Privacy Policy

This Privacy Policy explains how ToxicKartik (operated by Kartik Sunagar) (“we”, “us”, “our”) collects, uses, and protects personal information when you visit or interact with the site, including Home, About, Portfolio, Shop, Blog, and Contact. We are committed to complying with applicable data protection laws.

Compliance

We process personal data lawfully, fairly, and transparently, and support user rights such as access, deletion, objection, and consent withdrawal where applicable.

Information We Collect

- Contact form data: first name, last name, email, phone, and message content submitted via the “Get in Touch” form.

- Basic usage data: pages visited, time on page, clicks, device/browser information, and approximate location (via standard analytics or server logs).

- Transaction data (Shop): when you purchase via the Shop, payment processing and order details may be handled by third‑party providers. We receive only necessary records (e.g., transaction references, order confirmation, billing and shipping details, and support history).

How We Use Your Information

- To respond to inquiries and provide requested information or services.

- To manage orders, delivery, customer support, and legal/financial record‑keeping.

- To maintain website functionality, security, and improve content (e.g., portfolio and blog).

- To communicate updates about the site, research, or photography when you opt in.

- To protect our rights, users, and property, and to prevent fraud or misuse.

Legal Bases for Processing (EEA/UK visitors)

- Consent: for direct communications or marketing you opt into, and any promotional display of images/content where we ask for approval.

- Contract: to process inquiries and orders and deliver services you request.

- Legitimate interests: site security, performance, and audience insights.

- Legal obligations: tax, accounting, and compliance requirements.

Email Marketing

We do not conduct email marketing. We do not share personal data with third parties for their marketing.

Client/Viewer Galleries (if applicable)

If we provide private galleries or downloads, they are protected (e.g., by password). Access does not require additional personal data beyond what is necessary to deliver the service.

Cookies and Analytics (Google Analytics)

We use cookies and similar technologies to enable core functions, measure performance, and improve content. Essential cookies are required for certain features to function. You can control cookies via your browser settings; disabling non‑essential cookies may affect site functionality.

We use Google Analytics to understand site usage and improve performance. Google Analytics may collect page views, referrers, time on page, clicks, device/browser type and settings, operating system, approximate location inferred from IP, and technical identifiers (e.g., client ID) stored in cookies to differentiate visits.

Where configured, we use IP address masking/anonymization to reduce identifiability. Analytics reports are aggregated; we avoid using Analytics to track individual profiles. You can limit Analytics by adjusting browser settings, using privacy modes, or installing Google’s opt‑out add‑on. Data collected via Analytics may be processed on Google’s infrastructure, which can be located outside your country; appropriate safeguards apply per Google’s compliance frameworks.

Shop Payments (Razorpay)

Payments in the Shop are processed by Razorpay, a third‑party payment service provider. When you make a purchase:

- Razorpay collects and processes payment information (e.g., card, UPI, wallet details) directly and securely under its policies and PCI‑DSS requirements.

- We do not store full card/payment credentials. We only receive necessary order records, such as transaction references, order confirmation, billing and shipping details, and support history.

- Razorpay may conduct fraud checks and compliance screening. Data relevant to payment may be processed on systems outside your country, subject to appropriate safeguards.

Sharing and Disclosure

We do not sell personal data. We may share limited data with service providers (website hosting, email and form handling, Google Analytics, Razorpay, and delivery partners) acting under our instructions and subject to appropriate safeguards, and with legal authorities when required by law or to protect rights, safety, or property.

External Links and Third‑Party Platforms

We may link to external websites (e.g., Instagram, Twitter/X, LinkedIn, YouTube). Their privacy practices are governed by their own policies. We cannot guarantee or verify the content or privacy practices of external sites; visiting these links is at your own risk.

Data Retention

- Contact inquiries: retained as long as needed to address your request and for reasonable follow‑up.

- Transaction records: retained per applicable law and accounting requirements.

- Analytics/logs: retained for operational needs and site improvement, following reasonable retention periods.

When data is no longer needed, we securely delete or anonymize it.

Images and Personal Data in Media (if applicable)

Under GDPR, photographs can constitute personal data when they uniquely identify a person. We do not photograph individuals for unique identification or authentication unless consented and contractually required. Individuals appearing in images related to events or projects do so under our legitimate interests and those of our clients, balanced against individual rights. You may contact us with concerns at any time.

Promotional Use of Images (if applicable)

With your consent, we may select work samples, including images or screenshots, to promote our services on the website, social media, and marketing materials. We will only display such content lawfully and respectfully. You may withdraw consent at any time (see “Your Rights”).

Your Rights

Depending on your location, you may have the right to access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; object to or restrict certain processing; exercise data portability; and withdraw consent where processing is based on consent. To exercise your rights, contact us via the Contact page or the email listed below. We will respond within a reasonable timeframe (typically within 30 days, and within 72 hours for simple contact‑form deletion requests).

International Transfers

If data is transferred to servers or providers outside your country (including processing by Google Analytics or Razorpay), we use appropriate safeguards (e.g., standard contractual clauses) to protect your information.

Security

We use reasonable technical and organizational measures to protect personal data, including password‑protected systems and encrypted backups for any stored content. No method of transmission or storage is completely secure; we continuously review and improve security practices.

Children’s Privacy

This site is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us to request deletion.

Contact and Responses

By submitting a contact form on toxickartik.com, you consent to us contacting you via the email address you provided to respond to your enquiry, typically within 72 hours. If you do not wish your email to be retained after we respond, please state this in your message or request deletion.

Withdrawal of Consent for Displayed Content

If you previously consented to the display of images or content featuring you and wish to withdraw consent, email us specifying the item(s). We will remove the content from online and printed materials wherever feasible.

Updates to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a new “Last updated” date. Continued use of the site after changes indicates acceptance of the updated policy.

Contact

For privacy questions or requests, please reach out via the site’s Get in Touch form on Contact.