SECTION 01Who are we?

Buy Outdoor Gear ("we", "us", "our") is an outdoor equipment retailer operating a physical store at 38/6, Hosur Main Road, Beside Anu Furniture, Bommanahalli, Bangalore, Karnataka 560068, and an online store at www.buyoutdoorgear.in.

Buy Outdoor Gear is a sister concern company of Outdoor Gear (formerly known as xdogtrekking). The two are separate companies under common ownership; neither is a subsidiary of the other, and each is responsible for the personal data it holds. References in this policy to "we" mean Buy Outdoor Gear unless stated otherwise. Where a group company processes your data on our behalf (for example shared warehousing, customer support, or IT systems), it does so under the same safeguards and only for the purposes described in this policy. We do not transfer your data to a group company for that company's own independent marketing without your consent.

For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described in this policy. If you are in the European Economic Area or United Kingdom, we act as the Data Controller under the GDPR and UK GDPR respectively. You are the Data Principal (DPDP) or Data Subject (GDPR).

Our registered contact details and the identity of our Grievance Officer appear in Section 21 and Section 22.

SECTION 02Scope of this policy

This policy applies to personal data we process when you:

• browse or place an order on our website;
• create an account, subscribe to our newsletter, or leave a product review;
• visit or buy from our Bommanahalli store;
• contact us by phone, email, WhatsApp, or social media;
• participate in a trek, ride-out, workshop, or giveaway we organise;
• apply for a job with us.

It does not apply to third-party websites we link to, or to data you share directly with delivery partners, payment providers, or marketplaces under their own policies. See Section 18.

SECTION 03Personal data we collect

We group the data we hold into the categories below. Not every category applies to every customer. A guest checkout, for example, generates far less data than a registered account.

3.1 Identity and contact data

• Full name, and any name you ask us to print on personalised gear
• Email address and mobile number
• Billing address and one or more shipping addresses
• Account username and a securely hashed password (we never store passwords in readable form)
• Date of birth, only where you volunteer it for a birthday offer

3.2 Order and transaction data

• Products ordered, sizes, quantities, and order value
• Order, invoice, and shipment tracking numbers
• Payment method type and the last four digits of the card, where the gateway returns them
• Delivery status, delivery instructions, and proof-of-delivery records
• Returns, exchanges, refunds, and warranty claims
• GSTIN, where you request a GST invoice for a business purchase

3.3 Fitting and product-recommendation data

To fit gear correctly we may record measurements you give us: torso length for backpacks, head circumference for helmets, jacket and boot sizes. We use this so repeat purchases fit without re-measuring. You may ask us to delete it at any time without affecting your ability to shop.

3.4 Technical and usage data

• IP address, browser type and version, operating system, device type and screen size
• Pages viewed, products viewed, time on page, referring URL, and exit pages
• Cart contents, including items abandoned before checkout
• Approximate location derived from IP address (city level), used to show correct delivery timelines
• Cookie identifiers (see Section 7)

3.5 Communications data

Records of your emails, WhatsApp messages, contact-form submissions, chat transcripts, and product reviews. Customer-support calls may be recorded for quality and training; where they are, you will be told at the start of the call.

3.6 Marketing preferences

Your consent status for email, SMS, and WhatsApp marketing, the date and source of that consent, and your engagement with those messages.

3.7 Sensitive personal data

SECTION 04How do we collect your data?

SECTION 05Why do we use your data, and on what legal basis?

Under the DPDP Act we process personal data either with your consent or for a "legitimate use" the Act permits. Under GDPR we rely on the bases named below. We do not use your data for a new, incompatible purpose without telling you first.

SECTION 06Payment information

This is the point customers ask about most, so we will be precise.

• We never receive your full card number, CVV, or card PIN. Card details are entered on a page served by our payment gateway and travel directly to them over an encrypted connection.
• Our gateway partners are PCI-DSS Level 1 certified, the highest tier of the payment card industry security standard.
• In line with the RBI card-on-file tokenisation mandate, any saved card is stored as a token issued by the card network. This is a substitute value that cannot be used to transact anywhere else. We can see only the card network, the last four digits, and the expiry.
• UPI, net banking, and wallet payments are authenticated entirely within your bank's or provider's own app or page. We receive a success or failure result and a reference number.
• Cash-on-delivery orders generate no payment data beyond the amount collected.

If someone claiming to be from Buy Outdoor Gear asks you for a full card number, CVV, OTP, or UPI PIN, it is not us. Do not share it, and please report it to contact@buyoutdoorgear.in.

SECTION 07Cookies and similar technologies

Cookies are small files stored by your browser. We also use pixels and local storage, which work similarly. On your first visit we show a consent banner; only strictly necessary cookies are set before you choose.

You can change your choices anytime through the "Cookie settings" link in our footer, or block and delete cookies in your browser settings. Blocking strictly necessary cookies will break checkout. We honour Global Privacy Control signals where your browser sends them.

SECTION 08Who do we share your data with?

We do not sell your personal data, and we do not rent or trade mailing lists.

We share data only with the categories of recipient below, only to the extent each needs it, and only under a written contract requiring them to protect it and use it for no other purpose.

SECTION 09International data transfers

We primarily store data on servers located in India. Some of our service providers, particularly cloud hosting, email, and analytics platforms, process data outside India, including in Singapore, the European Union, and the United States.

Under Section 16 of the DPDP Act, transfers outside India are permitted except to countries the Central Government restricts by notification; we monitor that list and will change providers if a restriction affects us. Where data of EEA or UK residents is transferred out of those regions, we rely on European Commission Standard Contractual Clauses or the UK International Data Transfer Addendum, together with technical safeguards including encryption in transit and at rest.

SECTION 10How long do we keep your data?

We keep personal data only as long as the purpose requires, or as long as the law requires, whichever is longer. When a period ends we delete the data or irreversibly anonymise it so it can no longer identify you.

SECTION 11How do we protect your data?

We maintain reasonable security practices as required by Section 8 of the DPDP Act and Rule 8 of the SPDI Rules. These include:

Technical and organisational measures

• Encryption in transit. The entire site is served over TLS 1.2 or higher; we do not serve any page containing personal data over plain HTTP.
• Encryption at rest for databases and backups.
• Password hashing using a slow, salted algorithm. Nobody at Buy Outdoor Gear can read your password.
• Role-based access control. Staff see only the data their role requires. Store staff cannot export the customer database.
• Multi-factor authentication on all administrative and cloud accounts.
• Logging and monitoring of administrative access, retained for at least one year, as Rule 6 of the DPDP Rules requires.
• Vendor due diligence before any processor receives customer data, with contractual security obligations.
• Data masking and tokenisation where a full value is not needed for the task.
• Backups and continuity, tested for restoration, so data can be recovered after an incident.
• Periodic review of access rights, vulnerabilities, and restore procedures.

SECTION 12What happens if there is a data breach?

Rule 7 of the DPDP Rules, 2025 sets a two-stage procedure, and CERT-In imposes a separate, faster duty. If a personal data breach occurs, we will:

1. contain the incident and begin investigating immediately;
2. report qualifying cyber incidents to CERT-In within 6 hours of noticing them, under the IT Act and the CERT-In directions of 2022;
3. intimate every affected Data Principal without delay through your registered email or account, describing the breach, its likely consequences for you, the measures we are taking, and what you can do to protect yourself;
4. give the Data Protection Board of India an initial intimation without delay, followed by a detailed report within 72 hours of becoming aware, as Rule 7 requires;
5. notify the relevant supervisory authority within 72 hours where the GDPR applies.

The 72-hour clock starts when we become aware a breach has occurred, not when an investigation concludes. We will not delay telling you in order to finish investigating first.

SECTION 13Your rights over your data

Under Chapter III of the DPDP Act, as a Data Principal you have the right to:

• Access. Obtain a summary of the personal data we process about you, the processing activities involved, and the identities of other Data Fiduciaries and processors we have shared it with.
• Correction and completion. Have inaccurate or misleading data corrected, incomplete data completed, and outdated data updated.
• Erasure. Have your data deleted where we no longer need it for the purpose it was collected for, and no law requires us to keep it.
• Withdraw consent. Withdraw it as easily as you gave it. Withdrawal does not affect processing already carried out lawfully.
• Grievance redressal. A readily available means of raising a complaint with us, and escalation to the Data Protection Board if we do not resolve it.
• Nominate. Appoint another person to exercise these rights on your behalf in the event of your death or incapacity.

If you are in the EEA or UK, you additionally have the rights to restrict processing, to data portability in a machine-readable format, to object to processing based on legitimate interests or to direct marketing, and to lodge a complaint with your local supervisory authority.

If you are a California resident, you have the right to know what personal information is collected and disclosed, to delete it, to correct it, and to opt out of "sale" or "sharing", noting that we do not sell personal information as that term is defined under the CCPA/CPRA. We will not discriminate against you for exercising any right.

SECTION 14How do you exercise your rights?

Email contact@buyoutdoorgear.in from the address registered on your account, or write to the postal address in Section 22. Tell us which right you wish to exercise and what data it concerns.

• Verification. We will ask you to confirm your identity, usually a code sent to your registered email or mobile. This protects you from someone else obtaining your data. We ask for no more identification than is necessary.
• Timeline. We acknowledge within 48 hours and respond substantively within 30 days. If a request is unusually complex we may extend this once, and will tell you why before the 30 days elapse.
• Cost. Free. We may charge a reasonable fee only for a manifestly excessive or repetitive request, and we will tell you before charging anything.
• Limits. We may decline in part where a law requires us to retain data. For example, an invoice we must keep for 8 years under tax law. We will always tell you what we retained and why.
• Self-service. Much of this needs no request: edit your profile and addresses in your account, and unsubscribe from marketing using the link in any message.

SECTION 15Marketing and commercial communications

We send marketing only where you have opted in. Opting out is always one click, and never affects your ability to shop with us.

• Email. Every marketing email carries an unsubscribe link that works immediately. We action it within 24 hours.
• SMS and WhatsApp. Reply STOP, or message us. WhatsApp marketing follows Meta's Business Messaging policies and requires your prior opt-in.
• Telephone. We honour TRAI's Do Not Disturb registry. Registering your number on DND stops promotional calls from us.
• Transactional messages are different. Order confirmations, dispatch and delivery updates, refund confirmations, and safety recalls are part of fulfilling your order, not marketing. These continue while you have an active order, even if you have opted out of marketing.

SECTION 16Children's data

Our store is intended for adults. Under the DPDP Act, a "child" is anyone under 18 years of age in India, a higher threshold than in many other countries.

• We do not knowingly collect personal data from anyone under 18 without verifiable parental or guardian consent.
• We do not carry out behavioural tracking or targeted advertising directed at children, which Section 9(3) of the DPDP Act prohibits outright.
• We do not process children's data in any way likely to cause a detrimental effect on their wellbeing.
• Where a parent buys children's gear, the account and data belong to the parent, and we ask that no data about the child beyond a size be provided.

Under Rule 11 of the DPDP Rules, 2025, where a Data Principal is a person with a disability who has a lawful guardian, we process their personal data only with that guardian's consent, verified against an order of a court or a designated authority.

If you believe a child has given us personal data, write to contact@buyoutdoorgear.in and we will delete it promptly.

SECTION 17Automated decision-making and profiling

We use limited automated processing to recommend products based on what you have viewed and bought, to sort search results, and to flag orders showing patterns associated with payment fraud.

We do not make solely automated decisions that produce legal or similarly significant effects on you. Where an automated system flags an order as suspicious, a person reviews it before any order is cancelled, and you may contest the outcome by contacting us.

SECTION 18Third-party links and platforms

Our site links to third-party websites, and we sell through marketplaces and social platforms. Once you leave our site, or transact on a marketplace, that operator's privacy policy governs, not ours. We do not control those parties and are not responsible for their practices. We encourage you to read their policies before sharing data with them.

SECTION 19CCTV and in-store data

Our Bommanahalli store operates CCTV for security and loss prevention. Signage at the entrance notifies you before you enter a monitored area. Footage is retained for 30 days and then overwritten, unless it is needed for an ongoing incident or legal claim. Access is limited to the store manager and, where required, law enforcement acting under valid legal process. Cameras do not cover fitting areas or washrooms.

In-store purchases generate the same order records as online purchases where you ask for an invoice or provide contact details for warranty and exchange purposes.

SECTION 20Changes to this policy

We review this policy at least annually and update it when our practices or the law change. The "Last updated" date at the top always reflects the current version.

For minor clarifications we update the page. For material changes, such as a new purpose, a new category of recipient, or a significantly longer retention period, we will give you prominent notice on the site and, where you have an account, by email, at least 14 days before the change takes effect. Where a change requires your consent under the DPDP Act, we will ask for it rather than assume it.

We maintain previous versions and will provide one on request.

SECTION 21Grievance redressal

In accordance with the Information Technology Act, 2000, the DPDP Act, 2023 and Rule 4 of the Consumer Protection (E-Commerce) Rules, 2020, we have appointed a Grievance Officer for complaints about data handling or our services, and a Nodal Officer resident in India for coordination with law enforcement and regulatory authorities.

Every complaint is issued a ticket number so you can track its status until it is resolved.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India under Section 13(3) of the DPDP Act. The Board expects you to have first raised the complaint with us. Consumers may also approach the National Consumer Helpline (1915) or the relevant Consumer Disputes Redressal Commission. Users in the EEA or UK may complain to their national data protection authority.

SECTION 22Contact us

For any question about this policy, how we handle your data, or a suspected security issue, use the address below.

SECTION 23Governing law and jurisdiction

This policy and any dispute arising from our handling of your personal data are governed by the laws of India. The principal legislation that applies to us includes:

• the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, on the phased timeline described in Section 1;
• the Information Technology Act, 2000 and the SPDI Rules, 2011, which continue to govern until the DPDP obligations commence;
• the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020;
• the Karnataka Shops and Commercial Establishments Act, 1961, under which our Bommanahalli store is registered;
• the CERT-In directions of 28 April 2022, on reporting cyber incidents.

We operate from Bangalore, Karnataka, and our business is conducted principally within Karnataka. Subject to your statutory consumer rights, which allow a consumer to file where they reside or work, the courts and tribunals at Bangalore, Karnataka have jurisdiction over disputes arising from this policy.

Consumers in Karnataka may approach the District Consumer Disputes Redressal Commission with jurisdiction over their area, or the Karnataka State Consumer Disputes Redressal Commission in Bangalore. The National Consumer Helpline can be reached on 1915. Complaints about personal data may be escalated to the Data Protection Board of India once we have had the chance to respond, as described in Section 21.

SECTION 24Language of this policy

This policy is published in English. Rule 3 of the DPDP Rules, 2025 requires that a notice be made available in English or in any language listed in the Eighth Schedule to the Constitution of India. If you would like this policy in Kannada or another Eighth Schedule language, write to us and we will provide it. Where a translation and the English version differ, the English version governs.