Privacy Policy

This policy explains how Vasana Retail Private Limited collects, uses, stores, shares, and protects your personal data when you use the Vasana website, app, and related services (the “Platform”). It applies to you as a visitor, guest, or registered consumer. If you are a brand partner, the Vendor Privacy Policy applies to you instead.

By using the Platform, you acknowledge this policy. Where your consent is required by law — such as for non-essential cookies — we ask for it separately, as described below.

Who We Are

Vasana Retail Private Limited is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) for the personal data described in this policy. This means we determine why and how your personal data is processed.

Registered office:54/55, Surya Apartments, Fraser Road, Maurya Lok Complex, Jamal Road, Patna – 800 001, Bihar, India.

Contact for data protection matters: info@vasanaindia.com

What Data We Collect

Identity and account data: Your email address when you sign in, and your name — either as you give it to us or, if you continue with Google, as Google provides it along with your profile picture. Your email address is your account identifier. We ask for a mobile number when you add a delivery address, so that you and our courier can reach each other about an order. We do not collect your date of birth.

Order and transaction data: Delivery address, order history, items purchased, payment status, and related transaction details. We do not store your full card or payment instrument details — when online payment becomes available these will be handled by a regulated payment gateway, never stored by us.

Refund and banking data: If you pay by Cash on Delivery and later become entitled to a refund, we ask you for the bank account details needed to pay you back — account holder name, account number, and IFSC code. We collect this only when a refund is actually due to you, we use it only to pay that refund, and we never use it to take money from your account. If you pay online, refunds go back to your original payment method and we do not need these details at all.

Preference and behavioural data: Your browsing activity, items viewed and saved, search queries, and responses to our preference mapper, used to personalise your experience and recommendations.

Communication data: Messages you send through Customer Support, and any correspondence with us.

Technical data:IP address, device type, browser information, and cookies — collected automatically when you visit the Platform. See “Cookies” below.

Why We Use Your Data

Under the DPDP Act 2023, we process personal data with your consent, or for a legitimate use the Act allows, such as personal data you have given us voluntarily for a stated purpose, or where a law requires us to keep or disclose it. After each purpose we say why we need the data.

To fulfil your orders: processing payment, sharing the minimum necessary delivery details with the relevant Brand Partner and our logistics partner, and providing order tracking and support. Why: we need it to fulfil the order you placed.

To personalise your experience: using your preferences and behaviour to recommend products and tailor what you see on the Platform. Legal basis: your consent, which you may withdraw at any time without affecting your ability to browse or purchase.

To provide customer support: responding to your queries, complaints, and grievances. Why: we need it to answer you and to meet our grievance duties.

To keep the Platform safe:detecting fraud, preventing misuse, and enforcing our Terms & Conditions. Why: to keep the Platform and its users safe.

To comply with the law: maintaining records required under income-tax law, GST law, the Consumer Protection Act 2019, and the Consumer Protection (E-Commerce) Rules 2020. Why: the law requires it.

To send you communications: order updates and transactional messages always; marketing communications only if you have opted in, and you may opt out at any time. Why: transactional messages are needed to fulfil your order; marketing is sent only with your consent.

We do not sell your personal data to any third party.

Cookies

We use cookies to operate the Platform.

Essential cookies — session management, security, and fraud prevention — are placed whenever you use the Platform. They keep you signed in, hold your cart, and protect checkout. The Platform cannot work without them, and they do nothing else. Under the DPDP Act these do not require your consent, because they do nothing except make the service you asked for work.

There is no cookie banner on the Platform today, and no cookie choice for you to make. We do not ask you to accept or reject cookies, and nothing you can do on the site depends on your having done so.

If that changes, we will ask you first. Before we place any cookie that is not essential — including anything that measures how the storefront is used — we will ask for your agreement in plain words, with refusing exactly as easy as agreeing, and we will not place it unless you say yes. Nothing about your ability to browse, order, or sign in will depend on your answer. We will update this policy and our Cookies page at the same time.

You can delete or block cookies at any time through your browser settings. Blocking essential cookies will stop parts of the Platform from working.

A full breakdown of what we currently use — and what we don’t — is on our Cookies page.

Children’s Data

Browsing the Platform is open to everyone. An account — which you need in order to place an order — is restricted to users aged 18 and above. We do not collect a date of birth; we rely on the confirmation you give when you sign in, as set out in our Terms & Conditions.

If we identify that an account belongs to someone under 18, we will suspend the account, stop all processing of that person’s data, and delete it. Because placing an order requires an account, ordering on the Platform is limited to adults. Browsing remains open to everyone. The Platform is not directed at people under 18, and we ask that they do not use it.This approach is designed to meet the children’s data protections in Section 9 of the DPDP Act.

Who We Share Your Data With

We share your data only where necessary, and only with these categories of recipients:

Brand Partners — strictly for order fulfilment. When you order a product, we share only your name, delivery address, and phone number with the relevant Brand Partner, solely so they can prepare and dispatch your order. Brand Partners are contractually bound to use this data only for that purpose, never to contact you directly for marketing, and never to share or sell it. They must delete it once it is no longer needed for fulfilment, subject to their own statutory record-keeping obligations.

Logistics partners: your name, delivery address and phone number are shared with our logistics partner and the courier assigned to your shipment, solely to deliver your order and to collect payment from you if you chose Cash on Delivery. Our logistics partner is Shiprocket, and delivery addresses for dispatched orders are shared with them.

Payment processors:your payment details are handled by a regulated payment gateway, not by us — we never store full card or payment-instrument data. Online payment is live on this site. When you pay online, your card, UPI or wallet details go directly to the gateway; we receive only the result of the payment and an identifier for it. Where you pay by Cash on Delivery, the courier collects payment on our behalf and no card or bank data is involved in that collection.

Legal and regulatory authorities: where required by law, legal process, or government request.

Professional advisors: our legal, accounting, and audit advisors, under confidentiality obligations.

Service providers: hosting, cloud storage, and communications providers who process data on our behalf, under contractual data-protection obligations.

We do not share your personal data with other consumers, and we do not sell it to anyone.

Vasana Spotlight

Vasana Spotlight is an analytics service we offer to Brand Partners. It provides aggregated category and engagement analytics — never information about you individually.

• Spotlight is built only on anonymised, aggregated data. The anonymisation process is designed to be irreversible, and no individual consumer can be identified from it.
• We enforce a minimum group size before any data segment can be shared. If a segment is too small to rule out identifying an individual, it is suppressed entirely rather than shared.
• No Brand Partner can request information about you specifically through Spotlight, and Spotlight data is never segmented in a way that could identify you, even indirectly.
• Spotlight does not change anything about how your individually identifiable data is handled — that continues to be governed by this Privacy Policy in full.

Data Security

We use access controls, encryption in transit and at rest, and periodic security testing to protect your data. We maintain a documented incident response process and will notify you without undue delay if a breach affects your personal data. No system is completely secure, and we cannot guarantee absolute security — please also keep your own account credentials confidential.

Data Retention

We keep your data only as long as necessary, or as required by law.

When a retention period expires, we delete the data or irreversibly anonymise it. Anonymised data may be retained indefinitely, as it is no longer personal data.

Your Rights Under the DPDP Act, 2023

Right to information (Section 11): You can ask for a summary of the personal data we hold about you, why we process it, and who we have shared it with. Write to info@vasanaindia.com — we respond within 30 days.

Right to correction and erasure (Section 12): You can ask us to correct inaccurate data or delete data we no longer need, by writing to info@vasanaindia.com. We cannot delete data we are legally required to retain, such as 8-year financial records.

Right to grievance redressal (Section 13): If you are not satisfied with our response, contact our Grievance Officer (below). If you remain unsatisfied, you may complain to the Data Protection Board of India.

Right to nominate (Section 14): You may nominate someone to exercise your data rights on your behalf if you pass away or become incapacitated, by writing to info@vasanaindia.com.

Right to withdraw consent: Where we rely on your consent — for example, for personalisation, or for marketing communications you have opted into — you can withdraw it at any time by writing to info@vasanaindia.com, and we will act on it. Where we give you a control on the site for a particular consent, you can use that instead, and we will tell you where it is at the moment we ask you. Withdrawing consent does not affect your ability to browse and purchase on the Platform, and does not affect processing we already carried out before withdrawal.

We will never deny you access to the Platform for exercising your data rights.

Data Breach Notification

If a breach affects your personal data, we will notify you without undue delay, describing what happened, what data was affected, and what we are doing about it. We will also notify the Data Protection Board of India without delay, and give it a detailed report within 72 hours of becoming aware of the breach, as Rule 7 of the DPDP Rules 2025 provides.

Cross-Border Data Transfers

Vasana is an Indian company and your data is handled under Indian law. Some of the infrastructure we use to store and process it is located outside India:

• Our database— which holds your account, orders, addresses and contact details — is hosted in Singapore.
• Our analytics provider, which only receives data if you have consented to analytics, processes it in the European Union.
• Product and review images are served from a global content-delivery network.

We do not transfer personal data to any country or territory to which the Central Government has restricted transfers by notification under section 16 of the DPDP Act 2023, and these transfers are made with contractual safeguards in place. We do not sell or transfer your personal data to anyone else outside India.

Changes to This Policy

We may update this policy from time to time. For material changes — such as new categories of data collected or new purposes of processing — we will notify you via a website banner or registered email at least 30 days before they take effect. For minor or clarifying changes, we will update the “Last updated” date without separate notice. The current version is always available at vasanaindia.com/legal/privacy-policy.

Grievance Officer

Name: Aayush Raj
Designation: Grievance Officer, Vasana Retail Private Limited
Email: info@vasanaindia.com
Phone: +91 82920 80657

We acknowledge your grievance within 48 hours and resolve it within 30 days. If you remain unsatisfied, you may approach the Data Protection Board of India.

Contact Us

Email: info@vasanaindia.com
Phone: +91 82920 80657

Vasana Retail Private Limited
54/55, Surya Apartments, Fraser Road
Maurya Lok Complex, Jamal Road
Patna – 800 001, Bihar, India