Cave Art Studios Private Limited ("we", "us", "our" or "Company"), incorporated under the Companies Act, 2013, with its registered office at No. 442 Poonamallee High Road, Maduravoyal, Chennai – 600 095, owns and operates
https://www.caveart.store/ (the "Platform").
This Privacy Policy explains how we collect, use, store, disclose, protect, and process personal data when you access, browse, register on, place an order through, or otherwise interact with the Platform. By using the Platform, you agree to the practices described here. This Policy forms an integral part of our Terms of Use.
We collect only the data necessary to provide, operate, improve, and secure the Platform.
Information You Provide
Account / Checkout Details: Full name, email address, mobile number, billing address, shipping address
Order-Related Information: Payment details (processed securely by the payment gateway), order preferences, special instructions
Communications: Any information voluntarily submitted when contacting us — support queries, grievances, returns, or other communications
Automatically Collected Information
When you interact with the Platform, we may automatically collect limited usage data necessary for providing and improving the shopping experience, such as:
🛍️ Products Viewed / Added to Cart🔍 Items Searched For🖱️ Session Actions
This data is processed only to maintain your shopping cart, process and fulfil orders, prevent fraud, and analyse general shopping patterns.
✅The Platform does not collect device model, OS version, unique device identifiers, or IP addresses intentionally. No device/usage information beyond what is strictly necessary for basic functionality and security is collected.
No Sensitive Personal Data
🛡️We do not collect or process sensitive personal data such as biometric information, health data, racial or ethnic origin, religious beliefs, or any data that could infer emotional states or medical conditions.
We use personal data only for the following legitimate purposes:
Processing and fulfilling orders — including payment authorisation, shipping, and delivery
Managing your account and providing customer support
Communicating regarding orders, returns, refunds, promotions, and service updates
Improving the Platform, analysing usage trends, and preventing fraud
Complying with legal obligations, responding to lawful requests, and protecting our rights
Sending transactional emails/SMS — order confirmations, shipping updates, etc.
✅We do not use your personal data for targeted advertising, behavioural profiling, or selling data to third parties for marketing purposes.
Under the Digital Personal Data Protection Act, 2023, our processing is based on:
Performance of Contract
To fulfil orders and provide services
Legitimate Interests
Fraud prevention, platform improvement, security
Consent
Where required, e.g. marketing communications
Legal / Compliance
Obligations under applicable Indian laws
⚠️You may withdraw consent at any time where processing is consent-based, but this may affect your ability to use certain features or complete orders.
🔒We do not sell, rent, or trade your personal data.
We may share data only in the following limited cases:
With trusted service providers for cloud hosting, analytics, and crash-reporting tools who are contractually bound to protect your data and process it only on our instructions
With payment processors or logistics partners, only if required for product delivery or refunds
When required by law, court order, or government authority
In the event of a merger, acquisition, or sale of assets — with notice where required
📍We do not transfer your personal data outside India. All personal data is stored and processed exclusively on servers within India. Any future transfer, if necessary, will only occur with adequate protection measures and full compliance with Section 16 of the DPDP Act, 2023.
We value your privacy and treat all collected personal data with the highest level of confidentiality. Access to your data is strictly limited to authorized personnel who are bound by contractual confidentiality obligations and required to process it solely for the purposes outlined in this Privacy Policy.
We share your personal data only with trusted service providers who assist us in operating the Website, and only to the extent necessary for that purpose. We do not sell your personal information to third parties for marketing or any other commercial use. All such parties are required to maintain appropriate confidentiality and security measures.
📌Our confidentiality obligations continue even after the termination of your use of the Website or our relationship with you.
We retain personal data only as long as necessary for the purpose for which it was collected or as required by law.
Order & Account Data
Duration of customer relationship + reasonable period for returns, refunds, disputes & legal obligations
Processing Logs & Security Records
Minimum 1 year from date of processing (DPDP Rules, 2025)
Marketing Communications
Until consent is withdrawn
🗑️After the retention period, data is securely deleted or anonymised unless longer retention is required by law.
Under the Digital Personal Data Protection Act, 2023, you — as the data principal — have the following rights in relation to your personal data processed by us:
👁️
Right to Access
Obtain confirmation of whether we process your personal data and request a summary or copy of it
✏️
Right to Correction
Request rectification or updating of inaccurate, incomplete, or outdated personal data
🗑️
Right to Erasure
Request deletion of your personal data when no longer necessary, consent is withdrawn, or processing is unlawful
👤
Right to Nomination
Nominate individuals who can exercise your rights in case of death or incapacity
📣
Right to Grievance Redressal
Raise concerns or complaints about our personal data processing activities
🔄
Right to Withdraw Consent
Withdraw consent at any time for consent-based processing (see Clause 8)
ℹ️To exercise any of these rights, contact our Grievance Officer / Data Protection Officer (see Clause 16). We will verify your identity and respond within timelines prescribed under the DPDP Act. No charge applies for exercising these rights, except in cases of manifestly unfounded or excessive requests as permitted by law.
You may withdraw your consent for any consent-based processing of your personal data at any time, with the ease of withdrawal comparable to how the consent was originally provided. To withdraw your consent, contact our Grievance Officer (mentioned in Clause 16) with your request.
Upon receiving your request, we will cease the relevant processing within a reasonable period, unless the processing is required under another lawful basis — without affecting any processing already carried out prior to the withdrawal.
⚠️Withdrawal of consent may affect your ability to access certain features or services available on the Website. Any such consequences shall be borne by you.
The Platform is intended for selling toys and educational products for children. If the Platform is accessed or used by an individual under 18 years of age, such use is deemed to occur under the active supervision and with verifiable consent of a parent or legal guardian who has accepted our Terms of Use and this Privacy Policy on their behalf.
🛡️We do not knowingly collect personal data from children under 18 without verifiable parental or legal guardian consent. If we become aware that such data has been collected without consent, we will promptly delete it.
The Platform may contain links to, integrate with, or rely on third-party websites, services, payment gateways, logistics partners, or other external platforms (collectively, "Third-Party Services"). We do not own, control, operate, or endorse any Third-Party Services, and we are not responsible or liable for:
The availability, accuracy, completeness, reliability, or legality of any Third-Party Services
The content, products, services, privacy practices, security measures, or data handling of any Third-Party Services
Any loss, damage, claim, or expense arising from your use of or interaction with any Third-Party Services
Any transactions, payments, deliveries, or disputes involving Third-Party Services
⚠️Your use of any Third-Party Services is at your own risk and governed solely by the terms and privacy policies of those third parties. We recommend carefully reviewing those policies before providing any personal information. Nothing in these Terms creates any partnership, joint venture, or agency between the Company and any third-party provider.
To the maximum extent permitted under applicable Indian law — including the DPDP Act 2023, the IT Act 2000, and the Consumer Protection Act 2019 — the Company shall not be liable for any indirect, incidental, special, consequential, punitive, or exemplary damages arising from or in connection with:
Your access to, use of, or inability to use the Website or our services
Any unauthorised access, use, disclosure, alteration, or destruction of your personal data, except where directly caused by our gross negligence or wilful misconduct
Any interruption, suspension, or cessation of transmission to or from the Website
Any bugs, viruses, or malware transmitted through the Website by third parties
Any errors or omissions in content or any loss arising from use of content available via the Website
📌Our total aggregate liability for all claims shall not exceed the total amount paid by you to us in the 12 months immediately preceding the event giving rise to the claim, except for liabilities or penalties arising under applicable laws including the DPDP Act, 2023.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The revised version will be posted on the Platform with an updated "Last Updated" date.
🔔Significant changes will be notified via prominent notice on the Platform or via email where appropriate. Continued use of the Platform after such changes constitutes acceptance of the updated Policy.
This Privacy Policy is governed exclusively by the laws of India.
Governing Jurisdiction
Laws of India
Courts
Chennai, Tamil Nadu, India
Any dispute arising out of or in connection with this Privacy Policy shall first be resolved through arbitration under the Arbitration and Conciliation Act, 1996.
Arbitrator
Sole arbitrator mutually appointed, or three arbitrators if no agreement within 30 days
Seat of Arbitration
Chennai, Tamil Nadu
Award
Final and binding on all parties
💬We encourage amicable resolution. Please contact our Grievance Officer (Clause 16) first for any issues before initiating formal proceedings.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Data Protection Board of India without undue delay — and, where feasible, within 72 hours of becoming aware of the breach, as required under the DPDP Act, 2023.
The notification will include:
Nature of Breach
Full description of what occurred
Affected Data Principals
Categories and approximate number affected
Likely Consequences
Assessment of impact on your rights and freedoms
Measures Taken
Steps taken or proposed to address and mitigate
🔔If the breach poses a high risk, we will also provide specific recommendations on steps to protect yourself.
In accordance with the Digital Personal Data Protection Act, 2023, we have appointed a Data Protection Officer and a Grievance Officer to address user queries, complaints, and grievances relating to our services, including issues concerning personal data.
⏱️We will acknowledge and resolve grievances within the timelines prescribed under the DPDP Act, 2023 and the Information Technology Act, 2000. You may also write to us at the address above.
Acknowledgement: By using the Platform, you acknowledge that you have read, understood, and agree to this Privacy Policy.
Thank you for choosing Cave Art Store.
Last Updated: _____, 2026
