1. Who we are
Kalash & Co makes miniature mandirs to order in the United Kingdom. We are the data controller for personal data collected through www.kalashandco.com.
For anything in this policy, use the contact form at the bottom of this page.
2. What we collect
When you place an order through the form on this site:
- Your name and email address
- The country you want it delivered to
- The shikhar and finish you chose, and which part of the page you ordered from
We do not take card details on this website, so we never hold them. If your order goes ahead, payment is arranged separately and the payment provider handles those details, not us.
Automatically, when you visit:
- Your IP address, browser, device type and approximate location
- Which pages you looked at, what you clicked, and where you arrived from
- Which shikhar and finish you looked at, and how far through the order you got
- Where you clicked and how far down you scrolled, counted together with everybody else rather than kept as a recording of your visit
None of it is tied to you. We use no cookies at all, so there is nothing stored on your device and nothing that follows you from one visit to the next. Come back tomorrow and we have no way of knowing it is you.
3. Why we use it
- To answer your order, confirm what you chose, quote postage to your country and arrange delivery. The lawful basis is performance of a contract, or steps taken at your request before entering one.
- To understand which parts of this page lead to orders, so we know whether the product is worth making. The lawful basis is our legitimate interest in knowing whether the thing we are making is wanted. It is measured without cookies and without identifying anybody, which is what keeps that interest a fair one.
We do not use your details to market anything unrelated, and we do not sell or rent them to anybody.
4. Who else sees it
- Netlify hosts this site and receives your order form. This is the only one of them that sees your name and email. Their servers are in the United States.
- PostHog provides the analytics described in section 2, on their European servers. They receive no name and no email: the order event tells them only which shikhar and finish was chosen and which country it is going to.
- Google receives analytics and advertising data, so we can tell which adverts brought people who ordered. Nothing is sent to Google unless you accept cookies.
- A delivery carrier receives the name and address needed to deliver a confirmed order.
We do not sell or rent your details to anybody, and nobody else receives them. Transfers outside the UK rely on the UK International Data Transfer Addendum or an adequacy decision.
5. Cookies
This site sets no cookies. Not for analytics, not for advertising, not to remember you. Nothing is written to your browser's storage either.
That is also why there is no cookie banner asking you to agree to any. There is nothing to agree to.
6. How long we keep it
- Order enquiries that do not become orders: two years, then deleted.
- Completed orders: six years from the end of the tax year they fall in, because HMRC requires it.
- Analytics: as long as the cookie you accepted lasts, up to two years.
7. Your rights
You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Use the contact form at the bottom of this page and we will respond within one month.
If you are not satisfied with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk.
8. Security
The site is served over HTTPS and submissions are encrypted in transit. No system is perfectly secure, so we hold as little as we can and for no longer than we have to.
9. Changes
If this policy changes we update it here. Nothing is applied retrospectively to data already collected under an earlier version.