Privacy Policy & Data Protection

1. Introduction & Overview

Welcome to CGS 360 CART, an enterprise-grade multi-tenant ecommerce platform owned and operated by CGS 360 Family (“we”, “our”, or “us”). This Privacy Policy explains our commitment to transparency, security, and your data rights when you visit our website (cart.cgs360.in), create a merchant store, or purchase items through a storefront hosted on our platform.

By accessing or using our platform, you acknowledge and agree to the data collection and processing practices described in this policy. If you do not agree with this policy, please refrain from using our services.

2. Information We Collect

We collect information in two main capacities: as a Data Controller for our direct merchants and visitors, and as a Data Processor on behalf of merchants whose end customers place orders through storefronts.

A. Information Collected from Merchants (Store Owners)

• Account Credentials: Full name, email address, password hash, store business name, phone number, and store slug URL.
• Billing & Gateway Settings: Razorpay API Key ID and Key Secret (stored encrypted), GSTIN, billing address, and subscription plan choices.
• Storefront Configuration: Brand logos, custom CSS/styling tokens, product catalogs, SKU details, pricing, discount codes, and uploaded media assets.

B. Information Collected from Shoppers / End Consumers

• Order & Contact Details: Full name, shipping address, billing address, phone number, and email address for order delivery and AWB tracking alerts.
• Transaction Data: Order IDs, purchased SKUs, payment mode (UPI, Card, NetBanking, COD), payment status, and automated GST invoice records. (Note: Sensitive card numbers and CVV codes are never stored on CGS 360 servers; they are tokenized directly via PCI-DSS compliant Razorpay gateways).
• Session & Telemetry Data: IP address, device type, browser user-agent, edge response time, and shopping cart items.

3. Purpose & Legal Basis for Data Processing

In compliance with the Digital Personal Data Protection (DPDP) Act 2023 and applicable Indian IT laws, we process personal data exclusively for specified, legitimate business purposes:

4. Data Retention, Security & Tenant Isolation

We enforce multi-tenant database partitioning. Every merchant's data (products, orders, customers, transactions) is strictly isolated using Firestore Security Rules and server-side tenant authentication checks.

• 256-Bit TLS Encryption: All data in transit between customer devices, edge servers, and databases is secured using automated TLS certificates.
• Encryption at Rest: Database records, media uploads, and secrets are encrypted with AES-256 cloud encryption.
• Retention Timelines: Order financial records and tax invoices are retained for the statutory 8-year requirement under Indian GST and taxation regulations. Abandoned cart and telemetry data are automatically purged after 90 days.

5. Third-Party Service Providers & Sub-Processors

We collaborate with industry-leading sub-processors to deliver high-performance platform services:

• Google Cloud & Firebase: Cloud computing, serverless container hosting (Cloud Run), and global edge CDN.
• Razorpay: PCI-DSS Level 1 compliant payment gateway, UPI intent processing, and settlement ledger.
• Courier Partners (BlueDart, Delhivery, Shiprocket): Shipment dispatch and live AWB tracking alerts.

6. Your Rights Under DPDP Act 2023

As a data principal in India, you hold the following statutory rights regarding your personal information:

• Right to Access: You may request a copy of all personal data held about you or your store.
• Right to Correction & Erasure: You can update inaccurate data or request deletion of non-statutory records.
• Right to Grievance Redressal: Direct escalation to our designated Grievance Officer within statutory response deadlines (within 30 days).

7. Grievance Officer & Contact Locations

If you have any questions, concerns, or requests regarding this Privacy Policy or your data rights, please reach out to our Grievance Officer: