Penju Mart – Privacy Policy

Last Updated: 10 September 2025

PenjuMart (“we,” “our,” or “us”) respects your privacy and is committed to protecting your personal data. This Privacy Policy sets forth the manner in which we collect, use, store, disclose, and protect the information provided by users (“you” or “User”) while using our website https://penjumart.com (“Website”) and Android application (“App”) collectively referred to as the “Platform”.

By accessing or using our Platform, you agree to this Privacy Policy and consent to the collection and use of your information in accordance with this Policy and applicable laws. If you do not agree with the terms of this Privacy Policy, you should not use the Platform.

1. Scope and Applicability

This Privacy Policy applies to all users accessing, using or interacting with the digital platforms, services, and functionalities offered by PenjuMart, whether as a registered customer, a guest user, or a visitor browsing the Platform. For the purposes of this Policy, the term “Platform” shall collectively refer to our official website https://penjumart.com, our Android application, mobile web versions, and any future associated features, technological solutions, tools, or services that we make available to you to provide a seamless shopping experience.

The scope of this Policy extends to all services and offerings currently available and those that may be introduced in the future. At present, PenjuMart provides an e-commerce platform primarily focused on grocery and daily essentials, personal care and beauty products, household cleaning products, and stationery items. We are continuously evolving to meet consumer demands and, as part of our future roadmap, intend to expand into additional categories, thereby making this Privacy Policy applicable to all such future services and enhancements. All activities related to browsing, ordering, making payments, and interacting with customer support through the Platform are covered under the provisions of this Privacy Policy.

This Policy governs the collection, storage, usage, disclosure, and protection of personal information belonging to all users of the Platform, regardless of whether such users are residents of Kantabanji town, Balangir District, Odisha, where we currently operate, or in other parts of India where PenjuMart may expand its services in the future. This Policy is applicable only to users located within the territorial jurisdiction of India and is not intended to apply to users outside India. Any international access to our Platform will be deemed to be at the user’s own discretion and risk, and such users are advised to review this Policy carefully before using our services.

Further, this Privacy Policy applies equally to all categories of users, including but not limited to (a) registered customers who create an account and place orders; (b) guest users who browse the Platform without registration; and (c) visitors who access any part of our Platform or its features for informational purposes only or any other non-transactional activity. By accessing or using the Platform in any manner, you acknowledge and agree to be bound by the terms set forth in this Privacy Policy.

PenjuMart adheres to all applicable laws and regulations governing data privacy, including but not limited to the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020. While our operations are currently focused within India, we aim to align our practices with globally recognized principles of data protection and user privacy, including elements inspired by the General Data Protection Regulation (GDPR), to the extent feasible.

2. Information We Collect

We value your trust and are committed to protecting the information you share with us. To provide our services effectively, PenjuMart collects, processes, and stores certain types of data when you access or use our Platform. This section explains the nature of information we collect and the methods through which it is obtained.

2.1 Personal Information

When you create an account on the Platform, we collect personally identifiable information (“Personal Information”) necessary for account creation, order processing, and customer support. This includes, but is not limited to:

• Full Name
• Gender
• Email Address
• Mobile Phone Number
• Delivery Address and Billing Address

This information is mandatory for all users, as we do not permit guest checkout. You are required to provide accurate and complete information, and we rely on you to update such details as necessary to ensure the proper execution of services.

2.2 Account and Profile Information

To enhance your experience on the Platform, you may choose to upload a profile photograph and other optional information within your account settings. The Platform also allows users to access certain features such as product reviews, ratings, and feedback submissions, which may include text, images, or other files voluntarily provided by you. These inputs may be visible to other users where applicable (e.g., on product review sections), and you are solely responsible for any information you share in public sections of the Platform.

2.3 Payment Information

To complete transactions, we may collect limited payment-related information, such as the payment method used (UPI, debit/credit card, net banking, wallet, etc.) and transaction details. However, we do not store your complete card details, CVV numbers, or sensitive financial data. All such data is processed securely by authorized third-party payment gateways such as Razorpay, in compliance with applicable industry standards (PCI-DSS).

2.4 Device, System, and Technical Information

When you access or interact with the Platform, certain technical data is automatically collected, including:

• IP Address
• Device Identifier and Device Type
• Operating System and Version
• Browser Type and Version
• App Version and Usage Logs
• Network Information

This data helps us maintain platform security, detect fraud, troubleshoot issues, and optimize performance across devices.

2.5 Location Information

At present, we collect location details based on the address you provide during account creation and order placement. In future, with your consent, we may enable precise location detection using GPS and related technologies to improve delivery accuracy and service availability.

2.6 Camera, Photos, and Media Access

The Platform may request access to your camera and device storage for specific features, such as:

• Uploading profile photographs for your account
• Submitting product images or videos for reviews and feedback
• Uploading identity documents for KYC verification, if required for certain product categories or regulatory compliance
• Scanning QR codes or barcodes for order tracking or promotional activities

This access is entirely optional and requires your consent at the time of use. You may decline such permissions, although doing so may limit access to certain features.

2.7 Files and Downloads

For your convenience, the Platform allows you to download invoices and related documents in PDF format. These files may contain personal and transactional details relevant to your order. We recommend that you handle these files responsibly and prevent unauthorized access to them.

2.8 Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to enhance your browsing experience and improve the functionality of our Platform. Cookies allow us to:

• Remember your preferences and account settings
• Understand user behavior and improve website performance
• Deliver personalized product recommendations and marketing communications

We also use third-party analytics tools, such as Google Analytics, which may collect anonymized usage data to help us analyze trends and optimize our services. You can manage or disable cookies through your browser settings; however, certain features of the Platform may not function properly without them.

2.9 Analytics, Plugins, and Third-Party Integrations

Our Platform is built using wordpress and woocommerce, and employs various plugins and integrations to deliver a secure and efficient experience. These include, but are not limited to, security plugins like Wordfence, analytics services, and marketing tools. Such integrations may collect limited technical and usage data to function effectively. All third-party services are governed by their respective privacy policies, and we encourage you to review those for additional details.

2.10 Data from Communications and Support

If you contact our customer support team via email or other communication channels, we may collect and store such interactions, including the content of your queries and any supporting documents or files shared, for quality assurance and issue resolution purposes.

3. How We Collect Information

We employ multiple methods to collect information from and about users of our Platform. The collection process is designed to ensure transparency, legal compliance, and adherence to principles of necessity and proportionality. Below, we outline the primary sources and methods through which your information is obtained.

3.1 Information Provided Directly by You

The majority of personal information we collect is provided voluntarily by you when you interact with the Platform. This includes instances where you:

• Create an Account: When registering on our Platform, you provide personal details such as your name, gender, email address, mobile number, and delivery address. These details are necessary to set up and maintain your account and enable order processing.
• Place Orders and Make Payments: When you place an order or initiate a transaction, you share payment-related information. While the complete financial details (such as card numbers and CVV) are processed by third-party payment gateways, we receive limited transactional information for reconciliation and order confirmation purposes.
• Submit Feedback or Reviews: If you submit product reviews, ratings, feedback, or participate in surveys, we collect any textual content, images, or media files you choose to provide. Please note that such information may be publicly visible in relevant sections of the Platform.
• Communicate with Customer Support: When you contact us via email or other channels for assistance, we collect the details of your inquiry and any additional documents or files you share for resolution purposes.

By providing such information voluntarily, you consent to its collection and use in accordance with this Privacy Policy.

3.2 Information Collected Automatically

When you access or interact with the Platform, we automatically collect certain technical and usage data through server logs, cookies, and analytics tools. This includes:

• Device and Network Information: IP address, browser type, operating system, device identifiers, app version, and network details.
• Usage Patterns: Information regarding your interactions with the Platform, such as pages visited, time spent on pages, products viewed, and actions performed.
• Cookies and Similar Technologies: These technologies enable us to recognize your preferences, provide a personalized experience, and analyze user behavior for service improvement. Cookies also assist in authentication and fraud prevention.

Such automated collection is essential for the proper functioning of the Platform and to maintain security, monitor performance, and deliver a consistent user experience.

3.3 Information from Device Permissions

Certain features of the Platform require access to device functionalities such as:

• Camera Access: For uploading profile photographs, submitting product images for reviews, or scanning barcodes for order tracking.
• Storage Access: For uploading files or media during feedback submissions or downloading invoices and receipts in PDF format.

These permissions are requested explicitly at the time of use and can be managed through your device settings. Declining such permissions may restrict access to related features but will not prevent you from using other parts of the Platform.

3.4 Information from Third-Party Sources

In addition to the above, we may receive limited information from third-party services integrated with our Platform, such as:

• Payment Gateways: For confirming successful transactions and processing refunds.
• Analytics Providers: Including Google Analytics, which helps us understand traffic patterns, user engagement, and service performance.
• Security Plugins: Such as Wordfence, which monitor and prevent unauthorized access, malware attacks, and other security threats.

These third-party services operate under their respective privacy policies, and we encourage you to review those independently.

3.5 Legal and Compliance Requirements

We may collect and process information as required to comply with applicable laws, regulatory directives, or lawful requests from government authorities. Such collection is limited to the extent necessary to fulfill statutory obligations or respond to legal proceedings.

4. How We Use Your Information

PenjuMart uses the information collected from you for purposes that are lawful, specific, and clearly defined in this Policy. We process your data only to the extent necessary to provide our services, ensure compliance with legal obligations, and enhance your experience on our Platform. The primary purposes for which we use your information are as follows:

4.1 To Facilitate Account Creation and Maintenance

When you register on our Platform, the personal details you provide, such as your name, gender, email address, and contact number, are used to create and maintain your user account. This enables us to uniquely identify you, manage your credentials, and provide you with a secure and personalized experience. Account information is also essential for order history retrieval, profile updates, and communication related to your account activity.

4.2 To Process Orders and Fulfill Transactions

We utilize your personal and address information to process your orders, arrange for delivery of products, and communicate order-related updates, including confirmations, dispatch notifications, and estimated delivery timelines. Transactional data received from third-party payment gateways is used strictly for reconciling payments, issuing refunds, and resolving disputes. Under no circumstances do we store or have access to your complete payment card details such as CVV or OTP.

4.3 To Communicate Important Updates

We may use your contact details, such as email address and mobile number, to share critical communications regarding your orders, account security alerts, system updates, and changes to our Terms of Use or Privacy Policy. These communications are essential for maintaining transparency and fulfilling our contractual obligations to you. Such messages are considered non-promotional and cannot be opted out of, as they relate to the functioning of your account or ongoing transactions.

4.4 To Provide Customer Support and Resolve Queries

When you reach out to us through our customer support channels, we process your personal details, order history, and any documents you may provide to resolve your concerns efficiently. We also use this data to improve our customer support systems and prevent the recurrence of similar issues in the future. All such communications are recorded in compliance with applicable laws and for audit purposes.

4.5 To Enable Optional Features and Personalization

Certain features of the Platform, such as adding a profile picture, submitting product reviews, or scanning barcodes, require access to your device’s camera or storage. We use this information solely for enabling these functionalities and enhancing your overall experience. Additionally, we analyze your browsing patterns and purchase history to offer personalized product recommendations, relevant offers, and tailored content, thereby improving user engagement.

4.6 For Marketing and Promotional Activities

Subject to your consent, we may use your contact information to send promotional messages via email, SMS, or WhatsApp regarding offers, new products, and seasonal discounts. We strictly adhere to opt-in and opt-out mechanisms as per applicable regulations, including providing you the ability to unsubscribe from promotional communications at any time. We do not share your personal information with third-party advertisers for their independent marketing purposes.

4.7 For Security, Fraud Prevention, and Legal Compliance

We process device information, IP addresses, and other technical data to safeguard our Platform from unauthorized access, security breaches, and fraudulent transactions. Advanced security plugins such as Wordfence and analytics tools are deployed to monitor suspicious activity and mitigate risks. Additionally, we may process and disclose your data as necessary to comply with applicable laws, respond to legal notices, enforce our Terms of Use, and protect the rights, safety, and property of PenjuMart, its users, and third parties.

4.8 For Research, Analytics, and Service Enhancement

We leverage aggregated and anonymized data to conduct internal research and analyze trends relating to user behavior, product performance, and operational efficiency. These insights help us enhance the Platform’s features, optimize delivery timelines, improve our inventory management, and provide a superior user experience. Analytics tools, including Google Analytics, assist in measuring website performance, traffic sources, and conversion metrics.

4.9 For Record-Keeping and Audit Requirements

As a business entity registered under Indian law, we are obligated to maintain accurate records of transactions, communications, and customer interactions for purposes such as tax compliance, regulatory audits, and statutory reporting. This information is retained and processed strictly within the framework of applicable legal and regulatory requirements.

5. How We Share Your Information

PenjuMart respects your privacy and does not engage in the sale or unauthorized disclosure of your personal information to third parties for their independent marketing or advertising purposes. However, in order to operate our Platform efficiently and fulfill our contractual and legal obligations, we may share your information with certain authorized third parties under strict confidentiality and data protection safeguards. The categories of such sharing are outlined below:

5.1 Sharing with Service Providers and Business Partners

We engage with a range of service providers and vendors to enable the seamless delivery of our services. These include:

• Payment Gateway Providers: For processing transactions securely, managing refunds, and addressing disputes. We currently utilize third-party payment aggregators, such as Razorpay, who operate under their respective privacy and security frameworks.
• Logistics and Delivery Partners: To ensure timely dispatch and delivery of your orders to your specified address. Delivery agents may require access to your name, address, and contact number solely for the purpose of fulfilling the delivery.
• IT and Technical Support Providers: Including hosting service providers, cloud storage partners, and security plugin vendors (e.g., Wordfence) who assist in maintaining the integrity, availability, and security of our Platform.

All such entities are contractually bound by confidentiality obligations and are permitted to process your data only for purposes aligned with this Privacy Policy.

5.2 Sharing for Analytics and Service Improvement

We may share non-personally identifiable information or aggregated data with analytics and performance monitoring providers to evaluate Platform usage and improve our offerings. For example:

• Analytics Providers: Such as Google Analytics, to assess traffic sources, usage trends, and user engagement metrics.
• Advertising Technology Partners (Internal Only): For displaying personalized product recommendations within the Platform, not for external advertising.

Such data is anonymized wherever possible and used exclusively for enhancing user experience and operational efficiency.

5.3 Sharing to Comply with Legal Obligations

We may disclose your personal information to government authorities, regulatory bodies, law enforcement agencies, or pursuant to judicial orders where:

• It is required to comply with applicable laws, tax regulations, or statutory reporting obligations.
• It is necessary to detect, prevent, or address fraud, security breaches, or technical issues.
• It is mandated for the protection of the rights, property, or safety of PenjuMart, its users, or the public at large.

All such disclosures are made in good faith and limited to the extent required under applicable law.

5.4 Sharing in Connection with Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, user information may be transferred as part of such a transaction. In such cases:

• You will be notified through prominent updates on the Platform and, where feasible, via email communication.
• The acquiring entity will be bound to process your information in accordance with the commitments made in this Privacy Policy unless you consent otherwise.

5.5 Restrictions on Third-Party Marketing Use

We do not share your personal information with independent advertisers or marketing agencies for their standalone promotional activities. Any promotional communication you receive from us will be governed exclusively by your preferences and consents managed within your account settings.

5.6 Confidentiality and Data Protection Measures

All third parties with whom we share your information are bound by:

• Non-Disclosure Agreements (NDAs): Prohibiting unauthorized use or disclosure of data.
• Data Processing Agreements (DPAs): Requiring adherence to strict data protection and security standards in compliance with applicable laws, including the Information Technology Act, 2000, and relevant rules.
• Limited Purpose Access: Ensuring that data is processed solely for the specific purpose for which it was shared and not for any unrelated activity.

5.7 Cross-Border Data Transfers

While PenjuMart operates under Indian jurisdiction, certain technical operations may involve the transmission or storage of your data across Indian borders—for instance, when utilizing globally distributed infrastructure or third-party services. However, we mitigate associated risks effectively:

• Our website is hosted with Hostinger, and we have specifically selected the Mumbai, India data center. This ensures that your data remains within India’s legal and regulatory boundaries, minimizing cross-border data handling.
• Other parts of the Platform—such as backups, analytics processing, or plugin integrations—may involve data flows outside India (for example, servers supporting third-party services or cloud tools). When such transfers occur, we ensure they are performed in compliance with applicable legal standards and only to the extent necessary for providing the services.

If you have concerns or require further details regarding cross-border data transfers, please reach out to our Grievance Officer at privacy@penjumart.com.

6. Data Retention and Storage Practices

PenjuMart is committed to retaining your personal information only for as long as is necessary to fulfill the purposes for which it was collected or as required under applicable laws, whichever is longer. This section outlines the principles and standards governing the storage, retention, and disposal of your data.

6.1 General Retention Principle

We retain personal information for a duration that is:

• Necessary for service delivery: Including order processing, transaction verification, product delivery, invoicing, and customer support.
• Required by law: Certain data elements, such as billing records and tax-related documents, must be preserved for statutory periods as per the Income Tax Act, Goods and Services Tax (GST) regulations, and other applicable Indian laws.
• Reasonably necessary for legitimate business interests: Including fraud prevention, dispute resolution, auditing, and enforcing our Terms of Service.

6.2 Retention Periods by Data Category

• Account Information (Name, Email, Mobile Number, Gender): Retained for the lifetime of your account and deleted or anonymized within a reasonable period (typically 90 days) upon account closure or verified deletion request.
• Transaction and Order History: Retained for a minimum of 8 years in accordance with tax and accounting regulations, even after account deletion, to comply with legal and audit obligations.
• Payment Details: We do not store complete payment card numbers or CVV codes. Payment tokens or references shared by payment gateways (such as Razorpay) are retained only for reconciliation and dispute resolution purposes, for a period of up to 13 months as per RBI guidelines.
• Location and Address Details: Retained for as long as they are linked to active orders or your account profile, and subsequently deleted upon request or account closure.
• Customer Support Records: Including emails and grievance communications, retained for up to 3 years from the date of resolution, for quality monitoring and dispute handling.
• Cookies and Analytics Data: Retention varies by type but generally does not exceed 26 months, after which the data is anonymized or deleted.

6.3 Secure Storage Measures

All personal information collected by PenjuMart is stored on secure servers hosted in Mumbai, India, through Hostinger’s infrastructure, which adheres to industry-standard security certifications. Additional safeguards include:
• Encryption: Sensitive data, including passwords and transactional details, is encrypted both in transit (via SSL/TLS) and at rest.
• Access Controls: Data access is restricted to authorized personnel based on the principle of least privilege.
• Security Monitoring: Continuous threat detection mechanisms, such as firewall protection, malware scanning, and security plugins (e.g., Wordfence), are in place to prevent unauthorized access.

6.4 Deletion and Anonymization

Upon the expiry of the retention period or upon receipt of a valid deletion request, PenjuMart will:

• Permanently delete the data from active systems and backups, or
• Anonymize the data in a manner that irreversibly prevents identification of the individual.

However, certain residual copies may persist in system backups for disaster recovery purposes for a limited period, after which they will be securely overwritten.

6.5 Exceptions and Legal Holds

If any data is subject to a legal hold or regulatory inquiry, such data will be retained beyond the standard retention period until the resolution of the matter. You will be notified where such extended retention is applicable, to the extent permitted by law.

7. Your Rights and Choices

PenjuMart respects your privacy and is committed to empowering you with meaningful control over your personal information. This section explains the rights available to you under applicable laws and the mechanisms provided by PenjuMart to exercise them.

7.1 Right to Access and Review

You have the right to request access to the personal information we hold about you. This includes:

• Details of the categories of information collected
• The purposes for which it is being processed
• The entities with whom it has been shared

How to exercise:
You can log in to your PenjuMart account to view profile details, saved addresses, and order history. For additional information, you may email us at privacy@penjumart.com with the subject line “Data Access Request”.

7.2 Right to Rectification (Correction)

If you believe that any personal information held by us is inaccurate, incomplete, or outdated, you have the right to request correction or update.
How to exercise:
Profile details such as name, contact number, and address can be updated directly via your account dashboard. For non-editable data or errors in transactional details, contact us at privacy@penjumart.com.

7.3 Right to Withdraw Consent

Where the processing of your data is based on your consent (e.g., marketing communications, promotional emails, WhatsApp messages), you may withdraw consent at any time without affecting the lawfulness of prior processing.
How to exercise:

• Use the “unsubscribe” link in promotional emails
• Reply “STOP” to SMS or WhatsApp communications
• Update notification preferences in your account settings
• Email us at privacy@penjumart.com requesting consent withdrawal

7.4 Right to Deletion (Right to be Forgotten)

You may request deletion of your personal data when:

• It is no longer necessary for the purpose for which it was collected
• You have withdrawn consent and there is no other legal basis for processing
• You object to processing and we have no overriding legitimate interest
• Data has been unlawfully processed

Important: Certain data, such as tax invoices and order records, may be retained for statutory compliance even after account deletion.
How to exercise:
Submit a request by emailing privacy@penjumart.com with the subject line “Data Deletion Request”. Verification may be required before processing.

7.5 Right to Data Portability

Where technically feasible, you may request a copy of your personal information in a structured, machine-readable format, or request that we transfer it to another service provider.
How to exercise:
Email your request to privacy@penjumart.com, specifying the format or destination platform (if supported).

7.6 Right to Restrict or Object to Processing

You may request us to restrict processing of your data under specific circumstances, such as:

• When accuracy of the data is contested
• When processing is unlawful, but you oppose deletion
• When you have objected to processing pending verification of legitimate grounds

7.7 Right to Lodge a Complaint

If you believe your privacy rights have been violated or are dissatisfied with our response to your requests, you may:

• Contact our Grievance Officer at privacy@penjumart.com
• File a complaint with the appropriate authority under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

7.8 Identity Verification for Rights Requests

To protect user privacy, we may require you to provide sufficient identity verification (e.g., account credentials or KYC documents, where applicable) before processing any rights request. We will respond to all verified requests within 30 days, subject to applicable law.

8. Cookies, Tracking Technologies, and Third-Party Integrations

PenjuMart uses cookies, analytics tools, and third-party services to enhance user experience, improve site performance, and ensure security. This section explains the types of tracking technologies we use, their purposes, and the choices available to you.

8.1 What Are Cookies?

Cookies are small text files placed on your device (computer or mobile) when you visit our website or use our mobile application. They help us:

• Recognize your device and preferences
• Maintain session integrity during navigation
• Enable secure transactions and login functionality
• Provide personalized content and offers

8.2 Types of Cookies and Technologies We Use

We use the following categories of cookies and related technologies:

• Essential Cookies: Required for core website functionality, including secure login, shopping cart management, and order processing. Disabling these may affect site usability.

• Functional Cookies: Used to remember user preferences such as language selection, location preferences, and saved items for a better browsing experience.

• Analytics and Performance Cookies: Enable us to measure traffic sources, understand user behavior, and optimize site performance. We primarily use Google Analytics and similar tools to collect aggregated and anonymized data such as:

• • Pages visited
  • Session duration
  • Interaction with site features
  • Geographic location (general)

• Marketing and Communication Cookies: Used for remarketing, sending personalized offers, and delivering relevant advertisements (only within our platform and official communications; we do not sell user data to third-party advertisers).

• Security and Fraud Detection Tools: We use plugins like Wordfence for real-time threat monitoring, IP blocking, and prevention of unauthorized access to ensure platform integrity.

8.3 Mobile App Permissions and Tracking

Our Android application may request access to:

• Camera and Photos/Media: For profile photo uploads, product reviews, and KYC (where applicable).
• Storage Access: To enable downloading of invoices and receipts in PDF format.
• Push Notifications: To keep you informed about order updates, offers, and security alerts.
• Device and App Analytics: For crash reporting, bug fixes, and performance improvements.

8.4 Third-Party Integrations

We rely on trusted third-party service providers for specific functions, including:

• Payment Processing: Razorpay for secure payment transactions.
• Hosting Services: Hostinger, with servers located in Mumbai, India.
• Analytics: Google Analytics for usage insights and platform optimization.
• Security Tools: Wordfence for real-time malware scanning and intrusion prevention.

These third parties process your data strictly under contractual obligations and in compliance with applicable data protection laws.

8.5 Your Choices and Control

You have the ability to control cookies and tracking technologies in the following ways:

• Browser Settings: Most web browsers allow you to block or delete cookies. Please note, disabling essential cookies may affect website functionality.
• Analytics Opt-Out: You can opt out of Google Analytics tracking using the Google Analytics Opt-Out Browser Add-on.
• Marketing Preferences: You can withdraw consent for promotional communications at any time by:
  • Clicking the unsubscribe link in emails
  • Replying STOP to SMS/WhatsApp
  • Adjusting settings in your PenjuMart account
• Mobile App Permissions: Permissions for camera, storage, and notifications can be managed through your device settings.

8.6 Do-Not-Track Signals

At present, PenjuMart does not respond to browser-based “Do-Not-Track” signals due to lack of uniform standards. We may update this policy when industry standards are established.

9. How We Protect Your Information (Security Practices)

At PenjuMart, we are committed to implementing industry-leading security measures to safeguard your personal and financial information against unauthorized access, disclosure, alteration, or destruction. We recognize the sensitivity of your data and adopt robust technical, organizational, and administrative controls in line with applicable laws, including the Information Technology Act, 2000 and the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information (SPDI) Rules, 2011.

9.1 Encryption and Secure Transmission

• All data transmitted between your device and our servers is encrypted using SSL/TLS (HTTPS) protocols to prevent interception or tampering during transmission.
• Payment-related information is processed through PCI-DSS compliant payment gateways (such as Razorpay), ensuring that your card details or banking credentials are never stored on our servers.

9.2 Secure Infrastructure and Hosting

• Our website is hosted on Hostinger, with servers located in Mumbai, India, ensuring compliance with local data residency requirements.
• We deploy firewall protection, intrusion detection, and malware scanning to monitor and prevent unauthorized access.
• Server environments are regularly updated and patched to address security vulnerabilities.

9.3 Application-Level Security

• The PenjuMart platform (built on WordPress and WooCommerce) utilizes:
  • Wordfence Security Plugin for real-time threat detection, IP blocking, and login attempt monitoring.
  • Role-Based Access Control (RBAC) to ensure only authorized personnel can access sensitive areas of the system.
• Multi-layer authentication and session management techniques are implemented to prevent account takeover.

9.4 Organizational and Administrative Controls

• Access to personal information within PenjuMart is strictly limited to employees and authorized partners on a need-to-know basis.
• All personnel handling user data undergo confidentiality agreements and security awareness training.
• Internal audits and vulnerability assessments are periodically conducted to ensure compliance and mitigate risks.

9.5 Data Storage and Retention Security

• User data is stored in encrypted databases with restricted access.
• Backup copies of critical data are maintained in secure environments to ensure business continuity in case of system failures.
• Retention periods are aligned with legal and business requirements, after which data is securely deleted or anonymized.

9.6 Monitoring and Incident Management

• We continuously monitor our systems for unusual activity, breaches, or vulnerabilities.
• In the event of a data breach that is likely to result in harm, we will:
  • Notify affected users promptly via email or other communication channels
  • Inform the relevant government authority, where required by law
  • Take immediate steps to contain the breach and prevent recurrence

9.7 No Absolute Guarantee

While we implement reasonable security practices in accordance with Rule 8 of the SPDI Rules, no system can guarantee absolute security. By using our services, you acknowledge that transmission over the internet involves inherent risks, and we cannot warrant that your data will remain 100% secure.

10. Children’s Privacy

PenjuMart is committed to protecting the privacy and safety of children online. The Platform is not intended for children under the age of 18, and we do not knowingly collect personal information from minors.

10.1 Age Restriction

• Users must be at least 18 years of age to create an account or place orders on PenjuMart.
• By accessing or using the Platform, you represent and warrant that you meet the minimum age requirement.
• We reserve the right to terminate or suspend accounts if it is discovered that a user is underage.

10.2 Parental Consent

• PenjuMart does not knowingly solicit personal information from children under 18.
• In the rare event that we discover personal information of a minor has been collected without parental consent, we will take immediate steps to delete such information from our systems.

10.3 Prohibited Activities

• Children under the age of 18 are prohibited from placing orders, submitting reviews, uploading photos, or engaging in other transactional or interactive activities on the Platform.
• Parents or guardians should supervise minors’ access to the Platform to ensure compliance with these rules.

10.4 Reporting Concerns

• If you believe that a child under 18 has provided personal information on our Platform without parental consent, please contact our Grievance Officer immediately at privacy@penjumart.com.
• We will investigate and remove the information promptly in accordance with applicable laws and our privacy commitments.

10.5 Educational and Promotional Communications

• PenjuMart does not direct marketing communications to children under 18. All promotional materials, notifications, and offers are intended for adults only.
• Children’s privacy is safeguarded through age-gating mechanisms and explicit age verification during account creation.

11. Changes to Privacy Policy

PenjuMart reserves the right to modify, update, or revise this Privacy Policy at any time to reflect changes in our practices, legal obligations, or regulatory requirements. We are committed to ensuring that you are informed of any material changes that may affect how your personal information is collected, used, or shared.

11.1 Notification of Changes

• Significant updates to this Privacy Policy will be communicated by:
  • Posting a prominent notice on our Platform, or
  • Sending notifications to your registered email address or mobile number (where applicable).
• Such notifications will clearly indicate the date of the latest update and highlight any changes that materially affect the way your personal information is processed.

11.2 Effective Date

• All changes to this Privacy Policy are effective immediately upon posting unless otherwise specified.
• The “Last Updated” date at the top of this Privacy Policy indicates the most recent revision.

11.3 Your Continued Use of the Platform

• By continuing to use or access PenjuMart after any modifications to this Privacy Policy, you consent to the updated terms.
• If you do not agree with the revised Privacy Policy, you must cease using the Platform and may contact us to request the deletion of your personal information in accordance with Section 7 (Your Rights and Choices).

11.4 Encouragement to Review Policy Regularly

• Users are encouraged to review this Privacy Policy periodically to stay informed about how PenjuMart collects, uses, and protects personal information.
• Regular review ensures that you remain aware of your rights and obligations while using the Platform.