This notice explains what personal data SLM Boutique collects, why, what you can ask us to do about it, and who to complain to if we get it wrong. It is written for India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Last updated: 9 September 2026
1. Who we are
SLM Boutique is the Data Fiduciary for the personal data described here — meaning we decide why and how it is processed, and we are accountable for it.
SLM Boutique166/1, NGGO Nagar Main Road, Moolapalayam
Erode, Tamil Nadu 638002, India
Email: slmboutique.erode@gmail.com
Phone / WhatsApp: +91 92837 78899
2. What we collect and why
Under section 5 of the DPDP Act you are entitled to an itemised notice. This is it.
| What we collect | Why we need it | Basis |
|---|---|---|
| Name, delivery address, phone number, email | To take payment for, pack, ship and deliver your order, and to contact you about it | Consent, given when you place the order |
| Order and payment status (we do not store card or UPI credentials) | To confirm payment, issue invoices, process refunds and meet tax and accounting obligations | Consent and legal obligation |
| WhatsApp and email correspondence | To answer your questions, send photographs of stock, and keep a record of what was agreed | Consent, given when you message us |
| Marketing preferences and email address | To send new-arrival and offer emails, only if you opt in | Consent, withdrawable at any time |
| Website usage data (pages viewed, device and browser type, approximate location from IP) | To keep the site working, prevent fraud and understand which collections people actually use | Consent for analytics cookies; legitimate use for security |
| Returns and complaint records | To process a return and to defend or resolve a dispute | Consent and legitimate use |
We do not sell your personal data. We do not buy mailing lists. We do not profile you for advertising beyond the basic audience tools inside the platforms we name below.
3. Your consent, and how to take it back
Where we rely on consent, that consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action — ticking a box, placing an order, or messaging us. We will not make you consent to marketing in order to buy something.
You can withdraw consent at any time, and it must be as easy to withdraw as it was to give. To withdraw:
- Marketing emails: click unsubscribe at the foot of any email, or email us
- WhatsApp messages: reply STOP and we will remove you
- Analytics cookies: decline them in the cookie banner, or clear them in your browser
- Everything else: email slmboutique.erode@gmail.com
Withdrawing consent does not undo processing that already happened lawfully. Where we still need data to complete an order you have placed, or to meet a legal obligation such as tax records, we will tell you plainly what we must keep and for how long.
4. Your rights as a Data Principal
Sections 11 to 14 of the DPDP Act give you the following rights. Exercise any of them by emailing slmboutique.erode@gmail.com. We respond within 7 working days, and resolve within 30 days.
Right to access information
You can ask for a summary of the personal data we hold about you, what we are doing with it, and the identities of any other Data Fiduciaries and Processors we have shared it with.
Right to correction, completion, updating and erasure
You can ask us to correct anything inaccurate, complete anything partial, update anything stale, or erase your data entirely — except where we are required by law to retain it, such as invoices held for tax purposes.
Right of grievance redressal
You can complain to our Grievance Officer about anything in this notice or about how we have handled your data. See section 5 below. You must use this route before approaching the Data Protection Board.
Right to nominate
You can nominate another individual to exercise these rights on your behalf if you die or become incapacitated. Email us the nominee's name and contact details and we will record it against your account.
5. Grievance Officer
If something has gone wrong, this is the person responsible for putting it right.
Grievance Officer — SLM Boutique166/1, NGGO Nagar Main Road, Moolapalayam
Erode, Tamil Nadu 638002, India
Email: slmboutique.erode@gmail.com
Phone / WhatsApp: +91 92837 78899
Subject line: DPDP Grievance
Acknowledgement within 48 hours. Resolution within 30 days.
If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India established under the DPDP Act.
6. Your duties
Section 15 of the Act places duties on you too, and we mention them because they protect both of us. Please give accurate information, do not impersonate anyone else when registering or claiming a refund, do not suppress material information, and do not file false or frivolous grievances.
7. Who else sees your data
We share the minimum necessary with Data Processors acting on our instructions:
- Shopify — the platform this store runs on; hosting, order records, checkout
- Payment gateway — processes your payment. Card and UPI credentials go directly to them and are never stored by us
- Courier and logistics partners — receive your name, address and phone number to deliver the parcel
- Email and messaging providers — to send order updates and, if you opted in, marketing
- Analytics providers — only where you accepted analytics cookies
- Our accountants and, where legally compelled, government authorities
8. Transfers outside India
Some of the providers above process data on servers outside India — Shopify, for example, hosts in North America and other regions. The DPDP Act permits transfer of personal data outside India except to territories the Central Government restricts by notification. Where a transfer happens we require the provider to protect your data under contract to a standard consistent with this notice, and we will stop transferring to any territory that is subsequently restricted.
9. How long we keep it
- Order, invoice and tax records: 8 years, as required under Indian tax and companies legislation
- Correspondence about an order or return: 3 years from resolution
- Marketing consent records: until you withdraw, then a suppression record so we do not contact you again by mistake
- Analytics data: 14 months
Once the purpose is served and no legal obligation requires retention, we erase the data and require our Processors to do the same.
10. Keeping it safe
We apply reasonable security safeguards as required by section 8(5): encryption in transit across the site and checkout, access limited to the staff who need it, no storage of payment credentials on our systems, and periodic review of who holds access. No system is perfect, and we will not claim otherwise.
11. If there is a breach
If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal, in the form and timeframe the Act and its rules require. Our notice to you will describe what happened, what data was involved, what we are doing about it, and what we suggest you do.
12. Children
This store is intended for adults. We do not knowingly process the personal data of anyone under 18 without verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child's data has reached us, tell the Grievance Officer and we will erase it.
13. Cookies
Strictly necessary cookies keep your cart and session working and cannot be switched off. Analytics and preference cookies are set only if you accept them, and you can change your mind at any time through the cookie banner or your browser settings.
14. Changes
If this notice changes materially we will update the date at the top and, where the change affects how we use data you have already given us, tell you directly before it takes effect.
Questions about any of this: slmboutique.erode@gmail.com or +91 92837 78899.