- The cross-border transfer claim is almost certainly false. The page states that visitors’ information “will be transferred outside of India, including to Canada and the United States.” That sentence is Shopify’s standard boilerplate, and Shopify’s infrastructure is in Canada and the US. kcgr.in runs on WordPress. Unless you can point to where the data actually goes, this sentence is a false statement about personal data handling on your own privacy policy, which is a worse place to be wrong than anywhere else on the sit.
- No DPDP Act compliance. The Digital Personal Data Protection Act, 2023 requires, among other things, a named Grievance Officer with contact details, a clear statement of the purpose of collection, and a defined retention period. None of these are present. “Unless and until you ask us to delete this information” is not a retention policy.
- Confirm the behavioural advertising section is true. It gives opt-out links for Facebook, Google and Bing advertising. If kcgr. in does not actually run those pixels, delete the whole section rather than leave a claim that you are doing targeted advertising you are not doing.
- “If you are a Indian resident” → “an Indian resident”. Appears once.
- Update the “Last updated” date when the rewrite goes live. It currently reads 12 January 2025.
