The Information Technology Act, 2000 (IT Act)

The IT Act is the primary legislation governing electronic commerce and digital data in India. Section 43A of the IT Act requires any body corporate that handles sensitive personal data or information (SPDI) to implement and maintain reasonable security practices. Section 72A makes unauthorised disclosure of personal information without consent a punishable offence with imprisonment of up to 3 years or a fine of up to Rs. 5 lakh, or both. Puroque is bound by this law and complies fully with its requirements.

The IT (SPDI) Rules, 2011 — Sensitive Personal Data or Information Rules

These rules, notified under Section 43A of the IT Act, define what constitutes Sensitive Personal Data or Information (SPDI) and impose obligations on how it must be collected, stored, transferred, and disclosed. Under these rules, SPDI includes passwords, financial information such as bank account, credit card, and debit card details, physical, physiological, and mental health conditions, sexual orientation, medical records, and biometric information. These rules require us to obtain your written consent before collecting SPDI, use it only for the purpose for which it was collected, and not retain it longer than necessary. You have the right to withdraw your consent at any time by contacting us.

The Digital Personal Data Protection Act, 2023 (DPDPA)

The Digital Personal Data Protection Act, 2023 was enacted by the Parliament of India and received Presidential assent on 11 August 2023. It is the most comprehensive personal data protection legislation in India to date. While its rules and operational provisions are being notified in phases, Puroque is proactively aligning our data practices to comply with its requirements ahead of full operationalisation. Under the DPDPA, you have the following rights as a Data Principal (a person whose personal data is processed): the right to obtain information about your personal data being processed; the right to correction and erasure of inaccurate or outdated personal data; the right to grievance redressal from the Data Fiduciary (us); the right to nominate another individual to exercise rights on your behalf in case of your death or incapacity; and the right to approach the Data Protection Board of India if your grievance is not resolved satisfactorily. Puroque, as a Data Fiduciary, is obligated under this Act to process personal data only for lawful purposes with your consent, maintain accuracy of data, implement appropriate security safeguards, notify you in the event of a personal data breach, and not retain your data beyond the period for which it is necessary.

The Consumer Protection (E-Commerce) Rules, 2020

These rules require every e-commerce entity operating in India to clearly disclose its privacy policy, inform users about the personal data it collects and how it is used, and ensure that users are not subjected to unfair data practices. Puroque complies fully with these rules and this policy constitutes our required disclosure under Rule 4 and Rule 5 of these regulations.

The Right to Privacy — Article 21 of the Constitution of India

The Supreme Court of India in its landmark judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, unanimously held that the right to privacy is a fundamental right guaranteed under Article 21 of the Constitution of India, which protects the right to life and personal liberty. This constitutional recognition forms the foundational basis of all data protection frameworks in India. Puroque acknowledges this right and treats the protection of your personal information as a fundamental obligation, not merely a compliance requirement.

Strictly Necessary Cookies

These cookies are essential for the basic functioning of the website. They allow you to add items to your cart, complete the checkout process, stay logged in to your account, and use secure areas of the website. Without these cookies, core website features would not work. These cookies do not require your consent and cannot be disabled.

Preference Cookies

These cookies remember your preferences and settings such as your chosen language, region, and display preferences. They help us deliver a more personalised experience when you return to our website. You may disable these cookies, but doing so may affect how the website looks and functions for you.

Analytics Cookies

We use Google Analytics to understand how visitors use puroque.com. These cookies collect information about which pages are visited, how long users spend on each page, where visitors come from, and which products are most viewed. All data collected through analytics cookies is aggregated and anonymised. It does not personally identify you. We use this data solely to improve our website's content, structure, and performance.

Marketing and Advertising Cookies

These cookies are used to deliver relevant advertisements to you on other websites and platforms after you visit puroque.com. They are used by Google Ads and Meta Ads to show you products you have previously viewed or categories you have shown interest in. These cookies track your activity across multiple websites to build a profile of your interests. They are only placed with your explicit consent via our cookie consent banner.

Session Cookies vs Persistent Cookies

Session cookies are temporary and are deleted from your device when you close your browser. Persistent cookies remain on your device for a set period (typically between 30 days and 2 years, depending on the cookie's purpose). You can delete persistent cookies at any time through your browser settings.

Logistics and Courier Partners

We share your name, delivery address, mobile number, and order details with our logistics and courier partners (such as Shiprocket, Delhivery, Bluedart, DTDC, and similar providers) solely for the purpose of delivering your order to you. These partners are contractually required to handle your data securely and use it only for delivery-related purposes.

Payment Gateway Providers

We share your name, email address, phone number, and order value with our payment gateway partner (such as Razorpay or similar RBI-regulated payment aggregators) to facilitate secure payment processing. Payment gateways handle your card or UPI details directly under their own security frameworks and comply with PCI-DSS (Payment Card Industry Data Security Standards). We do not receive or store your full card number, CVV, or net banking credentials.

Technology and Platform Service Providers

Our website is hosted and operated on Shopify Inc., a global e-commerce platform. Your data is stored on Shopify's servers and is subject to Shopify's data processing agreement. We also use email service providers for transactional and marketing communications. All such providers are contractually bound to process your data only on our instructions and in accordance with applicable data protection laws.

Google and Advertising Platforms

We use Google Analytics, Google Ads, and Google Shopping. In connection with these services, certain website usage data and anonymised audience information is shared with Google. This data is used for website analytics, advertising measurement, and remarketing. Google processes this data in accordance with Google's Privacy Policy and its data processing terms. You can manage your Google data preferences at myaccount.google.com.

Manufacturers and Brands (for Warranty Claims)

When you raise a warranty claim for a product, we may share your name, contact information, order details, and the nature of the defect with the relevant manufacturer or brand to facilitate resolution of your claim. This sharing is limited strictly to what is necessary for the warranty process.

Legal and Regulatory Authorities

We may disclose your personal information to courts, law enforcement agencies, tax authorities (including the GST authorities and Income Tax Department), or other government bodies when required to do so by law, court order, or valid legal process under Indian law. We will, where legally permissible, notify you of such disclosures.

Business Transfers

In the event of a merger, acquisition, restructuring, sale of assets, or any change in ownership of Roziyo Trading Private Limited, your personal information may be transferred to the successor entity as part of the business. You will be notified of any such change by email and given an opportunity to exercise your data rights before the transfer takes effect.

SSL Encryption

All data transmitted between your browser and our website is encrypted using 256-bit SSL (Secure Sockets Layer) encryption. The padlock icon in your browser's address bar confirms this encryption is active.

Secure Hosting

Our website is hosted on Shopify's ISO 27001-certified infrastructure, which maintains industry-leading physical and digital security controls at its data centre facilities.

Password Security

Account passwords are stored using industry-standard one-way cryptographic hashing algorithms. We cannot view your password in plain text. We encourage you to use a strong, unique password for your account.

Payment Security

Payment card data is processed directly by our PCI-DSS-compliant payment gateway. We do not store, process, or transmit full card numbers, CVV codes, or PIN numbers on our systems at any point.

Access Controls

Access to your personal data within our organisation is strictly limited to employees and authorised personnel who need it to perform their specific job functions. All staff with data access are trained in data protection obligations.

Breach Response

In the event of a personal data breach that poses a risk to your rights and interests, we will notify you and the relevant authorities as required under the DPDPA, 2023, within the prescribed timeframe without undue delay.

Right to Access

You have the right to request a copy of all personal information we hold about you. This includes the categories of data, the purposes for which it is held, and the third parties it has been shared with. We will provide this information within 30 days of a verified request at no charge for the first request in any 12-month period.

Right to Correction

You have the right to request correction of any personal information we hold about you that is inaccurate, incomplete, or out of date. Many fields can be updated directly in your account settings on puroque.com. For information that cannot be self-corrected, please contact us and we will make the correction within 15 business days.

Right to Erasure (Right to be Forgotten)

You have the right to request deletion of your personal information when it is no longer necessary for the purpose for which it was collected, when you withdraw your consent, or when it has been unlawfully processed. We will fulfil verified erasure requests within 30 days, except where we are legally required to retain certain data (such as transaction records for tax compliance under the CGST Act, 2017).

Right to Withdraw Consent

Where we process your personal data based on your consent — such as for marketing communications, cookies, or personalisation — you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent for marketing emails, click the "Unsubscribe" link in any marketing email we send you. To withdraw consent for cookies, manage your preferences via your browser settings.

Right to Object to Processing

You have the right to object to the processing of your personal data for marketing purposes, profiling, or where we rely on legitimate interest as the legal basis. We will stop such processing upon receipt of a verified objection unless we have compelling legitimate grounds to continue that override your interests and rights.

Right to Grievance Redressal

Under the DPDPA, 2023, you have the right to raise a grievance with us regarding any alleged violation of your data protection rights. We will acknowledge your grievance within 2 business days and resolve it within 30 days. If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India once that body is constituted and operational.

Right to Nominate

Under the DPDPA, 2023, you have the right to nominate another individual who can exercise your data protection rights on your behalf in the event of your death or incapacity. To register a nomination, please contact us at privacy@puroque.com.

Registered Mobile Number

Order Number(s) (Optional — helps us locate your records faster)

Specific Data You Are Requesting (Optional)

I confirm that I am the account holder named above and that the information provided is accurate. I understand that Puroque may ask me to verify my identity before processing this request.

Submit Data Access Request

What Information Is Incorrect or Outdated? *

What Should the Correct Information Be? *

I confirm that I am the account holder named above and that the corrected information I have provided is accurate and complete.

Submit Correction Request

Please note: We are legally required to retain certain data for up to 8 years under the CGST Act, 2017, and the Income Tax Act, 1961 (specifically, transaction and tax records). Data required for legal compliance cannot be deleted before the mandatory retention period expires. All other personal data will be deleted within 30 days of your verified request. Deletion of your account is permanent and cannot be reversed.

What Would You Like Deleted? * Please select what you would like deleted My entire account and all associated personal data My marketing and communication preferences data only My browsing history and analytics data only Specific data categories (please describe below)

Additional Details or Specific Data to Delete

I confirm that I am the account holder named above, I understand that account deletion is permanent and irreversible, and I acknowledge that certain data required for legal compliance may be retained for the period specified in this policy before deletion.

Submit Deletion Request

Mobile Number to Unsubscribe from SMS (Leave blank if not applicable)

Which Channels Do You Want to Unsubscribe From? *

Unsubscribing from marketing will not affect transactional communications such as order confirmations, shipping updates, and refund notifications, which are necessary for order fulfilment and cannot be disabled.

Submit Unsubscribe Request

Nature of Your Grievance * Please select the nature of your complaint I believe my data was shared without my consent I believe my account or data may have been compromised I am still receiving marketing after unsubscribing My data access request was not fulfilled My data deletion request was not completed My correction request was not addressed Other privacy-related concern

Describe Your Grievance in Detail *

What Resolution Are You Seeking?

I confirm that the information provided in this complaint is accurate and complete to the best of my knowledge, and I understand that Puroque will investigate this matter and respond within 30 calendar days.

Submit Privacy Grievance

Google Customer Reviews

If you complete a purchase on puroque.com, you may be invited to participate in the Google Customer Reviews programme. Participation is entirely voluntary. If you opt in, your email address will be shared with Google so that Google can send you a post-purchase survey. Google's Privacy Policy governs how Google handles the survey data. Your participation or non-participation does not affect your order in any way.

Google Ads Conversion Tracking

We use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. When you click on a Google Ad and complete a purchase on puroque.com, a cookie is placed on your device to record the conversion. This data is aggregated and does not personally identify you to us. It is used solely for the purpose of measuring advertising performance and improving our ad campaigns.

Google Remarketing

We use Google Remarketing to show our advertisements to users who have previously visited puroque.com when they browse other websites within the Google Display Network or use Google Search. This uses cookies and the Google Ads platform. You can opt out of Google Remarketing at any time by visiting Google's Ad Settings at adssettings.google.com or by using the Google Analytics Opt-Out Browser Add-on.

Google Shopping Product Data

Product listings, prices, descriptions, and images from puroque.com are shared with Google via a product data feed for the purpose of displaying our products on Google Shopping. This feed contains product information only and does not include any customer personal data.