Privacy Policy

1. Introduction and Consent

Welcome to Maheera Jewels (“we”, “us”, “our”, or “Data Fiduciary”). This Privacy Policy describes how we collect, process, store, disclose, and safeguard the personal data of visitors and clients (“you”, “your”, or “Data Principal”) when you browse our digital showcase, interact with our online jewellery catalogue, submit bespoke enquiries, or visit our atelier.

This policy is formulated in compliance with the Information Technology Act, 2000; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules); the Digital Personal Data Protection Act, 2023 (DPDP Act); and the Consumer Protection (E-Commerce) Rules, 2020.

By accessing our Website, submitting enquiry or consultation forms, communicating with our WhatsApp concierge, or sharing your credentials, you acknowledge that you have read, understood, and voluntarily agree to the collection and processing of your personal data as described herein.

2. Who We Are (Data Fiduciary)

Under applicable Indian privacy jurisprudence, the Data Fiduciary responsible for deciding the purpose and means of processing your personal data is:

3. Data We Collect

We collect information through three primary avenues:

• Information You Provide Directly: Full name, telephone/WhatsApp mobile number, email address, postal delivery address, bespoke design preferences, ring sizing, budget expectations, and communication records submitted via our consultation or enquiry portals.
• Statutory KYC & Tax Records: Where required by Indian statutory mandates (e.g., Prevention of Money Laundering Act, 2002 and Income Tax regulations for high-value precious metal transactions above designated thresholds), we may request government identification such as PAN card details or official address verification.
• Automatically Collected Technical Data: Internet Protocol (IP) address, browser type and version, device identifier, operating system, pages visited, time spent, and referral URLs collected via automated server logs and performance cookies.
• Third-Party and Referral Information: Information received if you interact with our social channels (Instagram, Facebook), certified diamond verification databases (e.g., GIA/IGI verification portals), or messaging APIs.

4. Purposes of Use

Your personal data is collected and processed exclusively for lawful, specified purposes:

• Facilitating one-on-one bridal and custom fine jewellery design consultations;
• Responding to catalogue product enquiries, stock availability requests, and price quotations;
• Coordinating appointments, studio visits, and concierge consultations;
• Fulfilling orders, managing secure transit, insured courier dispatches, and in-person collections;
• Issuing hallmarking authentication cards, diamond grading reports, and GST-compliant tax invoices;
• Complying with statutory accounting, anti-money laundering (AML), and taxation disclosures;
• Maintaining digital platform integrity, troubleshooting system performance, and preventing fraudulent enquiries.

5. Legal Basis and Consent (Withdrawal Rights)

Our legal bases for processing personal data under the DPDP Act, 2023 and the SPDI Rules, 2011 include:

• Express Consent: Freely given, specific, informed, and unambiguous consent provided when submitting forms or opting in to communications.
• Certain Legitimate Uses: Fulfilling requested custom quotes, servicing scheduled consultations, or addressing user-initiated service requests.
• Legal & Regulatory Obligations: Mandated compliance under the Indian Companies Act, Central Goods and Services Tax (CGST) Act, Income Tax Act, 1961, and Prevention of Money Laundering Act (PMLA).

Right to Withdraw Consent: You have the absolute right to withdraw your consent at any time. Withdrawal can be exercised by emailing our Grievance Officer at maheeradiamonds@gmail.com with the subject line “Withdrawal of Consent”. Upon receiving your withdrawal request, we will stop processing your data, except where retention is strictly required by statutory tax or legal record-keeping mandates.

6. Sharing with Third Parties

We do not sell, rent, trade, or commercialize your personal information to third-party data brokers or advertisers. Data is shared strictly on a confidential need-to-know basis with trusted partners:

• Courier & Valuables Logistics Providers: Specialized, insured courier partners (such as BVC Logistics, Sequel Logistics, or speed couriers) solely to safely deliver jewellery shipments to your designated address;
• Gemological Certification Laboratories: GIA, IGI, or authorized gem testing facilities for certificate verification and stone registry matching;
• Banking & Payment Processing Entities: RBI-authorized payment gateways, banking channels, and POS terminal operators for processing invoices and transactions;
• Technology & Infrastructure Providers: Secure cloud hosting, encrypted database providers, and messaging API infrastructure (such as WhatsApp Business API);
• Government & Law Enforcement Authorities: Authorized judicial, regulatory, police, or tax authorities when mandated under applicable Indian law, court summons, or statutory audits.

7. Transfers of Personal Data Outside India

Your personal data is predominantly processed and stored within India. In instances where our cloud hosting providers, database servers, or communication infrastructure operate global nodes, such transfers comply strictly with Section 16 of the Digital Personal Data Protection Act, 2023 and any notifications issued by the Central Government regarding cross-border data flows, ensuring comparable security and contractual protections.

8. Cookies and Tracking Technologies

Our Website utilizes basic cookies and tracking technologies to optimize performance and usability:

• Essential / Strictly Necessary Cookies: Required for fundamental website navigation, security authentication, and session persistence;
• Analytics / Performance Cookies: Anonymous aggregated metrics that help us evaluate page load times and user journeys to refine our design showcase;
• Functional Cookies: Remember your device preferences and consultation session details.

You can control or disable cookies through your internet browser settings. However, disabling essential cookies may impact certain interactive features of our catalogue showcase.

9. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is mandated or permitted by law:

• General Enquiries & Consultations: Retained for up to twenty-four (24) months from your last interaction, unless earlier deletion is requested;
• Sales, Invoicing & Tax Records: Retained for a minimum of eight (8) consecutive financial years to satisfy mandatory requirements under the Income Tax Act, 1961 and GST regulations;
• Statutory KYC Records: Retained for a minimum of five (5) years following the conclusion of the transaction in accordance with Prevention of Money Laundering (Maintenance of Records) Rules.

10. User Rights (Data Principal Rights)

As a Data Principal under the Digital Personal Data Protection Act, 2023, you enjoy statutory rights including:

• Right to Access: Request a summary of your personal data being processed and identities of Data Fiduciaries/Processors with whom data has been shared;
• Right to Correction & Updating: Request correction of inaccurate or incomplete personal data;
• Right to Erasure: Request the deletion of your personal data where continuing retention is no longer necessary for legal or specified purposes;
• Right to Grievance Redressal: Avail prompt grievance redressal through our designated Grievance Officer;
• Right to Nominate: Nominate an individual to exercise your rights under the DPDP Act in the event of death or incapacity.

To exercise any of these rights, email your request with verifiable proof of identity to maheeradiamonds@gmail.com.

11. Security Measures and Breach Notification

We implement reasonable security practices and procedures as mandated under Section 43A of the IT Act, 2000 and the SPDI Rules, 2011. These include HTTPS SSL 256-bit encryption for transit, role-based access limitations, hardened database infrastructure, and internal confidentiality protocols.

While we enforce rigorous protective measures, no electronic storage or transmission over the internet is completely infallible. In the unlikely event of a personal data security breach affecting your rights, we will notify the Data Protection Board of India and affected Data Principals in accordance with statutory guidelines prescribed under the DPDP Act, 2023.

12. Children’s Privacy (18+ Only)

Our website and fine jewellery services are directed exclusively at individuals who are at least eighteen (18) years of age. We do not knowingly solicit, collect, or process personal data from minors. In strict adherence to Section 9 of the DPDP Act, 2023, we do not undertake tracking, behavioral monitoring, or targeted marketing directed at children. If you believe a minor has provided us with personal data, please contact us immediately to facilitate prompt deletion.

13. Grievance Redressal Mechanism

In accordance with Rule 5(9) of the SPDI Rules, 2011, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, 2023, our designated Grievance Officer is:

Response Timelines: In accordance with the Consumer Protection (E-Commerce) Rules, 2020, we will acknowledge receipt of your grievance within forty-eight (48) hours and resolve the grievance within one (1) month from the date of receipt.

14. External Third-Party Links

Our website may contain hyperlinks to external services, including Google Maps (for store location directions), Instagram, Facebook, and laboratory certificate verification databases. We are not responsible for the privacy practices, content, or security standards of third-party platforms. We advise you to review their respective privacy policies upon navigating away from our domain.

15. Amendments and Updates

We reserve the right to revise or update this Privacy Policy periodically to reflect changes in our operational procedures, technological advancements, or legislative updates. Any modifications will be posted directly to this page with an updated “Last Updated” date. We encourage regular review to stay informed about our data protection standards.

16. Governing Law and Jurisdiction

This Privacy Policy, along with any dispute, controversy, or claim arising out of or related to your personal data, shall be governed by and interpreted in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Subject to statutory rights under the DPDP Act, the courts located in Pune, Maharashtra, India shall have exclusive jurisdiction.

17. Contact Details

For general privacy questions, clarifications on jewellery orders, or bespoke commission enquiries, please reach out to: