Privacy Policy

1. Introduction & Scope

Welcome to Iridelle ("we," "us," or "our"). Iridelle is an Indian eCommerce brand specialising in handmade iridescent glass bracelets and angelic charms, operated from Bengaluru, Karnataka, India.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our website, place an order, or otherwise interact with us. It applies to all users of our website regardless of how they access it (desktop, mobile, or any other device).

This policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). By using our website, you consent to the practices described in this policy.

2. Information We Collect

We collect the following categories of information:

Information you provide directly:

• Full name
• Email address
• Phone number
• Shipping and billing address
• Any other information you voluntarily submit through contact forms, reviews, or customer support requests

Information collected automatically:

• Browsing data (pages visited, time spent, click patterns, referral URLs)
• Device information (device type, operating system, browser type and version, screen resolution)
• IP address and approximate geographic location
• Cookies and similar tracking identifiers

3. How We Use Your Information

We use the information we collect for the following purposes:

• Order fulfilment: Processing your purchases, arranging delivery, handling eligible damaged, defective, or incorrect-item claims, and sending order confirmations and shipping updates.
• Communication: Responding to your enquiries, providing customer support, and sending transactional notifications related to your account or orders.
• Marketing (with consent): Sending promotional emails, new collection announcements, and exclusive offers. You may opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly.
• Analytics: Understanding how visitors use our website so we can improve product offerings, site design, and overall user experience.
• Fraud prevention & security: Detecting and preventing fraudulent transactions, unauthorised access, and other illegal activities to protect both you and Iridelle.
• Legal compliance: Fulfilling our obligations under applicable Indian laws and regulations.

4. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience:

• Essential / session cookies: These are necessary for the website to function properly. They maintain your shopping cart, remember your login session, and enable core site features. These cookies expire when you close your browser or after a short period of inactivity.
• Google Analytics: We use Google Analytics to collect aggregated, anonymised data about site traffic and user behaviour. This helps us understand which pages are popular, how visitors navigate the site, and where we can improve. Google Analytics may set its own cookies. You can learn more about how Google uses data at Google's Privacy Policy.

You can control or disable cookies through your browser settings. Please note that disabling essential cookies may impair core website functionality such as your shopping cart and checkout process.

5. Sharing with Third Parties

We do not sell, rent, or trade your personal information to any third party. We share your data only with the following categories of service providers, strictly to the extent necessary to fulfil their role:

• Payment processor (Razorpay): When you make a purchase, your payment is processed securely by Razorpay. Razorpay supports UPI, credit/debit cards, and netbanking. Iridelle does not store, collect, or have access to your full payment card details, bank account numbers, or UPI PINs. All payment data is handled directly by Razorpay in accordance with PCI-DSS standards. You can review Razorpay's Privacy Policy for further details.
• Shipping partners: We share your name, phone number, and shipping address with our logistics and courier partners solely for the purpose of delivering your order.
• Google Analytics: Anonymised browsing and usage data is shared with Google for analytics purposes as described in section 4 above.

We may also disclose your information if required to do so by law, regulation, court order, or governmental authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Data Storage & Security

We take the security of your personal information seriously and implement reasonable security practices and procedures as required under the SPDI Rules, 2011. Our security measures include:

• SSL/TLS encryption for all data transmitted between your browser and our servers
• Secure, access-controlled servers located in India
• Regular security reviews and updates to our infrastructure
• Restricted access to personal data on a need-to-know basis among our team

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to taking all reasonable steps to safeguard your data.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Specifically:

• Transactional data: Retained for 3 (three) years after your last transaction with us, or until the purpose for which it was collected has been fulfilled, whichever is later.
• Account data: Retained for as long as your account remains active. If you request account deletion, your data will be erased within a reasonable timeframe, subject to any legal retention obligations.
• Analytics data: Anonymised analytics data may be retained indefinitely as it cannot be linked back to an individual.

Once the retention period expires or the purpose is fulfilled, your personal data will be securely deleted or anonymised in accordance with the DPDP Act, 2023.

8. Your Rights

Under the Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

• Right to access: You may request a summary of the personal data we hold about you and the processing activities associated with it.
• Right to correction: You may request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure: You may request the deletion of your personal data, subject to any legal obligations that require us to retain certain information.
• Right to withdraw consent: Where we process your data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.
• Right to grievance redressal: You have the right to register a complaint with our Grievance Officer (see section 11) or with the Data Protection Board of India if you believe your data has been mishandled.

To exercise any of these rights, please contact us at [email protected] or write to our Grievance Officer. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

9. Children's Privacy

Our website and services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children under 18 years of age.

If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete such data from our records. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at [email protected] so we can take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this page periodically for the latest information on our privacy practices. Your continued use of our website after any changes to this policy constitutes your acceptance of the updated terms.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and the SPDI Rules, 2011, we have appointed a Grievance Officer to address any concerns or complaints regarding the processing of your personal information:

The Grievance Officer will acknowledge your complaint within 48 hours of receipt and endeavour to resolve it within 30 days from the date of receipt. If you are not satisfied with the resolution, you may escalate your complaint to the Data Protection Board of India as established under the DPDP Act, 2023.