Privacy policy

Lekhraj Corp Private Limited (“Cottonworld”, “the Company”, “we”, “us”) takes the privacy of its users very seriously and are committed to protecting the same. Below is an outline of the practices and policies (“Privacy Policy”) in relation to the collection, use and disclosure of the information provided by Users when visiting and/or registering themselves on the Cottonworld Website www.cottonworld.net (“the Website”). Additionally, it will also provide the User with information on how to control the disclosure of data as also the manner in which this information is protected.

By visiting and/or using and/or accessing and/or registering themselves at the Website, the User agrees to the practices and policies contained in this Privacy Policy (as may be amended from time to time). Additionally, it is assumed and in any event the User is deemed to have agreed and acknowledged that he/she/it has acquainted himself/herself/itself and is satisfied with this Privacy Policy, as also the Terms and Conditions, the abridged Terms and Conditions and the Disclaimer (“Agreement”) and consents to be bound by the same, including in respect of the collection and/or use and/or disclosure of the information provided in the manner and subject to the restriction as set out herein. Accordingly, any objection that the User may have shall be deemed to have been waived and/or abandoned.

For the purposes of this Privacy Policy, the terms “User” shall mean any natural or legal person who has visited and/or registered himself/herself/itself on the Website. Capitalized terms that are not defined in this Privacy Policy have the meaning assigned to them in the Terms and Conditions.

This Privacy Policy contains certain provisions that are applicable specifically to Users located in India and other provisions that are applicable to Users who are located outside of India. It also contains provisions that apply specifically to Users who are located in the European Union and whose data is protected by the General Data Protection Regulation (“GDPR”), the Digital Data Protection Act, 2023 (“DPDP Act”) and the exceptions thereto.

Any queries you may have in relation to and/or arising out of this Privacy Policy may be directed to Cottonworld at hrcottonworld@gmail.com.

This Privacy Policy does not apply to information collected through any other third party website and/or to the practices of any third party corporation and/or organization and/or association that Cottonworld does not directly and/or indirectly own and/or control, and/or to individuals that Cottonworld does not directly and/or indirectly employ or manage. Illustratively, in the event that the Website provides a link that redirects the User to another website, this Privacy Policy will have no application to the information collected on such other website. The Website may include external and/or third-party links, including advertisements and it is the responsibility of the User and the User will be deemed to have acquainted himself/herself/itself with the privacy policies and terms and conditions of such third-party websites; Cottonworld does not in any manner whatsoever vouch for and/or in any manner be held responsible for the information set out therein.

1. Personal Data We Collect

By “personal data” we mean any data about you from which you can be identified.

“Data Principal” is you – the individual the data relates to.

“Data Processor” is a third party that processes personal data on the Company’s our instructions. We collect only the personal data we need for the purposes set out in Clause 2. Depending on how you use Cottonworld, this may include:

A. Information you voluntarily provide to us

1.1. Identity and contact details: name, email address, phone number;

1.2. Order details: shipping and billing address, items purchased, order history, returns and exchanges;

1.3. Payment information: processed securely by our payment gateway. We do not store your full card number or CVV.

1.4. Account information: login credentials and saved preferences, if you create an account.

1.5. Communications: messages, queries and feedback you send us, including chat and email support.

B. Information collected automatically when you interact with Cottonworld

1.6. Technical and usage data: IP address, device and browser type, and pages viewed, collected through cookies and similar technologies (including Google Tag Manager) as described in Clause 4.

1.7. Server log data: standard server log information, bandwidth and connection details.

1.8. While you are not required to provide any personal data to browse CottonWorld, certain features (such as placing an order or creating an account) will require the information listed above. If you choose not to provide it, we may be unable to deliver those services.

2. Why We Use Your Personal Data?

2.1. We process the data above to carry out and deliver your orders, take payment, provide returns/refunds, manage your account, respond to your queries, keep Cottonworld secure, prevent fraud, and meet our legal and tax obligations. This processing is necessary to give you the goods you have purchased and service you have requested, in a seamless manner.

2.2. Only with your separate consent:

2.2.1. Marketing: sending you promotional emails, SMS or WhatsApp about new arrivals and offers. You opt in separately and can opt out at any time.

2.2.2. Analytics and personalisation: non-essential cookies that help us understand usage and tailor what you see.

2.3. Purpose limitation. We ask for consent separately from the terms of purchase, so you can say yes to a purchase without having to agree to marketing. We will not use your personal data for a new purpose that is incompatible with the ones above without telling you and, where required, obtaining your consent.

2.4. Specific uses by data type:

(a) Email address – order confirmations, delivery updates, account notifications and, with your consent, promotional communications.

(b) Phone number – delivery coordination by our courier partners and, with your consent, promotional SMS/WhatsApp.

(c) Correspondence – stored for our records and to improve customer support.

(d) Payment information – processed solely by our third-party payment gateway for completing your transaction.

2.5. Legal and regulatory compliance. We may also use your personal data to comply with applicable legal and regulatory obligations, including requests from law enforcement authorities and to establish or defend legal claims.

3. Our Legal Basis for Processing

3.1. We process your personal data either with your consent under Section 6 of the Digital Personal Data Protection Act,2023 (the “Act”) or for a “legitimate use” under Section 7 of the Act, mainly where you have voluntarily given us your data for a specified purpose, such as for completing a purchase. The specific grounds we rely on are:

(a) Order fulfilment and account management - a legitimate use under Section 7 of the Act, as you have voluntarily provided us your personal data for the specified purpose of completing a purchase or creating an account;

(b) Statutory and regulatory compliance - a legitimate use under Section 7(c) of the Act, including compliance with obligations under the Income Tax Act, 1961, GST law, and any applicable court order or direction of a competent authority;

(c) Fraud prevention and platform security - a legitimate use under Section 7(a) of the Act, being reasonably necessary to the purpose for which data was provided; and

(d) Marketing communications — processing on the basis of your explicit consent under Section 6 of the Act, which you may withdraw at any time.

4. Cookies and Tracking

4.1. When you first visit the Cottonworld website, you will be able to view a cookie consent banner on the home page. The toggles for essential cookies that are needed to run the site and to update your cart are always on.

4.2. The toggles for non-essential cookies (analytics, marketing) are not pre-set – you may accept or reject them as per your discretion. You can change your choices at any time through “Manage Preferences”.

4.3. You can also block or delete cookies in your browser, though some features may not function for example - your shopping cart may not retain items between sessions, you may be unable to stay logged in to your account, saved preferences such as your shipping address may not be remembered, and the checkout flow may not work correctly, amongst others.

5. Who We Share Your Personal Data With.

We do not sell your personal data. We share it only with the following categories of recipients, and only to a limited extent as may be required:

5.1. Platform and hosting: Shopify, which hosts Cottonworld and stores order and account data.

5.2. Payment gateways: to process your payments securely.

5.3. Logistics and courier partners: to deliver your orders and manage returns.

5.4. Analytics and marketing tools: such as Google, used through Google Tag Manager (subject to your cookie consent).

5.5. GoKwik (GoExcelsior Technologies Private Limited), which facilitates checkout optimisation on our platform, and processes order and payment data on our instructions.

5.6. Advisors and authorities: professional advisors, and law enforcement or government bodies where we are legally required to disclose by applicable law, or pursuant to any court order or direction of a competent authority.

5.7. Each processor acts on our instructions under a written contract and may use your data only to perform the service for us.

5.8. If our business is merged, acquired or reorganised, your data may transfer to the successor entity, which will remain bound by this Policy.

6. Transfer Outside India

6.1. Some of our service providers (for example, Shopify, etc.) may store or process your personal data on servers located outside India.

6.2. Where this happens, the transfer is made in accordance with Section 16 of the Act, and we do not transfer personal data to any country that the Central Government restricts by notification.

7. How Long We Keep Your Data

7.1. We keep your personal data only for as long as it is needed for the purposes in this Policy, or for as long as the law requires By way of illustration:

(a) Order and transaction records - retained for 8 years from the date of the transaction, in accordance with the Companies Act, 2013 and applicable GST law;

(b) Tax and accounting records - retained for 8 years from the end of the relevant financial year, as required under Section 128 of the Companies Act, 2013 and Section 36 of the CGST Act, 2017;

(c) Account data - retained for as long as your account is active, and for a reasonable period thereafter in the event of disputes or legal claims;

(d) Marketing data - retained until you withdraw consent or opt out, whichever is earlier.

7.2. When the purpose is met, or if you withdraw consent and we have no other lawful reason to keep it, we erase or anonymise your personal data.

7.3. Certain technical logs are retained for a minimum period of one year as may be required by the applicable law such as :

(a) Consent logs - records of consent given, modified, or withdrawn by Data Principals, including the timestamp and purpose for which consent was obtained;

(b) Access and processing logs - records of who within the organisation (or among processors) accessed personal data, and for what purpose;

(c) Security and incident logs - records of access attempts, anomalies, and any personal data breach events, to enable investigation and compliance with breach notification obligations.

8. Security and Data Breaches

8.1. We use reasonable technical and organisational safeguards including encryption in transit, access controls and secure hosting to protect your personal data.

8.2. No system is completely secure, but if a personal data breach occurs, we will promptly notify the Data Protection Board of India and you as an affected Data Principals in accordance with Section 8(6) of the Act read with Rule 7 of the Digital Personal Data Protection Rules, 2025. Such notification will be made as soon as possible upon becoming aware of the breach, and will include:

(a) a description of the nature of the breach and the personal data affected;

(b) the likely consequences of the breach; and

(c) the measures taken or proposed to be taken to address the breach and mitigate its effects.

8.3. Notification to you will be made in clear and plain language, through the contact details you have provided to us.

9. Your Rights

As a Data Principal under the Act, you have the right of:

9.1. Access – obtain a summary of the personal data we hold about you and how we process it.

9.2. Correction and erasure – correct, complete, update or delete your personal data.

9.3. Grievance redressal – a readily available way to raise complaints with us (see Clause 13).

9.4. Nomination – nominate another person to exercise your rights in the event of your death or incapacity.

9.5. To exercise any of these rights, contact our Grievance Officer using the details in Clause 13. You can also manage your data by logging into your account.

10. Withdrawing Your Consent

10.1. You may withdraw your consent at any time.

10.2. You can unsubscribe using the link in any marketing message, promotional email, change your cookie choices under “Manage Preferences”, or write to our Grievance Officer.

10.3. Withdrawing consent does not affect processing already carried out, and we will stop the relevant processing within a reasonable time. Some features that depend on that data may no longer be available for example, you may no longer receive personalised product recommendations, promotional offers, or updates on new arrivals, and your browsing experience on the Website may no longer be tailored to your preferences.

11. Children’s Data

11.1. CottonWorld is intended for adults. We do not knowingly process the personal data of anyone under 18 without the verifiable consent of a parent or lawful guardian.

11.2. We do not carry out tracking, behavioural monitoring or targeted advertising directed at children.

11.3. If you believe a child has provided us personal data without such consent, please contact us on our registered email ID or the phone number provided on our website so that we may forthwith take necessary action to delete such data.

12. Links to External Websites

12.1. CottonWorld may contain links to third-party websites over which we have no direct control. These links do not imply endorsement.

12.2. We are not responsible for the privacy practices of external websites, and your use of them is subject to their own privacy policies.

13. Contact and Grievance Redressal

If you have any question about this Policy or wish to exercise your rights, please contact our Grievance Officer / Data Protection Officer:

Name: Sonal Mohite

Email: hrcottonworld@gmail.com

Address: Lekhraj Corp Private Limited, Gala-F, Sidhwa Estate, Old BMP Building, N.A. Sawant Marg, Colaba, Mumbai - 400001, Maharashtra, India.

We will acknowledge and respond to your request within the timelines required by law.If your complaint is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India.

14. This Privacy Policy is published in English.

15. Changes to This Policy:

15.1. This Privacy Policy is subject to change from time to time, including to reflect changes in applicable law, regulatory requirements, our practices, technologies and/or the manner in which we process personal data.

15.2. In particular, the DPDP Act and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) are being brought into force in a phased manner. While certain provisions of the DPDP Act and DPDP Rules are presently in force, the remaining provisions are scheduled to come into force at a later date, including provisions scheduled to take effect in May, 2027. Accordingly, this Privacy Policy may be further updated from time to time to reflect the provisions of the DPDP Act and the DPDP Rules as and when they become applicable to us.

15.3. While we shall endeavour to keep this Privacy Policy updated and aligned with applicable law at all times, there may be a delay between any change in applicable law or its coming into force and the corresponding update to this Privacy Policy. To the extent permitted by applicable law, Cottonworld shall not be liable for any such delay, and the User shall not hold Cottonworld liable solely on account of such delay.

15.4. Users are responsible for periodically reviewing this Privacy Policy for any changes or updates. Any changes to this Privacy Policy shall be effective upon being posted on the Website, unless otherwise specified, and the User shall be bound by the Privacy Policy as modified from time to time.

This Privacy Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

****