Privacy policy

Who we are

This website is operated by GANESHA ENTERPRISE, a private limited company incorporated in India, with its registered office at Ground Floor, Shop No. 1, Nirav Co-op Hsg Chs Ltd, Vasai West, Palghar, Maharashtra - 401202. Our GSTIN is 27AQSPS6757L1ZN.

We are the data fiduciary for the personal data described here. This policy is issued under the Information Technology Act, 2000 and the rules made under it, and reflects the principles of the Digital Personal Data Protection Act, 2023.

What we collect

We ask for the minimum a paper merchant needs to get a box to your door and issue a valid tax invoice:

• Identity and contact data — your name, email address and mobile number.
• Delivery data — your postal address, city, state and PIN code.
• Order data — the products, weights, sizes and quantities ordered, the amounts paid, any coupon used and the order reference.
• Business data, only if you give it — your firm name and GSTIN, when you want them on the invoice for input credit.
• Technical data — IP address, browser type and pages viewed, collected by our analytics tools where those are enabled.

Why we collect it

Each item has a purpose and is not used beyond it:

We do not sell personal data. We do not rent it, trade it or hand it to data brokers.

Payment data

UPI payments are handled entirely by our payment gateway partner. Your UPI ID, PIN, card numbers and banking credentials never reach our servers and we have no way to see them. All we receive back is a transaction reference and whether the payment succeeded or failed.

For cash-on-delivery orders no payment data exists at all — you pay the courier directly.

Who we share it with

Only the parties that have to be involved for the order to happen:

• Courier and logistics partners — your name, address and phone number, so the parcel can be delivered.
• The payment gateway — the order reference and amount.
• Our email service provider — your email address, to deliver order notifications.
• Our accountants and auditors — order and invoice records, under confidentiality obligations.
• Government authorities — where we are required by law to disclose, or to establish or defend a legal claim.

Cookies and analytics

The site uses a small number of cookies. Some are strictly necessary — they keep your order contents in the browser and remember your session while you check out. Your cart is stored in your own browser's local storage, not on our servers, which is why clearing your browser data empties it.

If analytics or advertising tags are enabled by the merchant, those services set their own cookies and receive usage data under their own privacy policies. You can block or delete cookies through your browser settings; the checkout will still work, but your cart may not persist between visits.

How long we keep it

Order, invoice and tax records are kept for eight years, which is what Indian tax and company law requires. Marketing contact details are kept until you unsubscribe. Analytics data is kept for the retention period set by the analytics provider. Anything outside these categories is deleted once the purpose it was collected for has ended.

Your rights

You can ask us to:

• Tell you what personal data of yours we hold, and give you a copy.
• Correct anything inaccurate or out of date.
• Delete data we no longer need — except records we are legally required to retain, such as tax invoices.
• Stop sending you marketing email, which you can also do from the unsubscribe link in any such email.
• Nominate someone to exercise these rights on your behalf if you are unable to.

Write to support@ganeshapapers.com from the email address on the order. We respond within 30 days.

Security

The site runs over HTTPS. Administrative access is restricted and password-protected, database credentials are held outside the web root, and payment credentials are never stored by us at all. No system is perfectly secure, but if a breach ever affected your personal data we would notify you and the relevant authority as the law requires.

Children

This store is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy

When this policy changes, the revised version is published here with a new date at the top. Material changes to how we use personal data are notified by email to customers with an active order.