Privacy Policy

At Indo Marketplace ("we," "us," or "our"), we are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website indo-shop.com or make a purchase from us.

This policy is designed to comply with applicable privacy laws, including the General Data Protection Regulation (GDPR) for our European Union customers and the California Consumer Privacy Act (CCPA) for California residents.

Status of this document

1. Information We Collect

1.1 Personal Information You Provide

We collect information you voluntarily provide to us, including:

• Account Information: Name, email address, password, phone number
• Billing Information: Billing address, payment card details (processed securely through Stripe)
• Shipping Information: Delivery address, recipient name, contact details
• Communication Data: Messages you send us, customer service inquiries, reviews
• Marketing Preferences: Your choices regarding promotional communications

1.2 Information Collected Automatically

When you visit our website, we automatically collect certain information:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages viewed, time spent on pages, links clicked, referring URLs
• Location Data: General geographic location based on IP address
• Cookies and local storage: What this site stores in your browser, and what it does not (see section 12 below)

1.3 Information from Third Parties

We may receive information about you from:

• Payment processors (transaction confirmations)
• Analytics providers (website usage statistics)
• Social media platforms (if you connect your account)

2. How We Use Your Information

We use your personal information for the following purposes:

2.1 To Provide Our Services

• Process and fulfill your orders
• Send order confirmations and shipping updates
• Manage your account and provide customer support
• Process payments and prevent fraud

2.2 To Improve Our Services

• Analyze website usage and trends
• Develop new features and products
• Personalize your shopping experience
• Conduct research and analytics

2.3 To Communicate With You

• Send transactional emails (order confirmations, shipping updates)
• Respond to your inquiries and requests
• Send promotional communications (with your consent)
• Notify you about changes to our policies

2.4 To Ensure Security and Compliance

• Detect and prevent fraud or abuse
• Comply with legal obligations
• Enforce our terms of service
• Protect our rights and the rights of others

3. Legal Basis for Processing (GDPR)

For our EU customers, we process your data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill our contract with you (e.g., order processing)
• Legitimate Interests: Processing for our legitimate business interests (e.g., fraud prevention, analytics)
• Consent: Processing based on your explicit consent (e.g., marketing emails)
• Legal Obligation: Processing required to comply with applicable laws

4. How We Share Your Information

We may share your information with:

4.1 Processors we use

These are the processors that receive personal data through this site. This list names every one of them, and nothing that is not one:

• Vercel Inc. — hosting and delivery of this site. Receives every request, including IP address and user agent.
• Supabase, Inc. — database and authentication. Holds your account, your addresses and your order history.
• Stripe Payments Europe, Ltd. — payment processing. Loads on the checkout page only, and only when you reach the payment step. It does not load on any other page of this site.
• Cloudinary Ltd. — image delivery. Product images are requested from res.cloudinary.com on every page that shows one. It sets no cookie.
• Resend, Inc. — transactional email: order confirmations, shipping notifications, password resets.
• Functional Software, Inc. (Sentry) — error monitoring, EU region, ingest host ingest.de.sentry.io. Session replay is switched off and no session recording is collected. It loads on every page, before any consent is asked for — see the Cookies section below.

No analytics provider, no advertising network, no tracking pixel and no consent management platform is used on this site. There is no Google Analytics, no Vercel Analytics, no Meta or Facebook pixel, no TikTok pixel and no Google Ads tag. This was verified by search over the whole codebase on 26 and 27 August 2026.

4.2 Legal Requirements

We may disclose information when required by law, court order, or government request, or when we believe disclosure is necessary to protect our rights or the safety of others.

4.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4.4 With Your Consent

We may share your information in other ways with your explicit consent.

5. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer data internationally, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

6. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy. Specifically:

• Account Data: Retained while your account is active and for 3 years after deletion
• Transaction Data: Retained for 7 years for tax and legal compliance
• Marketing Data: Retained until you withdraw consent or unsubscribe
• Analytics Data: Retained for 26 months in aggregated form

7. Your Rights

7.1 Rights for All Users

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Opt-Out: Unsubscribe from marketing communications

7.2 Additional Rights for EU Residents (GDPR)

• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Request limitation of processing
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time for consent-based processing
• Right to Lodge a Complaint: File a complaint with your local data protection authority

7.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at support@indo-shop.com. We will respond to your request within 30 days (or sooner if required by law). We may need to verify your identity before processing your request.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL)
• Secure payment processing through PCI-compliant providers
• Access controls and authentication measures
• Regular security assessments and monitoring
• Employee training on data protection

However, no method of transmission over the internet is completely secure. We cannot guarantee the absolute security of your data.

9. Children's Privacy

Our Services are not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to read their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we may also notify you by email.

12. Cookies and local storage

What this site stores in your browser was measured on 27 August 2026 with a clean browser profile, on both the English and the German home page. This section states the measurement.

12.1 Cookies

One cookie is set, on every page, in both languages: NEXT_LOCALE. It is a first-party session cookie holding your interface language and nothing else — the value is "en" or "de". It expires when you close your browser. No third-party cookie is set by any origin, including Cloudinary and Sentry.

12.2 Local storage

Local storage is empty when you arrive. Three keys can be written, each only by something you do:

• cookie-consent — written when you press Accept or Decline on the cookie notice.
• indo-recent-searches — written when you run a search, so your recent searches are offered back to you.
• indo-cart-storage — written when you add something to your basket, so the basket survives a reload.

All three stay in your browser and are never sent to us. Clearing site data removes them.

12.3 What the notice does not do

The Accept/Decline notice at the bottom of the page is a notice, not a consent gate. Sentry, our error monitoring, is initialised on every page load before the notice is drawn, and pressing Decline does not stop it — this was measured, not assumed. That request carries your IP address to Sentry's EU ingest host. Nothing else is withheld or released by the choice either, because there is nothing else to gate: this site runs no analytics and no advertising code at all.

13. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

• Email: support@indo-shop.com
• Company: SGM Tripathi UG (haftungsbeschränkt)
• Data Protection Inquiries: support@indo-shop.com

For EU residents, you have the right to lodge a complaint with your local supervisory authority if you believe we have not adequately addressed your concerns.