This Privacy Policy explains what personal data Commis Station collects when you use commisstation.com, place an order or contact us, and how we use, share and protect it. We collect only what we need to make, deliver and support your orders, and we never sell your personal data.
Who we are
This website is run by Shrada Mahesh Aswani, trading as Commis Station ("Commis Station", "we", "us" or "our"). We decide why and how your personal data is used, which makes us its Data Fiduciary under India's Digital Personal Data Protection Act, 2023.
Address: 2nd Floor, Plot No 233, 74 Floor, 2, Kakad Industrial Estate, Sitaram Keer Marg Off L J Road, Mahim, Mumbai, Maharashtra, 400016
Email: info.commisstation@gmail.com
Phone: +91 75064 30004
What we collect
What you give us
Account details: your name, mobile number and email address. We confirm your number or email address with a one-time code.
Delivery details: the recipient's name, phone number and full address, including the pincode, for each delivery address you save.
Order details: the items, choices (such as a filling or sauce) and quantities you order, the price you pay, your delivery or pickup date and slot, your timing preference, any coupon you use, and your confirmation that you have read the allergen information and our order policy.
Party orders: your event date, guest count and any other details you share about the event.
Your choices: whether you want to hear about offers, and the items you save to your wishlist.
Messages: what you tell us when you call, email or message us, for example when you report a problem with an order.
When you pay
Payments are handled by Razorpay. You enter your card, UPI or bank details in Razorpay's secure payment window, so they never reach our servers. Razorpay tells us the payment reference, amount, status and the type of payment method used (for example, UPI or card), so that we can confirm your order.
What we collect automatically
Sign-in and security records: when you sign in or ask for a sign-in code, we record the time, your IP address and the browser you used. This lets us show your signed-in devices on your Account page, limit how many codes can be sent and keep your account safe.
How the website is used: we count visits to product pages, carts, checkout and payment, and how many results a search returns, to understand what customers like and to improve the website. These records are linked to a random code, or to your account if you are signed in. They never include what you type into the search box, and they are deleted after 400 days.
How we use your personal data
To run your account: to create it, sign you in with one-time codes sent by WhatsApp or email, and show your orders, addresses and signed-in devices.
To make and deliver your order: to prepare your food, arrange delivery or pickup, send you order and payment updates, and send payment links for party orders.
To issue GST invoices and keep accounts: to create your invoice and keep the records that tax law requires.
To help you: to answer your questions and sort out any problem with an order.
To keep our business and website safe: to prevent fraud and misuse, protect your account and keep a record of refused deliveries (see below).
To improve our service: to understand which products and pages customers use, from the website records described above.
To send you offers, only if you agree: news, offers, and reminders about items you saved or left in your cart, by email or WhatsApp. You can stop these at any time.
We use your personal data with your consent, or where the law allows us to use it for a purpose without separate consent, such as completing an order you placed or keeping GST records.
Refused deliveries
Every order is made for a particular customer. If an order is refused at the door, the payment is not refunded (see our Refund Policy). We record the refusal and its reason against the name, phone number and delivery address on the order. When repeated refusals are linked to the same name, phone number or address, our team sees a warning on new orders and may decline further orders. This is always decided by a person, never automatically, and if we decline an order that has already been paid, we refund it in full.
Who we share it with
We share personal data only when it is needed to serve you, and only what is needed:
Delivery partners: when we deliver your order, we book a third-party delivery partner and give them the recipient's name, phone number and address. A copy of your GST invoice, which shows the same details, goes with the order.
The person you send: for self-pickup, we hand the order and its invoice to whoever you send to collect it, including a delivery service you book yourself.
Razorpay: to process your payment.
Messaging services: Meta's WhatsApp Business Platform, through the WhatsApp service provider we use, delivers our WhatsApp messages, and Google (Gmail) delivers our emails.
Hosting: our website and its data are stored on servers rented from Hostinger.
Professional advisers: our accountants, auditors and lawyers, when needed for tax, audits or legal advice.
Authorities: government bodies, courts or the police, when the law requires it, or to protect our rights, our customers or the public.
We never sell your personal data.
Data stored outside India
Some of our service providers, such as Google and Meta, may store or process data outside India. Any such transfer is made as Indian law permits.
How long we keep it
Account details and saved addresses: while your account is open. If you ask us to delete your account, we delete or anonymise them, except what the law requires us to keep.
Orders, payments and invoices: as long as tax and accounting laws require. For GST records this is generally at least six years.
Website usage records: 400 days.
Signed-in device records: until 400 days after the device was last used.
Refused-delivery records: as long as needed to protect our business from repeated refusals.
Security records and messages with us: as long as needed to keep the website safe, deal with your request or meet a legal requirement.
Your rights
Under India's Digital Personal Data Protection Act, 2023, you can:
ask for a summary of the personal data we hold about you, how we use it and who we have shared it with;
correct, complete or update your personal data. You can change your name, phone number, email address and delivery addresses yourself on your Account page;
ask us to delete your personal data, unless the law requires us to keep it (for example, invoices);
withdraw your consent at any time, for example to stop marketing messages. This does not affect anything we did before you withdrew it;
nominate someone to use these rights for you if you die or are unable to use them yourself;
complain to our Grievance Officer and, if you are not satisfied with our answer, to the Data Protection Board of India.
To use any of these rights, contact our Grievance Officer (details below). We may ask you to confirm your identity first.
Marketing messages
We send offers and reminders only if you have agreed to receive them. You can stop them at any time:
Email: use the unsubscribe link in any marketing email.
WhatsApp: reply STOP.
Account page: change your marketing choices.
We will still send the messages you need about your orders, such as sign-in codes, order updates, payment links and invoices.
Cookies
We use only the cookies the website needs to work:
a session cookie that keeps your cart and keeps you signed in while you browse;
a security cookie that protects the website's forms from misuse;
cookies that remember your browser, so you can stay signed in and can see and sign out your devices from your Account page.
We do not use advertising or third-party tracking cookies. When you pay, Razorpay's payment window may use its own cookies, as described in Razorpay's privacy policy.
How we protect it
The whole website uses an encrypted (HTTPS) connection. Only authorised staff can see customer data, through their own password-protected accounts. Sign-in codes are short-lived and can be used only once, and your payment details stay with Razorpay. No website can be completely secure, so if a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.
Children
You must be 18 or older to create an account or place an order. If you are under 18, please ask a parent or guardian to order for you. If we learn that we hold a child's personal data without a parent's or guardian's consent, we will delete it.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it last changed. If we make important changes, we will tell you on the website or by email.
Grievance Officer and contact
For any question, request or complaint about your personal data, contact our Grievance Officer:
Name: Divesh Aswani
Designation: Grievance Officer
Email: info.commisstation@gmail.com
Phone: +91 75064 30004
Address: 2nd Floor, Plot No 233, 74 Floor, 2, Kakad Industrial Estate, Sitaram Keer Marg Off L J Road, Mahim, Mumbai, Maharashtra, 400016
We will acknowledge your complaint within 48 hours and aim to resolve it within one month.