Privacy Policy

1. Information We Collect

We collect the following categories of personal data:

• Account & identity data: name, email address, phone number, billing/shipping address, gender, date of birth, and any profile preferences you provide.
• Order & transaction data: items purchased, order references, payment method, transaction amounts, and invoices.
• Device & usage data: IP address, browser type, device identifiers, pages visited, referral URLs, and interactions with our emails and website (via cookies and similar technologies).
• Communications data: copies of your messages to us and our responses.
• Sensitive personal data: payment card details are NOT stored by us; they are tokenized and processed by our PCI-DSS compliant payment partners.

2. How We Use Your Data

• To process, fulfill, and deliver your orders and payments.
• To communicate order updates, shipping notifications, and customer service replies.
• To personalize your experience, recommend products, and remember your preferences.
• To detect and prevent fraud, unauthorized access, and abuse of our services.
• To comply with legal obligations and resolve disputes.
• To send marketing communications if you have subscribed (you may opt out at any time).

3. Legal Basis & Lawful Processing

We process your data on the following lawful bases: (a) performance of a contract (order fulfillment); (b) your consent (marketing, preference cookies); (c) our legitimate interests (fraud prevention, analytics, security); and (d) compliance with applicable laws (tax, accounting, legal obligations).

4. Sharing & Disclosure

We may share your data with:

• Courier, logistics, and shipping partners (to deliver your orders and provide tracking).
• Payment gateways and financial institutions (to process payments).
• Service providers (hosting, analytics, email, fraud screening) acting on our behalf.
• Authorities, regulators, or law enforcement when required by law or to protect our rights and safety.

We do not sell or rent your personal data to third parties. We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, for the duration of your account, or as required by applicable tax and accounting laws (typically up to 8 years for transaction records). You may request deletion of your account at any time.

6. International Transfers

Your data may be transferred to and processed in countries other than India (including the United States and the EU) where our service providers operate. We use contractual safeguards and approved transfer mechanisms to protect your data.

7. Your Rights

Under applicable law, you have the right to:

• Access and obtain a copy of your personal data.
• Rectify inaccurate or incomplete personal data.
• Request erasure (deletion) of your personal data.
• Restrict or object to processing of your personal data.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time without affecting lawfulness of prior processing.
• Lodge a complaint with the Data Protection Authority of India / competent authority.

To exercise these rights, contact us via the details on the Grievance Officer page. We will respond within a reasonable time and in any event within 30 calendar days.

8. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data of children. If we become aware that we have collected such data, we will delete it promptly.

9. Security

We implement industry-standard security measures including SSL/TLS encryption in transit, tokenized payment processing, database Row-Level Security (RLS) via Supabase, and role-based access controls. However, no method of transmission over the internet is 100% secure; you acknowledge that we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top and, where appropriate, notify you by email. The latest version will always be posted on this page.

11. Contact Us

For any questions about this Privacy Policy or your personal data, please contact our Grievance Officer (see the Grievance Officer page) or email concierge@crownandcrest.com.