Privacy Policy | The Krishna's Collection

The Krishna's Collection collects only what it needs to sell you a garment and get it to you. This policy says what that is, why we have it, how long we keep it, and what you can ask us to do with it. We are the data fiduciary for this data under the Digital Personal Data Protection Act 2023.

What we collect, and why

Your name and mobile number — to identify your order, to send you the one-time code that signs you in, and to tell you where your parcel is. Without these we cannot sell to you at a distance.
Your mobile number at our shop's counter, if you give it — so that your bill reaches you on WhatsApp and we know your visits. Whether you also want offers on WhatsApp is asked separately: the box stays unticked unless you say yes, and your answer is recorded when the bill is saved, with the name of the person who asked you and the time.
Your delivery address — to deliver, and because a tax invoice above fifty thousand rupees must carry the buyer's address and state by law (GST rule 46).
Your email address, if you give it — to send your invoice and order updates.
Your birthday and wedding anniversary, if you give them — only to send you a wish on the day, and only if you have agreed to offers.
What you bought — to service returns and exchanges, to keep the accounts and GST records the law requires, and to know your size the next time you shop.
Your PAN, or a signed Form 97 (formerly Form 60) — only on a sale above two lakh rupees, because rule 159 of the Income-tax Rules 2026 (formerly rule 114B) requires it.
Payment information — handled by our payment gateway. We receive only whether the payment succeeded and a reference number. We never see or store your card number, UPI PIN or password.
A UPI payment through Razorpay — when you pay at our counter by a UPI QR that confirms itself, or pay money you owe us by such a QR or a payment link we send you, Razorpay tells us the payment arrived, with the bank's reference number and, where it gives one, the UPI ID you paid from.
A UPI payment to our own QR code — when you pay at our counter, or pay money you owe us, by UPI to our own PhonePe, Paytm, BharatPe or other QR code, we may match your payment to your bill from that provider's statement: its time, amount and reference number, and your name or the UPI ID you paid from where the statement shows them. We keep your name and UPI ID from the statement for 90 days from when we match it, then remove them; the time, amount and reference stay with our accounts.
What you write to us on WhatsApp, if you do — the message itself, and any picture, voice note or file you send with it, so that whoever answers can see what you asked and what has already been said. Pictures and files are kept privately, for our staff who answer messages. An ordinary photo is kept with its camera details, including the place it was taken, removed; a HEIC or GIF picture is kept exactly as it came and never goes on our website. We put a picture you sent on our website only with your agreement. We see only what you send to us; nothing else on your phone, and none of your other chats.
Photos you add to a review or a return request — to show us the piece. Before a photo is kept, it is turned the right way up and its camera details, including the place it was taken, are removed.
How you use the website — we count visits, product pages seen, items added to a bag and checkouts, and which of our ads or links brought a visit, without a cookie and without anything that tells one visitor from another; these counts are kept for 90 days. When you place an order, the order notes which of our ads or links brought you, so that we know which ones work. These counts are never sent to Google, Meta or any other service; we may show the totals to whoever runs our advertising, and the totals say nothing about you.
What helps us suggest your size — the sizes you kept, exchanged or sent back, and, only if you agree, the measurements we took of you at our shop. What you type into “What's my size?” on our website is not kept; we keep only that a size was suggested.
Your child's first name, and birth month if you give it, when you ask us to remind you that your child may need the next size — with your agreement as their parent or guardian. We use it for that reminder only, write only to you, and remove it when you stop the reminders or your child turns 18.
Your family members, if you shop for them with us — each one's name and relation to you and, if you give them, gender, date of birth and a note, kept as part of your record. A child's details are kept only with your recorded consent as their parent or guardian.
Money you pay ahead — a receipt voucher, and a refund voucher if the money is paid back, carry your name and mobile number, and your address and GSTIN where GST law asks for them; we keep the payment's reference, such as a UPI reference or a card's last four digits.

Our lawful basis

For everything needed to complete the sale you asked for, we rely on that purpose itself — you gave us the data for it.
For marketing messages — offers, a festival offer, a birthday or anniversary wish, a note when we have not seen you for a while — we rely on your consent, which we ask for separately and which you may withdraw at any time without affecting your ability to shop with us. They go only between 9 am and 9 pm. Reply STOP to any of them and they stop at once.
For messages about something you bought, owe or asked for — your bill, a reminder of money due on a credit bill (at most three for the same dues), a request to review a purchase, word that a piece you asked us about is back — we rely on that purchase or that request. Reply STOP and we send no more review requests or back-in-stock messages, and no more reminders about those dues.
For size advice from your measurements and next-size reminders about your child, we rely on your consent. Withdraw it at any time on your account page, or reply STOP to a reminder.
For a child's details, we rely on the recorded consent of their parent or guardian. Each consent is for one purpose — size advice or next-size reminders — and is never used for another. When you give it on this website, you also confirm that you are 18 or older and the child's parent or guardian. You can withdraw it at any time on your account page or by telling us, and the child's details for that purpose are then removed.
For books of account, GST returns and tax records, we rely on the law that requires us to keep them.

Who else sees it

Our courier — your name, address and phone number, so the parcel arrives.
Our payment gateway, Razorpay — to take your payment securely, on this website and when you pay by a UPI QR or a payment link from us.
Our messaging provider — your mobile number, to send the one-time code, your bill and order updates over SMS or WhatsApp, and to bring us the messages and pictures you send.
VASAH, the software our shop and this website run on (support@vasah.app) — it hosts our records and this website for us, as a data processor, and keeps our records and their backups in India. Its staff see your data only while we have switched on time-limited support access to fix a problem, and it uses your data for nothing of its own.
Our accountant and the tax authorities — the invoice, as the law requires.
We do not sell your data, rent it, or hand it to anyone for their own advertising.

How long we keep it

Invoices, credit notes and stock records: eight years from the end of the financial year, as the GST and Income-tax Acts require.
Your account and contact details: while you shop with us, and for three years after your last order, when your name, number and address are erased automatically. Ask us sooner and we do it sooner.
Marketing consent and its withdrawal: as long as we hold your contact details, so we can prove what you agreed to.
WhatsApp messages between you and us, with any picture or file you sent: six months at the most, after which they are erased and only the fact that we spoke remains.
Your name or UPI ID as our UPI provider's statement shows it: 90 days from when we match the statement.
One-time codes and login sessions: days, not months.
A link we send you to an order or an invoice: it opens for 180 days, then stops working. After that, find the order again on the Track your order page or under My orders, or ask us for the invoice.
Your family members' details: while you shop with us. They are erased with your other details, or sooner if you ask, and a child's as soon as the parent withdraws consent.

What you can ask us to do

See what we hold about you, and who we have shared it with.
Correct anything wrong or out of date.
Erase your personal details, where no law requires us to keep them — we then remove your name, number, address and email from our records, delete our WhatsApp conversation with you and the pictures and files you sent in it, remove any picture of yours from our website, and keep only what the law demands: the financial entries, which no longer carry your mobile number, and, for one year from each WhatsApp message between us, the record that it passed and when, without its words, as the DPDP Rules ask of every business. A tax invoice keeps your name and address only where GST law requires them on it — a bill of fifty thousand rupees or more, or one made out to your GSTIN (GST rule 46) — and a PAN recorded on a sale above two lakh rupees stays on that invoice, as the income-tax rules require. The same erasure removes your family members. A receipt or refund voucher for money you paid ahead keeps your name and address only where GST law requires them, and never your mobile number.
Withdraw consent to marketing, at any time. Reply STOP to a message, or write to us.
Nominate someone to exercise these rights if you die or cannot act.
Complain to us first, through our Grievance Officer, and to the Data Protection Board of India if we do not put it right.

You can do the first four yourself when signed in — correct your details under Account → About you; see, erase or withdraw under Account → Your data — or by writing to us at the address below. We answer within 7 days.

Children

We do not knowingly sell to anyone under 18. We keep a child's details only as part of a parent's or guardian's record, and only with that parent's recorded consent, given for one purpose — the first name for the next-size reminders a parent asks for. A parent who gives it on this website also confirms that they are 18 or older.

We never treat a child as a customer of their own, never write to a child, and never use a child's details for offers. The parent can withdraw consent at any time — on the account page of this website, or by telling us — and the child's details for that purpose are then removed. If you believe a child's details have reached us any other way, tell us and we will erase them.

Keeping it safe

Data is held in India on managed database servers, encrypted in transit and at rest, and reachable only by named staff accounts with the access their work needs. Backups are encrypted with our own key, and so is any off-site copy of them. Payments run over the gateway's own secure channel. If a breach ever affects your data we will tell you and the Data Protection Board, as the Act requires.

Cookies

We use only what the website needs to remember your bag and keep you signed in. Our Cookie Notice explains each one.

Who to write to

Krishna Patoliya, Grievance Officer
Phone: +91 97258 95808
Email: admin@tkcwestern.com
Shop # 104, Siddheshwari Plaza, Opp. Uma Complex, Kamrej Gam Road, Kamrej, Surat, 394180

This policy was last revised on 26 October 2026. We will post any change on this page.