PRIVACY POLICY

Effective Date: March 4, 2026   |   Last Updated: March 4, 2026

IMPORTANT: This Privacy Policy must be read in conjunction with REVVOGUE's Terms & Conditions of Website Use and Sale ("T&C"). In the event of any conflict between this Policy and the T&C, the T&C shall prevail. Defined terms used but not defined herein have the meanings ascribed to them in the T&C.

1. Purpose, Scope and Subordination

1. This Privacy Policy ("Policy") describes how REVVOGUE collects, receives, processes, stores, uses, discloses, and protects the Personal Data and Sensitive Personal Data of Users and Customers who access the Website or transact with REVVOGUE.
2. This Policy has been prepared in compliance with the following applicable laws and regulations:
   • The Information Technology Act, 2000 ("IT Act"), particularly Sections 43A and 72A;
   • The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), particularly Rules 3 through 8;
   • The Digital Personal Data Protection Act, 2023 ("DPDPA") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), to the extent in force; and
   • The Consumer Protection (E-Commerce) Rules, 2020, to the extent they impose data-related disclosure obligations.
3. This Policy forms an integral part of, and is expressly subordinated to, the T&C. In the event of any inconsistency or conflict between this Policy and the T&C, the T&C shall prevail to the extent of such inconsistency or conflict.
4. By accessing the Website or placing an Order, you acknowledge that you have read and understood this Policy and consent to the collection, processing, and use of your Personal Data as described herein.

2. Identity and Contact Details of the Data Fiduciary

1. For the purposes of the DPDPA and the IT Act, REVVOGUE is the Data Fiduciary — the entity that determines the purpose and means of processing your Personal Data.

2. REVVOGUE has designated a Grievance Officer / Data Protection Contact to handle privacy-related requests and complaints. Contact details are set out in Clause 17 of this Policy.

3. Definitions

"Consent" means a free, specific, informed, unconditional, and unambiguous indication of the Data Principal's agreement to the processing of their Personal Data for a specified purpose, expressed through a clear affirmative act, as required under Section 6 of the DPDPA.

"Data Fiduciary" means REVVOGUE, which determines the purpose and means of processing of Personal Data.

"Data Principal" means the individual to whom the Personal Data relates — in this context, the User or Customer.

"Data Protection Board" means the Data Protection Board of India established under Section 18 of the DPDPA.

"Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined in Section 2(t) of the DPDPA and Rule 2 of the SPDI Rules.

"Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.

"Sensitive Personal Data or Information" ("SPDI") has the meaning assigned under Rule 3 of the SPDI Rules and includes passwords, financial information (bank account, card, payment instrument details), physical or mental health condition, sexual orientation, medical records, and biometric information.

4. Personal Data We Collect — Categories and Details

1. REVVOGUE collects only such Personal Data as is necessary for the purposes described in this Policy (the principle of data minimisation). The categories of Personal Data collected are set out in the table below:

2. REVVOGUE does not collect or process any of the following categories of Personal Data and requests you not to provide such information: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data for uniquely identifying a natural person; or data concerning sexual life or sexual orientation, except to the limited extent voluntarily disclosed by you in a support communication.

5. Sensitive Personal Data or Information (SPDI)

1. Under Rule 3 of the SPDI Rules, financial information constitutes Sensitive Personal Data or Information. REVVOGUE does not directly collect, store, or process payment card numbers, CVV codes, UPI PINs, net banking credentials, or any other sensitive payment instrument data.
2. All payment-related SPDI is collected and processed exclusively by Razorpay Payment Solutions Private Limited, which operates as an independent payment gateway under its own PCI-DSS compliant infrastructure and privacy policy. REVVOGUE receives only a transaction ID, payment status, and payment method type (e.g., card, UPI, net banking) from Razorpay.
3. By completing a payment transaction through the Website, you provide your express consent to Razorpay's collection and processing of your payment SPDI in accordance with Razorpay's privacy policy and applicable law.

4. Passwords (if REVVOGUE implements user accounts): Where REVVOGUE offers user account functionality, passwords are stored in encrypted form using industry-standard hashing algorithms. REVVOGUE does not store or have access to your password in plain text. REVVOGUE staff will never ask you for your account password.

6. How We Collect Your Personal Data

1. REVVOGUE collects Personal Data through the following means:
   
   (a) Directly from you: When you browse the Website, register an account (if applicable), place an Order, complete the checkout process, contact REVVOGUE's customer support or Grievance Officer, submit a review or feedback, or communicate with REVVOGUE through any channel (email, phone, WhatsApp, social media DMs).
   
   (b) Automatically through the Website: Technical and usage data is collected automatically through cookies, web beacons, server logs, and similar tracking technologies when you access and navigate the Website. See Clause 12 for details.
   
   (c) From third parties: REVVOGUE may receive limited data about you from payment gateway providers (transaction status), courier partners (delivery confirmation updates), or social media platforms (if you interact with REVVOGUE's social media accounts or use social login features).
2. REVVOGUE does not purchase, rent, or otherwise acquire Personal Data lists from third-party data brokers or marketing agencies for the purpose of unsolicited marketing.

7. Purposes of Processing and Legal Basis

1. REVVOGUE processes your Personal Data only for specified, explicit, and legitimate purposes. The purposes of processing and the corresponding legal basis under both the DPDPA and the SPDI Rules are set out in the table below:

2. REVVOGUE shall not process your Personal Data for any purpose other than those stated in this Policy without first obtaining your fresh consent or establishing an alternative lawful basis under the DPDPA or the SPDI Rules.

8. Consent — Mechanism, Specificity and Withdrawal

1. Nature of Consent: Where REVVOGUE relies on consent as the legal basis for processing your Personal Data, such consent shall be: free (not coerced or conditioned on acceptance of the T&C beyond what is strictly necessary); specific (linked to a defined purpose); informed (given after you have been provided with this Policy); unconditional (not bundled with consent for unrelated processing); and unambiguous (expressed through a clear affirmative act such as ticking a checkbox or clicking an accept button).
2. Consent at Checkout: By completing the checkout process and placing an Order, you:
   
   (a) Consent to REVVOGUE's collection and processing of your Personal Data (name, contact details, address, Order data) for the purpose of fulfilling your Order, communicating about it, and maintaining records;
   (b) Consent to REVVOGUE's disclosure of your delivery details to its logistics partner for delivery purposes; and
   (c) Consent to Razorpay's collection and processing of your payment data for payment processing purposes.
3. Consent for Marketing: REVVOGUE will not send you promotional or marketing communications without your separate, specific, and freely given consent. Such consent will be sought through a distinct opt-in mechanism (e.g., a separate checkbox at checkout or account registration). Pre-ticked boxes shall not be used for marketing consent.
4. Withdrawal of Consent:
   
   (a) You may withdraw your consent to the processing of your Personal Data at any time by sending a written request to revvogue.business@gmail.com or via WhatsApp at +91 7710857053 / +91 8169357858.
   
   (b) Withdrawal of consent for marketing communications: You may opt out of marketing emails at any time by clicking the 'Unsubscribe' link in any marketing email, or by contacting REVVOGUE directly. Opt-out requests for SMS/WhatsApp marketing may be made by contacting REVVOGUE directly.
   
   (c) Withdrawal of consent for core processing: Withdrawal of consent for the processing necessary to fulfil an existing Order will not affect Orders that are already confirmed and in production. REVVOGUE may not be able to continue providing services to you after consent is withdrawn.
   
   (d) Effect of Withdrawal: Withdrawal of consent does not affect the lawfulness of any processing carried out by REVVOGUE prior to such withdrawal.

9. Disclosure of Personal Data to Third Parties

1. REVVOGUE does not sell, rent, trade, or otherwise commercially exploit your Personal Data to or with any third party.
2. REVVOGUE discloses your Personal Data to third parties only to the extent strictly necessary for the purposes set out in this Policy and only to the recipients identified below:

3. All third-party recipients to whom REVVOGUE discloses Personal Data are required to: (i) process such data only for the purpose for which it was disclosed; (ii) implement reasonable security measures to protect the data; and (iii) not further disclose the data to any other party without REVVOGUE's prior written authorisation.
4. REVVOGUE shall remain accountable to the Data Principal for its disclosures to third parties as required under the DPDPA and the SPDI Rules.

10. Data Transfers — Domestic and Cross-Border

1. Domestic Transfers: All primary processing of Personal Data by REVVOGUE is carried out within India. Third-party service providers engaged by REVVOGUE (Razorpay, fulfilment vendors, courier partners) are predominantly India-based entities operating under Indian law.
2. Cross-Border Transfers: To the extent that any third-party service provider (including analytics or cloud infrastructure providers) processes Personal Data outside India, such transfers shall be made only to such countries or territories as may be notified by the Central Government under Section 16(1) of the DPDPA as permitting transfer of Personal Data, or pursuant to a standard contractual framework as may be prescribed.
3. Analytics and Cloud Services: REVVOGUE may use third-party analytics or cloud hosting services that store data on servers outside India. REVVOGUE shall ensure that appropriate contractual safeguards are in place with such providers.

11. Children's Personal Data

REVVOGUE's Website and Products are intended exclusively for individuals who are eighteen (18) years of age or older. REVVOGUE does not knowingly collect, process, or store Personal Data of children (persons under eighteen years of age).

1. In accordance with Section 9 of the DPDPA, REVVOGUE shall not process the Personal Data of a child without obtaining verifiable consent from the child's parent or lawful guardian.
2. If REVVOGUE becomes aware that it has inadvertently collected Personal Data of a child without appropriate parental consent, it shall: (i) immediately cease processing such data; (ii) delete such data from its systems without undue delay; and (iii) if an Order was placed, cancel the Order and initiate a full refund.
3. If you have reason to believe that a child has provided Personal Data to REVVOGUE without parental consent, please notify REVVOGUE immediately at revvogue.business@gmail.com.
4. REVVOGUE does not profile children and does not direct behavioural advertising at children.

12. Cookies and Tracking Technologies

1. REVVOGUE's Website uses cookies and similar tracking technologies (including web beacons, pixels, and session storage) to enhance user experience, analyse Website usage, and deliver relevant content.
2. Categories of Cookies Used:
   
   (a) Strictly Necessary Cookies: These cookies are essential for the Website to function and cannot be switched off. They include session cookies that maintain your shopping cart and checkout process. These do not require consent.
   
   (b) Performance and Analytics Cookies: These cookies collect anonymised or pseudonymised information about how visitors use the Website. They are used to improve Website performance. These require consent.
   
   (c) Functionality Cookies: These cookies allow the Website to remember your preferences (e.g., language, size selections) to provide a more personalised experience. These require consent.
   
   (d) Marketing and Targeting Cookies: These cookies may be set by REVVOGUE or third-party analytics/advertising partners to build a profile of your interests and display relevant content. REVVOGUE uses these only with your explicit consent.
3. Cookie Consent: When you first access the Website, you will be presented with a cookie consent banner that allows you to accept all cookies, accept only necessary cookies, or customise your preferences. Your consent choices are recorded and honoured.
4. Third-Party Cookies: Third-party services such as analytics providers may set their own cookies. REVVOGUE does not control third-party cookies and recommends reviewing the respective third-party privacy policies.
5. Disabling Cookies: You may disable cookies through your browser settings. Please note that disabling cookies may impact the functionality and performance of the Website. Strictly necessary cookies cannot be disabled through browser settings.

13. Data Retention and Storage Limitation

1. REVVOGUE retains Personal Data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law, whichever is longer. The following retention schedule applies:

2. Upon expiry of the applicable retention period, REVVOGUE shall delete or anonymise your Personal Data in a secure and irreversible manner, unless:
   
   (a) Retention is required to comply with a legal obligation (e.g., statutory audit, court order, regulatory investigation);
   (b) Retention is necessary for the establishment, exercise, or defence of legal claims by or against REVVOGUE; or
   (c) The data has been anonymised such that the individual can no longer be identified, in which case the anonymised data may be retained for analytics or statistical purposes.

14. Security Safeguards

1. REVVOGUE implements reasonable security practices and procedures as required under Section 43A of the IT Act and Rule 8 of the SPDI Rules to protect Personal Data from unauthorised access, disclosure, alteration, loss, or destruction.
2. Security measures in place include, without limitation:
   
   (a) Transmission of Personal Data over the Website via SSL/TLS encryption (HTTPS);
   (b) Access controls restricting access to Personal Data to authorised personnel on a need-to-know basis;
   (c) Password hashing using industry-standard algorithms for any stored account credentials;
   (d) Payment data processed entirely by Razorpay under PCI-DSS certified infrastructure — REVVOGUE does not store sensitive payment data;
   (e) Periodic review of security practices and access controls; and
   (f) Contractual requirements imposed on third-party vendors and processors to maintain appropriate security standards.
3. No method of electronic transmission or storage is completely secure. While REVVOGUE takes commercially reasonable steps to protect your Personal Data, it cannot guarantee absolute security. In the event of a data breach affecting your Personal Data, REVVOGUE shall comply with its notification obligations under Clause 15 of this Policy.

15. Data Breach — Detection, Notification and Response

1. A Personal Data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by REVVOGUE.
2. Upon becoming aware of a Personal Data breach, REVVOGUE shall:
   
   (a) Contain the breach and take immediate remedial steps to prevent further unauthorised access or disclosure;
   (b) Notify the Data Protection Board of India as required under Section 8(6) of the DPDPA and the DPDP Rules, within the prescribed timeframe (currently seventy-two (72) hours under the draft DPDP Rules, subject to final notification);
   (c) Notify affected Data Principals in the manner and within the timeframe prescribed by the Data Protection Board or the DPDP Rules; and
   (d) Conduct an internal assessment of the breach and implement corrective measures to prevent recurrence.
3. The notification to affected Data Principals shall include, to the extent practicable: (i) a description of the nature of the breach; (ii) the categories and approximate number of individuals and records affected; (iii) the likely consequences of the breach; and (iv) the measures taken or proposed to address the breach.
4. REVVOGUE maintains an internal incident response procedure for managing Personal Data breaches. REVVOGUE's obligations under this Clause are subject to such restrictions as may be imposed by law enforcement or regulatory authorities investigating the breach.

16. Rights of Data Principals

1. As a Data Principal, you are entitled to the following rights under the DPDPA. REVVOGUE is committed to facilitating the exercise of these rights in a timely and transparent manner:

2. How to Exercise Your Rights: To exercise any of the rights described above, please submit a written request to REVVOGUE's Grievance Officer / Data Protection Contact as set out in Clause 17, clearly identifying:
   
   (a) Your full name and contact details as registered with REVVOGUE;
   (b) The Order ID(s) or account details relevant to your request (if applicable);
   (c) The specific right you wish to exercise; and
   (d) Any supporting documentation that may be required to verify your identity.
3. REVVOGUE shall respond to your request within a reasonable period, and in any event within the timeframe prescribed under the DPDPA and DPDP Rules. REVVOGUE may ask for additional verification of your identity before processing sensitive requests such as erasure or access.
4. REVVOGUE shall not charge a fee for processing requests to exercise Data Principal rights under the DPDPA, except where a request is manifestly unfounded or excessive, in which case a reasonable fee may be charged.
5. Where REVVOGUE is unable to fully honour a request (for example, where data retention is required by law), REVVOGUE shall inform you of the reason and the extent to which the request can be accommodated.

17. Grievance Redressal and Data Protection Contact

1. REVVOGUE has designated a Grievance Officer who also serves as the Data Protection Contact for the purposes of this Policy, the IT Act, the SPDI Rules, and the DPDPA.

2. Upon receipt of a complaint or privacy-related request, REVVOGUE shall:
   
   (a) Acknowledge receipt of the complaint within forty-eight (48) hours; and
   (b) Communicate the resolution or outcome of the complaint within thirty (30) days of receipt.
3. If you are not satisfied with REVVOGUE's response, you have the right to approach:
   
   (a) The Data Protection Board of India, established under Section 18 of the DPDPA, by making a complaint in the manner prescribed under the DPDPA and DPDP Rules; or
   (b) The appropriate Consumer Disputes Redressal Commission under the Consumer Protection Act, 2019.

18. Links to Third-Party Websites

1. The Website may contain hyperlinks to third-party websites, social media platforms (Instagram, WhatsApp, Facebook, etc.), and other external resources for the User's convenience. REVVOGUE does not operate or control these third-party websites and is not responsible for their content, privacy practices, or terms of use.
2. This Policy applies solely to Personal Data collected by REVVOGUE through the Website. REVVOGUE strongly recommends that you read the privacy policy of any third-party website you visit through a link on the Website before providing any Personal Data to that website.

19. Modifications to This Policy

1. REVVOGUE reserves the right to amend, revise, or update this Policy at any time to reflect changes in law, regulatory requirements, or REVVOGUE's data processing practices.
2. Revised versions of this Policy will be posted on the Website with an updated effective date. Where changes are material, REVVOGUE will take reasonable steps to notify Users and Customers (for example, via email or a prominent Website notice).
3. Your continued use of the Website following the posting of a revised Policy constitutes your acceptance of the revised terms. If you do not agree to the revised Policy, you should cease using the Website.
4. The version of this Policy applicable to any Order shall be the version in effect at the time of Order placement.

20. Governing Law

1. This Policy shall be governed by and construed in accordance with the laws of India, including without limitation the IT Act, the SPDI Rules, and the DPDPA.
2. Any disputes arising out of or in connection with this Policy shall be subject to the jurisdiction provisions set out in Clause 19 of the T&C, subject to the Data Principal's right to approach the Data Protection Board of India and the appropriate consumer forum.

21. Contact

For all privacy-related queries, requests, or notices:

Schedule A — Legal Framework Reference Table

The following table summarises the primary legal provisions applicable to REVVOGUE's data processing activities for quick internal reference: