Data
Processing.

Our role

Under India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, Fauji Funk is the Data Fiduciary for the personal data you give us through this website: we decide why and how it’s used. The companies that help us run the store are Data Processors. They act only on our instructions, under written contracts that require them to keep your data secure and confidential.

This page sets out what we process, who processes it for us, where it goes and how we protect it. It sits alongside our privacy policy, which explains your rights.

What we process and why

Who processes it for us

We tell you here before we add a new processor. Our full list, with contract details, is available on request.

Transfers outside India

Some processors store or handle data outside India, as shown above. The DPDP Act allows this except to countries the Government of India restricts by notification. We don’t send personal data to any restricted country, and we require each processor to protect it to the same standard we do.

How we protect it

• Everything travels over HTTPS, with HSTS enforced.
• Card and UPI details go straight to Razorpay and never touch our servers.
• Sign-in sessions use secure, HttpOnly cookies, and we store only a one-way hash of each session token.
• Staff access is limited by role, and every back-office action is written to an audit log.
• Session recordings hide every input field, and analytics loads only after you consent.
• We collect the minimum needed, and we delete or anonymise data when its retention period ends.

If something goes wrong

If we become aware of a personal data breach, we will tell the people affected without delay: what happened, what it means for them and what they can do. We will report it to the Data Protection Board of India and send the Board a detailed report within 72 hours, as the DPDP Rules require. Our processors must tell us about any breach on their side promptly.

Unit and regimental orders

When a unit, mess or association sends us a list of names, ranks or numbers to personalise an order, the unit decides what goes on that list, and we use it only to make and deliver that order.

1. The person placing the order confirms the unit is entitled to share the list for this purpose.
2. We use the list only to make, proof and deliver the order. It’s never used for marketing.
3. We delete the list 90 days after delivery, unless the unit asks us to keep it for repeat orders.
4. Please don’t send posting details or anything operational or classified. We don’t need it.

Units that need a signed data processing agreement can ask for one at privacy@faujifunk.com.

Requests and contact

To see, correct or delete your data, withdraw consent or nominate someone to act for you, email privacy@faujifunk.com. We reply within 30 days. Details of our Grievance Officer are in the privacy policy, and cookie choices are explained in the cookie policy.