Data
Processing.
What happens to your data after you hand it over: who touches it, where it goes, how long we keep it, and how we keep it safe.
Our role
Under India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, Fauji Funk is the Data Fiduciary for the personal data you give us through this website: we decide why and how it’s used. The companies that help us run the store are Data Processors. They act only on our instructions, under written contracts that require them to keep your data secure and confidential.
This page sets out what we process, who processes it for us, where it goes and how we protect it. It sits alongside our privacy policy, which explains your rights.
New Delhi, India
What we process and why
| Purpose | Data | Basis | Kept for |
|---|---|---|---|
| Taking, making and delivering orders | Name, email, phone, delivery address, items, personalisation text | You provide it to place the order | 8 years (tax records) |
| Payments and refunds | Payment status and reference. Never card numbers, CVV or UPI PIN. | You provide it to pay | 8 years |
| GST invoices and accounts | Name, billing address, GSTIN if given, order values | Legal obligation | 8 years |
| Your account | Name, email, sign-in ID, saved addresses, wishlist | Consent when you sign up | Until you delete it, then 30 days |
| Customer support | Messages, order reference, photos you send | You provide it to get help | 3 years |
| Newsletters | Email address | Consent (opt-in) | Until you unsubscribe |
| Analytics and session recordings | Pages visited, clicks, device and browser, approximate location, campaign source. Form fields are masked. | Consent (cookie choice) | Recordings 30 days. Events up to 24 months. |
| Advertising measurement | Ad click IDs, visits and purchases | Consent (cookie choice) | Not in use today |
| Security and fraud prevention | IP address, request logs | Legitimate use: keeping the service safe | Up to 90 days |
Who processes it for us
| Processor | What they do | Where |
|---|---|---|
| Cloudflare | Hosts the website and database, delivers pages, blocks attacks | Global network, including India |
| Razorpay | Processes payments and refunds (PCI-DSS compliant) | India |
| Zitadel | Secure account sign-in | Cloud region set by our account |
| Resend | Sends order, proof and dispatch emails | United States |
| Shiprocket, courier partners, India Post | Collect and deliver parcels: name, address and phone only | India |
| PostHog | Analytics and session recordings, only with your consent | United States |
| Google, Meta | Ad measurement, only if we enable it and you consent | United States and others |
We tell you here before we add a new processor. Our full list, with contract details, is available on request.
Transfers outside India
Some processors store or handle data outside India, as shown above. The DPDP Act allows this except to countries the Government of India restricts by notification. We don’t send personal data to any restricted country, and we require each processor to protect it to the same standard we do.
How we protect it
- Everything travels over HTTPS, with HSTS enforced.
- Card and UPI details go straight to Razorpay and never touch our servers.
- Sign-in sessions use secure, HttpOnly cookies, and we store only a one-way hash of each session token.
- Staff access is limited by role, and every back-office action is written to an audit log.
- Session recordings hide every input field, and analytics loads only after you consent.
- We collect the minimum needed, and we delete or anonymise data when its retention period ends.
If something goes wrong
If we become aware of a personal data breach, we will tell the people affected without delay: what happened, what it means for them and what they can do. We will report it to the Data Protection Board of India and send the Board a detailed report within 72 hours, as the DPDP Rules require. Our processors must tell us about any breach on their side promptly.
Unit and regimental orders
When a unit, mess or association sends us a list of names, ranks or numbers to personalise an order, the unit decides what goes on that list, and we use it only to make and deliver that order.
- The person placing the order confirms the unit is entitled to share the list for this purpose.
- We use the list only to make, proof and deliver the order. It’s never used for marketing.
- We delete the list 90 days after delivery, unless the unit asks us to keep it for repeat orders.
- Please don’t send posting details or anything operational or classified. We don’t need it.
Units that need a signed data processing agreement can ask for one at privacy@faujifunk.com.
Requests and contact
To see, correct or delete your data, withdraw consent or nominate someone to act for you, email privacy@faujifunk.com. We reply within 30 days. Details of our Grievance Officer are in the privacy policy, and cookie choices are explained in the cookie policy.
Last updated 19 October 2026
Talk to a person, not a form.
Write to orders@faujifunk.com or WhatsApp us, Monday to Saturday, 10:00 to 18:00 IST. Have your order reference (FF-XXXXXX) handy.