Privacy Policy

Effective Date: 9 September 2026 | Last Updated: 23 October 2026

Welcome to Super Stree (“we,” “us,” or “our”). We deeply respect your privacy and are steadfastly committed to protecting your personal data in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023, the Consumer Protection (E-Commerce) Rules, 2020 (as amended), and the Information Technology Act, 2000. This Privacy Policy outlines our transparent practices regarding the collection, processing, storage, protection, and sharing of your personal data when you browse, create an account, or make a purchase on superstree.com.

By visiting our website, creating an account, placing an order, or utilizing our services, you expressly acknowledge and accept the practices described in this Privacy Policy and agree to be bound by our Terms and Conditions.

For a comprehensive understanding of your rights and transactions, please also review our operational policies:

• Terms and Conditions: https://superstree.com/terms-and-conditions/
• Refund, Return & Cancellation Policy: https://superstree.com/refund_return_cancellation_policy/
• Shipping Policy: https://superstree.com/shipping-policy/

1. Information We Collect

To provide you with a seamless and personalized shopping experience, we collect only necessary personal data, including:

• Personal Identification Details: Full name, email address, mobile phone number, billing address, and shipping address provided during registration, checkout, or customer service enquiries.
• Account Information: Username, account preferences, saved addresses, order history, and account communication logs.
• Order and Transaction Details: Products purchased, sizes selected, quantities, order values, transaction status, tax invoices, delivery details, returns, refunds, and cancellations.
• Financial & Payment Information: Payment details required to process your transaction. Sensitive financial credentials (credit/debit card numbers, net banking details, UPI credentials) are processed directly by our PCI-DSS compliant third-party payment partner, PhonePe Payment Gateway (PhonePe PG). Super Stree does not store complete card numbers, CVVs, or UPI PINs on its servers.
• Communication Logs: Customer support enquiries, WhatsApp interactions, telephone calls, emails, feedback, and post-sale communications.
• Technical & Device Information: Internet Protocol (IP) address, browser type and version, device model, operating system, time zone, referring URLs, pages visited, and browsing patterns.
• Cookies and Identifiers: Data collected through functional, analytical, and session cookies described in Section 8 below.
• User-Generated Content: Reviews, testimonials, photographs, and survey responses voluntarily submitted by you.

2. How We Use Your Information

We process personal data strictly for specified, lawful, and legitimate commercial purposes:

• Order Fulfillment: To process transactions, verify payments, generate GST invoices, dispatch orders, and communicate shipping tracking information.
• Customer Care & Grievances: To respond to enquiries, assist with sizing questions, handle returns, process refunds, and redress grievances.
• Account Administration: To create, authenticate, secure, and maintain your customer profile and saved preferences.
• Platform Optimization: To analyze website traffic, diagnose server errors, and improve website responsiveness and user interface design.
• Marketing Communications: To send promotional updates, seasonal offers, and new collection drops where you have provided affirmative consent. You retain the right to unsubscribe at any time.
• Fraud Prevention & Security: To detect, prevent, and mitigate unauthorized transactions, fraudulent payment attempts, automated abuse, and security vulnerabilities.
• Statutory Compliance: To comply with mandatory tax laws (GST), accounting regulations, government reporting, and lawful notices from judicial or law enforcement authorities.

3. Grounds and Purpose of Data Processing

We process personal data in strict compliance with the Digital Personal Data Protection Act, 2023:

• Consent: Where you have granted free, specific, informed, unconditional, and unambiguous affirmative consent for a specified purpose. You may withdraw consent at any time.
• Legitimate Uses / Performance of Contract: Where processing is necessary to fulfill a contract with you (such as processing payment and delivering ordered ethnic wear to your address) or for compliance with legal obligations.

4. Data Minimization

We adhere to the principle of data minimization by collecting only the personal information strictly necessary to operate our store, fulfill orders, process customer support, and meet statutory accounting standards. We do not solicit personal data unrelated to these functions.

5. Data Protection, Security & Breach Protocol

We implement robust technical and organizational measures—including 256-bit Secure Socket Layer (SSL) encryption, firewalls, restricted database access, and multi-factor authentication—to safeguard your data against unauthorized access, loss, or alteration.

Access to personal data is restricted solely to authorized personnel and service providers under strict non-disclosure obligations. In the unlikely event of a personal data breach, we will initiate immediate containment measures and notify the Data Protection Board of India (DPBI) and affected users as mandated by law.

6. Third-Party Sharing and Disclosures

We do not sell, rent, or trade your personal information. Data is shared strictly on a need-to-know basis with trusted partners:

• Payment Gateway (PhonePe PG): Encrypted transaction data is transmitted directly to PhonePe Payment Gateway for payment authorization, fraud screening, and refund processing.
• Logistics Partners (Delivery One & Integrated Couriers): Name, delivery address, phone number, and order contents are shared with Delivery One and assigned national courier partners (e.g., Delhivery, Bluedart) solely to deliver and track your shipment.
• Technology & Infrastructure Providers: Trusted cloud hosting providers, transactional SMS/email gateways, and security firewalls that support our daily operations under strict confidentiality terms.
• Legal Disclosures: Personal information may be disclosed if required by an order of a court of competent jurisdiction, statutory law, or formal police/tax authority investigation.
• Corporate Restructuring: In the event of a merger, acquisition, or sale of business assets, customer data may be transferred subject to continuity under this Privacy Policy.

7. Third-Party Websites and External Links

Our website may contain links to third-party services (such as payment gateways or social media channels). We are not responsible for the independent privacy policies or practices of external websites. We encourage you to review their policies before providing personal information.

8. Use of Cookies and Tracking Technologies

Cookies are small text files stored on your device that enable key e-commerce features:

• Essential & Session Cookies: Necessary to keep items in your shopping cart, maintain user login sessions, and protect checkout security.
• Performance & Analytics Cookies: Help us measure site traffic, popular product categories, and page loading speeds to improve store performance.
• Cookie Control: You can manage or disable cookies via your browser settings. Please note that disabling essential cookies will prevent the cart and checkout from functioning properly.

9. Retention of Personal Data

We retain personal information only for as long as required to fulfill the purposes for which it was collected, including order delivery, handling returns, resolving disputes, and maintaining mandatory tax and GST audit records (typically up to 8 years under Indian financial regulations). Once retention is no longer legally mandated, data is permanently erased or anonymized.

10. Your Statutory Rights under the DPDP Act, 2023

In accordance with the Digital Personal Data Protection Act, 2023 and applicable Indian regulations, you hold the following statutory rights:

• Right to Access: You may request a summary of personal data processed by us, a description of processing activities, and identities of third parties with whom your data was shared.
• Right to Correction & Completion: You may request updating, correction, or completion of inaccurate, outdated, or misleading personal data.
• Right to Erasure: You may request the deletion of your personal data when it is no longer necessary for the purpose it was collected, subject to statutory retention obligations.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time with the same ease with which it was provided by emailing our Grievance Officer. We will cease processing your data within 7 business days.
• Right to Nominate: You have the statutory right under Section 14 of the DPDP Act, 2023 to nominate another individual who shall, in the event of your death or incapacity, exercise your data privacy rights on your behalf.
• Right of Grievance Redressal: You have the right to a readily accessible grievance redressal mechanism regarding personal data handling.
• Right to Approach the Board: If you are not satisfied with the resolution provided by our Grievance Officer, you have the right to file a formal complaint before the Data Protection Board of India (DPBI).

11. Account Deletion

You may request account closure and deletion of your profile by emailing support@superstree.com. Upon verification, your profile will be deactivated, and non-essential data will be deleted within 30 days, retaining only records required by tax, financial, and legal audit rules.

12. Children’s Privacy and Protections

Our website is designed for individuals competent to contract under the Indian Contract Act, 1872. In strict compliance with Section 9 of the Digital Personal Data Protection Act, 2023:

• We do not knowingly collect personal data from individuals under 18 years of age without verifiable parental consent.
• We strictly do not engage in behavioral monitoring, tracking, or targeted advertising directed at children.
• We do not process data in any manner detrimental to the well-being of a child.

If you believe a minor has submitted personal information to our site without parental consent, please alert our Grievance Officer immediately for prompt erasure.

13. Cross-Border Data Processing

Our primary servers and business operations are situated in India. Where trusted cloud infrastructure or service providers process information across borders, such processing is executed in compliance with central government transfer notifications and data protection standards.

14. Public Reviews and User-Generated Content

If you voluntarily post a review, photo, or comment on our product pages or social channels, that content becomes publicly visible. Please avoid including private or sensitive personal information in public reviews.

15. Commercial & Transactional Communications

You may opt out of promotional messages at any time via the unsubscribe link in emails or by notifying us. Essential transactional messages (order confirmations, dispatch updates, invoice PDFs, OTPs, and return updates) are non-promotional and will continue to be sent for order completion.

16. Data Accuracy

Users are responsible for providing authentic, accurate, and complete shipping and contact details. Inaccurate information may result in delivery delays or order cancellations.

17. Prevention of Fraud and Unlawful Activities

We reserve the right to process relevant transaction logs to investigate, prevent, and resolve suspected credit card fraud, unauthorized UPI transfers, bot abuse, payment disputes, or cyber offenses.

18. Grievance Redressal Mechanism & National Consumer Helpline (NCH)

In compliance with Rule 5(2) of the Consumer Protection (E-Commerce) Rules, 2020 (as amended), the Information Technology Act, 2000, and consumer protection guidelines:

• 48-Hour Acknowledgment: Every complaint, privacy request, or grievance received will be acknowledged within 48 (forty-eight) hours of receipt with a unique tracking ticket number and an official copy of the complaint as recorded.
• 30-Day Resolution: The Grievance Officer will investigate and resolve the grievance within 30 (thirty) calendar days (1 month) from the date of receipt.
• National Consumer Helpline (NCH) Convergence: If a consumer grievance is not resolved to your satisfaction within statutory timelines, you may escalate directly through the National Consumer Helpline (NCH) by calling toll-free 1915 or lodging a grievance online at https://consumerhelpline.gov.in/.

19. Governing Law and Jurisdiction

This Privacy Policy and all matters relating to your privacy and personal data shall be governed by and construed in accordance with the laws of the Republic of India. Any legal dispute, claim, or proceeding arising under or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts in Palghar, Maharashtra, India.

20. Policy Updates

Super Stree reserves the right to modify or update this Privacy Policy to reflect evolving legal, regulatory, or technical standards. Updates will be posted on this page with a revised “Last Updated” date. Continued use of our website following any update signifies your acceptance of the revised terms.

21. Statutory Grievance Redressal Officer Contact Details

For any grievances, privacy enquiries, data deletion requests, or rights enforcement under Indian law, please contact our designated Grievance Redressal Officer:

Name of Grievance Officer: Purnima Ravi Sharma
Designation: Grievance Redressal Officer & Founder
Entity: Super Stree
Registered Address: H No 5171, Plot: 9-B, Parmanu Nagar, Boisar-West, Dist: Palghar, Maharashtra, PIN: 401501, India
Direct Email: grievance@superstree.com (or support@superstree.com)
Contact Number: +91 9975654491 (Available Monday to Saturday, 10:00 AM – 6:00 PM IST)
Official Website: https://superstree.com

22. Consent and Affirmation

By using superstree.com, creating an account, or placing an order, you acknowledge that you have read, understood, and agreed to this Privacy Policy. Where express consent is required by law, it is collected via specific check-boxes or affirmative actions prior to data processing.