Privacy Policy

Royal Lady ("we", "us", "our") respects your privacy. This policy explains what personal data we collect, how we use it and the rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable Indian law.

1. Data we collect

• Account: name, email, phone, password hash.
• Orders: shipping and billing address, order history, size preferences, wishlist and cart.
• Payment: payment method type only. Card, CVV and UPI PIN are handled by PCI-DSS compliant processors.
• Technical: IP, device, browser, referrer, pages viewed and error logs for security, fraud prevention and analytics.

2. DPDP Act 2023 disclosures

• Data Fiduciary: Royal Lady is the Data Fiduciary for your personal data.
• Purpose: processing is limited to the certain, lawful purposes described in Section 3 below.
• Consent: your consent is free, specific, informed, unconditional and unambiguous. You may withdraw it at any time from Profile → Privacy.
• Notice: we notify you in plain language before collecting personal data.
• Grievances: our Grievance Officer (below) is your first point of contact.
• Complaints Authority: unresolved complaints may be escalated to the Data Protection Board of India.
• Children: we do not knowingly process personal data of anyone under 18. Age-verification is enforced at signup.

3. Purposes of processing

• Create and manage your account.
• Process orders, payments, invoices, shipping and returns.
• Provide customer support and respond to queries.
• Send transactional messages (order confirmation, dispatch, delivery, refund).
• With your consent, send marketing communications; opt out any time.
• Detect, investigate and prevent fraud and abuse.
• Comply with GST invoicing, tax and statutory record-keeping.

4. Sharing

We do not sell your personal data. We share it only with logistics partners (name, phone, delivery address, weight), payment processors, cloud & email providers, and government / law-enforcement when legally compelled.

5. Cross-border transfers

Our primary servers are in India. Some sub-processors (email delivery, cloud hosting, analytics) may store or process data outside India. Where they do, we require equivalent safeguards through standard contractual clauses and only transfer to jurisdictions permitted under Section 16 of the DPDP Act. A list of sub-processors and their locations is available on request from the Grievance Officer.

6. Retention

Account and order data are retained while your account is active and for a further period required by Indian tax law (typically 8 years for GST). You may request deletion of non-mandatory data any time from Profile → Delete my account.

7. Security

HTTPS/TLS in transit, bcrypt-hashed passwords, rate-limited auth endpoints, JWT sessions, HSTS + X-Content-Type-Options + X-Frame-Options headers, least-privilege access and encrypted backups.

8. Your rights under the DPDP Act

• Right to access a summary of personal data being processed.
• Right to correction and erasure.
• Right of grievance redressal — contact our Grievance Officer.
• Right to nominate — you may nominate another individual to exercise your rights if you are deceased or incapacitated.
• Right to withdraw consent — as easy as giving it.

9. Cookies & local storage

Only essential cookies and browser storage: an authentication token and a lightweight preferences store for cart / wishlist / recently viewed. No third-party advertising cookies.

10. Changes

We may update this Policy. Material changes will be notified by email or in-app notice. The "Last updated" date above reflects the current version.

11. Grievance Officer