Royal Lady (“we”, “us”, “our”) respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and the choices you have when you shop or browse at Royal Lady. By using the Service you consent to the practices described below.

1. Information we collect

• Account information — name, email address, phone number, password (stored as a one-way hash).
• Order information — shipping address, billing address, order history, size preferences, wishlist and cart contents.
• Payment information — payment method type (COD, UPI, card, wallet). Card numbers, CVV and UPI PINs are handled entirely by our PCI-DSS compliant payment partners and are never stored on Royal Lady servers.
• Communications — messages you send us via email, contact form, or WhatsApp, along with our replies.
• Technical & usage data — IP address, device type, browser type and version, operating system, referral source, pages viewed, session duration and error logs, collected for security, fraud prevention and analytics.
• Cookies & similar technologies — see the Cookies section below.

2. How we use your information

• To create and manage your account.
• To process orders, payments, invoices, shipping and returns.
• To provide customer support and respond to your queries.
• To send transactional messages (order confirmation, dispatch, delivery, refund).
• With your consent, to send occasional marketing communications about new drops, offers and restocks. You may opt out at any time.
• To detect, investigate and prevent fraud, abuse, and violations of our Terms.
• To improve the Service, our catalogue and the shopping experience through analytics.
• To comply with legal obligations (GST invoicing, statutory record-keeping, court orders).

3. Legal basis

We process your personal data on the basis of (a) performance of the sale contract when you place an order, (b) your explicit consent for marketing communications, (c) our legitimate interests in operating a secure, fraud-free store, and (d) compliance with applicable laws.

3A. DPDP Act 2023 — key disclosures

This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”). The following disclosures are made in accordance with Sections 5, 6, 7 and 11 of the Act.

• Data Fiduciary. Royal Lady is the Data Fiduciary responsible for the processing of your personal data.
• Certain, lawful purposes. Processing is limited to the purposes listed in Section 2 of this Policy and to legal obligations.
• Free, specific, informed & unambiguous consent. Where we rely on consent, it is obtained through a clear affirmative action (e.g. checking a box, tapping a button) with plain-language notice.
• Withdrawal of consent. You may withdraw consent at any time from Profile → Privacy or by writing to our Grievance Officer. Withdrawal takes effect prospectively and does not affect lawful processing before withdrawal.
• Notice. A separate, itemised notice is presented before we collect personal data for a new purpose; the notice is available in English (and, where feasible, in Hindi and one additional language of your choice under the Eighth Schedule of the Constitution).
• Grievance redressal. Our Grievance Officer (see Contact page) is your first point of contact. We acknowledge complaints within 24 hours and resolve them within 15 days.
• Escalation to the Data Protection Board of India. If unresolved, you may escalate to the Data Protection Board of India constituted under the DPDP Act.
• Data of children (< 18). We do not knowingly process personal data of any Data Principal under the age of 18. Age is verified at signup; if you believe a minor has shared data with us, please contact the Grievance Officer for immediate deletion.
• Data of persons with disability. Where a Data Principal is a person with disability under a lawful guardian, consent may be obtained from the guardian on their behalf.
• Automated decision-making. Royal Lady does not use automated decision-making that produces legal or similarly significant effects on you.

4. Sharing your information

We do not sell your personal data. We share it only with:

• Logistics partners (e.g. Shiprocket, Delhivery, Blue Dart, DTDC, India Post) — to deliver your orders. They receive your name, phone, shipping address and order weight only.
• Payment processors (e.g. Razorpay, UPI apps, card networks) — to process payments securely.
• Cloud & infrastructure providers — for hosting, database, email delivery, and analytics.
• Government & law-enforcement — when required by law, subpoena, or valid legal process.
• Successors in interest — in the event of a merger, acquisition or asset sale, under equivalent privacy commitments.

5. Data retention

We retain account and order data for as long as your account is active and for a further period required by Indian tax and accounting law (typically 8 years for GST and financial records). You may request deletion of non-mandatory data at any time via the Contact page.

6. Security

We protect your data using industry-standard measures: HTTPS/TLS encryption in transit, bcrypt-hashed passwords, rate-limited authentication endpoints, JWT-based sessions, secure HTTP headers (X-Frame-Options, HSTS, X-Content-Type-Options), and least-privilege access to production systems. No online service can guarantee absolute security, so please keep your password confidential.

7. Cookies & local storage

Royal Lady uses only essential cookies and browser storage: an authentication token for keeping you signed in, and a lightweight preferences store for your cart, wishlist and recently viewed items. We do not use third-party advertising cookies. You can clear cookies and storage from your browser settings at any time, but doing so will sign you out.

8. Your rights (including under the DPDP Act 2023)

• Right to information & access (DPDP §11) — request a summary of personal data being processed and the identities of Data Fiduciaries and processors with whom it has been shared.
• Right to correction & erasure (DPDP §12) — update inaccurate or incomplete data from your Profile or by writing to us; ask us to erase non-mandatory personal data.
• Right of grievance redressal (DPDP §13) — raise a grievance with our Grievance Officer; you will be acknowledged within 24 hours and resolved within 15 days.
• Right to nominate (DPDP §14) — you may nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent — as easy as giving it.
• Right to data portability — receive your data in a common, machine-readable format.
• Right to complain to the Data Protection Board of India — if unresolved by Royal Lady.

9. Children

Royal Lady is intended for adults aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us so we can delete it.

10. Cross-border transfers

Our primary servers are located in India. Certain processors and sub-processors (for example, cloud infrastructure, transactional email delivery, crash reporting and analytics) may store or process personal data in jurisdictions outside India — including the United States and the European Economic Area — but only to jurisdictions permitted from time to time under Section 16 of the DPDP Act.

Where such a transfer occurs, we require equivalent safeguards through Standard Contractual Clauses, encryption in transit and at rest, and contractual restrictions on onward transfer. A current list of sub-processors and their locations is available on written request to our Grievance Officer.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, notify you by email or an in-app notice.

12. Contact us

For privacy questions, data access requests or grievances, please visit our Contact page.