Privacy Policy

At ARQJewels (“we”, “us”, “our”) we take your privacy seriously. This Privacy Policy describes the kinds of personal data we collect when you visit arqjewels.com, place an order or contact us, how we use that data, who we share it with and your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act). By using our website you consent to the practices described below.

1. Information we collect

We collect information in three ways:

• Information you give us— name, email, mobile number, shipping & billing address, gender (optional) and the contents of any messages you send us. We collect this when you create an account, place an order, subscribe to our newsletter, write a review or contact our team.
• Order & payment data— products you ordered, prices, coupons used, payment method and transaction identifiers. We do not store your full card number, CVV or UPI PIN. Payments are processed by Razorpay Software Pvt. Ltd., and only a tokenised reference is returned to us.
• Automatic information— device type, browser, IP address, pages viewed, products clicked, add-to-cart and checkout events. We use cookies and similar technologies for this; see §5 below.

2. How we use your information

• To process and fulfil your orders, including delivery and customer support.
• To send order, shipping and refund updates by email and SMS.
• To verify Cash on Delivery orders by OTP.
• To detect and prevent fraud or abuse of our platform.
• To send marketing communications about new arrivals, offers and editorial features — only if you have opted in. You can opt out at any time from your account or by clicking the unsubscribe link in any marketing email.
• To comply with legal obligations, including GST invoicing, accounting and law-enforcement requests where required.

3. Lawful bases for processing

Under the DPDP Act we process your data on the lawful bases of (a) your consent (e.g. marketing email opt-in), (b) performance of the contract you enter into when you place an order, (c) our legitimate business interests (e.g. fraud prevention, analytics) and (d) compliance with statutory obligations (e.g. retention of invoices for GST purposes).

4. Who we share data with

We share the minimum information required with the following categories of data processors. Each one is contractually bound to keep your data confidential and use it only for the purposes we specify.

• Payment: Razorpay Software Pvt. Ltd. (PCI-DSS compliant) for online payments and refunds.
• Logistics: Shiprocket / KartRocket and the underlying courier partners (Delhivery, BlueDart, Ekart, India Post) for delivery and reverse pickup.
• Email: Resend / Amazon SES for transactional and marketing email delivery.
• SMS & OTP: MSG91 for transactional SMS and one-time-password verification.
• Analytics & advertising: Google Analytics (GA4) and Meta Pixel for traffic and conversion measurement. IP addresses are anonymised. You can opt out by setting cookie preferences (§5).
• Hosting & infrastructure: cloud infrastructure providers (AWS / Cloudflare) for storage, delivery and security.
• Government authorities: only when compelled by a valid legal process such as a court order, a notice under the IT Act, or in response to law-enforcement requests.

5. Cookies

We use the following cookie categories:

• Strictly functional— required to keep you signed in, hold your cart and remember preferences. Cannot be disabled.
• Analytics— help us understand how the site is used so we can improve it. You can decline these in our cookie banner.
• Marketing— used by Meta Pixel and Google to show relevant ads. Disabled by default until you opt in.

6. Data retention

Order, invoice and tax-related records are retained for up to seven (7) years as required under Indian tax law and the GST Act. Account profiles are kept while your account remains active and for 24 months thereafter for fraud-prevention purposes. Marketing identifiers are deleted within 12 months of opt-out. Cart and browsing data is retained for 90 days.

7. Your rights under the DPDP Act

• Access: request a copy of the personal data we hold about you.
• Correction: correct any inaccurate or outdated data.
• Erasure: ask us to delete your data, subject to overriding legal obligations.
• Portability: receive a machine-readable export of your data.
• Withdrawal of consent: at any time, without affecting prior lawful processing.
• Grievance redressal: lodge a complaint with our Grievance Officer (see Grievance Redressal) or, after exhausting our process, with the Data Protection Board of India.

To exercise any of these rights, write to us at hello@arqjewels.local from the email address registered on your account. We respond within 30 days.

8. Security

We use TLS encryption in transit, encrypted backups at rest, argon2id hashing for passwords, and tightly-scoped admin access with audit logging. No system is perfectly secure; we encourage you to use a unique password and not share account credentials.

9. Children

Our service is not directed at users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, please write to hello@arqjewels.local and we will delete it promptly.

10. Updates to this policy

We may update this Privacy Policy from time to time. Material changes are notified by email and a banner on the site. The “Last updated” date at the top of the page reflects the latest version.

11. Contact

ARQJewels · ARQJewels, India
Email: hello@arqjewels.local
Phone: +91 0000000000
GSTIN: [GSTIN pending]