Privacy Policy

Brand Name: Palm Angels India

Operated by: Zyvora Brands Private Limited

Registered Office: B-19-347 Near Omaxe Mall, Ferozpur Road, Ludhiana, Bharat Nagar Chowk, Ludhiana, Punjab – 141001.

Website: palmangels.co.in

Customer Care Email: customercare@palmangels.co.in

This Privacy Policy explains how Palm Angels India collects, uses, stores, shares, and protects your personal data. Please read it carefully.

1.1 Palm Angels India (referred to as the "Company", "we", "us", or "our") is committed to protecting the privacy and personal data of all individuals who access or use its Website and Services. This Privacy Policy describes how the Company collects, processes, stores, shares, and protects personal data in connection with the operation of its e-commerce platform.

1.2 This Privacy Policy is published in accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the rules and regulations made thereunder. It applies to all Users of the Website, including registered Customers and visitors who access the Website without registration.

1.3 By accessing the Website, creating an Account, or placing an Order, you acknowledge that you have read, understood, and consented to the collection and processing of your personal data as described in this Privacy Policy.

1.4 This Privacy Policy must be read in conjunction with the Terms & Conditions, Returns, Exchanges & Refunds Policy, and Shipping & Delivery Policy of the Company, each of which is published on the Website.

2.1 This Privacy Policy applies to all personal data collected by the Company through:

(a) The Website and any mobile-optimised version thereof;

(b) The Company's customer care channels, including email and telephone;

(c) Any other channel through which you interact with the Company in connection with the Services.

2.2 This Privacy Policy does not apply to third-party websites, platforms, or services that may be accessible through links on the Website. The Company is not responsible for the privacy practices of such third parties, and you are encouraged to review their respective privacy policies.

3.1 The Company collects and processes the following categories of personal data;

(a) Full name;

(b) Date of birth (where provided);

(c) Gender (where provided).

(d) Email address;

(e) Mobile phone number;

(f) Delivery address(es);

(g) Billing address.

(h) Payment method details (credit card, debit card, UPI, net banking, wallet, etc.);

(i) Transaction reference numbers;

(j) Billing details.

Please note that complete payment card details are not stored by the Company and are processed directly by our authorised payment gateway partners.

(a) Username and encrypted password;

(b) Account preferences and settings;

(c) Wishlist and saved items.

(d) Products ordered or purchased;

(e) Order values and dates;

(f) Delivery and return history;

(g) Communications relating to orders.

(h) IP address;

(i) Browser type and version;

(j) Operating system;

(k) Device type and identifiers;

(l) Time zone settings.

(m) Pages visited on the Website;

(n) Products viewed or searched;

(o) Time spent on the Website;

(p) Referring URLs;

(q) Clickstream data.

Information collected through cookies and similar tracking technologies, as further described in Part V of this Privacy Policy.

Records of communications between you and the Company, including customer support interactions, feedback, and survey responses.

4.1 The Company collects personal data

(a) Directly from you, when you register an Account, place an Order, subscribe to communications, contact customer support, or otherwise interact with the Website;

(b) Automatically, through cookies, web beacons, and similar technologies when you access or use the Website;

(c) From third parties, including payment gateway providers, logistics partners, analytics service providers, and marketing platforms, to the extent permitted by applicable law.

5.1 The Company collects and processes your personal data for the following purposes:

(a) Order Processing and Fulfilment: To process your Orders, arrange delivery, manage returns and exchanges, and provide after-sales support;

(b) Account Management: To create and manage your Account, verify your identity, and provide you with access to the Services;

(c) Payment Processing: To process payments, prevent fraud, and comply with financial and regulatory requirements;

(d) Customer Support: To respond to your queries, complaints, and requests, and to provide assistance in connection with your purchases;

(e) Personalisation: To personalise your experience on the Website, including displaying relevant Products, recommendations, and content based on your browsing and purchase history;

(f) Marketing and Communications: To send you promotional communications, newsletters, and information about new collections, offers, and events, subject to your consent and applicable law;

(g) Analytics and Improvement: To analyse usage patterns, improve the Website's functionality and user experience, and develop new features and Services;

(h) Legal and Regulatory Compliance: To comply with applicable Indian laws, respond to legal processes, and enforce the Company's rights and policies;

(i) Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions and other unlawful activities.

5.2 The Company shall not use your personal data for any purpose other than those described in this Privacy Policy, without obtaining your prior consent, except where required by applicable law.

6.1 The Company processes your personal data on the following legal bases, as applicable under the DPDP Act, 2023:

(a) Consent: Where you have provided your explicit consent to the processing of your personal data for a specific purpose, such as receiving marketing communications;

(b) Contractual Necessity: Where processing is necessary for the performance of a contract with you, including the processing of your Order and delivery of Products;

(c) Legal Obligation: Where processing is necessary for compliance with an applicable law or legal obligation;

(d) Legitimate Interests: Where processing is necessary for the legitimate interests of the Company, provided that such interests are not overridden by your rights and interests.

7.1 Your personal data is stored on secure servers located in India. The Company takes reasonable measures to ensure that personal data is stored in a secure environment and is protected from unauthorised access, disclosure, alteration, or destruction.

7.2 Where the Company engages third-party service providers to process personal data on its behalf, it ensures that such providers are contractually bound to implement appropriate data security measures and to process personal data only in accordance with the Company's instructions and applicable law.

8.1 The Company implements appropriate technical and organisational security measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. Such measures may include encryption, secure communication protocols, access controls, authentication mechanisms, network security controls, and continuous monitoring of critical systems, including:

• Network Security – Next-Generation Firewall (NGFW): A Next-Generation Firewall has been deployed to protect the Company's network infrastructure. The firewall provides advanced security features, including network traffic filtering, intrusion prevention, application control, web filtering, VPN security, and protection against unauthorised access and cyber threats;
• Device Management – Mobile Device Management (MDM) and Active Directory (AD): A centralised Mobile Device Management solution integrated with Active Directory is used to manage and secure all corporate user devices, enabling centralised policy enforcement, device compliance monitoring, user authentication, access control, software deployment, remote device management, and secure configuration management;
• Endpoint Security and Security Monitoring – CrowdStrike with SIEM: All corporate endpoints are protected using CrowdStrike Endpoint Detection and Response (EDR). Security events and endpoint activities are continuously monitored through Security Information and Event Management (SIEM) capabilities, enabling real-time threat detection, incident monitoring, rapid response, malware protection, and proactive security analytics;
• Encryption of data in transit using industry-standard protocols (such as SSL/TLS);
• Access controls limiting access to personal data to authorised personnel only;
• Regular security assessments and vulnerability testing;
• Secure storage of passwords using hashing and salting techniques;
• Monitoring of systems for potential security incidents.

8.2 While the Company takes all reasonable precautions to protect your personal data, no method of transmission over the internet or electronic storage is entirely secure. The Company cannot guarantee absolute security but shall notify you of any data breach in accordance with applicable law.

9.1 The Company retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer.

9.2 Upon expiry of the applicable retention period, the Company shall delete or anonymise your personal data in a secure manner.

10.1 The Company does not sell, rent, or trade your personal data to any third party for their independent marketing or commercial purposes.

10.2 The Company may share your personal data with the following categories of third parties, solely to the extent necessary for the purposes described in this Privacy Policy:

The Company shares your name, delivery address, contact number, and order details with its logistics and courier partners to facilitate the delivery of your Orders.

The Company shares your payment and transaction details with authorised payment gateway providers for the purpose of processing your payments securely.

The Company may engage third-party technology providers for website hosting, data storage, platform maintenance, and related services. Such providers are contractually bound to process personal data only in accordance with the Company's instructions.

The Company may use third-party analytics tools to analyse Website usage and performance. Such tools may collect anonymised or aggregated data to assist the Company in improving the Website and Services.

The Company may use third-party email marketing and communication platforms to send you promotional communications, subject to your consent.

The Company may disclose your personal data to governmental authorities, law enforcement agencies, or courts of law where required by applicable law, court order, or regulatory requirement.

10.3 All third-party service providers engaged by the Company are required to maintain appropriate data security standards and to use personal data only for the purposes for which it has been shared.

11.1 The Company uses cookies and similar tracking technologies (including web beacons, pixel tags, and clear GIFs) on the Website to enhance your browsing experience, analyse Website traffic, and deliver relevant content and advertising.

11.2 Cookies are small text files that are placed on your device by the Website when you visit it. They enable the Website to recognise your device on subsequent visits and to remember your preferences.

12.1 The Company uses the following categories of cookies:

(a) Strictly Necessary Cookies: These cookies are essential for the operation of the Website and cannot be disabled. They enable core functionality such as security, account login, and shopping cart management.

(b) Performance and Analytics Cookies: These cookies collect information about how Users interact with the Website, including pages visited, time spent, and error messages. This information is used to improve the Website's performance and user experience.

(c) Functional Cookies: These cookies allow the Website to remember your preferences and settings, such as your preferred language, region, and saved items.

(d) Marketing and Targeting Cookies: These cookies are used to deliver personalised advertisements and promotional content based on your browsing behaviour, both on the Website and on third-party platforms. They may be set by the Company or by third-party advertising partners.

13.1 You may manage your cookie preferences at any time through the cookie settings available on the Website or by adjusting your browser settings to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of the Website and your ability to access certain features.

13.2 For more information on managing cookies, you may refer to your browser's help documentation or visit www.allaboutcookies.org.

14.1 In accordance with the Digital Personal Data Protection Act, 2023, you, as a Data Principal, have the following rights in relation to your personal data processed by the Company:

(a) Right of Access: You have the right to obtain confirmation from the Company as to whether your personal data is being processed, and to receive a summary of the personal data held by the Company and the purposes for which it is being processed.

(b) Right to Correction and Erasure: You have the right to request the correction of inaccurate or incomplete personal data and the erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to applicable legal requirements.

(c) Right to Grievance Redressal: You have the right to have your grievances addressed by the Company in a timely and effective manner. Please refer to Clause 19 for details of the Grievance Officer.

(d) Right to Nominate: You have the right to nominate another individual to exercise your rights in the event of your death or incapacity.

14.2 Users are responsible for maintaining the confidentiality of their login credentials and must immediately notify the Company of any suspected unauthorised access to their Account.

14.3 To exercise any of the rights described above, please contact the Company's Grievance Officer at the details provided in Clause 19 of this Privacy Policy.

15.1 You may update or correct your personal information at any time by logging into your Account and accessing the account settings. Alternatively, you may contact the Company's customer care team at customercare@palmangels.co.in to request an update.

16.1 Where the Company processes your personal data on the basis of your consent, you have the right to withdraw such consent at any time by contacting the Company at customercare@palmangels.co.in or by using the opt-out mechanisms provided in marketing communications.

16.2 Please note that withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal. Withdrawal of consent for certain types of processing may affect your ability to use some features of the Website or to receive certain Services.

17.1 The Website is not directed at children below the age of eighteen (18) years. The Company does not knowingly collect personal data from minors. If the Company becomes aware that personal data has been collected from a minor without appropriate parental or guardian consent, it shall take immediate steps to delete such data.

17.2 If you are a parent or guardian and believe that your child has provided personal data to the Company without your consent, please contact the Grievance Officer at the details provided in Clause 19.

18.1 The Company primarily processes and stores personal data within India. In certain circumstances, personal data may be transferred to or processed in countries outside India, including in connection with the use of third-party technology platforms, analytics tools, or marketing services.

18.2 Where personal data is transferred outside India, the Company shall ensure that such transfers are made in accordance with the requirements of the DPDP Act, 2023, and any rules or regulations made thereunder, including ensuring that the recipient country or entity provides an adequate level of data protection.

19.1 In accordance with the Information Technology Act, 2000, the DPDP Act, 2023, and applicable rules, the Company has designated the following Grievance Officer to address privacy-related complaints and concerns:

Designation: Grievance Officer

Email: grievance@palmangels.co.in

19.2 The Grievance Officer shall acknowledge receipt of any complaint within forty-eight (48) hours and shall endeavour to resolve the complaint within one (1) month of receipt, in accordance with applicable law.

20.1 For any questions, concerns, or requests relating to this Privacy Policy or the Company's data practices, please contact:

Customer Care Email: customercare@palmangels.co.in

Customer Care Phone: + 91 7087585030

Business Hours: 10 AM to 7 PM

21.1 The Company reserves the right to amend, modify, or update this Privacy Policy at any time to reflect changes in applicable law, regulatory requirements, or the Company's data practices. Revised versions of this Privacy Policy shall be published on the Website with an updated effective date.

21.2 Where changes to this Privacy Policy are material, the Company shall endeavour to notify you by email or through a prominent notice on the Website prior to the changes taking effect.

21.3 Your continued use of the Website following the publication of a revised Privacy Policy shall constitute your acceptance of the updated terms.