At Little India Treasures, we take your privacy seriously. This Privacy Policy explains how Treasure & Trove Ltd — the company behind Little India Treasures — collects, uses, stores, and protects your personal data when you visit and shop at www.shoplittleindia.co.uk (the "Site"), contact us, or engage with us in any other way.

We are committed to being transparent about how we handle your data, and to processing it fairly, lawfully, and with respect for your rights. Please read this policy carefully. If you have any questions, we are always happy to help.

Data controller	Treasure & Trove Ltd
Trading as	Little India Treasures
Company number	15294111
Registered address	82A James Carter Road, Mildenhall, Bury St Edmunds, Suffolk, IP28 7DE, United Kingdom
Email	treasures@shoplittleindia.co.uk
Telephone	+44 (0) 739 790 1320
ICO registration	To be inserted upon registration

This Privacy Policy applies to all personal data we process in connection with the Site, your purchases, your account, your communications with us, and your marketing preferences. It covers customers in the United Kingdom, the European Union, the United States, and all other jurisdictions from which we accept orders.

This policy should be read alongside our Cookie Policy, Terms of Use, and Conditions of Sale, all of which form part of our legal framework.

Personal data means any information that can identify you, directly or indirectly. Depending on how you interact with us, we may collect the following categories of personal data:

Identity and contact data

• Your name, email address, telephone number, and postal address
• Your billing address and delivery address (which may differ)
• Your account login credentials if you create an account with us

Transaction and order data

• Details of products you have purchased, browsed, or added to your basket
• Order history, returns, and refund requests
• Payment method type (we do not store full card numbers — see Section 10)

Technical and usage data

• Your IP address, browser type and version, device type, and operating system
• Pages you visit, time spent on the Site, links clicked, and search terms used
• Cookie identifiers and similar tracking data (see our Cookie Policy)

Marketing and communications data

• Your marketing preferences and communication opt-in or opt-out status
• Your responses to promotions, surveys, or competitions
• Records of your correspondence with us by email, telephone, or other means

Wholesale and trade account data

• Business name, trading address, and contact details if you apply for a trade account
• Information provided in support of a trade account application

We do not collect any special category personal data (such as data about your health, ethnicity, religion, or political opinions), and we do not collect any data from children under the age of 16 knowingly. Please see Section 13 for more information.

We collect your personal data through a number of different routes:

Directly from you, when you:

• Place an order on the Site
• Create or update a customer account
• Sign up to our newsletter or marketing communications
• Apply for a wholesale or trade account
• Contact our customer services team by email, telephone, or through the contact form on the Site
• Enter a competition or respond to a survey
• Leave a review or engage with us on social media

Automatically, when you visit the Site, through cookies and similar tracking technologies that collect technical and usage data. You can control your cookie preferences at any time — please see our Cookie Policy for full details.

From third parties, including:

• Shopify, our e-commerce platform, which processes data as part of operating the Site
• Payment service providers such as Klarna, PayPal, and Stripe, in connection with processing your payments
• Social media platforms such as Instagram, Pinterest, and Facebook, if you engage with our content or advertisements on those platforms
• Analytics providers such as Google Analytics, which help us understand how the Site is used
• Delivery and logistics partners, in connection with fulfilling your order

We only use your personal data where we have a lawful basis for doing so. Under the UK GDPR and EU GDPR, the lawful bases we rely on are: contract performance (processing necessary to fulfil your order or account); legal obligation (processing required by law); legitimate interests (processing necessary for our genuine business interests, balanced against your rights); and consent (where you have actively opted in, such as for marketing emails).

The table below sets out in detail how and why we use your data:

Purpose	Data used	Lawful basis
Processing and fulfilling your order, including payment and delivery	Identity, contact, transaction, payment data	Contract performance
Managing your customer account	Identity, contact, transaction data	Contract performance
Sending order confirmations, dispatch notifications, and delivery updates	Identity, contact, transaction data	Contract performance
Handling returns, refunds, exchanges, and complaints	Identity, contact, transaction data	Contract performance / Legal obligation
Processing wholesale and trade account applications	Identity, contact, business data	Contract performance / Legitimate interests
Sending you marketing emails, newsletters, and promotions (where you have opted in)	Identity, contact, marketing preferences	Consent
Personalising your experience on the Site and showing you relevant products	Technical, usage, transaction data	Legitimate interests / Consent (for cookies)
Improving the Site, our products, and our services through analytics	Technical, usage data	Legitimate interests
Preventing fraud, protecting the security of the Site, and verifying identity	Identity, contact, technical, transaction data	Legitimate interests / Legal obligation
Complying with our legal and regulatory obligations (including tax, accounting, and VAT)	Identity, contact, transaction, financial data	Legal obligation
Administering competitions, surveys, and promotions	Identity, contact, marketing data	Consent / Legitimate interests
Responding to your customer service enquiries and complaints	Identity, contact, communications data	Contract performance / Legitimate interests
Enforcing our legal rights or defending legal claims	All relevant data	Legitimate interests / Legal obligation

Where we rely on legitimate interests as our lawful basis, we have carefully considered whether our interests are overridden by your rights and freedoms, and we are satisfied that they are not. You may object to processing based on legitimate interests at any time — please see Section 12 for details of your rights.

We would love to keep you updated about new arrivals, seasonal collections, artisan stories, exclusive offers, and everything happening at Little India Treasures. We will only send you marketing communications if you have actively opted in to receive them.

You can opt in to marketing emails when you create an account, place an order, or sign up to our newsletter. You can withdraw your consent and unsubscribe at any time by clicking the "unsubscribe" link in any marketing email we send you, or by contacting us at treasures@shoplittleindia.co.uk.

Withdrawing your consent to marketing will not affect any other processing we carry out, and will not affect the fulfilment of any orders you have placed with us.

We may also use your data to show you relevant advertising on social media platforms and across the web, based on your browsing behaviour and purchase history. You can manage your preferences for this type of advertising through your social media account settings or through our Cookie Policy.

We do not sell your personal data to third parties for their own marketing purposes. We never have, and we never will.

We share your personal data only where it is necessary for the purposes described in this policy, and only with organisations that are bound by obligations of confidentiality and data security. We do not sell, rent, or trade your personal data.

The categories of third parties with whom we may share your data are:

Our e-commerce and hosting platform

• Shopify Inc. — who powers our online store and processes data on our behalf as our data processor. For further detail, please see Section 7.

Payment service providers

• Klarna, PayPal, Stripe, Apple Pay, Google Pay, Mastercard, Visa, and other payment processors — who process your payment securely. We do not store your full card details.

Delivery and logistics partners

• Courier and fulfilment companies used to deliver your order. They receive only the data necessary to complete your delivery.

Marketing and analytics providers

• Google Analytics, Meta (Facebook/Instagram), Pinterest, and similar platforms — for the purposes of analytics, advertising, and understanding how our marketing performs. Your data is shared only with your consent where required.

Customer service tools

• Third-party platforms used to manage customer communications, reviews, and support.

Professional advisers

• Lawyers, accountants, auditors, and insurers — where necessary for the running of our business or to comply with legal obligations.

Regulatory and law enforcement authorities

• We may be required to share data with HMRC, the ICO, or other authorities where required by law, court order, or for the prevention of fraud.

All third parties with whom we share personal data are required to process it in accordance with applicable data protection law and to implement appropriate security measures.

Our Site is built and hosted on Shopify, one of the world's leading e-commerce platforms. When you visit or purchase from the Site, Shopify processes certain personal data on our behalf as our data processor. This includes data related to your browsing behaviour, orders, account, and payments.

Shopify is bound by a Data Processing Agreement with us and processes your data only on our instructions and in accordance with applicable data protection law. Shopify's own privacy practices are governed by their Privacy Policy, which you can read at www.shopify.com/legal/privacy.

Shopify is headquartered in Ottawa, Canada, which benefits from an EU adequacy decision, meaning that transfers of personal data to Shopify's Canadian operations are covered by appropriate safeguards. Where Shopify processes data in the United States or other jurisdictions, Shopify relies on appropriate transfer mechanisms including Standard Contractual Clauses.

As a global brand serving customers in the UK, EU, USA, and beyond, some of the personal data we collect may be transferred to, and processed in, countries outside the United Kingdom and the European Economic Area (EEA).

Where such transfers occur, we ensure that appropriate safeguards are in place to protect your data, in accordance with the UK GDPR and EU GDPR. The safeguards we rely on include:

• Adequacy decisions — transfers to countries that the UK Government or European Commission has determined provide an adequate level of data protection (for example, Canada in respect of Shopify)
• Standard Contractual Clauses (SCCs) — legally binding contractual terms approved by the UK ICO or the European Commission, used for transfers to countries without an adequacy decision
• EU-US Data Privacy Framework — for transfers to US organisations that are certified under this framework

If you would like further information about the specific safeguards applied to any transfer of your personal data, please contact us at treasures@shoplittleindia.co.uk.

We keep your personal data only for as long as is necessary for the purposes for which it was collected, and in accordance with our legal obligations. The retention periods we apply are:

Data type	Retention period	Reason
Order and transaction records	7 years from the date of the order	HMRC tax and accounting obligations
Customer account data	For the duration of your account, plus 2 years after closure	Legitimate interests — to assist with any post-closure queries
Marketing preferences and email history	Until you unsubscribe, plus 1 year	To maintain accurate suppression lists
Customer service correspondence	3 years from the date of the last correspondence	Legitimate interests — in case of any related dispute
Technical and usage data (analytics)	Up to 26 months	Standard analytics retention period
Fraud prevention and security data	Up to 5 years	Legal obligation and legitimate interests
Wholesale and trade account data	Duration of the trading relationship, plus 3 years	Legitimate interests and legal obligation

Once your personal data is no longer required, we securely delete or anonymise it. Where anonymisation is not possible, we ensure it is stored securely and isolated from further processing.

The security of your personal data is something we take very seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction, alteration, or disclosure.

These measures include:

• SSL encryption across the Site, ensuring that data transmitted between your browser and our servers is protected
• Secure payment processing through Shopify's PCI DSS Level 1 compliant infrastructure — we do not store your full card number, CVV, or payment credentials on our systems
• Access controls limiting who within our organisation can access personal data, on a need-to-know basis
• Regular review of our security practices and those of our key third-party processors

Despite these measures, no method of data transmission over the internet or electronic storage is completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at treasures@shoplittleindia.co.uk.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will notify you directly where required by law.

We use cookies and similar technologies on the Site to help it function properly, to improve your experience, and to understand how visitors use our Site. Some cookies are strictly necessary for the Site to work; others are used for analytics or marketing purposes and are placed only with your consent.

Full details of the cookies we use, their purpose, who sets them, and how you can manage your preferences are set out in our Cookie Policy. You can update your cookie preferences at any time by clicking "Manage Cookies" in the footer of the Site.

Under the UK GDPR and EU GDPR, you have a number of important rights in relation to your personal data. We have set out each of these rights below, together with how you can exercise them.

The right to be informed

You have the right to be told clearly and transparently how we collect and use your personal data. This Privacy Policy fulfils that obligation.

The right of access

You have the right to request a copy of the personal data we hold about you. We will provide this free of charge within one month of receiving your request.

The right to rectification

If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it. You can update many of your details directly through your account on the Site.

The right to erasure ("the right to be forgotten")

You have the right to request that we delete your personal data in certain circumstances — for example, where it is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent. This right is not absolute and may be limited by our legal obligations.

The right to restrict processing

You have the right to ask us to restrict the processing of your personal data in certain circumstances — for example, while we are verifying the accuracy of data you have contested.

The right to data portability

Where we process your personal data on the basis of consent or contract performance, and by automated means, you have the right to receive a copy of that data in a structured, commonly used, machine-readable format, and to request that we transfer it to another controller.

The right to object

You have the right to object to processing based on our legitimate interests, including profiling. You also have an absolute right to object to your personal data being used for direct marketing purposes, at any time.

Rights related to automated decision-making and profiling

We do not make decisions about you solely by automated means that produce legal or similarly significant effects. If this changes, we will update this policy and notify you accordingly.

How to exercise your rights

To exercise any of the rights above, please contact us at treasures@shoplittleindia.co.uk or by post to Treasure & Trove Ltd, 82A James Carter Road, Mildenhall, Bury St Edmunds, Suffolk, IP28 7DE, United Kingdom. We will respond within one month. In some cases, we may need to verify your identity before processing your request.

The Site is not intended for children under the age of 16. We do not knowingly collect personal data from anyone under the age of 16. If you are under 16, please do not provide any personal data to us through the Site, and please ask a parent or guardian to act on your behalf.

If you are a parent or guardian and you believe that a child under the age of 16 has provided personal data to us without your consent, please contact us immediately at treasures@shoplittleindia.co.uk. We will take prompt steps to delete that data.

If you are a resident of California, USA, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). These rights include:

The right to know — you may request details of the personal information we have collected about you, the categories of sources from which it was collected, the purposes for which we use it, and the categories of third parties with whom we share it.

The right to delete — you may request that we delete the personal information we hold about you, subject to certain exceptions permitted by law.

The right to correct — you may request that we correct inaccurate personal information we hold about you.

The right to opt out of sale or sharing — we do not sell your personal information to third parties, nor do we share it for cross-context behavioural advertising purposes without your consent. If this changes, we will update this policy and provide you with an opt-out mechanism.

The right to non-discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California privacy rights, please contact us at treasures@shoplittleindia.co.uk. We will respond within 45 days, as required by law. You may designate an authorised agent to submit requests on your behalf — please contact us for details of how to do this.

We may update this Privacy Policy from time to time to reflect changes in how we handle personal data, changes in the law, or changes in our business. When we make material changes, we will update the "Last reviewed" date at the top of this page and, where appropriate, notify you by email.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Site following any updates constitutes your acknowledgement of the revised policy.

If you have any concerns about how we handle your personal data, or if you wish to exercise any of your rights, please contact us in the first instance — we would always prefer the opportunity to resolve things directly and promptly:

Email	treasures@shoplittleindia.co.uk
Post	Treasure & Trove Ltd, 82A James Carter Road, Mildenhall, Bury St Edmunds, Suffolk, IP28 7DE, United Kingdom

If you are not satisfied with our response, or if you believe we are processing your personal data in a way that does not comply with the law, you have the right to lodge a complaint with the relevant supervisory authority:

For UK customers — the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113

For EU customers — the data protection authority in your country of residence. A full list of EU supervisory authorities is available at edpb.europa.eu.

For California customers — the California Privacy Protection Agency (CPPA): cppa.ca.gov.

This Privacy Policy should be read alongside our Legal Notice, Cookie Policy, Terms of Use, and Conditions of Sale.