Privacy Policy

BAGHPAT HOUSE EXPORTS PVT. LTD.

Premium Natural-Fibre & Leather Goods

CIN: U15121DL2024PTC433234 | GSTIN: 06AAMCB7066N1Z2 | Udyam: UDYAM-DL-10-0072319

PRIVACY POLICY

Effective Date: [Insert Date] | Version: 1.0

1. Scope and Data Controller

This Privacy Policy describes how Baghpat House Exports Pvt. Ltd. collects, uses, discloses, and protects your personal information when you visit, use, or make a purchase through www.baghpathouse.com (the “Site”), third-party marketplaces (including Faire.com), or otherwise communicate with us. This policy also covers our use of cookies and similar tracking technologies.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Company Identity: Baghpat House Exports Pvt. Ltd. (CIN: U15121DL2024PTC433234), a Private Limited Company incorporated under the Companies Act, 2013, classified as a Micro Enterprise (Manufacturing) under the MSMED Act, 2006 (Udyam Registration No. UDYAM-DL-10-0072319, NIC Code 15121).

Registered Office: Unit No.-216, City Centre, Plot No. 05, Sector-12, Dwarka Sec-6, South West Delhi, New Delhi, Delhi 110075

Principal Place of Business / Factory: C/O Sushma Rai, Khasra No-508, Basai Village, Gurugram, Haryana 122006

GSTIN: 06AAMCB7066N1Z2 | IEC: AAMCB7066N | PAN: AAMCB7066N

Third-party marketplace terms: Where Baghpat House sells through third-party platforms (e.g. Faire.com), the platform’s own privacy policy may apply in addition to or instead of this policy. In any conflict, the platform’s privacy terms shall prevail for orders placed through that platform.

2. Personal Information We Collect

When we use the term “personal information,” we refer to information that identifies or can reasonably be linked to you. Personal information does not include data that has been de-identified or anonymised. Depending on how you interact with us, we may collect the following categories:

• Contact details: Name, address, billing and shipping address, phone number, email address.

• Financial information: Payment card details, transaction details, and payment confirmation. Payment processing is handled by Shopify Payments; we do not store full card numbers on our systems.

• Account information: Username, password, preferences, and settings.

• Transaction information: Items viewed, added to cart or wishlist, purchased, returned, or cancelled, and past transaction history.

• Communications: Information included in messages you send us, including customer support inquiries.

• Device and usage information: IP address, browser type, device identifiers, operating system, pages visited, referring URLs, and how you navigate the Site. See Section 10 (Cookies) for details.

3. How We Collect Your Information

• Directly from you: When you create an account, place an order, contact us, or provide information through the Site.

• Automatically: Through cookies and similar technologies when you use the Site. Non-essential cookies are only activated with your consent. See Section 10.

• From service providers: Including Shopify (hosting, payments, analytics), shipping carriers, and fulfilment partners who process data on our behalf.

• From third parties: Including marketplace platforms (e.g. Faire.com) and marketing partners.

4. How We Use Your Information

• Fulfilling orders: Processing payments via Shopify Payments, arranging shipping, managing returns and exchanges, and maintaining your account.

• Improving the Site: Understanding how customers use the Site to improve products, navigation, and the shopping experience.

• Communications: Responding to inquiries, sending order updates, and — with your consent — marketing communications. You can opt out of marketing emails at any time using the unsubscribe link in each email.

• Personalisation: Shopify’s enhanced features may use data from your interactions with our store and other Shopify merchants to recommend products and personalise your experience. See Section 5.

• Security and fraud prevention: Detecting and preventing fraudulent or unauthorised activity, authenticating accounts, and securing the Site.

• Legal compliance: Meeting our obligations under applicable law, responding to lawful requests from authorities, and enforcing our terms.

5. How We Share Your Information

We share personal information only in the following circumstances:

• Service providers: Shopify (hosting, payments, analytics), shipping carriers, customer support tools, and cloud storage providers who process data on our behalf.

• Shopify enhanced features: To improve our business, we use certain Shopify features that incorporate data from your interactions with our store, other Shopify merchants, and Shopify itself. In these circumstances, Shopify is an independent data controller. For details, visit the Shopify Consumer Privacy Policy at https://www.shopify.com/legal/privacy.

• Marketing partners: With your consent, we may share data with marketing and advertising partners. Depending on where you reside, you may have the right to direct us not to share your information for targeted advertising. See Section 8 (Your Rights).

• Legal requirements: When required by law, regulation, legal process, or enforceable government request.

• Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate protections for your data.

• At your direction: When you request or consent to disclosure, such as using social media integrations or directing us to ship to a third party.

Baghpat House does not sell personal information in the traditional sense. However, certain data-sharing arrangements with Shopify and marketing partners may constitute “selling” or “sharing” under US state privacy laws (e.g. CCPA/CPRA). You may opt out of such sharing — see Section 8.

6. International Transfers

Your personal information may be transferred to and processed in countries other than where you reside, including India (where Baghpat House is established), Canada (where Shopify is headquartered), and the United States (where certain sub-processors operate).

For transfers out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses or equivalent UK transfer mechanisms, unless the destination country has been granted an adequacy decision. For Indian users, cross-border transfers are subject to any restrictions notified under the Digital Personal Data Protection Act, 2023.

EU Representative: GDPR Article 27 may require appointment of an EU-based representative since Baghpat House is established outside the EU but offers goods to EU consumers. This appointment is pending; this section will be updated with the representative’s details once confirmed. Legal counsel should advise on timing.

7. Data Retention

We retain personal information for as long as necessary to provide our services, maintain your account, comply with legal obligations (including tax and customs records under Indian law), resolve disputes, and enforce our agreements.

When data is no longer needed for any of these purposes, we delete or anonymise it. Under the DPDP Act, personal data must be erased when it is no longer necessary for the purpose for which it was collected or upon withdrawal of consent.

Session cookies are deleted when you close your browser. Persistent cookies expire after their set period or when you delete them manually. See Section 10 for cookie-specific retention.

8. Your Rights

Depending on where you live, you may have some or all of the following rights. These rights are not absolute and may be subject to legal exceptions.

To exercise any of these rights, contact us at support@baghpathouse.com. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights.

For rights related to data processed directly by Shopify, visit the Shopify Privacy Portal at https://privacy.shopify.com/en.

Managing marketing communications: You may opt out of promotional emails at any time using the unsubscribe link. If you opt out, we may still send non-promotional emails (order confirmations, shipping updates, account notifications).

9. Region-Specific Provisions

9.1 European Union and United Kingdom

We process your data under the GDPR (Regulation 2016/679) and UK GDPR. Legal bases include: performance of a contract (order fulfilment), consent (marketing, non-essential cookies), legitimate interest (fraud prevention, site improvement), and legal obligation (tax and regulatory compliance).

EU consumers may lodge a complaint with their local supervisory authority or use the EU Online Dispute Resolution platform at https://ec.europa.eu/consumers/odr. UK consumers may contact the Information Commissioner’s Office (ICO) or use ADR schemes recognised by CTSI.

9.2 India

We comply with the Information Technology Act, 2000 and the Sensitive Personal Data or Information (SPDI) Rules, 2011. The Digital Personal Data Protection Act, 2023 (DPDP Act) was notified on 14 November 2025 with rules taking effect in phases: the Data Protection Board was established immediately; consent manager provisions take effect in November 2026; full substantive compliance obligations (including notice, consent, security safeguards, breach notification, and data principal rights) take effect on 13 May 2027. Baghpat House will align its data processing practices with each phase as it comes into force.

9.3 California (USA)

Under the CCPA/CPRA, California residents have specific rights including the right to know, delete, correct, and opt out of the sale or sharing of personal information. Certain data-sharing arrangements with Shopify and marketing partners may constitute “selling” or “sharing” under these laws. California residents may opt out by contacting us at support@baghpathouse.com.

Global Privacy Control (GPC): Where your browser sends a GPC signal, Baghpat House will treat this as a valid opt-out request under applicable US state privacy laws that recognise GPC.

9.4 All Other Regions

For buyers outside the EU, UK, India, and California, we apply a consent-first approach as our global default. Local consumer protection and data privacy laws of the buyer’s jurisdiction may provide additional or different rights. Nothing in this policy is intended to restrict any mandatory statutory rights.

10. Cookies and Tracking Technologies

This section describes how we use cookies and similar technologies on the Site.

10.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They help the site recognise your browser on return visits.

• First-party cookies: Set by baghpathouse.com directly.

• Third-party cookies: Set by external services (e.g. analytics providers).

• Session cookies: Deleted when you close your browser.

• Persistent cookies: Remain until they expire or you delete them.

This section also covers web beacons (pixel tags), local storage (HTML5), device fingerprinting, and any technology that stores or accesses information on your device.

10.2 Legal Basis for Cookies

EU: Under Article 5(3) of the ePrivacy Directive (2002/58/EC) and the GDPR, prior informed consent is required before placing non-essential cookies. Pre-ticked boxes, implied consent, or continued browsing do not qualify.

UK: Under the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR, the same opt-in model applies.

India: The DPDP Act does not reference cookies specifically, but cookies that collect identifiable personal data fall within its scope. Full consent obligations take effect 13 May 2027; the IT Act, 2000 applies in the interim.

Other regions: We apply consent-first as our global default. Where local law (e.g. CCPA/CPRA, LGPD) adds requirements, those apply.

10.3 Categories of Cookies Used

Only essential cookies are active by default. All other categories require your prior consent.

No advertising or profiling cookies are currently deployed on baghpathouse.com. If this changes, this policy will be updated and your consent sought before any such cookies are placed.

10.4 Managing Cookie Preferences

Cookie consent banner: On your first visit, a banner will appear with three options of equal prominence: Accept All, Reject All, and Manage Preferences (category-by-category control). No non-essential cookies are placed until you make a choice. We do not use pre-ticked boxes, implied consent, or cookie walls.

Consent validity: Cookie consent preferences are retained for 6 months, after which you will be asked again. Preferences are per device and per browser. You can change preferences at any time via the Cookie Settings link in the footer of every page.

Browser settings: You can also manage cookies through your browser:

• Chrome: Settings > Privacy and security > Cookies and other site data

• Edge: Settings > Cookies and site permissions

• Firefox: Options > Privacy & Security > Cookies and Site Data

• Safari: Preferences > Privacy > Manage Website Data

For independent information: www.aboutcookies.org or www.allaboutcookies.org.

Withdrawal of consent: You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Change preferences via Cookie Settings on the Site, clear cookies in your browser, or email info@baghpathouse.com.

10.5 Third-Party Cookies and Data Transfers

Some cookies may be placed by third-party services. These providers operate under their own privacy policies. We do not control third-party cookies. Where third-party cookies transfer personal data outside the EU/EEA or UK, appropriate safeguards (Standard Contractual Clauses or adequacy decisions) are in place under GDPR Chapter V / UK GDPR.

10.6 Do Not Track (DNT) and Global Privacy Control (GPC)

There is no universally accepted standard for DNT signals. Baghpat House does not currently respond to DNT signals but will review this position as standards develop. Where your browser sends a GPC signal, we will treat this as a valid opt-out request under applicable US state privacy laws.

10.7 Consent Records

We maintain records of consent decisions (timestamp, categories accepted/rejected, policy version, pseudonymised IP). These records are retained for 5 years, aligned with the most stringent EU member state guidance. Records will be made available to regulatory authorities upon lawful request.

Implementation note (internal): A Consent Management Platform (CMP) must be implemented on the Shopify site before the cookie consent provisions of this policy go live. The CMP must block all non-essential scripts before consent is obtained. Standard options: Cookiebot, Osano, or Usercentrics.

11. Web Push Notifications

With your explicit consent, you may receive browser push notifications about new collections, launches, and news. A subscription identifier is stored on your device; some data is held on our servers to manage the service. Notifications may be personalised based on site navigation, products viewed or purchased, and account preferences.

Withdraw consent: Adjust notification settings in your browser (Chrome: Settings > Site settings > Notifications; Firefox: Privacy & Security > Notifications; Safari: Preferences > Notifications).

12. Children’s Data

The Site is not intended for use by children under the age of 18. We do not knowingly collect personal information from children. Under the DPDP Act, behavioural monitoring and targeted advertising directed at children is prohibited. Under the GDPR, parental consent is required for children (age threshold varies by member state, typically 13–16).

If you are a parent or guardian and believe your child has provided us with personal information, contact us and we will delete it promptly. As of the effective date of this policy, we do not have actual knowledge that we sell or share personal information of individuals under 16 years of age.

13. Security

We use reasonable technical and organisational measures to protect your personal information, including encryption in transit (TLS/SSL) and secure payment processing through Shopify Payments. However, no method of transmission over the internet is completely secure. We recommend that you do not send sensitive information through unsecured channels and that you keep your account credentials confidential.

14. Third-Party Websites and Links

The Site may contain links to third-party websites and platforms. We are not responsible for the privacy practices or content of those sites. Our inclusion of such links does not imply endorsement of their operators or content. We encourage you to read their privacy policies before providing any personal information.

15. Limitation of Liability

Baghpat House makes reasonable efforts to ensure this policy is accurate and up to date. However:

• Baghpat House is not responsible for the cookie or privacy practices of third-party services whose technologies may be present on the Site.

• Baghpat House is not liable for any loss arising from a user’s failure to manage their cookie preferences via the tools provided.

• This policy does not constitute legal advice. Users with specific data protection concerns should seek independent legal counsel.

• In the event of a conflict between this policy and applicable mandatory law, the mandatory law prevails.

• Baghpat House’s liability for any claim arising from data processing shall not exceed the amount paid by the user for goods purchased from the Site in the 12 months preceding the claim, or INR 10,000, whichever is greater.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the cookies we use, or for legal, operational, or regulatory reasons. The Effective Date at the top indicates the last revision. Material changes will be communicated via a prominent notice on the Site or, where required by law, by seeking your consent again.

17. Dispute Resolution

Governing Law: This policy is governed by the laws of the Republic of India.

Jurisdiction: Subject to mandatory consumer protection and data protection laws that may grant jurisdiction to courts or authorities in the buyer’s country of residence, disputes shall be subject to the exclusive jurisdiction of the courts at Gurugram, Haryana, India.

• EU consumers: May use the European Commission’s Online Dispute Resolution (ODR) platform at https://ec.europa.eu/consumers/odr.

• UK consumers: May contact the ICO or use ADR schemes recognised by CTSI.

• Indian consumers: May file complaints with the Data Protection Board of India or the appropriate Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019.

18. Data Protection / Grievance Officer

In compliance with the Consumer Protection (E-Commerce) Rules, 2020, the Information Technology Act, 2000, and the DPDP Act, 2023, a Data Protection and Grievance Officer has been designated:

Name: Reena Nain (Director, DIN 07201715)

Email: reena@baghpathouse.com

Phone: +91-9999246300

Complaints will be acknowledged within 48 hours and resolved within 30 days.

19. Contact Information

General enquiries: support@baghpathouse.com

Cookie queries: info@baghpathouse.com

Data protection: reena@baghpathouse.com

Address: Baghpat House Exports Pvt. Ltd., C/O Sushma Rai, Khasra No-508, Basai Village, Gurugram, Haryana 122006, India

Website: www.baghpathouse.com

20. Related Policies

• Terms & Conditions

• Returns, Refunds & Exchanges Policy (BH/POL/RRE/2026/01)

• Shipping Policy

21. Revision History

ANNEXURE A — LEGAL COMPLIANCE REFERENCE

This annexure is for internal reference and is not published on the website.