Privacy Policy
Effective date: [EFFECTIVE DATE]
This Privacy Policy explains how Dnyanesh Khanderao Mhatre, sole proprietor trading as Natali Enterprise, operating Natali Art Hub at 244, Ganesh Smriti, Dr Ambedkar Road, Parel, Mumbai, Maharashtra 400012, India, handles personal information through our website, orders and enquiries. Privacy contact: [PRIVACY CONTACT].
Information we collect and why
When you place an order or enquire, we collect the information needed to respond and fulfil the request, such as your name, email, phone number, billing and delivery address, items ordered and correspondence. Business orders may include company details and GSTIN. If you create an account, we process account identifiers and authentication information to provide account access.
We process payment status and transaction references and may receive payment instrument information made available by our payment provider. Payment details are handled through [PAYMENT PROVIDER]. We do not ask you to send full card credentials, OTPs or UPI PINs through an enquiry form.
The website may generate technical records needed for operation and security, including IP address, browser or device information, timestamps and activity logs. The Cookie Notice identifies any optional analytics or advertising tools actually enabled. If an artist or class-listing feature is used, we also process the profile, content and enquiry information you choose to submit.
Purposes and choices
We use information to process orders, issue invoices, arrange delivery and returns, operate accounts, answer enquiries, handle complaints, prevent fraud, secure the website and meet legal obligations. Optional promotional messages and non-essential tracking are handled according to your choices and applicable law. We do not treat an enquiry or purchase as permission for every form of marketing.
You may decline optional information or withdraw optional consent. This does not prevent ordinary shopping where that information is unnecessary. If you withhold information essential to a specific service, such as a delivery address for shipping, we may be unable to provide that service and will explain why.
Recipients and service providers
We share information needed for the relevant task with payment providers, courier and logistics partners, hosting and website support providers, order or customer-management providers, and professional advisers where appropriate. We may disclose information where required by law or reasonably needed to handle fraud, disputes or legal claims. Actual providers and their roles: [PRIVACY VENDOR LIST OR LINK TO APPROVED RECIPIENT TABLE].
If you ask to contact a listed artist or class provider, we share the enquiry details with that identified recipient and retain an administrative copy, as explained before submission. We do not publish your private phone or email in an artist profile without your specific choice. Any optional advertising data sharing must be described and separately configured; it must not be concealed in this policy.
Storage and security
We use reasonable technical and organisational measures appropriate to the information and risks, including controlled access and secure transmission where applicable. No system can guarantee absolute security. If an incident occurs, we will take steps to contain it and provide notifications required by the law then in force.
Our systems and service providers process information in [COUNTRIES OR APPROVED LOCATION DESCRIPTION]. Where information is transferred outside India, we will follow applicable transfer restrictions and safeguards.
Retention access and deletion
We retain order and invoice information for applicable tax, accounting and legal periods; complaint records while needed to resolve and defend claims; and account or optional marketing information only while justified by the service, your choices or law. Published retention schedule: [RETENTION PERIODS OR LINK]. We delete or anonymise information when it is no longer required, subject to lawful retention and backup controls.
You may contact [PRIVACY CONTACT] to ask about your information, request access or correction, seek deletion where permitted, withdraw optional consent or raise a privacy grievance. We may verify identity proportionately. We will explain any lawful reason why a request cannot be fully met. Additional statutory rights will be implemented as the relevant provisions come into force.
The purchasing service is intended for adults. Parents or guardians should place orders for children. We do not invite children to create shopping accounts or submit public profiles. If we learn of a child’s information collected without the safeguards applicable at that time, we will investigate and take appropriate action. Any future child-facing feature requires a separate design and consent review.
We may update this Policy when our practices or the law change. We will show the effective date and give additional notice or obtain fresh consent where required. External websites have their own practices; linking to them does not make us responsible for their data processing.