Privacy Policy
Effective date: 11 October 2026
Last updated: 11 October 2026
Your privacy matters to me. This Privacy Policy explains what personal data theharshita.com collects, why, how it is used and protected, who it is shared with, and the choices and rights you have. Please read it together with the Cookie Policy, the Affiliate Disclosure and the Terms and Conditions.
1. Who I am
This website, THEHARSHITA (theharshita.com), is operated by Harshita Tanwar, a shopping adviser and content creator based in Jaipur, Rajasthan, India (“I”, “me”, “my”, “the site”).
For the purposes of data protection laws, I am the “Data Fiduciary” (India) and “controller” (EU, UK) of the personal data described here.
Contact for privacy matters: Harshita Tanwar, email harshita@theharshita.com, website www.theharshita.com, Jaipur, Rajasthan.
2. The laws I aim to follow
I aim to handle personal data in line with the laws that apply to this site and its visitors, including:
- India: the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (as they come into force), the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- European Union and United Kingdom: the GDPR, the UK GDPR and the ePrivacy rules on cookies.
- United States: the California Consumer Privacy Act as amended (CCPA/CPRA), other state privacy laws, the CAN-SPAM Act for email, and COPPA for children.
- Other countries: comparable laws such as Canada’s PIPEDA and Australia’s Privacy Act.
Where two laws differ, I apply the higher level of protection to the extent it is reasonably possible.
3. What personal data I collect
3.1 Data you give me
- Contact form and emails: your name, email address, the content of your message and anything else you choose to include.
- Newsletter and free downloads: your name (if asked) and email address.
- Comments (if switched on): your name, email address, website (optional) and comment.
- Brand and partnership enquiries: your name, business, role, contact details and product information.
3.2 Data collected automatically
- Device and technical data: IP address, browser type and version, device type, operating system, language and screen size.
- Usage data: pages visited, time on page, links clicked (including affiliate links), the website you came from and the date and time of your visit.
- Approximate location: country or city, worked out from your IP address. I do not collect your precise location.
- Cookies and similar technologies: see the Cookie Policy.
- Server and security logs kept by my hosting provider and security tools.
3.3 Data from other sources
- Affiliate networks and merchants may share aggregated or limited information about clicks, orders and commissions. This normally does not identify you personally to me.
- Analytics providers give me reports about visitors in summary form.
3.4 What I do not collect
- I do not sell products or take payments on this site, so I do not collect card or bank details.
- I do not knowingly collect sensitive data such as health, financial account, biometric or government ID data. Please do not send it to me.
- I do not knowingly collect data from children (see Section 14).
4. Why I use your data and my legal basis
| Purpose | Examples | Legal basis (GDPR/UK) and Indian law basis |
|---|---|---|
| Reply to you | Answer contact form messages and brand enquiries | Legitimate interests / your consent or voluntary provision of data |
| Run and improve the site | Understand which guides are useful, fix errors | Consent (analytics cookies) |
| Track affiliate referrals | Record that a visit came from this site | Consent (where cookies require it) / legitimate interests |
| Keep the site secure | Block spam and attacks, keep backups | Legitimate interests / reasonable security safeguards |
| Comply with law | Respond to lawful requests, keep records | Legal obligation / legitimate use permitted by law |
Under India’s DPDP Act, I process your personal data on the basis of your consent or for certain legitimate uses the Act allows, such as when you voluntarily give me your data for a stated purpose, or to meet legal obligations. I will give you a clear notice before collecting data and will use it only for the purpose stated.
5. Cookies and tracking
I use cookies and similar technologies for the site to work, to understand how it is used and to track affiliate referrals. Where the law requires it, non-essential cookies are used only after you agree through the cookie banner. You can change your choice at any time using “Cookie settings” in the footer. Details are in the Cookie Policy.
6. Affiliate links and third-party websites
Some links on this site are affiliate links. When you click one, you leave this site and go to a seller’s or network’s website. They may set their own cookies to record that you came from this site, so that I can earn a commission if you buy. I do not receive your payment details or your account details from those sellers.
The seller’s or network’s own privacy policy applies once you leave this site. I encourage you to read it. Affiliate programs I take part in: Amazon Associates India, Amazon Associates United States, Amazon Associates Canada, Cuelinks, and Meesho.
Some US states treat certain advertising or affiliate tracking as “sharing” or “sale” of data. You can opt out through the cookie settings and, in applicable states, through a Global Privacy Control signal (see Section 15).
7. Analytics and advertising
- Analytics: I use Google Analytics 4 provided by Google LLC. It collects usage data in pseudonymised form to help me understand which content is useful. I enable IP anonymisation and set short data retention.
- Advertising: I do not currently show third-party ads on this site. If this changes, I will update this policy and my cookie banner before it begins.
- Social media: if I embed videos or posts (for example YouTube, Instagram or Pinterest), those providers may set cookies when the content loads.
8. Email marketing
I send newsletters only if you have signed up. I use Hostinger Reach to send them. You can unsubscribe at any time using the link in every email, or by writing to me. Every email includes my identity and contact details, as required by laws such as CAN-SPAM. I do not buy email lists.
9. Who I share data with
I do not sell your personal data for money. I share it only with the following, and only as needed:
- Service providers (processors): hosting (Hostinger), email service (Hostinger Reach), analytics (Google Analytics), form and security plugins, backup services and cookie-consent tools.
- Affiliate networks and merchants: only through the tracking described in Section 6, when you click a link.
- Professional advisers: accountants or lawyers, under confidentiality.
- Authorities: if the law requires it, or to protect rights, safety and security.
- Business changes: if the site is sold or transferred, your data may be transferred with it, and the same protections will apply.
Each service provider is allowed to use your data only to provide its service to me and must protect it.
10. International transfers
I am based in India. My website is hosted on Hostinger, and my providers may store or process data in other countries, including Mumbai,(India) and Singapore. If you are in the EEA or UK, your data may be transferred outside those regions. Where required, I rely on safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions. Indian law allows transfers abroad, except to countries the Government of India may restrict by notification. I will follow any such restriction.
11. How long I keep data
| Data | Kept for |
|---|---|
| Contact form messages and emails | Up to 12 months after the conversation ends, unless needed longer for a legal reason |
| Newsletter subscription | Until you unsubscribe, then removed or reduced to a suppression record so I do not email you again |
| Comments | Until you ask me to remove them or I delete the post |
| Analytics data | 14 months, depending on my analytics settings |
| Server and security logs | Up to 90 days |
| Records of consent | For as long as needed to show valid consent, and for the period required by law |
| Tax and accounting records | As required by Indian law |
When data is no longer needed, I delete it or make it anonymous.
12. How I protect your data
I use reasonable security safeguards, including HTTPS encryption, secure hosting, regular software updates, strong passwords, limited access, firewall and malware protection, and regular backups. No system is completely secure, so I cannot promise absolute security. If a personal data breach occurs that affects you, I will tell you and the relevant authorities within the time the law requires (for example, 72 hours to inform the Data Protection Board of India and certain regulators, where the law applies).
13. Your rights
13.1 If you are in India
Under the DPDP Act, you have the right to:
- get a summary of the personal data I hold about you and how it is processed;
- ask me to correct, complete or update your data;
- ask me to erase your data when it is no longer needed for the purpose;
- withdraw your consent at any time (withdrawal does not affect earlier lawful processing);
- get your grievance resolved, and approach the Data Protection Board of India if you are not satisfied;
- nominate another person to exercise your rights if you die or become incapacitated.
13.2 If you are in the EEA or UK
You also have the right to access your data, correct it, erase it, restrict or object to its processing, receive it in a portable format, withdraw consent, and complain to your supervisory authority (in the UK, the Information Commissioner’s Office). I do not make decisions about you using solely automated processing that have legal or similarly significant effects.
13.3 If you are in California or another US state
You may have the right to know what personal information I collect and how it is used, to access and delete it, to correct it, to opt out of the “sale” or “sharing” of personal information, and to not be treated unfairly for using these rights. I do not sell personal information for money. I do not knowingly sell or share the personal information of anyone under 16.
13.4 How to use your rights
Contact me with the subject “Privacy request” and tell me what you would like. I may ask you to confirm your identity so that I do not give your data to the wrong person. I will acknowledge your request within 7 days and respond within 30 days (or the period the law in your region requires). There is no charge unless a request is clearly unfounded or excessive, where the law allows me to charge or refuse. You can also use an authorised agent, where the law allows.14. Children’s privacy
This site is for adults and is not directed at children. I do not knowingly collect personal data from anyone under 18 in India, under 16 in the EEA (or the lower age set by a member state, not below 13), under 13 in the US and UK, or under the age set by the law of your country. If you are a parent or guardian and believe a child has given me data, please contact me and I will delete it promptly.
15. Do Not Track and Global Privacy Control
Browsers may send “Do Not Track” signals, but there is no common standard for responding to them. Where required by law, I honour opt-out preference signals such as Global Privacy Control for the sale or sharing of personal information.
16. Links to other websites
This site links to websites I do not control. I am not responsible for their content or privacy practices. Please read their policies.
17. Changes to this policy
I may update this policy when my practices or the law change. I will post the new version here with a new “Last updated” date. If a change is significant, I will tell you through the site or by email, and ask for fresh consent where the law requires it.
18. Grievance officer and contact
Grievance Officer / Data Contact: Harshita Tanwar
Email: harshita@theharshita.com
Address: Jaipur, Rajasthan
Response time: acknowledgement within 7 days, resolution within 30 days.
If you are not satisfied with my response, you can complain to the Data Protection Board of India, your local data protection authority (such as the supervisory authority in your EU country or the UK ICO), or, in California, the California Attorney General or the California Privacy Protection Agency.
19. Governing law
This policy is governed by the laws of India. Courts in Jaipur, Rajasthan, India have jurisdiction, subject to any mandatory rights you have under the law of the place where you live.