Privacy Policy

1. Scope of this policy

This policy applies to personal data we collect through our website, mobile web app, installable app (PWA), customer support channels, and any communication you have with us (including WhatsApp, email and phone).

It does not apply to third-party websites, apps or services that we link to but do not control. Those services have their own privacy policies, and we encourage you to review them.

2. Personal data we collect

Information you give us: your name, email address, mobile number, delivery and billing addresses (including PIN code), order and return history, product reviews or queries you post, and any information you share when you contact support.

Account & authentication data: if you sign in with Google, we receive your basic profile (name, email and profile picture) from Google; we do not receive your Google password.

Payment status data: the amount, currency, payment method type and success/failure status of a transaction. We do NOT collect or store your full card number, CVV, UPI PIN or netbanking credentials — these are handled entirely by our payment gateway.

Technical & usage data: device and browser type, IP address, approximate location derived from IP (used only to suggest a regional language and estimate delivery), pages viewed, searches, cart activity, and cookie/identifier data.

Consent records: the date, time, policy version, IP and device from which you accept this policy or grant/withdraw consent, retained as evidence of consent as required by the DPDP Act.

3. Purposes and lawful basis for processing

We process your personal data only for lawful purposes and, where required, on the basis of your consent, which you may withdraw at any time. Our purposes include:

• Fulfilling and delivering your orders, processing payments, refunds and returns, and generating tax invoices.

• Providing customer support and responding to your queries and grievances.

• Sending you transactional messages (order confirmations, payment and shipping updates, delivery and return notifications) by email, SMS and WhatsApp — these are service messages necessary to perform the contract with you.

• Preventing, detecting and investigating fraud, abuse, security incidents and other prohibited or illegal activity, and enforcing our terms.

• With your consent, sending you marketing and promotional offers, cart reminders and product recommendations. You can opt out of these at any time without affecting service messages.

• Improving our website, catalogue, search and overall experience through analytics.

• Complying with applicable law and lawful requests from government authorities.

4. Consent and how to withdraw it

Where we rely on your consent, we ask for it through a clear notice and record your acceptance. Your consent is free, specific, informed, unconditional and unambiguous, and limited to the purposes described in this policy.

You can withdraw your consent at any time — for example, by clicking “unsubscribe” in any marketing email, replying STOP to promotional WhatsApp messages, adjusting cookie settings in your browser, or writing to us at support@vardiano.com. Withdrawing consent is as easy as giving it.

Withdrawing consent will not affect the lawfulness of processing done before withdrawal, and we may continue to process the minimum data needed to complete transactions you have already placed or to comply with law.

5. Payments

Online payments are processed by our PCI-DSS compliant payment partner, Cashfree Payments India Pvt. Ltd. When you pay online you are served the gateway’s secure interface; your card, UPI, netbanking or wallet credentials are collected and processed by the gateway, not by Vardiano.

We receive only the transaction reference and its status so we can confirm your order and process refunds. We never see or store your full card number, CVV or UPI PIN.

6. Who we share your data with

We do not sell your personal data. We share it only with Data Processors and partners who help us run the store, under contracts that require them to protect it and use it only for the purposes we specify:

• Logistics partners (e.g. Delhivery) — to pick up, ship and deliver your orders and provide tracking. They receive your name, delivery address, phone number and order details.

• Payment gateway (Cashfree) — to process payments and refunds.

• Communication providers — email (Resend) and WhatsApp/SMS (Meta WhatsApp Business Platform) to send you order and, with consent, marketing messages.

• Analytics and advertising partners (e.g. Google, Meta) — to measure usage and, with consent, show relevant offers. These use cookies/identifiers as described below.

• Professional advisers, auditors, and government or law-enforcement authorities — where required to comply with applicable law, a court order, or a lawful request, or to protect our rights, users and platform.

In the event of a merger, acquisition or restructuring, personal data may be transferred to the successor entity, subject to this policy.

7. Cookies and tracking technologies

We use strictly necessary cookies for sign-in, security and cart functionality — these cannot be switched off as the site will not work without them.

With your consent we also use analytics and marketing cookies/pixels to understand how the store is used and to measure and improve our advertising.

You can control or delete non-essential cookies through your browser settings and through the consent choices we present. Blocking some cookies may affect how parts of the site function.

8. Data retention

We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to complete your orders, provide support and honour warranties/returns.

We retain order, invoice and transaction records for the period required under tax, accounting and other applicable laws (generally up to 8 years). Consent records are retained for as long as needed to demonstrate compliance.

When data is no longer required and there is no legal obligation to retain it, we delete or anonymise it. If you close your account, we erase or anonymise your personal data except where retention is required by law.

9. How we protect your data

We implement reasonable security safeguards to protect personal data against unauthorised access, disclosure, alteration and loss — including encryption in transit (HTTPS/TLS), access controls, hashed credentials, and processing of payments only through PCI-DSS compliant partners.

No method of transmission or storage is completely secure, but we work continuously to protect your information and to keep our safeguards up to date.

10. Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access — obtain a summary of the personal data we process about you and the processing activities.

• Correction & updating — have inaccurate or incomplete data corrected, updated or completed.

• Erasure — have your personal data erased where it is no longer needed and no law requires us to keep it.

• Grievance redressal — have your complaints addressed by us (see the Grievance Officer below).

• Nomination — nominate another individual to exercise your rights in the event of your death or incapacity.

• Withdraw consent — at any time, as described in Section 4.

To exercise any of these rights, write to us at support@vardiano.com (or the Grievance Officer at grievance@vardiano.com) from your registered email/phone. We may verify your identity before acting on a request and will respond within the timelines required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Children’s data

Our store is intended for users aged 18 and above. We do not knowingly process the personal data of children (individuals under 18) without verifiable parental or guardian consent, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

If you believe a child has provided us personal data without appropriate consent, please contact us at support@vardiano.com and we will take steps to delete it.

12. Cross-border transfers

Some of our processors may store or process data on servers located outside India. Where personal data is transferred outside India, we do so in accordance with the DPDP Act and only to jurisdictions permitted under applicable law, with contractual protections in place.

13. Data breach

In the event of a personal data breach, we will take prompt remedial action and notify the Data Protection Board of India and affected Data Principals as required under the DPDP Act and applicable rules.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. When we make material changes we will update the “last updated” date and, where required, ask you to review and accept the new version. Your continued use of the store after an update constitutes acceptance of the revised policy.

15. Grievance Officer & contact

In accordance with the DPDP Act and the Information Technology Act, 2000, the contact details of our Grievance Officer are:

Grievance Officer, Vardiano Technologies

Address: 279, Uttam Nagar, New Delhi – 110059, India

Email: grievance@vardiano.com

For general privacy queries you may also write to support@vardiano.com or support@vardiano.com. We aim to acknowledge grievances within 24 hours and resolve them within the timelines prescribed by law.