Privacy & Data Protection

1. Overview & Commitment to Transparency

SpaceWa ("we", "us", or "our") values your trust and is dedicated to preserving your digital privacy. This Privacy Policy details the types of personal data we collect through our website, why we require that data, and the strict technical safeguards we maintain under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 of India.

2. Information We Collect

We gather only the minimum information essential to process furniture orders and communicate delivery progress:

• Contact & Identity Data: Full name, telephone/mobile number, email address, and billing address.
• Delivery Fulfillment Data: Shipping street address, landmark, city, state, and 6-digit Indian postal pincode.
• Technical & Session Data: IP address, device browser type, time of access, and session tokens utilized strictly for shopping cart maintenance and CSRF security validation.
• Customer Inquiries: Communications submitted via our Contact Concierge form, email inquiries, or WhatsApp messages.

3. How We Use Your Information

Personal information provided to SpaceWa is utilized strictly for legitimate commercial and fulfillment objectives:

• Fulfilling and packing your furniture orders at our workshop facility.
• Booking doorstep courier delivery through authorized logistics partners (e.g. Delhivery, BlueDart, DTDC).
• Transmitting real-time automated order confirmations, AWB tracking links, and dispatch notifications via SMS and email.
• Generating official GST tax invoices in compliance with Indian commercial and taxation laws.
• Preventing fraudulent transactions and mitigating automated bot abuse through session rate limiting.

4. Third-Party Disclosures & Data Sharing

We do not sell, rent, monetize, or trade your personal data to advertising brokers or marketing agencies. Data is disclosed only to verified third-party service providers directly responsible for order execution:

• Logistics Couriers: Your recipient name, shipping address, and contact number are shared strictly with our freight partners solely to facilitate delivery.
• Payment Gateways: Order value and transaction references are exchanged with Razorpay to verify payment authorizations and initiate refunds.
• Statutory Authorities: Information may be shared where strictly mandated by law, court order, or governmental tax audits under Indian jurisdiction.

5. Cookies & Local Session Technologies

Our website utilizes minimal, functional cookies necessary for e-commerce operations:

• Session Cookie (spacewa_sess): Maintains items in your shopping cart as you navigate between pages. Expires when you close your browser.
• CSRF Security Token: Prevents Cross-Site Request Forgery attacks on checkout and inquiry forms.

We do not employ intrusive cross-site tracking cookies or invasive third-party ad retargeting pixels.

6. Data Security & Storage Architecture

We adhere to industry-standard technical security practices to prevent unauthorized data access, leakage, or modification:

• All web traffic between your browser and our servers is secured via HTTPS with TLS 1.3 encryption.
• Database queries are executed exclusively through PDO prepared statements, neutralizing SQL injection vulnerabilities.
• Customer passwords are protected with strong cryptographic hashing algorithms (BCrypt, cost factor 12).

7. Your Rights Under Indian Data Regulations

As an Indian data principal, you hold the legal right to:

• Access & Review: Request a digital copy of the personal information stored in your account.
• Rectification: Request correction of outdated telephone numbers or address records.
• Erasure & Deletion: Request account closure and erasure of personal data, subject to statutory record-retention requirements under Indian GST and tax legislation.

8. Statutory Grievance Redressal Officer

In accordance with the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020, the designated Grievance Redressal Officer for SpaceWa is: