Privacy policy

What personal data we collect

Information you give us

• Account details: your name, email address, and your mobile number if you provide one. Your password is stored only as a one-way hash — never the password itself.
• Order details: billing address, shipping address, the contents of your order, and your contact details for that order.
• Customisation content: for personalised products, the text, images or design files you upload — used to produce and fulfil your order, and to reprint it if you request a valid replacement.
• Customer support communications you send us.

Collected automatically

• Technical and usage data: IP address, device and browser information, and how you use the site — via cookies and similar technologies (see our Cookie policy).
• Authentication and cart cookies that keep you signed in and preserve your cart.

Payment information

Card, UPI and similar payment credentials are collected and processed by our payment gateway, Razorpay, on their systems. We do not receive or store your full card number, CVV or UPI PIN. We do receive limited transaction information (such as a payment reference, status, amount and method type) needed to confirm your order and handle refunds or disputes.

Why we use your data

• to create and manage your account;
• to process, produce, pack and deliver your orders (including customised items);
• to take payment and process refunds through our payment gateway;
• to arrange delivery through our logistics partners;
• to provide customer support and handle returns, replacements and complaints;
• to prevent, detect and investigate fraud, abuse and security incidents;
• to meet legal, tax and accounting obligations (for example, retaining GST invoices);
• to operate, maintain and improve the Website, including analytics.

Most messages we send are service communications about your account and orders. With your consent, we may also send you marketing emails about new products, offers and updates; you can opt out of these at any time using the unsubscribe link in the email or by contacting us. We do not send marketing SMS or WhatsApp messages, and we do not sell your personal data.

Consent and your choices

We process your data either with your consent or for the recognised legitimate uses under the DPDP Act. Order fulfilment, payment, delivery, support, fraud prevention and legal/tax compliance are necessary to provide the service you asked for and to meet our legal obligations. Non-essential analytics cookies are used based on your consent, which you can change at any time through your cookie or browser settings — see the Cookie policy. Where processing is based on consent, you can withdraw it at any time; withdrawal does not affect processing already carried out.

Who we share your data with

We are the business responsible for your data. We use trusted service providers who process personal data on our behalf, under contract and only for the purposes we set. We do not sell your data.

• Razorpay — payment and limited order/contact information, to take payment and process refunds and disputes.
• Shadowfax and other logistics partners — recipient name, delivery address, phone number and parcel details, to deliver your order.
• Amazon Web Services (AWS) — hosting and storage, including uploaded design files and order records.
• Zoho — to send transactional (order/account) emails.
• Google Analytics — website usage data, subject to your cookie choices.
• Tax, accounting, legal and government authorities — where required by law.

These providers may use your data only to perform their services for us and are required to protect it with appropriate safeguards.

How long we keep your data

• Account data: while your account is active, and for a reasonable period afterwards to handle disputes and legal claims.
• Order, invoice and tax records: retained for the period required under GST and other applicable laws.
• Uploaded design files: kept while needed to fulfil and reprint your order, and for a limited period afterwards to support replacements and disputes, then deleted or anonymised.
• Support communications: kept for a reasonable period to handle follow-ups.

When a retention period ends and no law requires us to keep the data, we delete or irreversibly anonymise it.

How we protect your data

We maintain reasonable security safeguards appropriate to the risk. Data moving between your browser and our servers is encrypted using HTTPS/TLS. Passwords are stored only as one-way hashes. Payment data is handled by Razorpay, a PCI-DSS-compliant gateway, and we do not store full card or UPI credentials. Administrative access is restricted to authorised staff on a least-privilege, role-based basis, and we log access and maintain a process to respond to security incidents. No method of transmission or storage is completely secure, but we work to protect your data and keep our safeguards under review.

Data breaches

If a personal data breach occurs, we will act to contain and remediate it, and we will notify affected users and the Data Protection Board of India where and in the manner required by the DPDP Act and the rules made under it.

Your rights

Subject to the DPDP Act and the rules made under it, you can:

• ask for a summary of the personal data we hold about you and how we process it;
• ask us to correct, complete or update inaccurate data;
• ask us to erase your data where it is no longer needed and no law requires us to keep it;
• withdraw consent you previously gave;
• nominate another person to exercise your rights in the event of death or incapacity;
• raise a grievance with our Grievance Officer, and, if unsatisfied, with the Data Protection Board of India.

To exercise any right, email us from the address on your account (see “Grievance officer”). We will verify your identity before acting. Some data cannot be deleted where we are legally required to keep it (for example, tax invoices) or where it is needed to complete an order still in progress.

Children

The Website is intended for users aged 18 and over. Under the DPDP Act, processing a child’s personal data generally requires verifiable consent of a parent or lawful guardian, and we do not knowingly collect a child’s data without it. If you believe a child has given us personal data, contact our Grievance Officer and we will remove it.

International transfers

We serve customers in India and process orders for delivery within India. Some of our service providers (for example, hosting, payment, email or analytics) may process or store data on servers outside India. Where that happens, we require appropriate contractual and security safeguards, and such transfers are made in accordance with the DPDP Act.

Grievance officer

Under India’s IT Act rules and the DPDP Act, you may contact our Grievance Officer with any complaint about how we handle your data:

• Suvojit Chatterjee, Designated Partner, NN Eterncraft LLP
• Email: grievance@nomadnation.in
• Address: Garalgacha, Dankuni, Hooghly, West Bengal – 712311
• General support: support@nomadnation.in · +919674707842

We aim to acknowledge complaints promptly and resolve them within the timelines required by applicable law. If you are not satisfied, you may escalate to the Data Protection Board of India.

Changes to this policy

We may update this Policy as our practices or the law change. We will revise the “Last updated” date and, for material changes, take additional steps to inform you where required.

Contact

Questions about this policy: support@nomadnation.in. See also our Terms & Conditions and Refund & Returns policy.