Privacy Policy

This Privacy Policy explains how [Required from Client] (legal business name), operating as Welcome Crystal at [Required from Client] (registered address) ("Welcome Crystal", "we", "us" or "our"), collects, uses, shares and protects your personal data when you visit https://welcomecrystal.com (the "Website"), place an order or contact us. Welcome Crystal is the Data Fiduciary for this personal data. We process it in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as applicable.

1. Personal Data We Collect

·         Identity and contact data: name, email address, mobile/WhatsApp number, and billing and shipping addresses.

·         Order data: products purchased, order value, invoice details, delivery status, and any GSTIN you provide for a business invoice.

·         Account data: login details if you create an account (passwords are stored in encrypted form by our platform).

·         Payment data: payment status and transaction reference. Card, UPI and bank details are entered directly with our payment gateway and are not stored by us.

·         Communications: messages, photos and unboxing videos you send us by email, WhatsApp or the contact form, including for damaged or wrong-item requests.

·         Technical and usage data: IP address, device and browser type, pages viewed, referring website, and cookie identifiers, collected automatically when you use the Website.

2. How We Use Your Personal Data

We process your personal data for the following purposes, based on your consent or on legitimate uses permitted under the DPDP Act (such as completing a transaction you have requested, or meeting a legal obligation):

·         to process, confirm, pack, ship and deliver your orders, and to send order and delivery updates;

·         to issue invoices and keep records required under tax and other laws;

·         to respond to queries and handle damaged or wrong-item replacement requests;

·         to prevent fraud, misuse of offers and unauthorised transactions, and to keep the Website secure;

·         to understand how the Website is used and to improve products and the shopping experience;

·         with your consent, to send offers, new arrivals and newsletters by email, SMS or WhatsApp. You can opt out at any time.

3. Cookies and Analytics

The Website runs on Shopify and uses cookies and similar technologies to keep your cart working, remember your preferences, keep checkout secure and measure Website performance. We may also use analytics and advertising tools: [Required from Client] (please list any tools enabled, e.g. Google Analytics, Meta Pixel or Google Ads). These tools may collect usage data about your visits. You can manage or block cookies through your browser settings or our cookie banner where available, but some features (such as the cart or checkout) may not work properly without essential cookies. For details of Shopify's cookies, see https://www.shopify.com/legal/cookies.

4. Payment Gateways

Payments are processed by Shopify and our payment partner(s): [Required from Client] (payment gateway names). When you pay, your payment details are collected and processed directly by the payment gateway under its own privacy policy and security standards (such as PCI-DSS). We receive only the information needed to confirm your payment, such as the transaction ID, the payment status and limited masked details.

5. Sharing Your Personal Data

We do not sell your personal data. We share it only as needed with:

·         Courier and logistics partners [Required from Client] (names): your name, delivery address, phone number and order details, so that they can deliver your parcel and contact you about delivery;

·         Shopify (our e-commerce platform) and our payment gateways, to run the store and process payments;

·         Communication and support tools (e.g. email and WhatsApp services) used to reply to you and send order updates;

·         Analytics and marketing providers listed in Section 3, in line with your cookie choices;

·         Professional advisers such as accountants and lawyers, where required;

·         Government or law-enforcement authorities, where required by law or a valid legal order, or to protect our rights or prevent fraud.

Some service providers, including Shopify, may store or process data on servers outside India. Any such transfer is made in line with the DPDP Act and any restrictions notified by the Government of India.

6. Data Security

We use reasonable security practices, including Shopify's SSL-encrypted checkout, restricted access to customer data and secure service providers, to protect your personal data. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by law.

7. Data Retention

We keep personal data only for as long as needed for the purposes described above, or as required by law. Order and invoice records are retained for the period required under GST and tax laws [Required from Client] (please confirm the retention period, e.g. 8 years). Unboxing videos and photos are retained until your request is resolved and for [Required from Client] (period) after that. Marketing data is retained until you withdraw consent. After that, data is deleted or anonymised unless the law requires us to keep it longer.

8. Your Rights

Under the DPDP Act, you have the right to:

·         obtain a summary of the personal data we process about you and the processing activities;

·         request correction, completion or updating of inaccurate or incomplete data;

·         request erasure of your personal data when it is no longer needed, unless we must keep it by law;

·         withdraw consent at any time (this does not affect processing already done, and may mean we cannot complete a pending order);

·         nominate another person to exercise your rights in the event of your death or incapacity;

·         have your grievances addressed by our Grievance Officer and, if you are not satisfied, complain to the Data Protection Board of India.

To exercise any right, write to [Required from Client] (privacy email). We may need to verify your identity before acting on a request.

9. Children's Personal Data

The Website is not intended for children under 18. We do not knowingly collect personal data from children without verifiable consent from a parent or lawful guardian, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has shared personal data with us, please contact us and we will delete it.

10. Third-Party Links

The Website may contain links to third-party websites or social media pages. We are not responsible for their privacy practices, so please review their policies.

11. Grievance Officer

In line with the DPDP Act, the Information Technology Act, 2000 and the rules made under them, our Grievance Officer is:

·         Name: [Required from Client]

·         Designation: [Required from Client]

·         Email: [Required from Client]

·         Phone: [Required from Client]

·         Address: [Required from Client]

·         Working hours: [Required from Client]

We will acknowledge your grievance within 48 hours and aim to resolve it within [Required from Client] (period, e.g. 30 days, or the period prescribed by law).

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The updated version will be posted on this page with a revised "Last updated" date. Where required, we will ask for your consent again.