Privacy policy

Privacy Notice

Last updated: 26 August 2026. This is the version in force from that date. If we change it, we change the date above, and the change applies from the day we publish it — not backwards.

This notice tells you what personal data MassDeals collects when you shop at https://massdeals.in, why we collect each item, who else sees it, where it is stored, how long we keep it, and what you can ask us to do about it. It is written to be read on its own. You do not need to read our Terms or our Returns and Refunds Policy to understand it. If anything on any other page of this website says something different about how we handle your personal data, this notice is the one that governs.

Who is asking for your data

Registered office: No. 537/A, Dr. Rajkumar Road, 1st Main, 2nd Phase, Rajajinagar, Bengaluru Urban, Karnataka 560010. Warehouse, and the address returns are delivered to: 45/1, Heggadadevanapura, Alur Post, Dasanapura Hobli, Bangalore North Taluk, Bengaluru Rural, Karnataka 562123.

MAGIKAL ONLINE SERVICES PVT LTD, trading as MassDeals, owns and runs the store at https://massdeals.in. When you buy from us, your contract is with that company, and that company is the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023, and the body corporate responsible for it under the Information Technology Act, 2000 and the rules made under it. It is also the agency that retains your information, at the address below — we name it here because Rule 5(3) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 requires us to tell you who holds it.

• Legal name: MAGIKAL ONLINE SERVICES PVT LTD
• Brand: MassDeals
• CIN: U19200KA2021PTC146612
• GSTIN: 29AAOCM5223C1ZH
• Website: https://massdeals.in
• Warehouse and correspondence address: 45/1, Heggadadevanapura, Alur Post, Dasanapura Hobli, Bangalore North Taluk, Bengaluru Rural, Karnataka 562123
• Branch: Mount Road, Anna Salai, near Government Estate Metro, Wallers Road, Ritchie Street, Chennai, Tamil Nadu, PIN [to be confirmed]
• Customer care: Warehouse Manager, office@massdeals.in
• Grievance Officer and Nodal Officer for data matters: Amit Kumar Jain, Director, office@massdeals.in

We sell our own stock. This is not a marketplace, there are no third-party sellers on this site, and nobody else receives your order because of a sale here.

We are an independent reseller, and it matters for your data

MassDeals is an independent reseller. We buy genuine branded footwear — Crocs, Skechers, U.S. Polo Assn. and others — as factory surplus, overstock and stock-lots, and sell it below MRP. We are not an authorised dealer, distributor, franchisee, agent or brand partner of any brand we sell. No brand owns, controls, endorses, sponsors or is otherwise connected with us, and we do not act for any brand. We use brand names only to describe what is in the box.

We say this here because it decides where your data goes. Your order data stays with us and the service providers named in this notice. We do not pass your name, phone number, address or order details to any shoe brand, and no brand has any access to our customer records. The only exception is if a court, a regulator or the police requires us to hand something over, or we need it to answer or defend a legal claim — and even then we give only what is actually required.

We have not been notified as a Significant Data Fiduciary under the Digital Personal Data Protection Act, 2023, so we are not required to appoint a Data Protection Officer. Our Grievance Officer, Amit Kumar Jain, Director, is the named individual you contact about anything in this notice. His details are repeated at the end.

What we collect, why, who else sees it, and how long we keep it

This is the full list of what we collect. We do not buy personal data about you from data brokers, marketing lists or anyone else.

What we collect	Why we need it	Who else sees it	How long we keep it
Your name	To address the parcel, raise your GST invoice, and confirm it is you when you contact us	Shopify, Unicommerce, Ekart or Shiprocket, Razorpay (on prepaid orders), the returns portal if you raise a return, our accountants and the tax authorities	8 financial years from the end of the financial year, with the invoice record
Delivery address and PIN code (and billing address if different)	To deliver your order, and to accept a return back at our warehouse	Shopify, Unicommerce, Ekart or Shiprocket, the returns portal if you raise a return	8 financial years from the end of the financial year, with the invoice record
Mobile number	So the courier can call you at the door, so we can send delivery and refund updates, and so we can reach you about a return	Shopify, Unicommerce, Ekart or Shiprocket, the returns portal, Wigzo and CleverTap for the messages we send you	8 financial years with the order record. If you opt out of marketing, it stays only in that order record and is not used to message you again
Email address	Order confirmation, dispatch and tracking, return updates, refund confirmation, and marketing only if you opted in	Shopify, Wigzo and CleverTap, the returns portal	8 financial years with the order record. Marketing use stops when you opt out — we action that within 7 working days
What you ordered — pairs, sizes, quantity, price paid, delivery charge	To pick and pack the right pairs, invoice you correctly, answer questions later, and make sure any message we send you is about something relevant	Shopify, Unicommerce, Wigzo and CleverTap, the returns portal if you raise a return, our accountants and the tax authorities	8 financial years from the end of the financial year
Your GSTIN and business name, only if you ask for a GST invoice in a business name	Because a business-name GST invoice cannot be raised without it	Shopify, Unicommerce, our accountants and the tax authorities	8 financial years with the invoice record
Payment method and payment status, and the reference number our payment gateway gives us	To confirm your payment went through, to issue a refund, and to trace a refund that has not reached you	Razorpay, Shopify, our bank and our accountants	8 financial years from the end of the financial year
Bank account or UPI details you give us for a Cash on Delivery refund	Only to pay that refund. On a Cash on Delivery order there is no card or UPI payment of yours to reverse, so we need an account to send the money to	Our bank only	Until that refund has actually reached you, and then with the payment record for as long as tax and company law require it. If a refund is delayed for one of the exceptional reasons set out in our Returns and Refunds Policy, we hold these details until it is paid. Used for that refund and nothing else
Your account sign-in details, if you create an account — the email address or mobile number you sign in with, and the one-time codes Shopify sends you	To let you sign in and see your own orders	Shopify	Until you ask us to close the account. Your invoice and payment records stay for the tax period above. We never see or store a password
Courier tracking and the delivery outcome — delivered, refused, undelivered, returned to us — with timestamp, attempt count, and the OTP or signature the courier captured	To tell you where your parcel is, to settle a dispute about whether it was delivered, and to decide whether we can keep offering Cash on Delivery to that number or address	Ekart or Shiprocket, Unicommerce, Shopify	Delivery record: 8 financial years with the order. The Cash on Delivery decision record: 12 months from the delivery attempt
Return requests — the reason you give, the photographs you upload, and the ticket or reference number issued to you	To assess your return, to check the pair against what the product page disclosed, and to prove what happened if the claim is later disputed	The operator of massdeals.returndotai.com, and our warehouse team	2 years from the day the return is closed. Longer if a dispute or a consumer complaint about it is still open, in which case until it is finally closed
Your emails, WhatsApp messages, SMS and our notes of your calls	To answer you, to keep a history of what was agreed, and to handle a grievance	Our own support and warehouse team; our email provider, which hosts the mailbox; WhatsApp's own platform for WhatsApp messages; and Wigzo or CleverTap where the message went through them	2 years from the last message on that order or complaint
Browsing data — IP address, device and browser type, approximate location, the pages and products you looked at, what you added to cart, whether you checked out	To keep the cart and checkout working, to protect checkout against fraud, and to see which pages and products people actually use	Shopify, Google (Analytics), Wigzo, CleverTap	Shopify's own logs for its retention period; analytics data for up to 14 months
Cookie and device identifiers	Explained under Cookies below	Shopify, Google, Wigzo, CleverTap	The cookie itself lasts from the end of your visit up to 24 months, depending on the cookie. The analytics data built from it is kept for up to 14 months

Your card details: we never have them

We do not collect, see or store your card number, CVV, UPI PIN, netbanking password or any other payment credential. Those go straight to Razorpay, our payment gateway, on their own secure page. All that comes back to us is whether the payment succeeded, how much, a reference number, and at most a masked reference to the instrument you used.

The one sensitive item we do hold

Bank account or UPI details given for a Cash on Delivery refund are sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. You give them to us voluntarily and you can refuse. If you would rather not share them, tell us and we will look for another way to return your money — but we cannot pay a refund without some route to send it to you.

What we do not collect

We do not ask for your Aadhaar number, PAN, date of birth, caste, religion, health information, biometric data or any government ID, and you should not send them. If any of that reaches us anyway — for example as an attachment in an email — we will delete it from our working records as soon as we notice, we will not use it for anything, and we will tell you we have removed it. We cannot promise that every routine backup copy disappears the same day; backups are overwritten on their normal cycle.

Why we are allowed to process it

Under the Digital Personal Data Protection Act, 2023 we rely on:

• Your consent. You give it by a clear, positive act — tapping Place order, filling in a return request, or ticking a box yourself. We never pre-tick a box for you, and we never treat silence, scrolling or continued browsing as consent.
• A legitimate use under section 7(a). You gave us your details yourself, for a purpose you came to us for — buying a pair of shoes and having it delivered — and you have not told us to stop.
• Records the law makes us keep. Section 8(7) of the Act lets us keep personal data even after you withdraw consent, where another law requires it. GST law, income-tax law and the Companies Act, 2013 require us to raise invoices and keep books. The Consumer Protection (E-Commerce) Rules, 2020 require us to log and answer complaints. We keep those records for the periods in the table above, and we use them for nothing else.

Marketing is separate from all of this and runs on your consent alone. Withdrawing it costs you nothing else.

Who we share your data with

Every company below is a Data Processor acting for us under contract. Each gets only what it needs to do its job, and is required to use your data only to provide that service to us and not for its own purposes. We do not sell your personal data, rent it, trade it, or hand it to other merchants. We do not use your personal data to train any AI model. Where a provider's own terms let it use aggregated or de-identified data to improve its service, that is set out in its own privacy policy, not ours.

Running the store

• Shopify — the platform this store is built on. It holds your account, cart, order and customer record. Shopify is a Canadian company and stores this data on infrastructure outside India.
• Shopify web pixels — Shopify's own on-site tracking framework, which is what allows the analytics tools below to receive page and checkout events from this store.

Taking payment

• Razorpay — our payment gateway for UPI, cards and netbanking. You enter your payment credentials on Razorpay's page, not ours. Razorpay is an Indian company, regulated in India, and stores payment data in India as the Reserve Bank of India requires.

Packing and delivering

• Unicommerce — our warehouse and order-management system. It receives your order details and delivery address so the right pairs are picked, packed and invoiced. Indian company.
• Ekart and Shiprocket — our couriers. They receive your name, delivery address, PIN code and mobile number, and on a Cash on Delivery order the amount to collect. Indian companies.

Handling returns

• The operator of massdeals.returndotai.com, which trades as Returndotai and runs our returns portal. Raising a return there is the only way to start a return. It receives your order reference, name, phone number, address, the reason you give and the photographs you upload, solely so that your return can be raised, tracked and closed. It has not published a registered company name and we will not guess one; if you need it for a legal step, ask us and we will get it for you. Its published contacts for data questions are privacy@returndotai.com and legal@returndotai.com. It states that it uses cloud hosting providers and may process data outside India.

An important point about that portal. Its own terms of use are governed by Indian law and name the courts at Bengaluru. Those terms are between us and that supplier. They do not bind you, they do not limit any right you have against MassDeals, and they do not force you to bring a complaint in Bengaluru. Your contract is with MAGIKAL ONLINE SERVICES PVT LTD, and under the Consumer Protection Act, 2019 you can complain where you live or work.

Analytics and the messages we send you

• Google Analytics (gtag) — counts visits, shows us which pages and products are used and where people drop off. Google is a US company and processes this data outside India.
• Wigzo — the tool that sends our order, cart and promotional email, SMS, WhatsApp and browser-push messages, and records which of them you opened or clicked. Wigzo is part of the Shiprocket group in India.
• CleverTap — customer engagement and analytics: it groups on-site behaviour and order history and drives the messages we send. CleverTap operates through WizRocket Inc. in the United States along with Indian and Singapore group companies, and runs data centres in several regions including India, Singapore and the United States.

Everyone else

• Our email provider — it hosts the mailbox at office@massdeals.in, so it holds any email you send us.
• Our bank, our accountants and the tax authorities — invoice and payment records, to meet our GST, income-tax and company-law duties.
• A court, a regulator, a consumer forum or the police — only what we are legally required to give, or what we need to defend or answer a claim.

Data that leaves India

We will not pretend otherwise: some of your data is processed outside India. Shopify hosts this store outside India. Google processes analytics data outside India. CleverTap runs data centres in several countries. The operator of our returns portal says it uses cloud hosting and may process data outside India.

Section 16 of the Digital Personal Data Protection Act, 2023 permits transfer of personal data outside India except to a country the Central Government has restricted. The Central Government has not restricted any country to date. If it restricts one that a provider of ours uses, we will move that processing or stop using that provider. Where another Indian law requires certain data to stay in India — for example the Reserve Bank of India's rules on payment data — that requirement applies on top, and our payment gateway keeps that data in India.

Under Rule 7 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, we transfer data to a provider only where it is necessary for your order or you have consented, and only to providers that maintain a level of protection comparable to what those Rules require of us. Wherever a provider lets us choose, we pick the India data region.

The one thing we keep close: the bank or UPI details you give us for a Cash on Delivery refund go only to our own bank, in India, to make that one payment. They are not loaded into any analytics, marketing or returns system.

Marketing, and how to stop it

We send you two very different kinds of message.

• Messages about your order — confirmation, dispatch, tracking, delivery, return and refund updates. These are part of the service you bought. They are not marketing, and they continue as long as your order is live, whatever your marketing preference is.
• Marketing — offers, new stock, abandoned-cart reminders, by email, SMS, WhatsApp or browser push. These go only to people who opted in.

To stop marketing: use the unsubscribe link in any email, reply STOP to an SMS or WhatsApp message, or simply email office@massdeals.in and say so. Withdrawing consent is as easy as giving it — one line in one email, no form, no reason needed. We action it within 7 working days; a message already queued before that may still reach you, and then it stops. After that we keep only the fact that you opted out, so that we do not message you again by mistake, and your contact details stay only in the order record.

Opting out of marketing never affects your order, your delivery, your return or your refund, and never changes the price you pay.

Cash on Delivery records

We keep a record of how parcels sent to a phone number or delivery address ended up — delivered, refused, undelivered or returned to us. We use it for one purpose: deciding whether to keep offering Cash on Delivery to that number or address.

Cash on Delivery is a facility we offer, not something you are entitled to. Where we stop offering it, prepaid payment stays fully available and the same products at the same prices remain open to you. We do not charge you anything because of this record, we do not hold back any refund because of it, and we do not cancel an order we have already accepted because of it.

This record is built only from courier outcomes on parcels we sent. It is not a credit score. It stays inside our business: we never publish it, post it in seller groups, sell it, or share it with any other merchant or credit bureau.

The rule may be applied automatically at checkout, but you can always ask a person to look at it. Courier "refused by customer" scans are sometimes simply wrong, so if you think a parcel was marked incorrectly, email office@massdeals.in with your order number. A person, not an automated system, will check it, we will reply within 7 working days, and if the scan was wrong we correct the record and restore Cash on Delivery.

How long we keep things, in short

The table above gives the period for each item. In summary:

• Orders, invoices and payment records: 8 financial years from the end of the financial year. That is the longest period company, GST and income-tax law require, and we use one period rather than several so you always know where you stand.
• Returns, photographs and support messages: 2 years from closure, which matches the two-year period you have to bring a consumer complaint under the Consumer Protection Act, 2019 — and longer if a dispute is still running.
• Cash on Delivery outcome history: 12 months.
• Analytics and cookie data: up to 14 months.
• Marketing contact details: used for marketing only until you opt out. After that they remain only inside the order record, for the period above.

When a period ends we delete the record from our working systems, or strip your identity out of it and keep only the numbers. Copies sitting in routine backups are overwritten on the normal backup cycle rather than being picked out one by one.

Your rights, and how to use them

You can ask us to:

• Show you what personal data we hold about you, and a summary of what we have done with it and who we shared it with;
• Correct or complete anything wrong, out of date or missing;
• Erase your personal data, where no law requires us to keep it;
• Withdraw a consent you gave us, including consent to marketing;
• Nominate someone, in writing, to exercise these rights for you if you die or cannot act for yourself;
• Raise a grievance about how we handled your data, and get an answer;
• Ask a person to review anything we decided about you automatically, such as whether Cash on Delivery is offered to your number or address.

How to ask: email office@massdeals.in. That is the single channel for all of these — you do not need a form or a template. Give us your order number and the phone number you ordered with, so we can be sure we are handing your data to you and not to somebody pretending to be you. We may ask a question or two to confirm it is you, and we send our answer to the email address or phone number on the order.

How fast: we acknowledge every request within 48 hours and answer it within 30 days of receiving it. If a request is unusually large and will take longer, we tell you inside those 30 days why, and when the answer will come.

You may also exercise these rights through a Consent Manager registered with the Data Protection Board of India, once that facility is operating.

Three honest limits, so nothing surprises you:

• Some records we must keep even if you ask us to erase them, because tax, company and consumer law require it. Where that is the reason, we say so and tell you which record it is.
• If you withdraw consent to data we need to complete an order already on its way, we may not be able to complete that order.
• If we cannot satisfy ourselves that a request really comes from you, we will not release the data. Handing your data to the wrong person would be the greater harm.

What the law asks of you

The Digital Personal Data Protection Act, 2023 places a few duties on you as well. These are the Act's duties, not our rules. We cannot fine you for anything. Only the Data Protection Board of India can, and the most it can impose for a breach of these duties is Rs 10,000. The duties are:

• Do not impersonate anyone else when you give us personal data.
• Do not suppress material information when you give personal data for a document or as proof of identity.
• Do not register a false or frivolous grievance or complaint.
• When you ask us to correct or erase data, give us information that is genuine and can be checked.

Separately — and this is a request from us, not a duty under that Act — please give an accurate, complete delivery address, PIN code and phone number, because that is what decides whether your parcel reaches you. What we expect of a return claim, including honest photographs of the pair, is set out in our Returns and Refunds Policy. That is a matter of that policy and of your contract with us, not of data-protection law, and nothing in this notice makes it one.

Cookies

Cookies are small files a website stores on your device. This store uses three kinds.

• Essential cookies, set by Shopify. They hold your cart, keep you signed in through checkout, and protect the checkout against fraud. The store simply does not work without them, so they are set as soon as you arrive.
• Analytics cookies, set through Shopify web pixels for Google Analytics, Wigzo and CleverTap. They count visits, group behaviour and show us where people drop off.
• Marketing cookies, used by Wigzo and CleverTap to know which of our messages you opened and which products you looked at, so that a reminder or an offer is about something relevant rather than random.

You control the last two. This store shows you a cookie choice, and analytics and marketing tags load only where you have accepted them there. If you have not accepted, only the essential cookies are set. You can change your choice at any time through the same cookie control. Independently of that, you can block or delete cookies in your browser settings, use Google's own Analytics opt-out browser add-on, and unsubscribe from our messages as described above. If you block essential cookies, the cart and checkout will stop working.

Children

This store is meant for adults. Under section 11 of the Indian Contract Act, 1872 a person under 18 cannot make this contract, so by placing an order you confirm you are 18 or over, or that a parent or guardian is placing it for you. We do not knowingly collect personal data from anyone under 18. We do not run behavioural advertising, tracking or profiling directed at children, which the Digital Personal Data Protection Act, 2023 forbids, and we do not knowingly include anyone under 18 in our marketing lists. If a child has given us personal data, email office@massdeals.in and we will delete it, except for an invoice or payment record that tax law requires us to retain.

How we protect your data

The store runs on Shopify and payments run on Razorpay, and each of those maintains its own security controls for the data it holds. Inside our business, access to customer data is limited to the people who need it to pack orders, arrange deliveries, process returns and answer you. We do not hold your payment credentials at all, which is the safest possible way to handle them. For the sensitive data we do hold — the bank or UPI details given for a Cash on Delivery refund — we follow reasonable security practices and procedures as required by section 43A of the Information Technology Act, 2000 and the rules made under it, and we use those details only for that one refund.

No system can promise that data will never be exposed, and we will not make a promise we cannot keep. If a personal data breach affects your data, we will tell you without delay, in plain words, what happened, what data was involved and what you should do about it. We will also report it to the Data Protection Board of India without delay and give the Board the fuller particulars within 72 hours, as the rules under the Digital Personal Data Protection Act, 2023 require. As a body corporate we are also covered by the CERT-In directions of 28 April 2022, so we report reportable cyber security incidents to CERT-In within 6 hours of becoming aware of them and keep the system logs those directions require.

If you are not happy with how we handled your data

Contact our Grievance Officer first — the Digital Personal Data Protection Act, 2023 asks you to try us before going to the Board, and he is a real, named person who answers.

• Name: Amit Kumar Jain
• Designation: Director. He is our Grievance Officer and our Nodal Officer.
• Company: MAGIKAL ONLINE SERVICES PVT LTD (MassDeals)
• Email: office@massdeals.in
• Post: 45/1, Heggadadevanapura, Alur Post, Dasanapura Hobli, Bangalore North Taluk, Bengaluru Rural, Karnataka 562123

We acknowledge every complaint within 48 hours of receiving it and resolve it within 30 days, as Rule 4(6) of the Consumer Protection (E-Commerce) Rules, 2020 requires. The acknowledgement carries a reference number, and we quote that number on every reply, so you can track where the complaint has got to.

If we have not sorted it out within 30 days, or you are not happy with how we handled it, you can take it further:

• the Data Protection Board of India, through its own complaint process, for anything about your personal data;
• the National Consumer Helpline on 1915, or consumerhelpline.gov.in, for anything about your order;
• a consumer complaint online at edaakhil.nic.in. Under the Consumer Protection Act, 2019 you can file where you live or work — you do not have to come to Bengaluru.

Nothing in this notice takes away any right you have under the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 or the Consumer Protection Act, 2019. If any part of this notice is ever held to be unfair or unenforceable, that part falls away and the rest continues to apply.

Reading this in another language

The Digital Personal Data Protection Act, 2023 gives you the choice of reading this notice in English or in any language listed in the Eighth Schedule to the Constitution. If you would rather read it in Hindi or Kannada, email office@massdeals.in and we will send you a translation. If you need a different Eighth Schedule language, ask and we will arrange it.

Changes to this notice

We may update this notice as our business, our service providers or the law change. Every change applies from the date we publish it and never backwards, and the Last updated date at the top will tell you which version is current. If a change would materially widen how we use your data, we will ask for fresh consent where the law requires it, rather than assuming it.

Who you are buying from

MAGIKAL ONLINE SERVICES PVT LTD (trading as MassDeals), an independent reseller, not an authorised dealer of or partner to any brand. CIN U19200KA2021PTC146612. GSTIN 29AAOCM5223C1ZH. Website https://massdeals.in.
Warehouse and correspondence address: 45/1, Heggadadevanapura, Alur Post, Dasanapura Hobli, Bangalore North Taluk, Bengaluru Rural, Karnataka 562123.
Branch: Mount Road, Anna Salai, near Government Estate Metro, Wallers Road, Ritchie Street, Chennai, Tamil Nadu, PIN [to be confirmed].
Customer care: Warehouse Manager, office@massdeals.in.
Grievance Officer / Nodal Officer: Amit Kumar Jain, Director, office@massdeals.in.
Returns are raised only at https://massdeals.returndotai.com.