Last Update: [Date]

 

1. Purpose and Scope

This Policy explains how MyTrident India ("MyTrident", "we", "us") retains personal data collected through our Shopify-hosted Store and how and when we delete or anonymize it. It supports our obligations as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act), which requires personal data to be retained only for as long as necessary to fulfill the purpose for which it was collected and to be deleted once that purpose has been fulfilled or consent has been withdrawn, subject to applicable legal retention requirements.

This Policy applies to the personal data of customers, prospective customers, and visitors to our Store. It does not apply to employee or vendor data, which is governed by separate internal policies.

 

2. Roles Under the Platform

Our Store operates on Shopify. Under applicable data protection laws:

a) MyTrident acts as the Data Fiduciary (Data Controller). We determine what personal data is collected, the purpose for collecting it, and are responsible for handling requests related to data access, correction, and deletion.

b) Shopify acts as a Data Processor, processing personal data on our behalf in accordance with its Data Processing Addendum (DPA).

This means that responsibility for complying with data retention requirements and responding to deletion requests rests with MyTrident, while Shopify provides the tools and infrastructure that support these processes.

 

3. What We Retain and For How Long

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or for a longer period where required by applicable law. The table below provides indicative retention periods for different categories of personal data.

 

Category of Data	Typical Purpose	Retention Period
Order and transaction records (name, address, contact details, order history, invoices)	Order fulfillment, accounting, taxation, and statutory compliance	Retained for the minimum period required under applicable Indian tax and company laws (for example, up to 8 years), after which the data is reviewed for deletion.
Customer account data	Managing and operating customer accounts	Retained until the customer account is closed and then deleted within [X days], unless a longer retention period is required by law.
Marketing contact data (email address and phone number)	Sending marketing communications with the customer's consent	Retained until consent is withdrawn and then deleted or suppressed within [X days].
Support and correspondence	Resolving customer queries and complaints	Retained for [X months/years].
Website analytics and cookie data	Improving website performance and user experience	Retained for the periods specified in our Cookie Notice.
Abandoned checkout data	Cart recovery and customer service	Retained for [X days].

 

Legal Retention Overrides Deletion: Even if a customer requests the deletion of their personal data, we may be legally required to retain certain records, such as transaction and tax records, in accordance with applicable laws, including the Goods and Services Tax (GST) Act, the Income-tax Act, and the Companies Act. In such cases, we retain only the information required by law for the applicable retention period and securely delete or anonymize the remaining personal data once it is no longer required.

 

4. How Deletion Requests Are Handled on Shopify

When a customer requests access to or deletion of their personal data, we use the data management tools and processes provided by Shopify.

a) Data Access Requests

When a customer requests a copy of their personal data, Shopify generates a data access request and notifies any installed applications that store customer information. This allows the requested data to be compiled and securely provided to the customer.

b) Erasure vs. Profile Deletion

Shopify supports two different actions for handling deletion requests, and we apply the appropriate action based on the request:

i. Erase Personal Data ("Remove Personal Data")
Shopify removes or redacts personally identifiable information, such as the customer's name and address, while retaining the customer profile and order history where required for statutory record-keeping. This enables us to comply with legal obligations without retaining unnecessary personal identifiers.

ii. Delete Customer Profile
The customer's entire profile is permanently removed from the Store.

c) Propagation to Apps and Processing Timelines

When a personal data erasure request is submitted, Shopify sends a redaction request to all installed applications that process customer data, requiring them to remove the customer's information from their systems.

These requests are generally processed within 30 days, unless the data must be retained to comply with legal obligations. For customers who have placed an order, Shopify delays the redaction until the legally required retention period has expired. If no order has been placed within the previous six months, the request is typically processed after approximately 10 days.

If an application is removed from the Store, Shopify instructs the application provider to permanently delete the Store's data within 48 hours.

 

5. How Customers Exercise Their Rights

Customers (Data Principals) may request access to, correction of, or deletion of their personal data, or withdraw their consent at any time by contacting our Grievance Officer at grievance-officer@mytrident.in.

Withdrawing consent is as simple as giving it. We will respond to your request within the time period prescribed under applicable law.

 

6. Purging Method and Security

When personal data reaches the end of its applicable retention period and no legal obligation requires its continued retention, it is securely deleted or permanently anonymized.

Backups are deleted according to our scheduled backup retention cycle. Access to personal data throughout its lifecycle is restricted in accordance with our Role-Based Access Control (RBAC) Policy to ensure appropriate security and confidentiality.

 

7. Review

This Policy is reviewed at least annually and updated whenever there are changes to our data processing practices, the Shopify platform, or applicable laws and regulations.