Privacy policy

The Old Mill Goods, The Old Mill, Kannerimukku Road, Kotagiri, The Nilgiris 643217, is the data fiduciary for everything described here — the term the Digital Personal Data Protection Act 2023 uses for whoever decides what is collected and why.

Questions, requests and complaints about any of it go to hello@theoldmillgoods.com, or to the grievance officer at the foot of this page.

To send you an order: your name, delivery address, phone number and email address. That is the whole list, and every field on the checkout is one of them — there is no optional survey and no date of birth.

If you subscribe to The Friday Note: your email address, kept separately from orders, used for that and nothing else.

If you write to us: whatever you put in the message.

If you make an account: the above, plus the addresses you save and your order history, so you do not type them again.

We do not collect your date of birth, your gender, your income, your occupation, or anything else a shop asks for because it can rather than because it needs to.

Payment happens on our payment partner's own page. Card numbers, CVVs, UPI PINs and net-banking credentials never touch our servers and we never see them.

What comes back to us is whether the payment succeeded, a transaction reference, and the last four digits of a card so that you can tell one from another in your order history.

If you paid cash on delivery and are owed a refund, we will ask for a bank account or UPI ID to send it to. That is the only time we ask, and we do not keep it afterwards.

For an order: because you asked us to send you something, and we cannot without it.

For The Friday Note: because you consented, in a single tick that was not pre-ticked, and you can withdraw it in one tap from any issue.

For order records kept after the fact: because tax and food-safety law requires us to keep them.

We do not rely on "legitimate interest" to justify anything you would not expect.

We do not sell your data, we have never sold it, and we will not sell it.

It is shared with exactly three kinds of company, each getting only the part they need:

Couriers — your name, address and phone number, because a parcel needs somewhere to go. Our payment partner — the amount and a reference, because somebody has to charge you. Our email service — your email address and your name, to send the confirmations and the Note you asked for.

Nobody else. Never for advertising. There are no data brokers, no lookalike audiences and no partner offers.

We may also disclose something where a law or a court requires it. If that ever happens and we are permitted to tell you, we will.

Your cart, your wishlist, the items you have looked at recently and whether you prefer light or dark are stored in your own browser, on your own device. They never reach us. Clear your site data and every trace of them is gone.

There are no third-party advertising pixels on this site — no Meta pixel, no Google Ads tag, no retargeting of any kind.

There is currently no analytics on the site at all, so nothing counts your visit. If that changes it will be a tool that counts pages rather than people, without cross-site tracking, and this page will say so before it is switched on.

Order records: seven years. Tax law requires it and we have no discretion about it.

Marketing consent, saved addresses, wishlist, account details and anything you wrote to us: until you ask us to delete them, or two years after your last order if you have not been in touch.

The Friday Note list: until you unsubscribe, and the record of the unsubscribe itself after that — kept for the single purpose of not emailing you again.

You can ask for a copy of what we hold on you, ask us to correct it, ask us to delete it, or withdraw a consent you gave. Those are your rights under the Digital Personal Data Protection Act 2023 and they cost nothing to exercise.

Write to hello@theoldmillgoods.com from the address on the account. You will have a confirmation within 72 hours and the thing itself done shortly after, in plain language, with no retention pitch and nobody asking you to reconsider.

The one thing we cannot delete on request is an order record inside its seven years. We will say so plainly rather than quietly keep it.

The site is served over HTTPS throughout. Access to order data is limited to the people who pack and despatch, and payment credentials are not ours to secure because they are never ours to hold.

No system is perfect. If we ever suffer a breach that puts your data at risk, we will tell you and the Data Protection Board directly, promptly, and without waiting to find out how bad it is.

This is a shop for adults. We do not knowingly collect anything from anyone under 18. If you believe a child has given us data, write to us and it will be deleted.