Privacy Policy | WoodStampArt

1. Who We Are

WoodStampArt ("we", "us", "our") is a handcrafted wooden art and craft business based in Jaipur, Rajasthan, India. We operate the website woodstampart.com and sell handcrafted wooden blocks, wall art, kitchenware, and decorative items to customers in India and internationally.

For the purposes of the EU and UK General Data Protection Regulation we are the data controller of the personal data described here. For the California Consumer Privacy Act as amended by the CPRA we are a business.

Privacy contact: support@woodstampart.com or +91 93510 23334.

2. Information We Collect

Information you give us:

Name, email address and phone number, when you register, sign in or place an order
Shipping and billing addresses, and any delivery instructions you add
One time passcodes we send by email or SMS to sign you in or verify your contact details
Order and return history, product reviews, wishlist and cart contents
Messages you send through our contact form, support email or WhatsApp
Marketing preferences and your cookie consent choices

Information we collect automatically:

IP address, used for currency and country detection, rate limiting and fraud prevention
Browser type, device and operating system, and whether you installed our web app
Pages viewed, products viewed, time on page and the site that referred you
Cookies and similar technologies, as described in section 6

Payment details: card and bank details are entered directly with our payment providers and are never stored on our servers. We receive only the outcome of the payment, the method used and a transaction reference.

Sensitive personal information: we do not ask for, and do not knowingly collect, government identifiers, precise geolocation, health data, biometrics, or data revealing race, religion, politics, union membership or sexual orientation. We do not use or disclose sensitive personal information for any purpose that would give you a CPRA right to limit its use.

3. How We Use Your Information

Process and fulfil your orders, including international shipping and customs paperwork
Send order confirmations, shipping updates, delivery notifications and return or refund updates
Sign you in and verify your email or phone number with a one time passcode
Detect your country for automatic currency conversion and shipping rates
Prevent fraud, abuse and payment risk, and keep the site secure
Answer your questions and provide customer support
Send marketing emails or messages, only where you have opted in, with an unsubscribe link in every one
Measure and improve the website, our products and our campaigns, where you allow those cookies
Meet legal obligations, including tax, accounting, export and consumer protection rules

We do not use your personal data for automated decision making or profiling that produces legal or similarly significant effects on you.

4. Legal Basis for Processing (GDPR)

For customers in the European Economic Area, the United Kingdom and other regions with equivalent laws, we rely on:

Contract performance: creating your account, taking payment, shipping and handling returns
Legitimate interest: fraud prevention, site security, and defending legal claims, balanced against your rights
Consent: marketing messages, analytics cookies and advertising cookies, which you can withdraw at any time
Legal obligation: tax records, invoices and export documentation

5. Your Privacy Rights

If you are in the EEA, the UK or Switzerland, you have the right to:

Access the personal data we hold about you and receive a copy of it
Rectification of data that is inaccurate or incomplete
Erasure, the right to be forgotten, where we no longer need the data
Restriction of processing while a dispute about accuracy or legitimate interest is resolved
Data portability, a machine readable export of the data you gave us, which we provide as JSON or CSV
Object to processing based on legitimate interest, and to direct marketing at any time
Withdraw consent at any time, without affecting processing already carried out
Lodge a complaint with your local supervisory authority, for example the Irish Data Protection Commission or the UK Information Commissioner's Office

If you are a California resident, under the CCPA as amended by the CPRA you have the right to:

Know the categories and specific pieces of personal information we collected, the sources, the purpose, and the categories of third parties we disclosed it to
Delete the personal information we hold, subject to legal exceptions such as completing an order or keeping tax records
Correct inaccurate personal information
Opt out of the sale or sharing of personal information for cross context behavioural advertising, see section 7
Non discrimination: we will not deny you products, charge you a different price or give you a lower quality service for exercising any of these rights

Other regions. If you are in India, Brazil, Canada, Australia or another country with a comparable law, we honour the equivalent rights of access, correction, deletion and grievance redressal on the same terms.

How to exercise your rights. Email support@woodstampart.com from the address on your account, or write to the postal address in section 13, and tell us which right you want to use. We may ask for information that lets us match your request to your account, and we use it only to verify the request. We respond within 30 days for GDPR requests and within 45 days for CCPA requests, and will tell you if we need a permitted extension. There is no charge unless a request is manifestly unfounded or excessive.

Authorised agents. A California consumer may use an authorised agent. We ask for written permission signed by you, and we may still contact you directly to confirm the request.

6. Cookies and Similar Technologies

We group cookies into three categories, and nothing outside the first one runs until you allow it:

Strictly necessary: your sign in session, cart, currency choice, security and consent record. These cannot be switched off.
Analytics: Google Tag Manager and the analytics tools it loads, used to understand which pages are used so we can improve them.
Marketing: the Meta pixel and related advertising tags, used to show you our products on other sites and to measure those campaigns.

You choose when the banner first appears, and you can change or withdraw the choice at any time here or from the "Cookie settings" link in the footer. Refusing is exactly as easy as accepting.

We also honour the Global Privacy Control signal. If your browser or extension sends it, we treat it as an opt out of the sale or sharing of personal information and keep marketing tags off, unless you later turn that category on yourself. You can additionally block or delete cookies in your browser settings, though strictly necessary cookies are needed for the cart and checkout to work.

7. Sale and Sharing of Personal Information

We do not sell your personal information for money, and we have not done so in the previous twelve months.

If you allow marketing cookies, identifiers such as your cookie ID, IP address and the pages or products you viewed are made available to advertising platforms, currently Meta, so we can show you our products elsewhere and measure those campaigns. Under California law that counts as sharing for cross context behavioural advertising, and under some other state laws as a sale.

To opt out, switch the Marketing category off in Cookie settings, use the "Do not sell or share my personal information" link in the footer, or send a Global Privacy Control signal. We do not knowingly share the personal information of anyone under 16.

8. Who We Share Data With

We share personal data only with service providers who process it on our instructions, under contract, and only for the purposes below:

Payments: Stripe, PayPal and Razorpay, to take and refund payments and to screen for fraud
Shipping and logistics: our courier and freight partners, including India Post and ShipGlobal, who receive the recipient name, address, phone number and parcel contents needed for delivery and customs
Email: Brevo, for order, account and, where you opted in, marketing email
SMS and WhatsApp: Twilio, for one time passcodes and delivery updates
Analytics and advertising: Google and Meta, only in line with the cookie categories you allowed
Hosting and infrastructure: our server, database, storage and content delivery providers
Professional advisers and authorities: accountants, auditors and legal or tax authorities, where the law requires it or to establish or defend legal claims

If our business is ever sold or reorganised, personal data may transfer to the buyer, who would remain bound by this policy until you are told otherwise.

9. International Data Transfers

We are based in India, so data you give us is processed in India, and some of our providers process data in the United States, the European Union and elsewhere.

For transfers of EEA, UK or Swiss personal data outside those regions we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum or the Swiss annex where relevant, together with technical measures such as encryption in transit.
Where a United States provider is certified under the EU-US Data Privacy Framework, including the UK Extension and the Swiss-US framework, transfers to that provider may instead rely on its certification.
You can ask us for a copy of the safeguards that apply to a specific transfer by emailing us.

10. How Long We Keep Data

Account data: while your account is open, then up to 12 months after you ask us to close it
Orders, invoices and tax records: 7 years from the transaction, as Indian tax law requires
One time passcodes: minutes, they expire and are discarded
Support messages: up to 3 years after the conversation ends
Cookie consent record: stored in your browser until you clear it or the policy version changes
Analytics and advertising data: retained by the relevant provider under its own retention settings

When a retention period ends we delete the data or irreversibly anonymise it.

11. Data Security

We protect your data with encryption in transit (TLS), hashed passwords and one time passcodes, role based access controls for staff, audited administrative actions, and regular updates of our software. No method of transmission or storage is completely secure, so if a breach ever affects your rights we will notify you and the relevant authority within the time the law allows.

12. Children's Privacy

Our services are not directed to anyone under 16, and we do not knowingly collect their personal data or share it for advertising. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes and How to Reach Us

We may update this policy. The date at the top always shows the current version, and we will tell you by email or a notice on the site before any change that materially affects your rights takes effect.

For any privacy question, or to exercise a right described above:

WoodStampArt
Email: support@woodstampart.com
Phone: +91 93510 23334
Address: F-2, B-16, Shri RadhaKrishna Dham Apartment, Ganesh Marg, Ajmer Road, Narayan Vihar, Jaipur, Rajasthan 302020, India