1. Introduction

Portus Packaging Private Limited ("we", "us", "our") operates this Shopify store. We respect your privacy and comply with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act), once operative. This Privacy Policy explains how we collect, use, and safeguard your digital personal data when you interact with our website and services.

2. Who We Are

• Merchant: Portus Packaging Private Limited, Gujarat, India
• Grievance Email: portusworldwide@gmail.com
  

3. Personal Data We Collect

• Contact & Identity Data: Name, email, phone number, billing and shipping addresses
• Order & Account Data: Payment information, order history, account details
• Device & Behavior Data: IP address, browser/device type, session analytics
• Marketing & Analytics Data: Information from tools such as Google Analytics 4, Google Ads (remarketing & conversion tracking), and Meta Pixel

4. Cookies & Tracking

We use both essential and non-essential cookies.

• Essential cookies help our store function (cart, checkout, login).
• Non-essential cookies (Google Analytics, Google Ads, Meta Pixel) are enabled only if you provide explicit opt-in consent via our cookie banner.
  This consent framework is configured through Shopify’s Customer Privacy settings or a Consent Management Platform (CMP) integrated with Google Consent Mode v2.

5. Purpose & Legal Basis

Purpose

Order processing & customer support

Site analytics & performance improvement

Marketing & remarketing ads

Data Collected

Contact, transaction, account info

Technical & behavioral data

Ad identifiers, usage behavior

Legal Basis

Contract / Legal necessity

Legitimate interest with consent

Explicit opt-in consent (DPDP Act)

6. Third-Party Services

Your data may be shared with and processed by trusted service providers, including:

• Shopify Commerce Singapore Pte. Ltd. (data processor under Shopify’s DPA)
• Google Analytics, Google Ads, Meta Pixel (active only after consent)
• Payment gateways, logistics providers, and email platforms—engaged under contracts that comply with DPDP requirements

7. Consent & Withdrawal

We obtain consent that is free, specific, informed, and affirmative in accordance with the DPDP Act.

• You may withdraw consent anytime via the cookie banner or by contacting us.
• Once withdrawn, non-essential tracking cookies will no longer be set for future sessions.

8. Your Rights (Under the DPDP Act)

Once the DPDP Act becomes fully operational, you will have the following rights:

• Right to access, correct, or erase your data (“right to be forgotten”)
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time
• Right to nominate a representative (in case of incapacity or death)

Requests can be submitted to our Grievance Officer at the email above. If unresolved, you may escalate to the Data Protection Board of India.

9. Children’s Data

We do not knowingly collect or process personal data from individuals under the age of 18. If such data is collected inadvertently, we will:

• Seek verifiable parental/guardian consent, and
• Disable targeted advertising or profiling of minors.

10. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy or to comply with legal obligations. After that, the data is securely deleted or anonymized.

11. Security Measures

We maintain reasonable technical and organizational safeguards as per the IT Act and SPDI Rules, including:

• Encryption of sensitive data
• Access control mechanisms
• Data breach response protocols

In the event of a personal data breach, we will notify the Data Protection Board of India within 72 hours.

12. Automated Decisions & Profiling

We do not rely solely on automated decision-making that significantly affects users.

• Limited profiling may occur (e.g., product personalization or recommendations).
• Such profiling is performed only with your explicit consent and transparency.

13. Policy Updates

This Policy may be updated to reflect changes in law (e.g., DPDP Rules 2025) or business practices. Significant updates will be communicated via website announcements or email. The revision date will always be displayed at the top of this page.