1.1 Information You Provide Directly

• Account & Order Data: Name, email address, mobile number, shipping address, PIN code, and state when you place an order.
• Player Details: Player names, jersey numbers, sizes, and sleeve preferences entered manually or via CSV upload.
• Team Information: Club/team name, logo files, and custom design preferences.
• GST Details (optional): GSTIN, registered business name, and business address if you opt for a B2B GST invoice.
• Payment Information: We do not store card numbers or bank details. Payments are processed securely by Razorpay. We receive only transaction confirmation and payment reference IDs.

1.2 Information Collected Automatically

• Device & Browser Data: IP address, browser type, operating system, screen resolution.
• Usage Data: Pages visited, time spent, clicks, referral URLs, and navigation path.
• Location Data: Approximate geographic location derived from IP address (used only for shipping eligibility checks).
• Cookies: Session cookies, preference cookies, and analytics cookies. See Section 5 for details.

1.3 Information from Third Parties

• Shipping status updates from Shiprocket (courier tracking data).
• Payment confirmation from Razorpay.
• Analytics data from Google Analytics (anonymised).

We do not sell, rent, or trade your personal information to any third party. We share data only with trusted partners who process it on our behalf:

We may also disclose your information if required by law, court order, or governmental authority under applicable Indian law.

4.1 Why We Collect GST Data

As a GST-registered business (GSTIN: 07AABCU9603R1ZX), we are legally required under the Goods and Services Tax Act, 2017 to maintain records of all taxable supplies. This includes:

• Customer name and address for every invoice.
• GSTIN of business customers (B2B transactions).
• Tax amount (CGST + SGST for intra-state; IGST for inter-state supplies).
• HSN/SAC code: SAC 9988 (manufacturing services on physical inputs owned by others — custom jersey printing).

4.2 GST Record Retention

GST records, including invoices and customer information, are retained for a minimum of 8 years from the date of the relevant annual return, as mandated by Section 36 of the CGST Act, 2017. This data is retained regardless of your deletion request.

You can manage or disable cookies through your browser settings. Disabling essential cookies may affect your ability to complete orders.

We implement appropriate technical and organisational security measures to protect your personal data:

• HTTPS / TLS 1.3 encryption for all data transmitted between your browser and our servers.
• Razorpay PCI-DSS compliance for all payment data — we never see or store raw card data.
• Access controls: Only authorised personnel with a legitimate need can access customer data.
• Regular security audits and vulnerability assessments.
• Data is stored on servers located in India.

In the unlikely event of a data breach that affects your rights and freedoms, we will notify you within 72 hours of becoming aware of it, in accordance with the DPDP Act, 2023.

The Digital Personal Data Protection Act, 2023 grants you the following rights as a Data Principal:

• Right of Access: Request a summary of your personal data we process.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data (subject to legal retention obligations, e.g. GST records).
• Right to Grievance Redressal: File a complaint with our Grievance Officer (details in Section 12).
• Right to Withdraw Consent: Withdraw consent for marketing communications at any time.
• Right to Nominate: Nominate another individual to exercise your rights in case of death or incapacity.

To exercise any right, email us at privacy@cricketdress.com with the subject "Data Rights Request". We will respond within 30 days.

Our website may contain links to third-party websites (e.g. Razorpay payment gateway, Shiprocket tracking portal). We are not responsible for the privacy practices of these websites. We encourage you to read their privacy policies before providing any personal information.

Third-party services we use and their privacy policies:

• Razorpay Privacy Policy
• Shiprocket Privacy Policy
• Google Privacy Policy
• Meta Privacy Policy

Our services are intended for users who are 18 years of age or older. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided personal data to us, please contact us immediately at privacy@cricketdress.com and we will delete such data promptly.

Player names and numbers submitted as part of team jersey orders may include minors. This data is collected solely for the purpose of jersey customisation, used only for production, and deleted 90 days after order fulfilment.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send an email notification to registered customers (where required by law).
• Display a prominent notice on our website for 30 days after material changes.

Your continued use of our website after any changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

As required under the DPDP Act, 2023, we have appointed a Grievance Officer to handle data-related complaints:

If you are not satisfied with our response, you may approach the Data Protection Board of India once established under the DPDP Act, 2023.