Legal Overview
This Privacy Policy ("Policy") is published in compliance with Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), framed under the Information Technology Act, 2000 (IT Act). It governs the collection, storage, processing, transfer, and deletion of personal information by CityCenterMall.
CityCenterMall is an individually registered trademark (™) owned by its Director / Proprietor. Technology infrastructure and platform operations are provided by Gadgetopia Technologies Private Limited, a company incorporated under the Companies Act, 2013, having its registered office in Pune, Maharashtra.
By accessing or using the CityCenterMall platform — whether through our website, mobile application, or any related digital service — you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, please discontinue use of our services immediately.
1. Information We Collect
We collect the minimum data necessary to provide our services. The categories of information collected are described below:
A. Personal Identification Information
- ✦ Full Name
- ✦ Mobile Number
- ✦ Email Address
- ✦ Date of Birth (optional)
- ✦ Gender (optional)
- ✦ Profile Photo (optional)
B. Contact & Address Information
- ✦ Delivery / Billing Address
- ✦ Pincode & City
- ✦ Geolocation (with consent)
C. Financial & Transaction Information
- ✦ Order & Payment History
- ✦ UPI / Wallet Identifiers
- ✦ Refund & Return Records
- ✦ Invoice & GST Records
Note: We do not store full card numbers, CVV, or banking credentials. Payment processing is handled exclusively by PCI-DSS compliant gateways.
D. Device & Technical Data
- ✦ IP Address
- ✦ Device Type & OS Version
- ✦ Browser Type & Version
- ✦ Device Identifiers (IMEI/UDID)
- ✦ Session Logs & Access Times
- ✦ Crash Reports & Diagnostics
E. Retailer / Business Information
- ✦ Business Name & PAN
- ✦ GSTIN & CIN
- ✦ KYC Documents (Aadhaar/Passport)
- ✦ Bank Account Details
2. Purpose & Lawful Basis of Processing
Under the SPDI Rules, personal data may only be processed for a specific, lawful purpose with the user's informed consent. Below are the purposes for which your data is used:
Processing purchases, coordinating with delivery partners, generating invoices, and tracking shipments.
Creating and managing your user account, authenticating logins, and maintaining account security.
Leveraging browsing history, purchase patterns, and preferences to deliver personalised product recommendations and search results.
Detecting fraudulent transactions, abuse, or suspicious activity using automated systems and human review.
Resolving queries, complaints, and disputes related to orders, payments, and platform services.
Sending promotional offers, newsletters, and event updates only where you have explicitly consented. You may withdraw consent at any time.
Meeting obligations under the IT Act, GST laws, FEMA, RBI regulations, and applicable Indian statutes.
Using aggregated and anonymised data to understand user behaviour, improve product features, and optimise platform performance.
4. Data Security
We implement reasonable security practices as required under Rule 8 of the SPDI Rules and ISO/IEC 27001-aligned standards. These include but are not limited to:
All data transmissions are protected using TLS 1.2+ (HTTPS) protocols.
Sensitive data is encrypted using AES-256 on secured cloud infrastructure.
Role-based access control (RBAC) ensures only authorised personnel can access personal data.
Regular security audits, penetration testing, and vulnerability scanning are conducted.
A documented data breach response plan is in place. Affected users will be notified as required by applicable law.
All staff with data access undergo periodic privacy and security awareness training.
While we strive to maintain the highest standards of security, no internet transmission or electronic storage method is 100% secure. Users are encouraged to maintain strong passwords and not share account credentials.
5. Data Retention
We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to the following guidelines:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Profile Data | Duration of account + 2 years | Business / Legal |
| Transaction Records | 7 years | GST Act / Income Tax Act |
| KYC Documents (Retailer) | 5 years post account closure | PMLA / RBI Guidelines |
| Server & Access Logs | 90 days | Security / IT Act |
| Marketing Preferences | Until consent withdrawal | Consent |
| Customer Support Records | 3 years post resolution | Legal / Audit |
Upon expiry of the applicable retention period, personal data is securely erased or anonymised using methods that prevent reconstruction.
6. Your Rights
As a data subject under the SPDI Rules and the forthcoming Digital Personal Data Protection Act (DPDP Act, 2023), you are entitled to the following rights:
You may request a copy of all personal data we hold about you, including its source and processing purpose.
You may request correction of inaccurate or incomplete personal data held by us.
You may request deletion of your personal data, subject to retention obligations mandated by Indian law.
You may withdraw consent for non-essential processing (e.g., marketing) at any time. Please note that withdrawal may limit access to certain platform features.
You may request your data in a structured, machine-readable format, where technically feasible.
You have the right to be notified if your personal data is compromised in a security breach affecting your rights.
To exercise any of these rights, please contact our Grievance Officer at support@citycentermall.in with subject line "Data Rights Request". We will respond within 30 days.
8. Children's Privacy
CityCenterMall is not directed at individuals under the age of 18 years. We do not knowingly collect, process, or store personal data of minors. If we become aware that personal data has been collected from a minor without verifiable parental consent, we will take immediate steps to delete such information.
Parents or guardians who believe their child's information has been collected should contact us at privacy@citycentermall.in immediately.
9. Third-Party Links & Services
Our platform may contain links to external websites, social media platforms, or partner services. CityCenterMall is not responsible for the privacy practices of such third parties. We encourage you to review their privacy policies independently.
The presence of a link on our platform does not constitute an endorsement of that website's privacy practices or content.
10. Grievance Redressal
In accordance with Rule 5(9) of the SPDI Rules, we have appointed a Grievance Officer to address data-related complaints. You may contact the Grievance Officer as follows:
| Name: | Grievance Officer – CityCenterMall |
| Organisation: | Gadgetopia Technologies Private Limited |
| Email: | privacy@citycentermall.in |
| Address: | Registered Office, Pune, Maharashtra, India |
| Response Time: | Within 30 days of receipt of complaint |
All complaints must be submitted in writing (email preferred) with the subject line "Privacy Grievance – [Your Name]". Providing full details of the issue will ensure a prompt resolution.
11. Governing Law & Jurisdiction
This Policy shall be governed by and construed in accordance with the laws of the Republic of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at:
12. Changes to This Policy
We reserve the right to update or modify this Privacy Policy at any time. Material changes will be communicated via:
- → A prominent notice on the CityCenterMall homepage
- → Email notification to registered users
- → In-app notification for mobile users
Continued use of the platform after the revised Policy takes effect constitutes acceptance of the updated terms. The "Last Updated" date at the top of this page will reflect the most recent revision.
13. Contact Us
For any privacy-related queries, data requests, or concerns, please reach out: