Privacy Policy

This Privacy Policy (“Policy”) governs the manner in which C18 Paris Cosmetics Private Limited (“Company”, “we”, “our”, “us”) collects, processes, stores, transfers, and protects information pertaining to identifiable individuals (“Personal Data”/“Data Subjects”) in connection with the access to or use of our websites, mobile applications, or digital platforms (collectively, “Platforms”).

By accessing, browsing, or using the Platforms, you (the “User”, “you”, “your”) expressly consent to the collection, use, processing, and disclosure of your Personal Data in accordance with this Policy and the Terms & Conditions, and represent that you have read, understood, and agree to be bound by this Policy. If you do not agree, you must immediately discontinue use of our Platforms.

This Policy is prepared in compliance with:
(a) Information Technology Act, 2000 and SPDI Rules, 2011;
(b) Digital Personal Data Protection Act, 2023 (to the extent notified);
(c) any other applicable laws, directives, or industry standards as may be amended from time to time.

·         We act as Data Fiduciary/Controller in determining the purposes and means of processing Personal Data and may act as Processor for data processed on behalf of third parties.

·         Without limitation, we may collect and process the following:

·         Personally Identifiable Information (PII): Name, address, phone, email, date of birth.

·         Financial Information: Payment instruments, transaction history (processed via PCI-DSS-compliant gateways; we do not retain full card data).

·         Technical Data: IP address, geolocation, device identifiers, browser fingerprints, log data.

·         Usage Data: Clickstream, browsing history, wishlists, purchase behavior, UGC (reviews, ratings, comments).

·         Sensitive Personal Data: Passwords, authentication credentials, and any other category defined under applicable law.

.

·         Failure to provide certain information may result in denial of services or termination of the account;

• Direct: User registration, order placement, support requests
• Automated: Through cookies, tags, pixels, SDKs, server logs, and other tracking technologies (see Section 10).
• Third-Party Sources: Payment processors, logistics partners, analytics/adtech providers, fraud prevention agencies.

·         We reserve the right to aggregate, pseudonymize, or anonymize data for analytics and business purposes.

·         Personal Data shall be processed strictly for:

(a) Contractual Necessity: order processing, delivery, returns;
(b) Legitimate Interests: fraud detection, platform security, service improvements, profiling for personalization;
(c) Legal Compliance: tax, audit, regulatory disclosures;
(d) Consent-Based Processing: marketing, cookies, optional services.

·         We may rely on multiple legal bases simultaneously for the same processing activity.

 

·         We may disclose or transfer Personal Data to:

(a) Affiliates/Subsidiaries: for internal business operations;
(b) Service Providers: logistics, payment processors, IT/cloud vendors (bound by DPAs with confidentiality & security obligations);
(c) Law Enforcement/Regulators: pursuant to lawful requests;
(d) Successors-in-Interest: in mergers, acquisitions, restructurings (with continued application of this Policy or equivalent protection).

·        Cross-border transfers, where undertaken, shall employ legally recognized safeguards (e.g., SCCs, adequacy, binding corporate rules).

·        Personal Data shall be retained only for as long as necessary to fulfill the purposes outlined or as mandated by law. Post-retention, data will be securely erased, anonymized, or destroyed in accordance with industry best practices. The Company assumes no obligation to retain data beyond applicable statutory periods.

 

·        We may use aggregated behavioral data to deliver personalized recommendations and marketing communications. Such profiling does not produce legal effects without human oversight. You may opt out of direct marketing at any time.

·         Subject to applicable law, you may:

• Request access, correction, or erasure;
• Withdraw consent for processing (without affecting prior lawful processing);
• Object to processing or request restriction.

·         Limitations: Requests may be refused where: (i) legally impermissible; (ii) impacts rights/freedoms of others; (iii) involves disproportionate effort or trade secrets; or (iv) retention is legally required.

·         Verification of identity is mandatory prior to processing any such request.

·         We deploy organizational, technical, and physical safeguards, including:

• TLS/SSL encryption, secure server infrastructure, firewalls;
• Role-based access controls and employee NDAs;
• Regular penetration testing and third-party security audits.

Disclaimer: While we aim to protect your data, no system is infallible. The Company disclaims liability for unauthorized access, interception, or breaches beyond its reasonable control.

10. COOKIES AND TRACKING TECHNOLOGIES

Our Platforms utilize cookies, web beacons, SDKs, and similar technologies to:
(a) enable functionality (session management, authentication);
(b) analyze usage patterns and performance;
(c) deliver personalized content and targeted advertising.

Users can manage cookie preferences via our Cookie Consent Manager, though disabling certain cookies may degrade user experience. Third-party cookies/SDKs are governed by their respective providers’ policies; we disclaim responsibility for their practices.

 

We reserve the right to amend this Policy at our sole discretion. Material changes will be notified via the Platforms. Continued use post-amendment constitutes deemed acceptance.