Privacy Policy

Karkana is the Data Fiduciary for the personal data described in this policy. We operate from Hyderabad and sell crackers and pyrotechnic products for delivery within India on a cash-on-delivery basis.

You can reach us at info@setacore.com or on 7207294554.

We collect only what is needed to take, fulfil and support an order:

• Identity data: your name, and email address if you create an account.
• Contact data: mobile number and delivery address, including pincode.
• Order data: the products you order, quantities, and order history.
• Account data: a hashed password, saved addresses and your wishlist.
• Uploads: photographs you submit for personalized packaging.
• Technical data: IP address, device type and the pages you view.

We do not collect payment card data. Orders are cash on delivery, so no card number or UPI credential ever reaches our systems.

We process personal data either on the basis of your consent, or as a legitimate use under Section 7 of the DPDP Act.

• Consent: creating an account, saving addresses, adding to your wishlist, and uploading a personalization photograph.
• Legitimate use: taking and fulfilling an order you have placed, responding to a query you have raised, and complying with a legal obligation such as maintaining transaction records.

Where we rely on consent, you can withdraw it at any time using the contact details above, or by deleting the relevant item from your account. Withdrawal does not affect processing that already happened, and we may still need to keep records to fulfil or evidence an existing order.

Our products are fireworks and pyrotechnics. Sale and use are restricted to adults, and you must be 18 or older to place an order.

We do not knowingly collect personal data from anyone under 18, and we do not carry out behavioural monitoring or targeted advertising directed at children. If you believe a minor has submitted data to us, contact us and we will delete it.

Order records are retained for the period required under applicable tax and commercial law, and for as long as needed to resolve disputes. Account data is kept until you delete your account or ask us to.

Personalization photographs are kept only until your order is produced and delivered, unless you ask us to retain them for a repeat order.

We do not sell your personal data. We share it only where it is necessary to fulfil your order, and only to the extent required:

• Delivery personnel: your name, mobile number and address, for the purpose of completing delivery.
• Cloud and storage providers: who host this application and its database under contractual confidentiality obligations.
• Authorities: where we are required to disclose by law or a valid legal order.

Our infrastructure is operated by providers who process data on our instructions. If any processing happens outside India, it will only be to jurisdictions permitted under the DPDP Act and the rules made under it.

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you, and the identities of parties we have shared it with.
• Correct or complete inaccurate or misleading data.
• Erase data that is no longer necessary for the purpose it was collected for.
• Grievance redressal, through the contact point below.
• Nominate another individual to exercise these rights on your behalf, in the event of your death or incapacity.

To exercise any of these rights, email info@setacore.com from the email address on your account, or write to us quoting your order ID.

You can raise a grievance about how your personal data is handled by writing to info@setacore.com. We will acknowledge it and respond within the timelines prescribed under the DPDP Act and the Consumer Protection (E-Commerce) Rules, 2020.

If you are not satisfied with our response, you may approach the Data Protection Board of India.

We apply reasonable technical safeguards proportionate to the data we hold: passwords are stored as salted, high-iteration hashes and never in plain text; session cookies are HTTP-only and transmitted over TLS; and access to the operator console is restricted to authenticated staff.

No system is perfectly secure. If a personal data breach occurs that affects you, we will inform you and the Data Protection Board as required by law.

We use two categories. A session cookie keeps you signed in. Browser local storage holds your cart so it survives a page refresh.

We do not use third-party advertising cookies or cross-site tracking. Clearing cookies and site data in your browser will sign you out and empty your cart.

We may update this policy. Material changes will be reflected in the effective date at the top of this page, and we will seek fresh consent where the change requires it.