Privacy Policy
Privacy Policy
Version 2.0 · Effective 1 July 2026 · Full DPDP Rules 2025 compliance by 13 May 2027.
Children’s Personal Data (DPDP Rule 10)
Carrington & Finch India Pvt Ltd is subject to India’s Digital Personal Data Protection Act 2023 + DPDP Rules 2025.
Children’s data definition: A “Child” means any individual under 18 years of age.
Parental consent required. We do not process Child personal data without verifiable parental consent. Our consent mechanism: parent declares 18+ at signup; under-18 signup is suspended pending verifiable parental consent (email verification + payment method verification).
No behavioral monitoring of children. Cookie tracking + remarketing pixels disabled for visitors identified as minors.
No targeted advertising to children. Meta + Google ad audiences configured minimum age 25+ with explicit under-18 exclusions.
Right to erasure. Parents may request erasure of all data relating to their child by emailing dpo@carringtonandfinch.com.au. 30-day SLA across our data stack.
Data Protection Officer designated: dpo@carringtonandfinch.com.au.
Breach notification: 72-hour notification per DPDP Rule 8 in the event of any breach affecting Child data.
Penalty awareness: DPDP Act provides for penalties up to ₹150 Crore for children’s data violations. We comply because it’s the right thing, not just because of the penalty.
Cookies + Tracking
First-visit cookie consent with granular controls:
- Essential — always on, required for site function + cart + checkout
- Analytics (Google Analytics 4) — optional, off for under-18 verified visitors regardless of consent
- Marketing (Meta Pixel + Google Ads) — optional, off for under-18 verified visitors regardless of consent
- Personalisation (Klaviyo behavioral data) — optional, off for under-18 verified visitors regardless of consent
Data We Collect
From parents (18+) who sign up for our waitlist, place an order, or contact us: name, email address, phone number (optional), shipping address, payment method (processed by Razorpay/Cashfree/Stripe AU — we don’t store card details), purchase history, communication history. We collect this to fulfil orders + provide customer service.
How We Use Data
- Process + fulfil your orders
- Customer service via email + WhatsApp Business
- Subscription management + reorder reminders (Klaviyo)
- Analytics to improve site performance (anonymized, with consent)
- Marketing communications — only to adults who have explicitly opted in
Data Processors
Shopify (Canada), Klaviyo (USA), Razorpay (India), Cashfree (India), Stripe AU (Australia), Delhivery 3PL (India), Google Analytics 4 (USA), Meta Pixel (USA), Wise Business (UK). All under written Data Processing Agreements per DPDP Rule 4.
Cross-Border Transfers
Some data may be transferred to processors located outside India (Shopify Canada, Klaviyo USA, Stripe AU, etc.). All transfers comply with DPDP Act + DPDP Rules 2025 cross-border transfer requirements.
Your Rights
You have the right to access, correct, port, and erase your personal data. Email dpo@carringtonandfinch.com.au with your request. 30-day SLA.
Data Retention
We retain personal data only as long as required for the purpose collected, plus required statutory retention (GST records 8 years, FSSAI records as per regulations, customer service records 3 years).
Contact
General privacy questions: hello@carringtonandfinch.com.au
Data Protection Officer (DPDP): dpo@carringtonandfinch.com.au
Safety + adverse events: safety@carringtonandfinch.com.au
Carrington & Finch India Pvt Ltd · Chandigarh, India · Carrington & Finch Pty Ltd · Suite 5A, 107-111 High Street, Prahran, Victoria 3181, Australia.