reaches you.
• To process and reconcile payment, and to issue a refund if an order is cancelled or returned.
• To create and maintain your account, saved addresses, wishlist, and notifications.
• To answer your questions and resolve complaints about an order or a gemstone.
• To publish a product review that you have submitted, along with the name you display on it.
• To keep the store secure, prevent fraud and abuse, and comply with our legal and tax obligations.

Where the law requires a lawful basis, we rely on performing the contract you enter into when you place an order, our legitimate interest in operating and securing the store, your consent for optional marketing email, and compliance with a legal obligation such as keeping transaction records.

We do not sell or rent your personal data. We share only what is necessary, with these categories of recipients:

• Payment providers for UPI and bank transfers, so a transaction can be verified and refunds can be sent back to your original payment method.
• Delivery and logistics partners, who receive your name, delivery address, and phone number. They are required to handle it only to deliver your parcel.
• Service providers that host the site, deliver email, and provide operational software. They process data on our instructions under a written agreement.
• Authorities, where we are legally required to disclose information, for example tax or law-enforcement requests.

Cash on delivery orders are not shared with any payment provider. If you ask us to delete your account, we remove your personal data except records we must retain to meet tax, accounting, or dispute obligations.

Our store does not use advertising or cross-site tracking cookies. We use a single strictly necessary cookie to keep a signed-in administrator session in the admin area. Because it is required for the site to function, it is not used for profiling and does not need separate consent.

If we ever introduce optional analytics or marketing cookies, we will ask for your consent first and you will be able to change that choice at any time.

• Passwords are stored as salted hashes and are never kept in readable form, including for administrators.
• Payment credentials are handled entirely by the payment provider and never reach our servers.
• Site traffic is served over HTTPS.
• Access to customer data in the admin area is restricted by role and recorded in an audit trail.
• Your data is stored in the database that runs this store. If our hosting or database provider is ever changed, we will tell you before your data moves.

No method of transmission or storage is completely secure. If a breach affects your data and creates a legally notifiable risk, we will notify you and the relevant authority as required.

• Order records are kept for as long as needed to run the order and support you, and then for as long as tax, accounting, or dispute obligations require.
• Account details are kept while your account is active. After you ask us to close it, we remove or anonymise them within a reasonable period, except records we must retain for legal reasons.
• Saved addresses and wishlist are deleted with your account.
• Server and security logs are retained for a short, fixed period and then deleted.

Under Indian law, including the Digital Personal Data Protection Act, 2023, you can ask us to confirm whether we hold your personal data, give you a copy of it, correct anything inaccurate, complete anything incomplete, or erase it. You can also withdraw consent, nominate someone to exercise these rights on your behalf, and complain to a supervisory authority if you are not satisfied with our response.

To make any of these requests, email us and we will:

• acknowledge your request in writing;
• verify your identity so we do not disclose data to the wrong person;
• respond substantively within 30 days, or explain if we need longer and why.

You can withdraw consent at any time by unsubscribing or emailing us, though this does not affect processing we did before the withdrawal. Some information cannot be deleted because we are required to retain it for tax, accounting, or dispute purposes.

Our store is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

We may update this policy as our store or the law changes. The “last updated” date at the top always reflects the current version, and we will tell you about any material change that affects your rights.

Questions, requests, or complaints about privacy can be sent to our grievance officer at [email protected], or by post to MAAGEMSHOUSE, Kolkata, West Bengal, India. We aim to resolve every grievance within 30 days.