Skip to content

Privacy Policy

What personal data we collect, why we collect it, and the rights you have over it.

This document is a draft

It has not been completed or reviewed by a lawyer, and it contains placeholders. It is not in force. 3 sections still need details from the business.

Effective from [DATE]

1. Who we are

Required by DPDP Act, 2023 s.5 — Identify the Data Fiduciary and give contact details

Majestic Cart is operated by Majestic Cart, [Private Limited / LLP / Proprietorship], registered at Bagdahar Supermarket, Jiaganj, Raichandpur, Lalbag Block, Jiaganj–Fultala Road, Jiaganj, West Bengal 742123. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described in this policy.

Still needed: legal name; entity type; registered address; CIN

2. What we collect

Required by DPDP Act, 2023 s.5(1) — Itemised notice of the personal data collected

We collect only what the platform needs to operate:

  • Account details: your name, mobile number, and email address if you give one.
  • Delivery details: the name, address and phone number you enter for an order.
  • Payment proof: the UTR and the screenshot you upload when you recharge your wallet. The screenshot is stored so our team can verify the payment against our bank statement.
  • Payout details: your UPI ID or bank account, used only to send withdrawals. These are encrypted at rest.
  • Order and wallet history, which we are required to retain for tax and audit purposes.
  • Sponsor relationship: who introduced you, and who you introduce. This is what your income is calculated from, so it cannot be deleted while your account is active.
  • Technical data: IP address, device identifier and browser details, used for security and fraud detection.

Still needed: confirm whether analytics or advertising cookies are used, and list them

3. Why we collect it

Required by DPDP Act, 2023 s.4 and s.6 — State the specified purpose and the lawful basis for each use

We use your data to run your account, process and deliver your orders, verify payments, calculate and pay commission, meet tax and accounting obligations, and detect fraud.

We do not sell your personal data. We do not use it for advertising by third parties.

Still needed: confirm no third-party advertising or data sharing before publishing this

4. Who we share it with

Delivery partners receive the name, address and phone number needed to deliver your order, and nothing else.

Our payment and hosting providers process data on our instructions under written agreements.

Members of your upline can see your name, member ID and the business volume you generate. They cannot see your address, contact details, payment information or wallet balances.

We disclose data to government authorities only where the law requires it.

Still needed: list every processor by name, with their location

5. How long we keep it

Account and transaction records are retained for eight years after your last transaction, to meet Income Tax and GST record-keeping requirements.

Payment screenshots are retained for [PERIOD] after verification and then deleted.

If you close your account, we delete what we are not legally required to keep.

Still needed: confirm retention periods with your accountant; set the screenshot retention period

6. Your rights

Required by DPDP Act, 2023 ss.11-14 — Publish the rights of the Data Principal and how to exercise them

Under the Digital Personal Data Protection Act, 2023 you have the right to:

  • ask what personal data of yours we hold and how we use it
  • have inaccurate or incomplete data corrected
  • have data erased where we are not required by law to keep it
  • nominate someone to exercise these rights if you die or become incapacitated
  • complain to us, and then to the Data Protection Board of India if you are not satisfied

Still needed: set up the process for handling these requests, and the response time you commit to

7. How we protect it

Passwords are stored using argon2id hashing and are never readable by us or by our staff. Payout bank details are encrypted at rest. Administrative access requires two-factor authentication, and every administrative action affecting money is logged with the user who performed it.

No system is perfectly secure. If a breach affects your data we will notify you and the Data Protection Board as the law requires.

8. Children

Required by DPDP Act, 2023 s.9 — Verifiable parental consent for users under 18; no tracking or targeted advertising to children

This platform is not intended for anyone under 18. You must be 18 or older to register as a member. We do not knowingly collect data from children, and we do not carry out behavioural tracking or targeted advertising directed at children.

9. Contacting us about your data

Required by DPDP Act, 2023 s.13 and IT Rules, 2021 r.3(2) — Publish a named grievance contact

Write to Bijoy Saha, Grievance Officer, at grievance@majesticcart.in. We acknowledge within 24 hours and aim to resolve within 15 days.

Still needed: appoint a named grievance officer; confirm the resolution timeline you can actually meet

Questions about this policy

Write to Bijoy Saha, Grievance Officer, at grievance@majesticcart.in. We acknowledge every complaint within 48 hours.