PRIVACY POLICY

Notice under the Digital Personal Data Protection Act, 2023

1. Introduction

1.1 CrushKart respects the privacy of every individual who visits or uses its Website, creates a customer account, places or receives an Order, communicates with CrushKart, submits a review, participates in a promotion or otherwise interacts with CrushKart.

1.2 This Privacy Policy explains how CrushKart collects, receives, records, organises, structures, stores, accesses, uses, analyses, shares, transmits, protects, retains, anonymises, erases and otherwise Processes Personal Data in connection with its Website, Products, Orders, customer relationships and related business activities.

1.3 This Privacy Policy is intended to provide a clear and comprehensive account of:

a. the identity and contact details of the person responsible for the Processing of Personal Data;

b. the categories of Personal Data that CrushKart may collect or receive;

c. the sources from which that Personal Data may be obtained;

d. the specific purposes for which Personal Data may be Processed;

e. the grounds upon which such Processing may be undertaken;

f. the categories of persons with whom Personal Data may be shared;

g. the manner in which Personal Data may be retained and protected;

h. the rights available to individuals in relation to their Personal Data;

i. the procedure for withdrawing Consent, where Processing is based on Consent;

j. the procedure for submitting a privacy request or grievance; and

k. the manner in which a complaint may be made to a competent authority.

1.4 This Privacy Policy serves as CrushKart’s general privacy policy and, where the relevant provisions are in force and applicable, as a notice under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

1.5 This Privacy Policy does not, by itself, constitute Consent to every form of Processing described in it. Where Applicable Data Protection Law requires Consent for a specific purpose, CrushKart will seek that Consent separately through a clear affirmative action.

1.6 By accessing the Website or voluntarily providing Personal Data to CrushKart, an individual acknowledges that this Privacy Policy has been made available to them. Such acknowledgement does not prevent the individual from exercising any right available under Applicable Data Protection Law.

2. Identity and Contact Details of CrushKart

2.1 For the purposes of this Privacy Policy, “CrushKart,” “we,” “us” and “our” refer to the business operating the CrushKart Website and offering Products and related services through it.

2.2 CrushKart’s principal business and correspondence address is:

CrushKart
J4/34, Khirki Extension
Malviya Nagar, New Delhi – 110017

2.3 The following contact details must be completed and verified before this Privacy Policy is published:

Privacy Contact Email: ______________________________
Privacy Contact Number: ______________________________

2.4 The details of the Grievance Officer are:

Name: ______________________________
Designation: Grievance Officer
Address: J4/34, Khirki Extension, Malviya Nagar, New Delhi – 110017
Email: ______________________________
Telephone: ______________________________

2.5 Unless CrushKart is formally notified as a Significant Data Fiduciary and is consequently required to appoint a Data Protection Officer, the Grievance Officer or another person specifically authorised by CrushKart will serve as the business contact responsible for answering questions concerning the Processing of Personal Data.

2.6 The appointment of a Grievance Officer does not mean that the person has been appointed as a statutory Data Protection Officer unless CrushKart expressly states that such an appointment has been made under Applicable Data Protection Law.

3. Applicable Legal Framework

3.1 CrushKart will Process Personal Data in accordance with the laws applicable to its operations and the relevant Processing activity.

3.2 This Privacy Policy has been prepared with reference to:

a. the Digital Personal Data Protection Act, 2023;

b. the Digital Personal Data Protection Rules, 2025;

c. the Information Technology Act, 2000;

d. the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, for so long and to the extent that those provisions remain in force and applicable;

e. the Consumer Protection Act, 2019;

f. the Consumer Protection (E-Commerce) Rules, 2020;

g. applicable taxation, accounting, cybersecurity and electronic-transaction requirements; and

h. any amendment, replacement, notification, direction or rule that becomes applicable to CrushKart.

3.3 The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are subject to phased commencement. A statutory obligation, right or procedure referred to in this Privacy Policy will apply from the date on which the relevant provision comes into force and applies to CrushKart.

3.4 Until a relevant DPDP provision becomes legally applicable, CrushKart will continue to comply with the data-protection and information-technology requirements then in force.

3.5 CrushKart may voluntarily implement standards aligned with the DPDP framework before every relevant provision becomes legally enforceable.

3.6 Where an existing law provides a higher degree of protection or imposes a stricter requirement in relation to a particular category of Personal Data or Processing activity, CrushKart will apply that higher or stricter requirement to the extent required by law.

3.7 Nothing in this Privacy Policy will be interpreted as excluding, restricting or waiving a right or remedy that cannot lawfully be excluded, restricted or waived.

4. Role of CrushKart under the DPDP Framework

4.1 CrushKart acts as a Data Fiduciary where it determines, either independently or together with another person, the purpose and means of Processing Personal Data.

4.2 The individual to whom Personal Data relates is referred to as the Data Principal.

4.3 A person that Processes Personal Data on behalf of CrushKart may act as a Data Processor.

4.4 Data Processors may include Website-hosting providers, payment processors, courier companies, communication providers, cloud-service providers, customer-support vendors, analytics providers, fraud-prevention providers and other persons engaged to support CrushKart’s business operations.

4.5 A third party may act as a separate Data Fiduciary or independent controller where that third party determines its own purposes and means of Processing. Examples may include a bank, payment-service provider, social-media platform or courier company that Processes Personal Data for its own legal, security or operational purposes.

4.6 This Privacy Policy does not represent that CrushKart has been notified as a Significant Data Fiduciary.

4.7 If CrushKart is notified as a Significant Data Fiduciary, it will comply with the additional obligations applicable to that designation, which may include:

a. appointing a Data Protection Officer based in India;

b. appointing an independent data auditor;

c. undertaking periodic Data Protection Impact Assessments;

d. conducting periodic audits;

e. implementing enhanced governance and risk-management measures; and

f. complying with any localisation or additional Processing restriction notified by the Central Government.

5. Scope of this Privacy Policy

5.1 This Privacy Policy applies to Personal Data Processed in connection with:

a. access to and use of the CrushKart Website;

b. creation, use, management or closure of a customer Account;

c. browsing, searching, viewing or saving Products;

d. use of the shopping cart and checkout facilities;

e. placement, verification, processing and fulfilment of Orders;

f. payments, invoices, refunds, reversals and transaction reconciliation;

g. dispatch, courier coordination, shipment tracking and delivery;

h. cancellations, returns, replacements and product-related claims;

i. customer-support requests and grievances;

j. communications through email, telephone, SMS, WhatsApp, Website forms or social-media channels;

k. preparation and supply of Customised Products;

l. submission and publication of product reviews, ratings, photographs, videos or comments;

m. marketing subscriptions and promotional communications;

n. cookies, analytics, security systems and similar technologies;

o. fraud prevention and investigation;

p. business administration, accounting, taxation and legal compliance; and

q. any other interaction in which CrushKart lawfully collects Personal Data for a disclosed purpose.

5.2 This Privacy Policy applies to Personal Data collected:

a. directly in digital form; or

b. in a non-digital form and subsequently digitised.

5.3 This Privacy Policy applies to Customers, Account holders, Website visitors, gift recipients, prospective Customers, persons communicating with CrushKart, persons appearing in customisation material and other identifiable individuals whose Personal Data is lawfully Processed by CrushKart.

5.4 This Privacy Policy does not ordinarily apply to:

a. information that has been irreversibly anonymised so that it can no longer identify an individual;

b. aggregated statistical information that does not identify an individual;

c. Personal Data Processed by an individual solely for a personal or domestic purpose; or

d. Personal Data independently Processed by an unrelated third party outside CrushKart’s control.

6. Definitions

6.1 “Account” means an online customer account, profile, registered email address, mobile-number-based login or other digital presence through which an individual accesses CrushKart’s services.

6.2 “Applicable Data Protection Law” means every privacy, data-protection, information-security, cybersecurity or related legal requirement applicable to CrushKart or the relevant Processing activity.

6.3 “Child” means an individual who has not completed eighteen years of age, where that definition applies under the Digital Personal Data Protection Act, 2023.

6.4 “Consent” means Consent that is free, specific, informed, unconditional and unambiguous and is signified through a clear affirmative action for a specified purpose.

6.5 “Consent Manager” means a person registered with the Data Protection Board of India to enable a Data Principal to give, manage, review or withdraw Consent through an accessible, transparent and interoperable platform.

6.6 “Customised Product” means a Product that is personalised, printed, engraved, designed, assembled, packed, procured or otherwise prepared according to material, instructions or selections provided or approved by a Customer.

6.7 “Data Fiduciary” means a person that determines, independently or jointly with another person, the purpose and means of Processing Personal Data.

6.8 “Data Principal” means the individual to whom the Personal Data relates. Where the individual is a Child or a person with a lawful guardian, the expression includes the parent or lawful guardian to the extent provided by Applicable Data Protection Law.

6.9 “Data Processor” means a person that Processes Personal Data on behalf of a Data Fiduciary.

6.10 “Personal Data” means data about an individual who is identifiable by or in relation to that data.

6.11 “Personal Data Breach” means an unauthorised Processing of Personal Data or an accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of Personal Data.

6.12 “Processing” means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, analysis, alignment, combination, indexing, sharing, disclosure, transmission, restriction, erasure or destruction.

6.13 “Product” means any item displayed, offered, sold or supplied by CrushKart.

6.14 “Service Provider” means a person or organisation engaged to provide technology, fulfilment, payment, delivery, communication, analytics, professional or other services to CrushKart.

6.15 “Specified Purpose” means the particular purpose for which Personal Data is proposed to be Processed and which has been described to the Data Principal.

6.16 “Website” means the official CrushKart website and any Account, checkout, order-management or other digital facility operated through or on behalf of CrushKart.

7. Privacy Notices and Consent Requests

7.1 This Privacy Policy provides general information about CrushKart’s Processing activities. Where required, CrushKart may provide an additional collection notice or just-in-time notice at the point at which Personal Data is requested.

7.2 A point-of-collection notice may explain:

a. the specific Personal Data being requested;

b. the Specified Purpose for which the Personal Data will be Processed;

c. the Product, service or functionality that the Processing enables;

d. whether providing the Personal Data is necessary or optional;

e. the consequence of not providing necessary Personal Data;

f. the manner in which Consent may be withdrawn;

g. the manner in which the Data Principal may exercise their rights;

h. the contact information of the person responsible for answering privacy questions; and

i. the manner in which a complaint may be submitted.

7.3 Where Applicable Data Protection Law requires a notice to be capable of being understood independently, CrushKart will not rely solely upon a broad reference to this Privacy Policy. CrushKart will provide a notice that contains the information necessary for the relevant decision.

7.4 Where Consent is requested, the request will identify the Personal Data and Specified Purpose with sufficient clarity to permit an informed decision.

7.5 CrushKart will not use a Consent request to obtain a waiver of a statutory right or to authorise conduct that would otherwise be unlawful.

7.6 Where required by Applicable Data Protection Law, a Consent request will be made available in English and in any other language that CrushKart is legally required to support.

7.7 Where CrushKart intends to use previously collected Personal Data for a new and materially unrelated purpose, CrushKart will provide an additional notice and obtain fresh Consent where required.

8. Categories of Personal Data Collected

8.1 Identity and Contact Data

8.1.1 CrushKart may collect a Customer’s or recipient’s full name, email address, mobile number, telephone number, billing address, Delivery Address, postal code, landmark and other contact information necessary to communicate with the individual or fulfil an Order.

8.1.2 CrushKart may also collect an Account identifier, customer identifier, order identifier or other reference used to distinguish one transaction or Account from another.

8.1.3 Identity and contact information may be used to establish an Account, process an Order, provide delivery instructions, issue an invoice, respond to an enquiry or verify a privacy request.

8.2 Account and Authentication Data

8.2.1 Where the Website offers an Account facility, CrushKart or its authorised platform provider may Process login information, Account identifiers, authentication records, saved addresses, Order history, preferences and Account-security events.

8.2.2 Passwords may be encrypted, hashed or otherwise secured by the Website platform or authentication provider.

8.2.3 CrushKart may not have direct access to a password in readable form where authentication is managed by an external provider.

8.2.4 CrushKart may Process information about login attempts, password-reset requests, device sessions and suspicious Account access to maintain Account security.

8.3 Order and Purchase Data

8.3.1 CrushKart may collect information concerning the Products viewed, selected, added to the cart, purchased, cancelled, returned, replaced or refunded.

8.3.2 Order and purchase data may include the Order number, Product name, quantity, selected variant, price, discount, coupon code, shipping charge, invoice information, Order status and purchase history.

8.3.3 CrushKart may retain information about incomplete checkout activity where it is lawfully available through the Website platform.

8.3.4 Incomplete checkout information may be used to preserve a cart, diagnose checkout errors, prevent fraud or send a cart reminder where the individual has consented or such communication is otherwise lawfully permitted.

8.4 Payment and Transaction Data

8.4.1 Payments may be processed by banks, card networks, payment gateways, UPI providers, wallet providers or other authorised payment-service providers.

8.4.2 The Customer may enter payment credentials directly into a secure interface operated by the relevant payment provider.

8.4.3 CrushKart may receive limited payment-related information, including:

a. confirmation that payment succeeded, failed, remained pending or was reversed;

b. the transaction reference number;

c. the payment method selected;

d. the transaction amount and date;

e. a masked card, bank, wallet or UPI identifier;

f. the payment provider’s fraud or risk result;

g. the status of a refund or chargeback; and

h. information necessary to reconcile the transaction.

8.4.4 CrushKart does not require Customers to disclose a card PIN, UPI PIN, banking password, complete unmasked card number, CVV or payment OTP to a customer-support representative.

8.4.5 Where a refund cannot be returned through the original payment method, CrushKart may collect bank-account or UPI information strictly for the purpose of processing the refund.

8.5 Recipient and Gifting Data

8.5.1 A Customer purchasing a Product for another individual may provide the recipient’s name, contact number, Delivery Address, email address, gift message and delivery instructions.

8.5.2 The Customer must ensure that the recipient’s Personal Data is accurate and is lawfully provided.

8.5.3 CrushKart will ordinarily use recipient information only to:

a. prepare and deliver the Order;

b. communicate concerning delivery;

c. confirm receipt;

d. address a delivery or Product issue; and

e. comply with a legal obligation.

8.5.4 CrushKart will not ordinarily add a gift recipient to an independent marketing list merely because the recipient received a Product.

8.5.5 Where Applicable Data Protection Law requires CrushKart to provide a notice to or obtain Consent from the recipient, CrushKart may contact the recipient for that limited purpose.

8.6 Customisation Data

8.6.1 Where CrushKart offers Customised Products, a Customer may submit names, photographs, images, artwork, dates, messages, logos, event details, design instructions or other material.

8.6.2 Such material will be Processed for the purpose of preparing, reviewing, approving, producing, delivering or supporting the Customised Product.

8.6.3 The Customer must ensure that they have the authority to provide Personal Data and other material relating to another individual.

8.6.4 CrushKart will not publish Customer-submitted customisation material in advertising, social media or promotional content without obtaining appropriate permission.

8.6.5 CrushKart may share necessary customisation material with a printer, designer, engraver, supplier, production partner or fulfilment vendor solely to the extent required to fulfil the Order.

8.7 Customer-Support and Grievance Data

8.7.1 When an individual contacts CrushKart, CrushKart may collect the contents of the communication, contact details, Order information, complaint details and the resolution requested.

8.7.2 For return, replacement, damage or refund claims, CrushKart may collect photographs, unboxing videos, Product-condition evidence, courier records, invoice copies and refund information.

8.7.3 Customer-support records may include email correspondence, chat messages, WhatsApp messages, internal case notes and the outcome of the matter.

8.7.4 Telephone calls will be recorded only where recording is operationally enabled, lawful and appropriately disclosed.

8.8 Review and User-Generated Content

8.8.1 Where CrushKart permits reviews, ratings, photographs, videos, questions or comments, CrushKart may collect the content submitted, the chosen display name, verified-purchase status and Product information associated with the submission.

8.8.2 A review may be visible publicly.

8.8.3 Customers must not include payment information, complete addresses, identity-document information or other unnecessary confidential information in a public review.

8.8.4 CrushKart may retain limited information necessary to verify that a review is genuine, prevent manipulation and respond to legal complaints.

8.9 Marketing and Preference Data

8.9.1 CrushKart may record whether an individual has subscribed to or unsubscribed from marketing communications.

8.9.2 Marketing and preference data may include the preferred communication channel, categories of interest, promotional-code usage, campaign interaction and response to surveys.

8.9.3 CrushKart may record the date, time, method and wording through which marketing Consent was given or withdrawn where such records are reasonably necessary to demonstrate compliance.

8.10 Device, Technical and Usage Data

8.10.1 When an individual accesses the Website, CrushKart and its authorised technology providers may automatically receive technical information.

8.10.2 Such information may include:

a. the Internet Protocol address;

b. browser type and version;

c. device type and operating system;

d. device, cookie and session identifiers;

e. referring webpage or campaign source;

f. approximate location inferred from the Internet Protocol address;

g. date and time of access;

h. pages and Products viewed;

i. links selected;

j. cart and checkout activity;

k. Website errors and diagnostic information;

l. network and connection information; and

m. login, security and fraud indicators.

8.10.3 CrushKart does not ordinarily seek precise real-time location information unless a specific function requires it and appropriate notice or permission is provided.

8.11 Fraud-Prevention and Security Data

8.11.1 CrushKart and its authorised Service Providers may Process transaction, device, Account, delivery and refund information to identify suspicious or fraudulent activity.

8.11.2 Such information may include unusual Order patterns, multiple failed payment attempts, suspected unauthorised access, disputed transactions, repeated delivery refusal, promotional misuse or inconsistent return claims.

8.11.3 Fraud-prevention information will not be used to arbitrarily deny a legitimate Order or complaint.

8.11.4 Where an automated risk indicator materially affects an Order, CrushKart may undertake or request additional verification before taking final action.

9. Personal Data that CrushKart Does Not Ordinarily Require

9.1 CrushKart does not ordinarily require Customers to provide:

a. banking or payment passwords;

b. card PINs or UPI PINs;

c. payment OTPs;

d. complete unmasked card details through customer support;

e. biometric information;

f. health or medical records;

g. religious beliefs;

h. political opinions;

i. sexual-orientation information;

j. criminal-history information unrelated to a lawful requirement; or

k. government identification documents unrelated to necessary verification.

9.2 A Customer must not send such information merely because they are contacting CrushKart.

9.3 Where unnecessary or excessive Personal Data is voluntarily submitted, CrushKart may redact, delete, quarantine or restrict access to that information.

9.4 Where CrushKart is legally required to collect a particular category of information, CrushKart will explain the purpose and apply safeguards appropriate to that information.

10. Sources of Personal Data

10.1 CrushKart may collect Personal Data directly from the individual when the individual creates an Account, places an Order, submits a form, makes a payment, requests support, submits a review or otherwise communicates with CrushKart.

10.2 CrushKart may receive Personal Data automatically through Website logs, cookies, session technologies, security tools and similar technologies.

10.3 CrushKart may receive Personal Data from Service Providers, including:

a. the Website platform;

b. payment processors;

c. courier and delivery companies;

d. customer-support systems;

e. communication providers;

f. fraud-prevention services;

g. analytics providers; and

h. technology vendors.

10.4 CrushKart may receive Personal Data from another individual, such as a Customer who provides the information of a gift recipient, family member, authorised representative or person appearing in a Customised Product.

10.5 CrushKart may receive limited Personal Data from public social-media interactions, lawful referral sources, advertising partners or fraud-prevention databases.

10.6 CrushKart will not treat the public availability of Personal Data as unrestricted permission to use it for unrelated purposes.

11. Lawful Basis and Permitted Grounds for Processing

11.1 CrushKart will Process Personal Data only for a lawful purpose.

11.2 Where the substantive provisions of the DPDP Act are applicable, CrushKart will ordinarily rely upon:

a. Consent given by the Data Principal for a Specified Purpose; or

b. a certain legitimate use expressly permitted under the DPDP Act.

11.3 A certain legitimate use may include Processing Personal Data voluntarily provided by the Data Principal for a Specified Purpose where the Data Principal has not indicated that they do not agree to its use for that purpose.

11.4 CrushKart may also Process or retain Personal Data where another law requires or authorises such Processing.

11.5 CrushKart will not describe every business interest as a lawful basis where that interest does not fall within an applicable legal ground.

11.6 Where Consent is required, CrushKart will obtain Consent before commencing the relevant Processing.

11.7 Where Personal Data is necessary to fulfil an Order already requested and paid for, withdrawal of Consent will not require CrushKart to stop Processing that is necessary to complete delivery, payment reconciliation, refund administration or another existing obligation where continued Processing is lawful.

12. Purposes for which Personal Data Is Processed

12.1 Operating and Securing the Website

12.1.1 CrushKart may Process Account, device, technical and usage information to provide access to the Website, maintain shopping-cart functionality, enable checkout, authenticate users and preserve Website sessions.

12.1.2 CrushKart may also use such information to identify errors, prevent malicious activity, maintain backups, protect Website systems and improve performance.

12.1.3 Technical information will not be used for a materially unrelated purpose without an appropriate legal basis.

12.2 Processing and Fulfilling Orders

12.2.1 CrushKart may Process identity, contact, Order, Product, transaction and recipient information to receive and verify an Order.

12.2.2 Such Processing may include confirming Product availability, issuing an Order acknowledgement, preparing an invoice, packing Products, coordinating customisation, arranging dispatch and providing delivery updates.

12.2.3 The delivery recipient’s information may be shared with the courier only to the extent reasonably necessary to deliver the shipment and address delivery issues.

12.3 Administering Payments and Refunds

12.3.1 CrushKart may Process payment-status and transaction information to confirm payment, reconcile Orders, investigate duplicate payments and manage refunds or chargebacks.

12.3.2 Bank-account or UPI details collected for a Cash on Delivery refund will be used only for completing and documenting that refund, preventing fraud and complying with applicable record-keeping obligations.

12.3.3 CrushKart will not use refund details for marketing or an unrelated commercial purpose.

12.4 Providing Customer Support

12.4.1 CrushKart may Process contact information, Order records, communications, photographs and videos to answer questions and investigate complaints.

12.4.2 Where a Customer submits an unboxing video, CrushKart will use the video to verify the condition and contents of the delivered parcel, assess the claim and document the resolution.

12.4.3 Customer-support evidence may be shared with a courier, supplier, insurer, payment provider or professional adviser where reasonably necessary to investigate the issue.

12.5 Managing Accounts

12.5.1 CrushKart may Process Account information to enable login, maintain Order history, save authorised addresses and provide Account-related support.

12.5.2 CrushKart may Process authentication and security data to detect unauthorised access, reset login credentials and protect the Account.

12.5.3 Closing an Account will not automatically require deletion of transaction records that must be retained for legal, accounting, fraud-prevention or dispute-resolution purposes.

12.6 Preparing Customised Products

12.6.1 CrushKart may Process Customer-supplied names, photographs, messages and designs to prepare the requested Product.

12.6.2 Customisation material may also be used to create a proof, obtain Customer approval, conduct quality control and resolve a reprint or Product complaint.

12.6.3 CrushKart will not reuse customisation material for another Customer or disclose it publicly without lawful authority.

12.7 Marketing and Promotions

12.7.1 Where an appropriate lawful basis exists, CrushKart may Process contact and preference data to send information about Products, promotions, discounts, back-in-stock alerts, cart reminders and other offers.

12.7.2 Optional marketing Consent will not be made a condition of purchasing a Product.

12.7.3 Transactional communications concerning an Order, payment, delivery, refund, security issue or grievance are not optional marketing communications.

12.7.4 CrushKart may measure whether a marketing message was delivered, opened, selected or resulted in a purchase, subject to Applicable Data Protection Law and cookie preferences.

12.8 Analytics and Business Improvement

12.8.1 CrushKart may analyse Website usage, Order patterns and Product interest to improve Website navigation, Product availability, customer support and business planning.

12.8.2 Wherever reasonably practicable, CrushKart may use aggregated or anonymised information for statistical analysis.

12.8.3 CrushKart will not use analytics as a justification for collecting Personal Data that is excessive in relation to the purpose.

12.9 Fraud Prevention and Legal Claims

12.9.1 CrushKart may Process relevant information to detect fraudulent Orders, unauthorised payments, false claims, Account takeover or misuse of promotions.

12.9.2 CrushKart may retain relevant evidence where necessary to investigate suspected fraud or establish, exercise or defend a legal claim.

12.9.3 Fraud-prevention Processing will be proportionate to the risk and will not prevent a Customer from making a genuine complaint or payment dispute.

12.10 Compliance with Legal Obligations

12.10.1 CrushKart may Process Personal Data to issue and retain invoices, maintain accounting and taxation records, comply with consumer-protection obligations and respond to lawful directions.

12.10.2 CrushKart may disclose Personal Data to a court, regulator, law-enforcement agency or government authority where disclosure is lawfully required.

12.10.3 CrushKart may also Process Personal Data to comply with product-safety, recall, cybersecurity, fraud-reporting or other legal obligations.

13. Data Minimisation and Purpose Limitation

13.1 CrushKart will seek to collect only the Personal Data reasonably necessary for the Specified Purpose.

13.2 CrushKart will not request access to unrelated device data, contact lists, photographs, messages or other information merely because such access is technically possible.

13.3 Personal Data collected for one purpose will not be used for a materially incompatible purpose without:

a. providing an additional notice;

b. obtaining fresh Consent where required; or

c. identifying another lawful ground for the new Processing.

13.4 Access to Personal Data within CrushKart will be limited, so far as reasonably practicable, to persons who require it for an authorised business purpose.

13.5 CrushKart may convert Personal Data into anonymised or aggregated information where individual identification is no longer required.

13.6 Anonymisation will not be described as irreversible where CrushKart or another person retains a reasonable means of re-identifying the individual.

14. Consent

14.1 Where Consent is relied upon, CrushKart will seek Consent that is free, specific, informed, unconditional and unambiguous.

14.2 Consent will be obtained through a clear affirmative action, which may include:

a. selecting an unticked checkbox;

b. selecting a communication preference;

c. submitting information after reviewing a collection notice;

d. confirming a request electronically; or

e. using another method permitted by Applicable Data Protection Law.

14.3 CrushKart will not ordinarily treat silence, inactivity, a pre-selected option or mere continued browsing as Consent where an affirmative action is required.

14.4 The Consent request will be limited to Personal Data necessary for the Specified Purpose.

14.5 CrushKart will not combine Consent for necessary Order Processing with optional marketing in a manner that prevents the individual from making a separate choice.

14.6 CrushKart may maintain records of the notice presented and affirmative action taken where necessary to demonstrate that valid Consent was obtained.

14.7 Any term purporting to require an individual to waive a statutory right will be invalid to the extent that such a waiver is prohibited by law.

15. Withdrawal of Consent

15.1 A Data Principal may withdraw Consent at any time where Consent is the basis of Processing.

15.2 The means of withdrawing Consent will be reasonably comparable in ease to the means by which Consent was given.

15.3 Consent may be withdrawn through:

a. an unsubscribe link;

b. an Account or communication-preference setting;

c. a supported opt-out command;

d. a registered Consent Manager, where available and applicable; or

e. a request submitted to CrushKart’s Privacy Contact.

15.4 Withdrawal will not affect the lawfulness of Processing undertaken before withdrawal.

15.5 Following a valid withdrawal request, CrushKart will cease the relevant Processing within a reasonable period and will instruct its Data Processors to do the same where required.

15.6 CrushKart may continue Processing without Consent where such Processing remains required or authorised by law.

15.7 Withdrawal of delivery or contact information after an Order has been placed may prevent CrushKart from providing future services, but it will not necessarily require CrushKart to abandon Processing necessary to complete or resolve the existing Order.

15.8 CrushKart may retain a limited suppression record after a marketing opt-out to ensure that the individual is not inadvertently added back to the marketing list.

16. Cookies and Similar Technologies

16.1 The Website may use cookies, pixels, tags, local storage, session technologies, software development kits and similar technologies.

16.2 These technologies may store or retrieve information on a browser or device and may permit the recognition of a session or returning visitor.

16.3 Strictly Necessary Technologies

16.3.1 Strictly necessary technologies may be used to maintain the shopping cart, enable checkout, authenticate Accounts, prevent fraud and maintain Website security.

16.3.2 The Website may not function correctly if such technologies are disabled.

16.4 Functional Technologies

16.4.1 Functional technologies may remember authorised preferences, previously entered information, Account status and other settings that improve usability.

16.4.2 Functional technologies will not be used for unrelated behavioural advertising merely because they are present on the Website.

16.5 Analytics Technologies

16.5.1 Analytics technologies may record Website traffic, pages viewed, navigation patterns, error events, checkout activity and campaign sources.

16.5.2 Analytics information may be used to identify technical issues and improve the Website.

16.5.3 Where analytics information identifies or is linked to an individual, it will be treated as Personal Data.

16.6 Advertising Technologies

16.6.1 Where lawfully enabled, advertising technologies may measure campaign performance, attribute purchases, limit repeated advertisements and support relevant promotions.

16.6.2 Non-essential advertising technologies will be deployed subject to any notice, Consent or preference requirement applicable to the relevant Processing.

16.7 Cookie Preferences

16.7.1 Where the Website provides a cookie-preference facility, an individual may use it to accept, reject or modify non-essential cookie preferences.

16.7.2 Cookies may also be managed through browser or device settings.

16.7.3 Browser settings may not remove information previously collected or prevent every server-side Processing activity.

16.7.4 Disabling necessary technologies may prevent the cart, checkout, login or security features from operating correctly.

17. Marketing Communications

17.1 CrushKart may send optional marketing communications through email, SMS, WhatsApp or another accepted communication channel where an appropriate lawful basis exists.

17.2 Marketing communications may contain information about Product launches, discounts, seasonal campaigns, back-in-stock alerts, cart reminders, recommendations or surveys.

17.3 An individual may opt out of optional marketing without affecting their ability to purchase a Product.

17.4 An opt-out may be submitted through:

a. the unsubscribe facility in an email;

b. a supported opt-out instruction in a message;

c. an available Account preference; or

d. a request to the Privacy Contact.

17.5 An opt-out may take a reasonable period to be reflected across all communication systems.

17.6 Even after opting out of marketing, the individual may continue receiving necessary communications concerning:

a. an Order;

b. payment or refund status;

c. shipment or delivery;

d. Account security;

e. a Product-safety issue;

f. customer support; or

g. grievance redressal.

17.7 CrushKart will not ordinarily send independent marketing to a gift recipient unless the recipient has separately consented or another lawful basis applies.

18. Payment Processing

18.1 Payment credentials may be collected directly by an authorised payment-service provider rather than by CrushKart.

18.2 The relevant payment provider may independently Process Personal Data for authentication, transaction authorisation, fraud prevention, settlement, chargebacks and regulatory compliance.

18.3 CrushKart will receive only the payment information reasonably necessary to administer the Order and transaction.

18.4 The payment provider’s own privacy policy and terms may apply to its Processing.

18.5 CrushKart will not request a Customer to disclose a UPI PIN, card PIN, CVV, banking password or payment OTP to receive a refund.

18.6 CrushKart will not ask a Customer to approve a UPI collect request merely to receive an approved refund.

18.7 Where bank-account information is collected for a refund, access to that information will be restricted to persons who require it for refund processing, reconciliation, fraud prevention or compliance.

19. Accounts and Authentication

19.1 An Account may enable an individual to view Orders, manage addresses, save preferences and access other Website functions.

19.2 CrushKart may Process Account activity to protect against unauthorised access and maintain the integrity of the Account.

19.3 The Account holder is responsible for maintaining the confidentiality of their login credentials and securing the device through which the Account is accessed.

19.4 The Account holder should promptly inform CrushKart if they suspect unauthorised access.

19.5 CrushKart may temporarily restrict Account access where reasonably necessary to investigate a security concern.

19.6 Account restriction will not prevent the individual from raising a genuine privacy request or grievance.

19.7 When an Account is closed, CrushKart will delete or deactivate Account functionality within a reasonable period, subject to the continued retention of records required for Orders, refunds, legal compliance, security or disputes.

20. Reviews, Public Content and Social-Media Communications

20.1 A review, rating, photograph, video, comment or other submission intended for public display may be visible to other persons.

20.2 The individual submitting public content is responsible for ensuring that it does not contain Personal Data they do not wish to disclose publicly.

20.3 CrushKart may moderate public content to remove:

a. payment or financial information;

b. complete addresses or contact details;

c. unlawful or abusive material;

d. content infringing another person’s rights;

e. spam or fraudulent reviews; and

f. information unrelated to the Product or service.

20.4 CrushKart will not materially alter the substance of a genuine review in a manner that creates a misleading impression.

20.5 Where an individual communicates through WhatsApp, Instagram or another third-party platform, that platform may independently Process Personal Data under its own privacy terms.

20.6 CrushKart may receive the individual’s profile name, account identifier, telephone number and message content through the platform.

20.7 Individuals should not send unnecessary payment credentials or sensitive information through social-media comments or unsecured messages.

21. Sharing and Disclosure of Personal Data

21.1 Website and Technology Providers

21.1.1 CrushKart may share Personal Data with providers that host or operate the Website, Accounts, checkout, Order-management systems, customer-support tools and security functions.

21.1.2 Such providers will receive only the information reasonably necessary for the service they provide.

21.2 Payment Providers

21.2.1 Transaction information may be shared with banks, payment gateways, card networks, UPI providers and wallet providers.

21.2.2 These persons may use the information to authorise transactions, prevent fraud, settle payments, manage disputes and comply with law.

21.3 Couriers and Logistics Providers

21.3.1 CrushKart may share the recipient’s name, telephone number, Delivery Address, Order reference, parcel details and delivery instructions with a courier or logistics provider.

21.3.2 A courier will not ordinarily require access to the Customer’s unrelated Account, marketing or detailed payment information.

21.4 Suppliers, Printers and Fulfilment Vendors

21.4.1 CrushKart may share limited Order or customisation information with a supplier, printer, engraver, packaging provider, warehouse or fulfilment partner.

21.4.2 Such disclosure will be limited to information reasonably required to prepare, pack or supply the Product.

21.5 Communication Providers

21.5.1 Contact and Order information may be shared with providers supporting email, SMS, WhatsApp, telephone or customer-support communications.

21.5.2 These providers may Process message-delivery, engagement and communication-status information.

21.6 Analytics and Advertising Providers

21.6.1 Subject to Applicable Data Protection Law and individual preferences, device, Website-usage and campaign information may be shared with analytics or advertising providers.

21.6.2 CrushKart will not provide complete payment credentials or unnecessary Order details merely for advertising measurement.

21.7 Cloud, Security and Fraud-Prevention Providers

21.7.1 Personal Data may be Processed by providers supporting cloud storage, backups, authentication, cybersecurity, system monitoring and fraud prevention.

21.7.2 Such providers may receive device, network, Account and transaction information necessary to identify security risks.

21.8 Professional Advisers

21.8.1 CrushKart may disclose relevant Personal Data to lawyers, accountants, auditors, insurers and consultants.

21.8.2 Such disclosure may be necessary to obtain advice, manage a claim, comply with law or conduct an audit.

21.9 Government, Regulatory and Legal Disclosures

21.9.1 CrushKart may disclose Personal Data where required by a valid law, court order, regulatory request or government direction.

21.9.2 CrushKart may also disclose Personal Data where reasonably necessary to prevent or investigate fraud, a cyber incident, an offence or a threat to safety.

21.9.3 Where legally permitted, CrushKart may review a request to determine whether it is valid, proportionate and issued by a competent authority.

21.10 Disclosure at the Individual’s Direction

21.10.1 CrushKart may disclose Personal Data where the Data Principal expressly requests or authorises the disclosure.

21.10.2 CrushKart may verify the request before making a disclosure that could affect the Data Principal’s privacy or security.

22. Data Processors and Service-Provider Accountability

22.1 CrushKart may appoint Data Processors to Process Personal Data on its behalf.

22.2 Where appropriate, CrushKart’s arrangements with Data Processors may address:

a. the permitted scope and purpose of Processing;

b. confidentiality obligations;

c. access restrictions;

d. reasonable security safeguards;

e. Personal Data Breach reporting;

f. use of subcontractors;

g. deletion or return of Personal Data;

h. cooperation with privacy requests; and

i. compliance with Applicable Data Protection Law.

22.3 CrushKart will seek to select Service Providers that are reasonably capable of protecting the Personal Data entrusted to them.

22.4 CrushKart may review, suspend or terminate a Service Provider’s access where the provider materially fails to comply with applicable security or privacy requirements.

22.5 Appointment of a Data Processor does not remove an obligation placed upon CrushKart as the Data Fiduciary.

22.6 A Service Provider acting as an independent Data Fiduciary remains responsible for its own Processing activities.

23. Sale and Rental of Personal Data

23.1 CrushKart does not sell or rent Personal Data to unrelated third parties for monetary consideration.

23.2 CrushKart may pay Service Providers that Process limited Personal Data to provide analytics, communication, advertising, payment, delivery or technology services.

23.3 Payment of a Service Provider does not, by itself, mean that CrushKart has sold Personal Data.

23.4 Where a law applicable to a particular advertising or sharing activity defines that activity as a regulated sale, sharing or transfer, CrushKart will provide the notice and choice required under that law.

24. International Processing and Transfers

24.1 CrushKart’s Website, payment, communication, cloud, analytics or other Service Providers may operate systems or personnel outside India.

24.2 Personal Data may therefore be stored, accessed or Processed in another country.

24.3 Where Personal Data is transferred outside India, CrushKart will seek to ensure that:

a. the transfer serves a lawful and disclosed purpose;

b. only reasonably necessary Personal Data is transferred;

c. the recipient is subject to appropriate privacy and security obligations;

d. the transfer complies with restrictions notified by the Government of India; and

e. any stricter localisation requirement applicable to particular Personal Data is observed.

24.4 The laws of another country may differ from the laws of India.

24.5 CrushKart will remain responsible for obligations that continue to apply where a Data Processor outside India Processes Personal Data on CrushKart’s behalf.

24.6 If CrushKart becomes subject to a restriction requiring specified Personal Data or traffic data to remain in India, CrushKart will take appropriate measures to comply with that restriction.

25. Accuracy, Correction and Quality of Personal Data

25.1 CrushKart will make reasonable efforts to ensure that Personal Data is complete, accurate and consistent where it is used to make a decision affecting an individual or disclosed to another Data Fiduciary.

25.2 Customers are responsible for reviewing the name, contact information, Delivery Address, recipient details and customisation instructions submitted with an Order.

25.3 CrushKart may rely upon information provided or approved by the Customer unless CrushKart knows or reasonably ought to know that it is inaccurate.

25.4 An individual may request correction, completion or updating of their Personal Data.

25.5 Where corrected information affects an outstanding Order, CrushKart will attempt to implement the correction where operationally possible.

25.6 A correction may not be possible after a shipment has been dispatched or a Customised Product has been produced.

25.7 An operational inability to alter an Order will not prevent CrushKart from correcting the underlying Personal Data for future use.

26. Retention of Personal Data

26.1 CrushKart will not retain Personal Data indefinitely merely because it was once collected.

26.2 The appropriate retention period will depend upon:

a. the Specified Purpose;

b. the nature of the Personal Data;

c. whether an Order, refund or grievance remains unresolved;

d. applicable tax, accounting and invoicing requirements;

e. fraud-prevention and security requirements;

f. a warranty, return or limitation period;

g. an actual or anticipated legal claim; and

h. a statutory retention obligation.

26.3 Account Information

26.3.1 Account information may be retained while the Account remains active.

26.3.2 After closure, CrushKart may retain limited Account information where necessary to prevent fraud, document consent preferences, comply with law or resolve a dispute.

26.4 Order and Transaction Records

26.4.1 Order, invoice, payment, delivery, cancellation, return and refund records may be retained for the period required under taxation, accounting, consumer-protection and other applicable laws.

26.4.2 Deletion of an Account will not require deletion of transaction records that CrushKart is legally required to maintain.

26.5 Customer-Support and Grievance Records

26.5.1 Support and grievance records may be retained until the matter is resolved and for a reasonable period thereafter.

26.5.2 Continued retention may be necessary to document the resolution, prevent repeated fraud, address a reopened complaint or manage a legal claim.

26.6 Customisation Materials

26.6.1 Customisation material may be retained for the period necessary to prepare, verify, deliver and support the Customised Product.

26.6.2 Such material may be retained while a reprint, replacement, complaint or chargeback remains possible.

26.6.3 CrushKart will not retain customer photographs or personal messages permanently merely because they were used for customisation.

26.7 Marketing and Consent Records

26.7.1 Marketing preference and Consent records may be retained while marketing continues.

26.7.2 Following withdrawal, CrushKart may retain a limited suppression record to ensure that the individual remains opted out.

26.7.3 CrushKart may retain evidence of the notice and Consent for a reasonable period where necessary to demonstrate compliance.

26.8 Security and Processing Logs

26.8.1 CrushKart may retain logs necessary to identify unauthorised access, investigate a Personal Data Breach and prevent recurrence.

26.8.2 Once the relevant DPDP Rules become applicable, CrushKart will retain the Personal Data, associated traffic data and Processing logs required by those Rules for at least the prescribed minimum period, including the applicable one-year period, unless another law requires a longer period.

26.9 Erasure after Completion of Purpose

26.9.1 Subject to legal-retention requirements, CrushKart will erase Personal Data when:

a. Consent has been withdrawn and no other lawful ground remains;

b. the Specified Purpose is no longer being served;

c. a valid erasure request is approved; or

d. retention is no longer reasonably necessary.

26.9.2 Where required, CrushKart will instruct the relevant Data Processors to erase Personal Data made available by CrushKart.

26.10 Backup Systems

26.10.1 Personal Data erased from active systems may remain temporarily in secure backup systems until the applicable backup is overwritten or deleted.

26.10.2 Personal Data retained in a backup will remain protected and will not be restored for ordinary business use unless restoration is required for disaster recovery, security or legal compliance.

27. Security Safeguards

27.1 CrushKart will implement reasonable technical and organisational measures appropriate to the nature, volume and risk of the Personal Data Processed.

27.2 Such measures may include:

a. encryption, masking, obfuscation or tokenisation where appropriate;

b. secure transmission protocols;

c. authentication and access-control measures;

d. limitation of access according to role and business need;

e. system logging, monitoring and review;

f. malware, firewall and fraud-prevention controls;

g. secure backups and recovery arrangements;

h. security updates and software maintenance;

i. secure deletion and disposal procedures;

j. confidentiality obligations for personnel and vendors;

k. incident-response procedures;

l. restrictions on unauthorised downloading or disclosure; and

m. contractual security requirements for Data Processors.

27.3 CrushKart will seek to maintain visibility over access to Personal Data through appropriate logs and monitoring where reasonably applicable.

27.4 CrushKart will seek to preserve continuity of essential Processing where Personal Data becomes unavailable because of destruction, system failure or another security incident.

27.5 CrushKart will periodically review its safeguards and may update them as technology, risk and legal requirements change.

27.6 No electronic system is completely secure. CrushKart cannot guarantee that a Personal Data Breach will never occur.

27.7 The absence of an absolute guarantee does not reduce CrushKart’s obligation to implement reasonable safeguards and respond appropriately to an incident.

27.8 Customers must protect their Account credentials, use secure devices and promptly report suspected Account compromise.

28. Personal Data Breach Response

28.1 A Personal Data Breach may involve unauthorised access, disclosure, alteration, destruction, loss, misuse or unavailability of Personal Data.

28.2 Where CrushKart becomes aware of a suspected Personal Data Breach, it will take reasonable steps to:

a. investigate the incident;

b. identify the affected systems and Personal Data;

c. contain the incident;

d. prevent continuing unauthorised access;

e. preserve relevant evidence;

f. work with affected Data Processors and Service Providers;

g. assess the likely impact upon individuals;

h. mitigate the risk of harm;

i. restore secure operations; and

j. implement measures intended to prevent recurrence.

28.3 When the relevant DPDP obligations become applicable, CrushKart will notify each affected Data Principal without delay in the manner prescribed by law.

28.4 Such notification may explain:

a. the nature, extent and timing of the Personal Data Breach;

b. the consequences likely to be relevant to the affected individual;

c. the measures implemented or proposed by CrushKart;

d. the steps the individual may take to protect their interests; and

e. the business contact information of a person able to answer questions.

28.5 Where required, CrushKart will notify the Data Protection Board of India without delay and provide the detailed information required within seventy-two hours, or within any longer period permitted by the Board.

28.6 CrushKart may also notify another regulator, cybersecurity authority, payment provider, insurer or law-enforcement agency where required or reasonably necessary.

28.7 A notification may be delayed or limited where disclosure is prohibited by law or would materially prejudice a lawful investigation.

29. Children’s Personal Data

29.1 The Website is intended for use by adults and is not intended to be used independently by a Child.

29.2 The fact that certain Products may be suitable for or attractive to children does not mean that the Website is directed to children as independent purchasers.

29.3 A person below eighteen years of age should create an Account or place an Order only through or under the supervision of a parent or lawful guardian.

29.4 Where CrushKart has actual knowledge that Personal Data relates to a Child and verifiable parental Consent is required, CrushKart will take appropriate steps to obtain that Consent before Processing.

29.5 Verification may involve:

a. reliable identity and age information already available to CrushKart;

b. information voluntarily provided by the person identifying themselves as the parent or guardian; or

c. a virtual token or verification mechanism issued by an authorised entity, where available.

29.6 CrushKart will not knowingly undertake Processing that is likely to cause a detrimental effect upon the well-being of a Child.

29.7 CrushKart will not knowingly track or behaviourally monitor a Child for targeted advertising.

29.8 CrushKart will not knowingly direct targeted advertising specifically at a Child, except to the extent a lawful exemption applies.

29.9 Where required parental Consent cannot be obtained or verified, CrushKart may decline the service, restrict Account functionality or erase the Child’s Personal Data.

29.10 A parent or lawful guardian who believes that a Child has provided Personal Data without appropriate authority may contact CrushKart to request review, correction or erasure.

29.11 CrushKart may retain limited information where necessary to comply with law, document the action taken, protect the Child or prevent fraud.

30. Automated Processing and Risk Screening

30.1 CrushKart and its Service Providers may use automated systems to identify potentially fraudulent transactions, unusual Account activity, technical errors and Website-performance issues.

30.2 Automated tools may also assist with Product recommendations, search ordering, stock planning and campaign measurement.

30.3 An automated fraud indicator may result in an Order being temporarily placed on hold or referred for additional verification.

30.4 CrushKart will not treat an automated risk indicator as conclusive where a reasonable human review is appropriate.

30.5 CrushKart does not intend to make a decision producing a legal or similarly significant effect solely through automated Processing without appropriate safeguards, except where such Processing is lawfully permitted.

30.6 An individual who believes that an Order or Account has been incorrectly affected by automated screening may contact CrushKart for review.

31. Rights of Data Principals

31.1 The rights described in this section will apply from the date on which the relevant statutory provisions come into force and apply to CrushKart.

31.2 Right to Access Information

31.2.1 A Data Principal may request a summary of the Personal Data being Processed and the Processing activities undertaken in relation to that Personal Data.

31.2.2 The Data Principal may also request information concerning the Data Fiduciaries and Data Processors with whom the Personal Data has been shared, subject to lawful exceptions.

31.2.3 CrushKart may withhold information where disclosure is prohibited by law or would prejudice the prevention, detection or investigation of an offence or cyber incident.

31.3 Right to Correction

31.3.1 A Data Principal may request correction of inaccurate or misleading Personal Data.

31.3.2 CrushKart may request reasonable supporting information where the requested correction cannot otherwise be verified.

31.4 Right to Completion and Updating

31.4.1 A Data Principal may request completion of incomplete Personal Data or updating of Personal Data that is no longer current.

31.4.2 Updating an Account record may not alter a completed invoice, historic delivery record or other document that must accurately reflect the transaction as it occurred.

31.5 Right to Erasure

31.5.1 A Data Principal may request erasure of Personal Data.

31.5.2 CrushKart may retain Personal Data where retention remains necessary:

a. for the Specified Purpose;

b. to fulfil or resolve an outstanding Order;

c. to process a refund, return or grievance;

d. to comply with a legal obligation;

e. to prevent or investigate fraud;

f. to preserve security logs;

g. to establish, exercise or defend a legal claim; or

h. for another lawful purpose.

31.5.3 Where only part of the Personal Data must be retained, CrushKart will seek to erase or restrict the remainder where reasonably practicable.

31.6 Right to Withdraw Consent

31.6.1 A Data Principal may withdraw Consent where Consent is the basis of Processing.

31.6.2 Withdrawal will be handled in accordance with Section 15 of this Privacy Policy.

31.7 Right to Grievance Redressal

31.7.1 A Data Principal may submit a grievance concerning CrushKart’s Processing of Personal Data, handling of Consent or response to a privacy request.

31.7.2 CrushKart will provide a readily available mechanism for submitting such grievances.

31.8 Right to Nominate

31.8.1 A Data Principal may nominate another individual to exercise applicable rights in the event of the Data Principal’s death or incapacity.

31.8.2 CrushKart may require documents necessary to verify the nomination, death, incapacity and identity of the nominee.

31.9 Right to Use a Consent Manager

31.9.1 Where the statutory mechanism is available and applicable, a Data Principal may give, manage, review or withdraw Consent through a registered Consent Manager.

31.9.2 CrushKart may require technical integration or verification necessary to act upon a valid instruction received through a Consent Manager.

32. Procedure for Exercising Privacy Rights

32.1 A privacy request may be submitted through the Privacy Contact details stated in this Privacy Policy.

32.2 The request should contain:

a. the Data Principal’s full name;

b. the registered email address or mobile number;

c. the relevant Account or Order number, where applicable;

d. a clear statement of the right being exercised;

e. a description of the Personal Data concerned; and

f. information reasonably necessary to locate the relevant record.

32.3 CrushKart may verify the identity of the requester before disclosing, correcting or erasing Personal Data.

32.4 Verification may be completed through:

a. the registered email address;

b. the registered mobile number;

c. Account authentication;

d. Order information; or

e. another proportionate method.

32.5 CrushKart will not request more Personal Data than is reasonably necessary for verification.

32.6 Where a request is submitted by a parent, guardian, authorised representative or nominee, CrushKart may request evidence of authority.

32.7 CrushKart will acknowledge and respond to a valid request within the period prescribed by Applicable Data Protection Law.

32.8 Where additional time is reasonably required, CrushKart may inform the requester of the reason and expected response period.

32.9 A request may be refused or limited where:

a. the identity or authority of the requester cannot be verified;

b. the request is fraudulent;

c. the request seeks another individual’s Personal Data without authority;

d. the requested action would violate a legal-retention obligation;

e. disclosure would prejudice security or an investigation;

f. the request is incapable of lawful fulfilment; or

g. another statutory exception applies.

32.10 Where a request is refused, CrushKart will provide an appropriate explanation, subject to legal and security restrictions.

33. Nomination

33.1 Where the right to nominate is applicable, the Data Principal may nominate one or more individuals to exercise their privacy rights following death or incapacity.

33.2 A nomination request should identify the Data Principal and the nominee with sufficient clarity.

33.3 CrushKart may require:

a. evidence of the nomination;

b. proof of the nominee’s identity;

c. evidence of death or incapacity;

d. confirmation that the nomination has not been revoked; and

e. any other document required by law.

33.4 CrushKart may decline to act upon a nomination that is invalid, unverifiable, revoked or inconsistent with a court order or later valid nomination.

33.5 Acting upon a nomination does not permit the nominee to obtain Personal Data unrelated to the rights they are authorised to exercise.

34. Duties of Data Principals

34.1 An individual providing Personal Data to CrushKart must comply with applicable law.

34.2 A Data Principal must not impersonate another person while providing Personal Data or exercising a privacy right.

34.3 A Data Principal must not suppress material information where such information is necessary to verify a lawful request.

34.4 A Data Principal requesting correction or erasure must provide authentic information where verification is reasonably required.

34.5 A person providing Personal Data relating to another individual must ensure that the disclosure is lawful.

34.6 A Data Principal must not submit a knowingly false or frivolous privacy grievance.

34.7 Nothing in this section prevents an individual from making a genuine complaint, disputing CrushKart’s response or approaching a competent authority.

35. Personal Data Relating to Other Individuals

35.1 A Customer may provide Personal Data relating to a gift recipient, family member, authorised representative or person appearing in customisation material.

35.2 The Customer confirms that:

a. the information is accurate to the best of their knowledge;

b. the information is lawfully provided;

c. the disclosure is reasonably expected by the affected individual; and

d. no more information is provided than is necessary.

35.3 CrushKart will use such Personal Data only for the relevant Order, customisation, delivery, support or legal purpose.

35.4 An affected individual may contact CrushKart to ask how their Personal Data has been used and to exercise applicable rights.

35.5 Where CrushKart is informed that Personal Data has been provided without authority, CrushKart may restrict, correct or erase the information after considering outstanding Order and legal requirements.

36. Third-Party Websites and Services

36.1 The Website may contain links to payment providers, courier tracking pages, social-media platforms, messaging services, embedded content or other third-party services.

36.2 Selecting a third-party link may take the individual outside the Website.

36.3 An independent third party may collect and Process Personal Data under its own privacy policy.

36.4 CrushKart does not control an independent third party’s privacy, security or retention practices.

36.5 The inclusion of a link or integration does not mean that CrushKart accepts responsibility for every independent Processing activity undertaken by the third party.

36.6 Individuals should review the relevant third party’s privacy policy before providing Personal Data.

36.7 Where CrushKart selects or integrates a Service Provider to Process Personal Data on its behalf, CrushKart’s Data Processor obligations will apply to the extent required by law.

37. Business Reorganisation and Transfer

37.1 Personal Data may be disclosed in connection with a proposed or completed merger, acquisition, financing, restructuring, sale of business, transfer of assets, insolvency process or change in control.

37.2 Disclosure will be limited to information reasonably necessary to evaluate, negotiate or complete the transaction.

37.3 Persons receiving Personal Data during due diligence will be expected to maintain confidentiality and use the information only for the transaction.

37.4 A successor acquiring CrushKart’s relevant business may continue Processing Personal Data for purposes compatible with those described in this Privacy Policy.

37.5 Where the successor proposes a materially different purpose requiring fresh notice or Consent, the successor or CrushKart will provide the legally required notice or obtain the required Consent.

37.6 A business transfer will not be used merely as a means of selling Personal Data independently of the underlying business.

38. Grievance Redressal

38.1 A Data Principal may submit a privacy grievance concerning:

a. collection or use of Personal Data;

b. disclosure or sharing of Personal Data;

c. failure to respect a Consent withdrawal;

d. inaccuracy or failure to correct Personal Data;

e. refusal or delay in responding to a privacy request;

f. a suspected Personal Data Breach;

g. unwanted marketing communications;

h. children’s Personal Data; or

i. another privacy-related act or omission.

38.2 The grievance must be submitted to:

Name: ______________________________
Designation: Grievance Officer
Email: ______________________________
Telephone: ______________________________
Address: J4/34, Khirki Extension, Malviya Nagar, New Delhi – 110017

38.3 The grievance should contain:

a. the complainant’s full name;

b. registered email address or mobile number;

c. relevant Account or Order information;

d. a clear description of the issue;

e. the date on which the issue occurred or was discovered;

f. copies of relevant communications or evidence; and

g. the resolution requested.

38.4 CrushKart may request additional information reasonably necessary to investigate the grievance.

38.5 CrushKart will acknowledge a consumer grievance within forty-eight hours of receipt.

38.6 CrushKart will endeavour to resolve the grievance within one month from receipt, subject to:

a. the nature and complexity of the issue;

b. the cooperation of the complainant;

c. any external investigation required; and

d. any shorter period prescribed by Applicable Data Protection Law.

38.7 An acknowledgement confirms receipt of the grievance and does not mean that the grievance has been accepted as valid.

38.8 CrushKart will communicate the outcome or the status of the grievance through an appropriate contact channel.

38.9 A complainant who disagrees with the outcome may request reconsideration and provide additional relevant information.

39. Complaint to the Data Protection Board of India

39.1 Where the relevant provisions of the DPDP Act are in force and applicable, a Data Principal may make a complaint to the Data Protection Board of India.

39.2 The Data Principal must first exhaust the opportunity to obtain grievance redressal from CrushKart before approaching the Board where the Act requires such exhaustion.

39.3 A Data Principal should therefore submit the grievance to CrushKart and allow the applicable response period before filing a complaint with the Board.

39.4 Nothing in this section prevents an individual from approaching another competent regulator, consumer commission, cybersecurity authority, law-enforcement agency or court where such recourse is available under law.

39.5 CrushKart will cooperate with a lawful inquiry, direction or proceeding initiated by the Data Protection Board of India or another competent authority.

40. Changes to this Privacy Policy

40.1 CrushKart may update this Privacy Policy to reflect:

a. changes in Applicable Data Protection Law;

b. commencement of additional provisions of the DPDP Act or Rules;

c. changes to the Website or Products;

d. changes in Service Providers or technology;

e. introduction of new payment, delivery, communication or marketing functions;

f. changes in Processing activities; or

g. improvements in privacy and security practices.

40.2 The revised Privacy Policy will be published with an updated Effective Date or Last Updated date.

40.3 Where a change materially affects the manner in which Personal Data is Processed, CrushKart may provide additional notice through:

a. the Website;

b. the Customer’s Account;

c. email;

d. SMS;

e. WhatsApp; or

f. another appropriate communication channel.

40.4 Where a new purpose requires fresh Consent, CrushKart will seek that Consent before commencing the relevant Processing.

40.5 Continued use of the Website may acknowledge receipt of an updated privacy notice, but it will not replace Consent where Consent is legally required.

40.6 The version of the Privacy Policy published at the relevant time will govern the Processing undertaken under that version, subject to Applicable Data Protection Law.

41. Governing Law and Jurisdiction

41.1 This Privacy Policy will be governed by the laws of India.

41.2 Nothing in this Privacy Policy limits the jurisdiction of the Data Protection Board of India, a Consumer Disputes Redressal Commission or another competent authority.

41.3 Subject to statutory jurisdiction, courts of competent jurisdiction in New Delhi will have jurisdiction over disputes arising from this Privacy Policy.

41.4 This jurisdiction clause will not prevent an individual from approaching a forum that has jurisdiction under applicable consumer or data-protection law.

42. Contact Information

42.1 Questions, privacy requests and grievances may be submitted through the following details:

CrushKart
J4/34, Khirki Extension
Malviya Nagar, New Delhi – 110017

Privacy Contact Email: ______________________________
Privacy Contact Number: ______________________________
Grievance Officer: ______________________________

42.2 CrushKart will prominently display the business contact information of the person authorised to answer questions concerning Personal Data Processing.

42.3 The contact details must be completed and tested before this Privacy Policy is published.

SCHEDULE A

Itemised Description of Personal Data and Processing Purposes

A.1 Account Registration

CrushKart may Process the individual’s name, email address, mobile number, login identifier, saved addresses and authentication records to create, maintain and secure the Account.

Where the individual does not provide the information necessary for authentication, CrushKart may be unable to create or maintain the Account.

A.2 Product Browsing and Website Use

CrushKart may Process Internet Protocol address, device information, browser information, session identifiers, pages viewed, Products viewed, search activity and error information to operate, secure and improve the Website.

Non-essential analytics or advertising Processing will be subject to the applicable notice and choice requirements.

A.3 Shopping Cart and Checkout

CrushKart may Process selected Products, quantities, variants, cart contents, checkout activity, contact information and Delivery Address to preserve the shopping session and enable the Customer to place an Order.

Where the checkout is not completed, CrushKart may retain limited checkout information for security, technical support or an authorised cart reminder.

A.4 Order Fulfilment

CrushKart may Process the Customer’s name, contact information, Delivery Address, Order details, payment status and recipient information to verify, prepare, dispatch and deliver the Order.

Failure to provide necessary fulfilment information may prevent CrushKart from accepting or completing the Order.

A.5 Payment Processing

CrushKart may Process transaction amount, payment method, payment status, masked payment identifier and transaction reference to confirm payment, reconcile the Order and process a refund.

Complete payment credentials may be Processed directly by the payment provider.

A.6 Delivery

CrushKart may Process the recipient’s name, telephone number, Delivery Address, shipment reference and delivery instructions to arrange and complete delivery.

The information may be shared with a courier or logistics provider for that purpose.

A.7 Customer Support

CrushKart may Process contact information, Order details, communications, photographs, videos and complaint evidence to investigate and resolve the Customer’s request.

Where the requested evidence is not provided, CrushKart may be unable to verify the claim.

A.8 Returns, Replacements and Refunds

CrushKart may Process Product-condition evidence, courier information, bank or UPI details, payment references and refund status to assess the claim and complete an approved remedy.

Bank or UPI information obtained for a refund will not be used for marketing.

A.9 Customised Products

CrushKart may Process names, photographs, messages, artwork and design instructions to prepare and deliver a Customised Product.

The Customer must ensure that material relating to another individual is lawfully provided.

A.10 Marketing

CrushKart may Process contact information, marketing preferences, campaign engagement and Product interests to send optional promotions where a lawful basis exists.

The individual may opt out at any time.

A.11 Reviews

CrushKart may Process the review content, rating, display name, uploaded media and verified-purchase status to publish and moderate the review.

The individual should not include unnecessary confidential information in a public review.

A.12 Security and Fraud Prevention

CrushKart may Process transaction, Account, device, delivery and refund information to detect unauthorised access, fraudulent Orders, payment misuse or false claims.

Such information may be retained where necessary to investigate and document a security or fraud matter.

SCHEDULE B

Categories of Recipients

B.1 Website and Hosting Providers

These providers may receive Account, Website-usage, Order and technical information required to host and operate the Website.

B.2 Payment Providers

These providers may receive transaction, authentication and limited Order information necessary to process or refund payment.

B.3 Courier and Logistics Providers

These providers may receive recipient, Delivery Address, contact and shipment information necessary to complete delivery.

B.4 Suppliers and Customisation Vendors

These providers may receive Product, Order and customisation information necessary to produce or prepare the Product.

B.5 Communication Providers

These providers may receive contact, message and Order-status information necessary to send transactional or authorised promotional communications.

B.6 Analytics and Advertising Providers

These providers may receive limited device, cookie, Website-usage and campaign information subject to applicable choices and Consent requirements.

B.7 Security and Fraud-Prevention Providers

These providers may receive Account, device, transaction and security information necessary to detect and respond to suspicious activity.

B.8 Professional Advisers and Authorities

Lawyers, accountants, auditors, insurers, courts, regulators and government authorities may receive relevant information where necessary for advice, compliance, claims or lawful disclosure.

SCHEDULE C

Retention Principles

C.1 Transaction Records

CrushKart will retain Order, invoice, payment and refund records for the period required by taxation, accounting, consumer-protection and other applicable laws.

C.2 Account Records

CrushKart will retain Account records while the Account is active and for a reasonable period after closure where necessary for security, fraud prevention, disputes or legal compliance.

C.3 Support and Grievance Records

CrushKart will retain support and grievance records until resolution and for a reasonable period thereafter to document the outcome and manage related claims.

C.4 Customisation Material

CrushKart will retain customisation material only for the period reasonably necessary to produce, deliver and support the Product, subject to legal or dispute-related requirements.

C.5 Marketing Records

CrushKart will retain marketing Consent and opt-out records for as long as necessary to administer preferences and demonstrate compliance.

C.6 Security Logs

CrushKart will retain security and Processing logs for the period necessary to detect, investigate and remediate security incidents and for any minimum period prescribed by law.

C.7 Deletion and Anonymisation

When retention is no longer justified, CrushKart will delete, securely destroy or anonymise the Personal Data, subject to backup cycles and legal-retention requirements.

End of Privacy Policy