PrivacyPolicy.

This Privacy Policy (the “Policy”) explains how [LEGAL ENTITY NAME], having its registered office at [REGISTERED ADDRESS] (“Noomi”, “we”, “us” or “our”), collects, uses, stores, shares and otherwise processes personal data in connection with the Noomi website, its online store and related communications (together, the “Website”).

For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, as and when in force, Noomi acts as the Data Fiduciary in respect of the personal data described in this Policy, and you are the Data Principal. Service providers that process personal data on our behalf act as Data Processors.

This Policy is intended to be read together with the Website’s Returns, Refunds, Replacements and Product-Damage Policy and any other terms displayed at the point of purchase.

This Policy is provided for transparency. It does not, by itself, constitute a representation that any particular legal requirement has been satisfied, and it does not limit any right you have under applicable law.

Pre-orders. Orders placed on the Website are currently pre-orders: products are dispatched after launch. We collect the information described in clause 3.2 for a pre-order, as for any order.

Orders and checkout. When you place an order we collect:

1. (a)your name, email address and phone number;
2. (b)your shipping address, city, state, postal code and country;
3. (c)billing information, where it differs from your shipping details; and
4. (d)order information, including the products, quantities, order value, order status, delivery status and related communications.

Payment-related information. Online payments are not yet enabled on the Website. When they are, payments will be processed by [PAYMENT PROVIDER — TBD]. We intend that card, UPI, net-banking and similar payment credentials be entered on, and processed by, that payment provider, and that Noomi receive only limited payment information, such as a transaction reference, payment status, amount and payment method type. This clause will be updated when a provider is integrated.

Customer support. When you contact us by email, phone, WhatsApp or any other channel, we collect the content of your communication, your contact details and any information, photographs or videos you choose to provide, including in connection with a claim under our Returns, Refunds, Replacements and Product-Damage Policy.

Other forms. Any other information you submit through a form on the Website.

Device, browser and IP information. Like most websites, the servers that host the Website may automatically record technical information such as your IP address, browser type and version, device type, operating system, referring page, pages requested and the date and time of access. These records are kept by our hosting provider ([HOSTING PROVIDER — TBD]) for security, reliability and troubleshooting.

Campaign attribution. The Website does not currently record campaign parameters or referring pages against your personal data. If we begin to, we will update this Policy first.

Analytics and website usage. The Website does not currently use any analytics service, advertising pixel or session-recording tool. If we introduce one, we will update this Policy before doing so and, where required by applicable law, seek your consent.

Cookies and browser storage. See section 7.

We process personal data only for the following purposes, and only to the extent reasonably necessary for them:

1. (a)processing and fulfilling orders, including confirming, packing and dispatching them;
2. (b)shipping and delivery, including sharing delivery details with logistics providers and providing tracking information;
3. (c)payment processing, including enabling the payment provider to process your payment, and handling refunds;
4. (d)order communications, such as order confirmations, dispatch and delivery updates, and service messages about your order;
5. (e)customer support, including responding to queries and assessing claims about damaged, defective or incorrect products;
6. (f)pre-order communications, such as confirming your pre-order and telling you its dispatch date;
7. (g)fraud prevention and security, including detecting and preventing fraudulent orders, abusive claims and misuse of the Website;
8. (h)website functionality, such as keeping your cart during your browsing session;
9. (i)analytics, if introduced in future as described in clause 3.8 (none at present);
10. (j)improving the Website and our products, using feedback and aggregated order and support information;
11. (k)marketing communications, only where you have agreed to receive them (see section 8); and
12. (l)legal and regulatory compliance, including tax, accounting, consumer-protection and record-keeping obligations, and responding to lawful requests from authorities.

We will not process your personal data for a purpose that is materially different from those described above without informing you and, where required, obtaining your consent.

Consent. We process personal data you provide on the basis of your consent, given when you submit a form or place an order, for the purposes described at that point and in this Policy.

Legitimate uses. Where applicable law permits processing without consent for certain legitimate uses, including where you have voluntarily provided personal data for a specified purpose, or where processing is necessary to comply with law, we may rely on those grounds.

Withdrawing consent. You may withdraw your consent at any time by writing to [PRIVACY EMAIL], or by using any unsubscribe or opt-out option in our messages. Withdrawal is as easy as giving consent. It does not affect processing carried out before withdrawal, and we may continue to process personal data where required or permitted by law (for example, to complete an order already placed or to keep tax records). If you withdraw consent needed to fulfil an order, we may be unable to complete that order.

We do not sell your personal data. We share it only as described below, and only to the extent necessary for the relevant purpose.

Service providers (Data Processors) that act on our instructions, which as the Website goes live may include:

1. (a)payment processors: [PAYMENT PROVIDER — TBD], to process payments and refunds;
2. (b)logistics and shipping providers: [SHIPPING CARRIER / LOGISTICS PROVIDER — TBD], to deliver orders and handle returns we authorise;
3. (c)e-commerce infrastructure and hosting providers: [HOSTING PROVIDER — TBD] and [ORDER MANAGEMENT / E-COMMERCE PLATFORM — TBD], to run the Website and store order records;
4. (d)email and messaging providers: [EMAIL / WHATSAPP SERVICE PROVIDER — TBD], to send order and pre-order messages; and
5. (e)professional advisers, such as accountants, auditors and lawyers, under duties of confidentiality.

We do not currently share personal data with analytics or advertising providers. If that changes, this Policy will be updated first.

Authorities. We may disclose personal data where required by law, court order or a lawful request from a government or regulatory authority, or where reasonably necessary to protect the rights, safety or property of Noomi, our customers or others, including to prevent fraud.

Business transfers. If Noomi’s business or assets are reorganised, merged or transferred, personal data may be transferred as part of that transaction, subject to this Policy and applicable law.

We require our service providers to process personal data only on our instructions and to protect it with reasonable security safeguards.

Cookies. The Website does not currently set cookies for analytics, advertising or tracking.

Session storage. The Website uses your browser’s session storage to remember the products and quantities in your cart while you browse. This information stays on your device, is not sent to us until you check out, and is deleted by your browser when the browsing session ends. It is strictly necessary for the cart to work.

Third-party services. When a payment provider or other service is integrated, it may set its own cookies, for example for fraud prevention during payment. We will describe these in this Policy when they are introduced.

You can clear browser storage and cookies through your browser settings. Doing so will empty your cart.

Pre-order messages. If you place a pre-order, we will contact you about it, including to confirm its dispatch date. These are service messages, not marketing.

Order messages. If you place an order, we will send service messages about that order. These are not marketing.

Marketing. We will send marketing communications only where you have agreed to receive them. You can opt out at any time using the option in the message or by writing to [PRIVACY EMAIL].

Under the DPDP Act, a “child” is an individual who has not completed eighteen years of age. Where applicable law requires it, we will process a child’s personal data only with verifiable consent of the child’s parent or lawful guardian, and we will not undertake tracking, behavioural monitoring or targeted advertising directed at children.

[POLICY ON USERS UNDER 18, INCLUDING THE PARENTAL-CONSENT MECHANISM — TBD]. Until that mechanism is in place, if you are under eighteen, please do not submit personal data on the Website without your parent or guardian. If we learn that we have collected a child’s personal data without the required consent, we will take reasonable steps to delete it.

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, and thereafter only as required or permitted by law. In particular:

1. (a)order, invoice and payment records: for the periods required under applicable tax, accounting and consumer-protection laws;
2. (b)customer-support and claims records: for as long as needed to resolve the matter and any related dispute, subject to [RETENTION PERIOD — TBD]; and
3. (c)hosting logs: for the period set by our hosting provider’s configuration, subject to [RETENTION PERIOD — TBD].

When personal data is no longer required, we will delete it or anonymise it so that it can no longer identify you.

We take reasonable security safeguards, including technical and organisational measures appropriate to the nature of the personal data, to protect it against unauthorised access, disclosure, alteration, loss and personal data breach. These include limiting access to personal data to people who need it, and choosing service providers that maintain appropriate safeguards.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will act as required by applicable law, including notifying the relevant authority and affected individuals where required.

Subject to applicable law, you have the right to:

1. (a)obtain a summary of the personal data we process about you and the processing activities undertaken;
2. (b)obtain the identities of the Data Fiduciaries and Data Processors with whom your personal data has been shared, and a description of the data shared;
3. (c)correct, complete or update inaccurate or incomplete personal data;
4. (d)have your personal data erased where it is no longer necessary for the purpose for which it was processed, unless retention is required by law;
5. (e)withdraw consent (see clause 5.3);
6. (f)have your grievances redressed (see section 14); and
7. (g)nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, write to [PRIVACY EMAIL]. We may need to verify your identity before acting on a request, and we will respond within the timelines prescribed by applicable law.

If you are not satisfied with our response, you may be entitled to approach the Data Protection Board of India, once constituted and as provided under the DPDP Act, after exhausting our grievance redressal mechanism.

Some of our service providers may store or process personal data outside India. Where that happens, we will do so only in accordance with applicable law, including any restrictions notified by the Government of India, and we will require appropriate safeguards from those providers.

If you have a question, request or complaint about this Policy or how we process your personal data, please contact us. We will acknowledge and address grievances within the timelines prescribed by applicable law.

We may update this Policy from time to time, including when we introduce new services such as payment processing or analytics. We will publish the updated Policy on this page with a new effective date and, where the change is material or where required by law, notify you or seek your consent.

This Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the rules made under it as and when in force, the Information Technology Act, 2000 and the rules made under it (including, to the extent applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), and the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, each as amended from time to time.

Subject to any mandatory provision of applicable law, courts at [JURISDICTION — TBD] shall have jurisdiction over any dispute arising out of this Policy. Nothing in this clause limits your right to approach any authority, forum or body available to you under applicable law.