Effective Date: September 27, 2026 | Last Updated: September 27, 2026

Welcome to KS Poshak Vrindavan ("we," "our," or "us"). We handcraft devotional dresses, laddu gopal poshaks, and sacred temple embellishments with devotional reverence. We are deeply committed to protecting the privacy, dignity, and autonomy of our devotees, patrons, and visitors.

This Privacy Policy outlines our transparent data practices in strict adherence to:

• India's Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and the Information Technology Act, 2000.
• The European Union General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR) and the UK Data Protection Act 2018.
• Global Privacy Control (GPC) and Do Not Track (DNT) browser standards.

1. Data Fiduciary & Controller Identity

The Data Fiduciary (Data Controller) responsible for your personal data is:

2. Categories of Personal Data We Process

We believe in strict data minimization ("collect only what is necessary for devotional seva"):

1. Devotee Inquiry & Custom Sizing Data: When you submit an inquiry through our contact forms, product inquiries, or bespoke poshak designer block, we collect your name, email address, WhatsApp/phone number, deity measurements, and custom embroidery requests.
2. Security & Essential Session Data: Cryptographic CSRF tokens (XSRF-TOKEN) and stateless session identifiers (ksposhak_session) to protect you against malicious cross-site scripting and bot forgery.
3. First-Party Performance Telemetry (Opt-in Only): Pseudonymous visitor ID (ks_vid) and session ID (ks_sid) tracking Core Web Vitals (LCP, CLS, INP) and scroll depth to optimize sacred image loading speeds. IP addresses are cryptographically hashed using SHA-256 with a secret salt and never stored in plain text.

3. Lawful Basis for Processing

• Under GDPR (Art. 6): (a) Consent for optional analytics telemetry and form communications; (b) Legitimate Interest for site security, fraud prevention, and session integrity; (c) Contractual steps prior to custom bespoke poshak preparation.
• Under DPDP Act 2023 (Sec. 4 & 6): Free, specific, informed, unconditional, and unambiguous consent granted by the Data Principal via explicit consent checkboxes.

4. Absolute Prohibition on Data Selling & Ad Tracking

We do NOT sell, lease, rent, or trade your personal data to any third party. We do not deploy third-party advertising tracking pixels (such as Meta Pixel or Google Ads Remarketing). All performance metrics are processed first-party on our own secure infrastructure.

5. Cookie & Storage Governance

6. Your Statutory Rights (GDPR & DPDP Act 2023)

Every devotee and visitor holds inviolable statutory rights over their personal data:

• Right to Access & Summary: Request an accessible summary of personal data held about you.
• Right to Correction & Erasure ("Right to be Forgotten"): Request the rectification of incorrect details or complete erasure of your inquiry history.
• Right to Withdraw Consent: Revoke consent anytime through the floating "Privacy & Cookies" button on this website.
• Right of Grievance Redressal: Dedicated officer responds to any privacy inquiry within 24 hours.
• Right to Nominate (DPDP Act Sec. 14): The right to nominate an individual who shall exercise your rights in the event of death or incapacity.
• Right to Lodge a Complaint: You may submit complaints to the Data Protection Board of India or your local European Supervisory Authority.

7. Grievance Redressal Officer Contact

In accordance with Section 6(1) of the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the IT (Intermediary Guidelines) Rules, 2021: