Last updated: 18 October 2026
1. Who we are
This Privacy Policy explains how Aikya Clothing Private Limited, which runs the brand A Toddler Thing ("ATT", "we", "us"), collects and uses your personal data when you visit www.atoddlerthing.com, shop with us, or contact us.
Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025, we are the Data Fiduciary for this data, and you are the Data Principal.
Registered address: Door No. 5A, 5B, Gandhi Nagar, Kavundampalayam, Coimbatore, Tamil Nadu 641030, India
Email: info@atoddlerthing.com · Phone: +91 63817 73133
2. What personal data we collect
Data you give us
- Order and account details: name, mobile number, email address, billing and shipping address, and your order history.
- Payment details: payments are processed by our payment partners. We do not see or store your full card number, CVV, UPI PIN or net-banking password.
- Messages: what you send us via our contact form, email, WhatsApp, Instagram or phone, including order issues, returns and replacement requests.
- Reviews and photos you choose to submit.
- Marketing preferences: whether you've agreed to receive offers by email, SMS or WhatsApp.
Data collected automatically
- Device and browser details, IP address, approximate location, pages viewed, products added to cart, and how you arrived at our site (for example, from an Instagram or Google ad).
- This is collected through cookies and similar technologies (see Section 5).
About your child
We sell products for babies and children, but our customers are adults. We only need details such as product size or age range to fulfil your order. We do not ask for your child's name, photo or date of birth, and we ask you not to share them unless needed to resolve a specific order.
3. Why we use your data
| Purpose | Basis under the DPDP Act |
|---|---|
| Processing, packing, shipping and delivering your order, including cash on delivery | You provided the data for this purpose (legitimate use) |
| Payments, refunds, replacements and customer support | Legitimate use |
| Sending order and delivery updates by SMS, email or WhatsApp | Legitimate use |
| Preventing fraud, fake orders and misuse of offers | Legitimate use |
| Keeping invoices and records required by tax and company law | Legal obligation |
| Sending offers, new arrivals and promotional messages | Your consent |
| Analytics and personalised advertising (e.g. on Instagram, Facebook, Google) | Your consent |
We will only use your data for the purposes listed here, or a purpose we tell you about and, where needed, ask your consent for.
4. Consent and how to withdraw it
Where we rely on consent, we ask for it clearly and separately. It is never a pre-ticked box and never a condition of buying from us.
You can withdraw consent at any time, as easily as you gave it:
- Click Unsubscribe in any marketing email.
- Reply STOP to our WhatsApp or SMS messages.
- Change your choices in our cookie settings (link in the website footer).
- Email info@atoddlerthing.com or our Grievance Officer.
Withdrawing consent does not affect anything we did before you withdrew it, and you can still place orders with us.
5. Cookies and tracking
We use:
- Essential cookies that make the store work (cart, checkout, login, security). These are always on.
- Analytics cookies that help us understand how visitors use our site.
- Marketing cookies and pixels, including the Meta Pixel and Google tags, which help us measure ads and show you relevant ads on other platforms.
Analytics and marketing cookies load only after you accept them in our cookie banner. You can change your choice at any time from the cookie settings link in the footer, or by clearing cookies in your browser.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers ("Data Processors") who help us run our business, under contracts that require them to protect it and use it only on our instructions:
- E-commerce platform: Shopify
- Checkout and payments: GoKwik, Razorpay, Easebuzz and other payment gateways
- Shipping and logistics: Delhivery and other courier partners
- Advertising and analytics: Meta (Facebook, Instagram), Google
- Communications: our email, SMS and WhatsApp messaging providers
- Customer support, reviews and loyalty tools we use on the store
We may also share data:
- when required by law, a court order or a government authority; or
- with a buyer or successor if our business is merged, sold or restructured, who must protect it in line with this policy.
7. Data stored outside India
Some of our service providers (such as Shopify, Meta and Google) may store or process your data outside India. We only transfer data to countries not restricted by the Government of India under the DPDP Act, and we expect these providers to protect it to a standard consistent with this policy.
8. How long we keep your data
- Order and invoice records: for as long as tax, GST and company laws require (generally up to 8 years).
- Customer account: while your account is active. If you haven't shopped or logged in for 5 years, we may delete or anonymise your account after giving you at least 48 hours' notice.
- Marketing data: until you withdraw consent.
- Support messages: as long as needed to resolve your query and handle any follow-up.
When data is no longer needed, we delete or anonymise it, unless the law requires us to keep it.
9. How we protect your data
We use reasonable security safeguards to protect your personal data, including encrypted (HTTPS/SSL) connections, PCI-compliant payment partners, access controls that limit staff access to what they need for their role, and logging of access to our systems.
If a personal data breach happens, we will inform affected customers and the Data Protection Board of India as required by the DPDP Act and Rules, including what happened, the likely impact, and the steps we are taking.
10. Your rights
As a Data Principal, you have the right to:
- Access: get a summary of the personal data we hold about you and how we use it, and know who we've shared it with.
- Correction and updating: ask us to correct, complete or update inaccurate or incomplete data.
- Erasure: ask us to delete your data, unless we need to keep it to meet a legal obligation.
- Withdraw consent at any time (see Section 4).
- Grievance redressal: raise a complaint with us about how we handle your data.
- Nominate someone to exercise these rights on your behalf if you die or become unable to do so.
To use any of these rights, email info@atoddlerthing.com or our Grievance Officer (Section 12) from the email or phone number linked to your orders. We may ask you to verify your identity before acting on the request. We will respond within 60 days.
11. Age requirement
Our website is meant for adults. You must be 18 or older to create an account or place an order. If we learn that we have collected personal data from someone under 18 without verifiable parental consent, we will delete it.
12. Grievance Officer
If you have any questions, requests or complaints about this policy or your personal data, please contact:
Swathi Sri, COO & Founder, A Toddler Thing – Grievance Officer
Aikya Clothing Private Limited
Door No. 5A, 5B, Gandhi Nagar, Kavundampalayam, Coimbatore, Tamil Nadu 641030
Email: swathi@atoddlerthing.com
Privacy requests: info@atoddlerthing.com
Phone: +91 63817 73133 (Mon–Sat, 10 am – 6 pm)
If you are not satisfied with our response, you can file a complaint with the Data Protection Board of India.
13. Changes to this policy
We may update this policy from time to time. If we make important changes, we will post a notice on the website or tell you by email before they take effect. The date at the top of this page shows when it was last updated.