Privacy Policy

Privacy Policy — By The Mountain

This Privacy Policy is published in accordance with the Information Technology Act, 2000, applicable rules made there under, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and describes how RawNectary Private Limited ("RawNectary", "By The Mountain", "we", "us", "our"), collects, uses, stores, and shares personal data of users ("you", "your") of www.bythemountain.com ("Site").

By using the Site or placing an order, you consent to the practices described in this Policy.

1. Information We Collect

We collect only the information reasonably necessary to fulfil your orders, provide customer support, and (where you consent) send you marketing communications:

Contact & identity data: name, email address, phone number, delivery/billing address
Order data: items purchased, order value, order history, delivery preferences
Payment data: processed by our third-party payment gateway; we do not store your full card/UPI credentials
Checkout & abandoned-cart data: if you begin a checkout on the Site but do not complete it, Shopify captures the contact details you entered so we may follow up with a reminder
Communications: records of your emails, WhatsApp messages, or calls with our customer support
Usage data: pages visited, device/browser type, IP address, and similar data collected automatically via cookies and analytics tools (see Section 4)

We do not access your phone's contacts, SMS inbox, call logs, or precise device location. We do not have a mobile app.

2. How We Use Your Information

To process, fulfil, and deliver your orders
To contact you regarding order confirmations, delivery updates, and support queries (via email, SMS, or WhatsApp)
To follow up on abandoned checkouts
To store your details in our customer relationship management (CRM) system for support and marketing purposes
Where you have consented, to send you promotional offers, new product updates, and marketing communications via email or WhatsApp
To improve the Site and our product offerings through aggregated, anonymized analysis
To comply with applicable law, prevent fraud, and enforce our Terms of Service

3. Legal Basis & Consent

We collect and process your personal data on the basis of your consent (provided at checkout or through your continued use of the Site) and, where applicable, for the performance of a contract (fulfilling your order).

You may withdraw consent for marketing communications at any time (see Section 7) without affecting the processing of data necessary to complete an existing order.

4. Cookies & Analytics

The Site uses cookies and similar technologies to:

Remember your cart and preferences
Understand how visitors use the Site (via Google Analytics or similar tools)
Measure and improve the performance of our advertising (via Meta/Facebook Pixel or similar tools)

You can control or disable cookies through your browser settings; doing so may limit certain features of the Site. You can opt out of Google Analytics tracking here: https://tools.google.com/dlpage/gaoptout

5. How We Share Your Information

We share your information only with:

Shopify, our e-commerce hosting platform
Payment gateway providers, to process transactions
Delivery/logistics partners, to fulfil and deliver your order
Our CRM/WhatsApp service provider, to store your contact details and enable order updates and marketing messages
Analytics and advertising partners (e.g. Google, Meta), in aggregated or pseudonymized form where possible
Law enforcement or regulators, where required by applicable law
A successor entity, in the event of a merger, acquisition, or sale of business assets

We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, including any period required to comply with legal, accounting, or tax obligations. You may request deletion of your data at any time, subject to Section 8.

7. Your Rights & Choices

Under the DPDP Act and applicable law, you have the right to:

Access the personal data we hold about you
Correct or update inaccurate data
Withdraw consent for marketing communications at any time, by replying "STOP" to any WhatsApp/SMS message or emailing hello@bythemountain.com
Request deletion of your data, subject to any legal retention requirements
Raise a grievance regarding how your data is handled (see Section 9)

Opting out of marketing communications does not affect transactional messages related to an active order.

8. Data Security

We use reasonable security practices, including SSL encryption for data in transit, restricted employee access to personal data on a need-to-know basis, and secure hosting via Shopify's infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Grievance Officer

In accordance with the Information Technology Act, 2000 and rules thereunder:

Name: Hazin Mir Email: info@rawnectary.com Response time: Grievances will be acknowledged within 48 hours and addressed within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date. Continued use of the Site after changes are posted constitutes acceptance of the revised Policy.

11. Governing Law

This Policy is governed by the laws of India, and any disputes shall be subject to the exclusive jurisdiction of the courts at Srinagar, J&K.