MAALGOODY

Privacy Policy

This Privacy Policy explains what personal data we collect when you visit or shop at www.maalgoody.com, why we collect it, how we use, store and protect it, who we share it with, and the rights you have over your own data.

Effective Date: 14 September 2026 · Last Reviewed: 14 September 2026

1. Introduction

MAALGOODY ("MAALGOODY", "we", "us" or "our") operates the website www.maalgoody.com and its associated Handicraft, Origin Store and Fashion verticals (together, the "Platform").

We are committed to handling your personal data lawfully, fairly and transparently, in line with applicable Indian law — principally the Information Technology Act, 2000 and the rules made under it, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, and the Consumer Protection (E-Commerce) Rules, 2020 — and, where applicable, international frameworks such as the EU/UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

By accessing or using the Platform, placing an order, creating an account or otherwise interacting with us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please discontinue use of the Platform.

2. Key Definitions

Personal Data means any data about an individual who is identifiable by or in relation to such data.
Sensitive Personal Data or Information (SPDI) has the meaning given under Rule 3 of the SPDI Rules, 2011, and includes passwords; financial information such as bank account, credit/debit card or other payment-instrument details; physical, physiological and mental health condition; sexual orientation; medical records and history; and biometric information.
Data Fiduciary means the entity that determines the purpose and means of processing personal data — in this context, MAALGOODY.
Data Principal means the individual to whom the personal data relates — in this context, you, our customer or website visitor.
Processing means any operation performed on personal data, including collection, storage, use, disclosure and deletion.
Platform means the website www.maalgoody.com, together with any associated mobile-optimised site, checkout system or customer-service channel operated by MAALGOODY.

3. Scope of This Policy

This Policy applies to personal data collected through www.maalgoody.com — including browsing, account creation, checkout, customer support, newsletter subscriptions and promotional entries.

This Policy does not apply to orders placed through third-party marketplaces where MAALGOODY products are also listed, such as Amazon, Flipkart and Meesho. Those transactions are governed by the respective marketplace's own privacy policy, since the marketplace collects your data at checkout in that context.

This Policy applies to visitors and customers located in India and, because MAALGOODY ships internationally, to customers located outside India, including in the European Union, the United Kingdom and the United States. Section 11 sets out the additional rights available to visitors from those regions.

4. Information We Collect

4.1 Information You Provide Directly

Identity and contact details: name, email address, phone number, shipping address and billing address, provided when you create an account, place an order or contact customer service.
Order details: products purchased, order value, size/fit or styling preferences (for Fashion products), gift-hamper personalisation notes (for Origin Store gifting orders) and delivery instructions.
Payment information: we do not store your full card, UPI or net-banking credentials on our own servers. Payment details are collected and processed directly by our third-party payment gateway partner(s) under their own PCI-DSS-compliant systems.
Communications: messages you send us via contact forms, email, WhatsApp or social media, and any information you include in product reviews or feedback.
Account credentials: your chosen password, stored in encrypted (hashed) form, never in plain text.

4.2 Information Collected Automatically

Device and browser information: IP address, browser type, operating system, device identifiers and language settings.
Usage data: pages viewed, time spent on the Platform, referring/exit pages, click patterns and cart/wishlist activity, collected via cookies and similar technologies (see Section 7).
Approximate location: derived from your IP address, used to show accurate shipping estimates and currency where relevant.

4.3 Information From Third Parties

Payment confirmation status from our payment gateway partner(s), so we can process and fulfil your order.
Delivery status updates from our logistics and courier partners.
If you choose to log in or interact with us via a third-party service (for example, Google or Facebook login, where offered), basic profile information such as your name and email address, as permitted by that service and by you.

5. How We Use Your Information

To process, confirm, pack, ship and deliver your orders, and to communicate with you about their status.
To create and manage your account, including order history and saved addresses.
To respond to customer service enquiries, complaints, returns and refund requests.
To send transactional communications such as order confirmations, shipping updates and payment receipts.
To send marketing communications about new arrivals, offers and festive collections — only where you have opted in, and always with an easy way to opt out (see Section 13).
To personalise your experience on the Platform, such as showing relevant categories or recommendations based on past orders.
To detect, investigate and prevent fraud, unauthorised transactions and misuse of the Platform.
To comply with legal obligations, including those under tax, consumer-protection and food-safety (FSSAI) law.
To maintain and improve the Platform's functionality, security and performance through aggregated and, where possible, anonymised usage analysis.

6. Legal Basis for Processing

6.1 Under Indian Law

Under the Digital Personal Data Protection Act, 2023, we process your personal data on the basis of your consent (for example, when you create an account, subscribe to marketing or complete a purchase) or, where permitted, for certain "legitimate uses" recognised under the Act — such as processing necessary to fulfil your order or to respond to a request you have voluntarily made.

6.2 For Visitors in the European Union / EEA / United Kingdom

Where the GDPR applies to you, we rely on one or more of the following legal bases: your consent; the necessity of processing to perform our contract with you (fulfilling your order); our legitimate interests (such as fraud prevention and improving the Platform), balanced against your rights; and compliance with a legal obligation.

6.3 For Visitors in California, United States

The CCPA/CPRA requires us to disclose the categories of data collected and the business or commercial purposes for collection, both of which are set out in Sections 4 and 5 above.

7. Cookies & Tracking Technologies

In the interest of transparency, we apply the same cookie disclosure standard to every visitor, regardless of location.

7.1 Types of Cookies We Use

Strictly necessary cookies: required for core functions such as keeping items in your cart and keeping you logged in. These cannot be switched off.
Performance/analytics cookies: help us understand how visitors use the Platform so we can improve it (for example, via tools such as Google Analytics).
Functional cookies: remember your preferences, such as language or recently viewed products.
Targeting/advertising cookies: used, where enabled, to show you relevant MAALGOODY advertisements on other websites and social platforms.

7.2 Managing Cookies

You can control or delete cookies through your browser settings at any time. Please note that disabling strictly necessary cookies may affect core functions such as checkout.

8. How We Share Your Information

We do not sell your personal data. We share it only in the following circumstances:

Payment gateway partners: to process your payment securely.
Logistics and courier partners: to deliver your order to you.
IT infrastructure and cloud hosting providers: to store and run the Platform securely.
Marketing and analytics service providers: only where you have consented to marketing, or on an aggregated/anonymised basis for analytics.
Prakash Natural & Organic and other sourcing/fulfilment partners: solely to the extent necessary to prepare and fulfil Origin Store food orders under our shared FSSAI compliance obligations.
Government authorities or regulators: where required by applicable law, court order or a valid legal request.
A successor entity: in the event of a merger, acquisition or sale of business assets, subject to that entity honouring the commitments in this Policy.

9. Data Storage, Security & Retention

9.1 Security Measures

SSL/TLS encryption for data transmitted between your browser and our servers.
Encrypted (hashed) storage of account passwords.
Access to personal data restricted to employees and partners who need it to perform their role.
Payment processing handled by PCI-DSS-compliant third-party gateways, so we never store your full card details.

While we follow reasonable security practices and procedures as required under the IT Act, 2000 and the SPDI Rules, 2011, no method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security.

9.2 Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy — including order history for accounting and warranty purposes, and any period required under applicable tax, consumer-protection or food-safety record-keeping laws. If you delete your account, we will delete or anonymise your personal data except where retention is required by law.

10. Cross-Border Data Transfers

Because MAALGOODY ships internationally and may use cloud infrastructure or service providers located outside India, your personal data may be transferred to, and processed in, countries other than your own.

Under Section 16 of the Digital Personal Data Protection Act, 2023, personal data may generally be transferred outside India except to countries specifically restricted by the Central Government by notification.

Where we transfer personal data of EU/EEA/UK visitors outside those regions, we take steps to ensure an appropriate level of protection, such as relying on standard contractual clauses with our service providers where applicable.

11. Your Privacy Rights

11.1 Rights for Users in India (DPDP Act, 2023)

Right to access information about how your personal data is being processed.
Right to correction and updating of inaccurate or incomplete personal data.
Right to erasure of personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements.
Right to grievance redressal (see Section 16).
Right to nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

11.2 Additional Rights for EU / EEA / UK Visitors (GDPR)

Right of access, rectification, erasure ("right to be forgotten") and restriction of processing.
Right to data portability, in a structured, commonly used, machine-readable format.
Right to object to processing based on legitimate interests or for direct marketing.
Right to lodge a complaint with your local data protection supervisory authority.

11.3 Additional Rights for California, U.S. Visitors (CCPA/CPRA)

Right to know what personal information is collected, used, shared or sold.
Right to delete personal information, subject to certain exceptions.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information — MAALGOODY does not sell personal information.
Right to non-discrimination for exercising any of the above rights.

11.4 How to Exercise Your Rights

You may exercise any of the above rights by writing to us at info@maalgoody.com with the subject line "Privacy Rights Request". We will verify your identity before acting on your request and will respond within the timeline required by applicable law (generally within 30 days, or sooner where Indian law prescribes a shorter period).

12. Children's Privacy

The Platform is intended for use by individuals who are 18 years of age or older, or who have reached the age of majority in their jurisdiction. We do not knowingly collect personal data from children.

Under Section 9 of the Digital Personal Data Protection Act, 2023, verifiable consent from a parent or lawful guardian is required before a child's personal data is processed. If you believe we have inadvertently collected personal data from a child, please contact us at info@maalgoody.com so that we can delete it promptly.

13. Marketing Communications

We will only send you marketing emails, SMS or WhatsApp messages if you have opted in — for example, by subscribing to our newsletter or ticking a consent box at checkout. Consent for marketing is collected separately from, and is not a condition of, completing your purchase, in line with the Consumer Protection (E-Commerce) Rules, 2020.

You may opt out at any time by clicking the "unsubscribe" link in any marketing email, replying "STOP" to SMS/WhatsApp messages, or writing to info@maalgoody.com. You will continue to receive essential transactional messages about any order you place.

14. Third-Party Links & Marketplace Sales

The Platform may contain links to third-party websites, including social media pages. We are not responsible for the privacy practices of those sites, and we encourage you to review their privacy policies independently.

If you purchase MAALGOODY products through Amazon, Flipkart or Meesho, your data for that transaction is collected and controlled by that marketplace under its own privacy policy, not this one.

15. Data Breach Notification

In the event of a personal data breach, we will act in line with the Digital Personal Data Protection Rules, 2025. Where required, we will notify the Data Protection Board of India without undue delay, with a detailed report within 72 hours of becoming aware of the breach (or such longer period as the Board may permit). We will also notify affected individuals without delay, describing the nature of the breach, its likely consequences and the steps we have taken or propose to take.

16. Grievance Redressal

In compliance with Rule 5(9) of the SPDI Rules, 2011 and Rule 4 of the Consumer Protection (E-Commerce) Rules, 2020, we have appointed a Grievance Officer to address any complaints or concerns relating to your personal data or your experience on the Platform.

Name	[Grievance Officer Name]
Designation	[Designation]
Address	Plot 425, Kothwan Murgiachak, Kothawan Road, Khagaul, Patna – 801105, Bihar, India
Email	info@maalgoody.com
Phone	+91 94314 98067

Our Grievance Officer will acknowledge your complaint within 48 hours and will work to resolve it within one month from the date of receipt.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services or applicable law. Material changes will be notified through a prominent notice on the Platform or by email, and the "Last Reviewed" date at the top of this Policy will be updated accordingly.

18. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India. Subject to applicable consumer-protection provisions that may allow you to approach a forum closer to your own location, any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Patna, Bihar, India.