We're not taking new orders right now. You can still browse, save to wishlist, and track existing orders.

Chynabazar

Privacy Policy

CUSTOMER DATA PROTECTION (CHYNABAZAR E-COMMERCE)

 

This section supplements the Chynabazar User Agreement (customer-facing terms).

 

1.1.      Customer Data We Process

We process customer name, delivery address, phone number, email address, order history, delivery notes, return records, payment transaction IDs (full payment details are handled by PCI DSS-compliant gateways such as eSewa and Khalti – we do not store CVV, raw card numbers, or UPI PINs), and device and browsing data including IP address, browser type, and session cookies for fraud prevention and analytics.

 

1.2.      Purpose Limitation

Customer data is used only for processing and delivering orders; customer support, returns, and refunds; fraud detection and prevention; sending operational notifications such as order confirmation and delivery updates (which the customer cannot opt out of); and sending marketing communications only with explicit opt-in consent.

 

1.3.      Customer Data Retention

Active order and account data is retained for the duration of the account plus 2 years. Inactive accounts with no login for 3 consecutive years are retained for 1 year and then anonymized. Marketing consent records are kept until withdrawn plus 1 year. Fraud investigation data is retained for 5 years from the last incident.

 

1.4.      Customer Rights

Customers may access their data via the Chynabazar account dashboard, request correction of inaccurate data, request deletion of their account and associated data subject to legal retention requirements, or opt out of marketing communications at any time via link in email or account settings. Requests are processed within 30 days and are free of charge. For deletion requests, data will be anonymized or deleted except for records required for tax or fraud prevention, which are retained for the periods stated above.

 

1.5.    CCTV & Call Recording: Where CCTV cameras or call recording systems are used on company premises or for customer support, signage or verbal notice must be provided to individuals. Recordings are retained for no more than 30 days unless required as evidence for an active investigation.

 

1.6.    Data Minimization: The Company shall collect and process only the minimum personal data necessary for the stated purpose and shall avoid collecting excessive or irrelevant information.