Privacy Policy

This Privacy Policy ("Policy") governs the manner in which Vardhman Cosmetics Private Limited ("Company", "we", "our", or "us") collects, processes, stores, transfers, and protects information relating to identifiable individuals ("Personal Data" or "Data Subjects") in connection with the access to or use of our websites, mobile applications, or digital platforms (collectively, the "Platforms").

By accessing, browsing, or using the Platforms, you ("User", "you", or "your") expressly consent to the collection, use, processing, and disclosure of your Personal Data in accordance with this Policy and our Terms & Conditions. You acknowledge that you have read, understood, and agreed to be bound by this Policy. If you do not agree with any part of this Policy, you must immediately discontinue using our Platforms.

This Policy has been prepared in compliance with:

The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
The Digital Personal Data Protection Act, 2023 (to the extent notified and applicable); and
Any other applicable laws, regulations, directives, or industry standards as may be amended from time to time.

1. Data Controller

The Company acts as the Data Fiduciary/Data Controller in determining the purposes and means of processing Personal Data and may also act as a Data Processor for data processed on behalf of third parties.

2. Information We Collect

Without limitation, we may collect and process the following categories of Personal Data:

(a) Personally Identifiable Information (PII)

Name
Residential or business address
Phone number
Email address
Date of birth

(b) Financial Information

Payment instrument details
Transaction history

Payment information is processed through PCI-DSS compliant payment gateways. We do not store complete debit or credit card information.

(c) Technical Information

IP address
Geolocation
Device identifiers
Browser information
Log files
Browser fingerprints

(d) Usage Information

Clickstream data
Browsing history
Wishlist activity
Purchase behavior
User-generated content including reviews, ratings, and comments

(e) Sensitive Personal Data

Where permitted by applicable law, we may process sensitive personal data including passwords, authentication credentials, and any other category recognized under applicable law.

Failure to provide certain Personal Data may result in denial of services, inability to complete transactions, or termination of your account.

3. How We Collect Information

We collect Personal Data through the following methods:

Direct Collection

User registration
Order placement
Customer support requests
Account updates

Automated Collection

Through:

Cookies
Pixels
Web beacons
SDKs
Server logs
Similar tracking technologies

Third-Party Sources

We may receive Personal Data from:

Payment processors
Logistics partners
Analytics providers
Advertising technology partners
Fraud prevention agencies

We reserve the right to aggregate, pseudonymize, or anonymize Personal Data for analytics, statistical reporting, and legitimate business purposes.

4. Purpose of Processing

Personal Data may be processed for the following purposes:

(a) Contractual Necessity

Order processing
Shipping and delivery
Returns and refunds
Customer support

(b) Legitimate Interests

Fraud detection and prevention
Platform security
Service improvements
Personalization and profiling

(c) Legal Compliance

Tax obligations
Audit requirements
Regulatory disclosures
Compliance with applicable laws

(d) Consent-Based Processing

Marketing communications
Promotional campaigns
Cookie management
Optional services

The Company may rely on multiple legal bases simultaneously where permitted by law.

5. Disclosure and Sharing of Personal Data

We may disclose or transfer Personal Data to:

(a) Affiliates and Subsidiaries

For internal administrative and business operations.

(b) Service Providers

Including logistics providers, payment processors, cloud hosting providers, IT vendors, and other service partners, all of whom are contractually bound by confidentiality and data protection obligations.

(c) Government Authorities

Law enforcement agencies, regulators, courts, or other authorities where disclosure is required by law.

(d) Business Transfers

In connection with mergers, acquisitions, restructuring, financing, or sale of assets, subject to equivalent privacy protections.

Where Personal Data is transferred outside India, such transfers shall be subject to legally recognized safeguards, including Standard Contractual Clauses (SCCs), adequacy decisions, or other applicable mechanisms.

6. Data Retention

Personal Data shall be retained only for as long as necessary to fulfill the purposes described in this Policy or as required under applicable law.

Upon expiry of the applicable retention period, Personal Data will be securely deleted, anonymized, or destroyed using industry-standard practices.

The Company shall have no obligation to retain Personal Data beyond the legally required retention period.

7. Profiling and Personalized Marketing

We may use aggregated and behavioral data to provide personalized recommendations, advertisements, and marketing communications.

Such profiling shall not produce legal or similarly significant effects without appropriate human oversight.

You may opt out of direct marketing communications at any time.

8. Your Rights

Subject to applicable law, you may have the right to:

Request access to your Personal Data;
Request correction or updating of inaccurate information;
Request deletion or erasure of Personal Data;
Withdraw previously provided consent;
Object to certain processing activities;
Request restriction of processing.

Limitations

The Company may refuse or limit such requests where:

Disclosure is prohibited by law;
It would adversely affect the rights or freedoms of others;
It involves disproportionate effort or disclosure of confidential business information or trade secrets; or
Retention is legally required.

Identity verification may be required before processing any such request.

9. Security Measures

The Company implements appropriate organizational, technical, and physical safeguards including:

SSL/TLS encryption;
Secure server infrastructure;
Firewalls and intrusion detection systems;
Role-based access controls;
Employee confidentiality agreements;
Regular vulnerability assessments;
Penetration testing; and
Independent third-party security audits.

Disclaimer

Although we implement commercially reasonable safeguards to protect Personal Data, no electronic transmission or storage system can be guaranteed to be completely secure.

Accordingly, the Company disclaims liability for unauthorized access, interception, alteration, or disclosure of Personal Data resulting from circumstances beyond its reasonable control.

10. Cookies and Tracking Technologies

Our Platforms use cookies, web beacons, SDKs, pixels, and similar technologies to:

Enable website functionality, authentication, and session management;
Analyze website performance and user behavior;
Deliver personalized content and targeted advertisements.

Users may manage cookie preferences through our Cookie Consent Manager. However, disabling certain cookies may affect the functionality and performance of the Platforms.

Third-party cookies and SDKs are governed by the respective privacy policies of their providers, and the Company accepts no responsibility for their practices.

11. Changes to this Privacy Policy

The Company reserves the right to amend, modify, or update this Privacy Policy at its sole discretion and without prior notice, unless otherwise required by applicable law.

Any material changes will be communicated through the Platforms. Continued access to or use of the Platforms following such amendments shall constitute your acceptance of the revised Privacy Policy.