Privacy Policy.

This Privacy Policy (the “Policy”) explains how Hae Hani, having its registered office at 1/9 Doctor's Enclave, Near Water Filter Plant, Idgah Hills, Bhopal, Madhya Pradesh 462001 (“Haehani”, “we”, “us” or “our”), collects, uses, stores, shares and otherwise processes personal data in connection with the Haehani website, its online store and related communications (together, the “Website”).

For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, as and when in force, Haehani acts as the Data Fiduciary in respect of the personal data described in this Policy, and you are the Data Principal. Service providers that process personal data on our behalf act as Data Processors.

This Policy is intended to be read together with the Website’s Returns, Refunds, Replacements and Product-Damage Policy and any other terms displayed at the point of purchase.

This Policy is provided for transparency. It does not, by itself, constitute a representation that any particular legal requirement has been satisfied, and it does not limit any right you have under applicable law.

Orders. We collect the information described in clause 3.2 for every order placed on the Website.

Orders and checkout. When you place an order we collect:

1. (a)your name, email address and phone number;
2. (b)your shipping address, city, state, postal code and country;
3. (c)billing information, where it differs from your shipping details; and
4. (d)order information, including the products, quantities, order value, order status, delivery status and related communications.

Payment-related information. Online payments on the Website are processed by Razorpay, through our store platform’s checkout. Card, UPI, net-banking and similar payment credentials are entered on, and processed by, that payment provider. Haehani receives only limited payment information, such as a transaction reference, payment status, amount and payment method type, and does not store your card details.

Customer support. When you contact us by email, phone, WhatsApp or any other channel, we collect the content of your communication, your contact details and any information, photographs or videos you choose to provide, including in connection with a claim under our Returns, Refunds, Replacements and Product-Damage Policy.

Offer sign-up. When you sign up for our offer or to hear about our next product, your email address or your WhatsApp mobile number, the fact that you agreed to hear from us, and when and where on the Website you signed up.

Reviews. When you write a review, the name you give, your star rating, your review and any photograph you choose to add. Reviews are published on the Website for anyone to read, under the name you give. Please do not put anything in a review, or in its photograph, that you do not want to be public.

Other forms. Any other information you submit through a form on the Website.

Device, browser and IP information. Like most websites, the servers that host the Website may automatically record technical information such as your IP address, browser type and version, device type, operating system, referring page, pages requested and the date and time of access. These records are kept by our hosting provider (Vercel) and our store platform (Shopify) for security, reliability and troubleshooting.

Campaign attribution. Apart from the Meta Pixel (clause 3.10), the Website does not record campaign parameters or referring pages against your personal data. If we begin to, we will update this Policy first.

Meta Pixel. If you accept advertising cookies in our cookie banner, the Website uses the Meta Pixel, code provided by Meta Platforms, Inc. and its affiliates (“Meta”). If you decline, or have not chosen, the Pixel does not load. With your consent, when you load a page, the Pixel sends Meta the address of the page, the time of your visit, your IP address, information about your browser and device, and identifiers stored in cookies (see section 7). It also tells Meta when you view a product, add a product to your cart or go to checkout (which products, how many and their price in rupees), sign up for our offer code (only that you signed up, by WhatsApp or email), or tap a link to email, call or message us. If you are logged in to Facebook or Instagram in the same browser, Meta may link the visit to your account. We use it to count visits to our pages and to measure, improve and target our advertising on Meta’s services. Meta also uses this information for its own purposes, as described in its Privacy Policy (facebook.com/privacy/policy). We do not send Meta your name, email address, phone number, address or payment details through the Pixel on the Website.

At checkout. The checkout, run by Shopify, shares data with Meta through Shopify’s Facebook & Instagram integration, using the Meta Pixel on the checkout pages and Meta’s Conversions API (from Shopify’s servers to Meta). Subject to your cookie choices at checkout, it tells Meta when you start a checkout, add payment information and complete a purchase, with the products, quantities and order value, and, to match the purchase to a Facebook or Instagram account, your name, email address, phone number and address in hashed (scrambled) form, along with identifiers from Meta’s cookies and ad clicks. Card and bank details are never shared with Meta. We use this to measure which of our ads lead to purchases and to show our ads to people likely to be interested; Meta also uses it for its own purposes under its own privacy policy. You can disconnect this information from your Facebook or Instagram account through Meta’s Off-Facebook Activity (Your activity off Meta technologies) settings.

Other analytics. The Website does not use any other analytics service, advertising pixel or session-recording tool. If we introduce one, we will update this Policy before doing so and, where required by applicable law, seek your consent.

Cookies and browser storage. See section 7.

We process personal data only for the following purposes, and only to the extent reasonably necessary for them:

1. (a)processing and fulfilling orders, including confirming, packing and dispatching them;
2. (b)shipping and delivery, including sharing delivery details with logistics providers and providing tracking information;
3. (c)payment processing, including enabling the payment provider to process your payment, and handling refunds;
4. (d)order communications, such as order confirmations, dispatch and delivery updates, and service messages about your order;
5. (e)customer support, including responding to queries and assessing claims about damaged, defective or incorrect products;
6. (f)fraud prevention and security, including detecting and preventing fraudulent orders, abusive claims and misuse of the Website;
7. (g)website functionality, such as keeping your cart and your offer code on your device;
8. (h)publishing reviews you submit, under the name you give;
9. (i)measuring and improving our advertising through the Meta Pixel, as described in clause 3.10;
10. (j)improving the Website and our products, using feedback and aggregated order and support information;
11. (k)marketing communications, only where you have agreed to receive them (see section 8); and
12. (l)legal and regulatory compliance, including tax, accounting, consumer-protection and record-keeping obligations, and responding to lawful requests from authorities.

We will not process your personal data for a purpose that is materially different from those described above without informing you and, where required, obtaining your consent.

Consent. We process personal data you provide on the basis of your consent, given when you submit a form or place an order, for the purposes described at that point and in this Policy.

Legitimate uses. Where applicable law permits processing without consent for certain legitimate uses, including where you have voluntarily provided personal data for a specified purpose, or where processing is necessary to comply with law, we may rely on those grounds.

Withdrawing consent. You may withdraw your consent at any time by writing to haehani.official@gmail.com, or by using any unsubscribe or opt-out option in our messages. Withdrawal is as easy as giving consent. It does not affect processing carried out before withdrawal, and we may continue to process personal data where required or permitted by law (for example, to complete an order already placed or to keep tax records). If you withdraw consent needed to fulfil an order, we may be unable to complete that order.

We do not sell your personal data. We share it only as described below, and only to the extent necessary for the relevant purpose.

Service providers (Data Processors) that act on our instructions, including:

1. (a)payment processors: Razorpay, to process payments and refunds;
2. (b)logistics and shipping providers: Shiprocket, to deliver orders and handle returns we authorise;
3. (c)e-commerce infrastructure and hosting providers: Vercel, to host the Website, and Shopify, to run the store and keep order, customer, sign-up and review records;
4. (d)email and messaging providers: Shopify for email, and WhatsApp (Meta) for WhatsApp messages, to send order messages and, where you agreed, marketing; and
5. (e)professional advisers, such as accountants, auditors and lawyers, under duties of confidentiality.

Advertising. If you accept advertising cookies, through the Meta Pixel and, at checkout, Shopify’s Facebook & Instagram integration, Meta receives the information described in clause 3.10, both to measure our ads for us and for its own purposes under its own privacy policy. We do not share personal data with any other analytics or advertising provider.

The public. Reviews you submit, with the name you give and any photograph, are published on the Website.

Authorities. We may disclose personal data where required by law, court order or a lawful request from a government or regulatory authority, or where reasonably necessary to protect the rights, safety or property of Haehani, our customers or others, including to prevent fraud.

Business transfers. If Haehani’s business or assets are reorganised, merged or transferred, personal data may be transferred as part of that transaction, subject to this Policy and applicable law.

We require our service providers to process personal data only on our instructions and to protect it with reasonable security safeguards.

Advertising cookies. The Website asks for your consent before setting any advertising cookie. If you accept, the Meta Pixel sets cookies in your browser (such as _fbp, and _fbc when you arrive from an ad) that let Meta recognise your browser across visits, for up to 90 days. If you use Facebook or Instagram in the same browser, Meta may also read its own cookies. The Website sets no other cookies for analytics, advertising or tracking.

Browser storage. The Website uses your browser’s local storage, on your device, to remember a reference to your cart (the cart itself is kept by Shopify), your offer code, whether you have signed up, and whether you closed the offer window, so you are not asked again, and your choice about advertising cookies. It uses session storage to remember, for the current visit only, that the offer window was shown. This storage is needed for the cart and the offer to work, and stays on your device until you clear it.

Checkout and payment. The checkout, run by Shopify, and our payment provider, Razorpay, set their own cookies, which are needed for the checkout and payment to work and to prevent fraud. They are described in Shopify’s Cookie Policy and in Razorpay’s privacy policy. The checkout asks separately before setting advertising cookies, including Meta’s (clause 3.10).

Your choices. You can accept or decline advertising cookies in the cookie banner, and change your choice at any time through “Cookie settings” at the foot of every page. If you withdraw consent, the Pixel stops sending information to Meta and its cookies are deleted. You can also block or delete cookies and browser storage in your browser settings, which also empties your cart. You can also control how Meta uses information for ads in your Facebook or Instagram ad preferences, and many browsers and extensions block the Pixel.

Order messages. If you place an order, we will contact you about it, including to confirm its dispatch. These are service messages, not marketing.

Order messages. If you place an order, we will send service messages about that order. These are not marketing.

Marketing. We will send marketing communications only where you have agreed to receive them. You can opt out at any time using the option in the message or by writing to haehani.official@gmail.com.

Offer sign-up. To sign up for our offer on the Website, you tick a box to agree to hear from us. If you give your email address, we record it in our store platform, Shopify, as a customer who has agreed to receive marketing emails. If you give your WhatsApp number, we record it in Shopify as a customer who has agreed to receive WhatsApp messages. We use it to send your offer code, product news and skincare tips. If you sign up to hear about our next product, we record your email address in Shopify in the same way, marked for that list, and use it to tell you when a new product is released, along with other news from time to time. We do not sell it or share it for others’ marketing. You can unsubscribe through the link in any email, ask us on WhatsApp to stop, or ask us to delete your details by writing to haehani.official@gmail.com.

Under the DPDP Act, a “child” is an individual who has not completed eighteen years of age. Where applicable law requires it, we will process a child’s personal data only with verifiable consent of the child’s parent or lawful guardian, and we will not undertake tracking, behavioural monitoring or targeted advertising directed at children.

The Website and our products are intended for adults aged eighteen or over. A person under eighteen may buy from Haehani only through a parent or lawful guardian, who places the Order and provides their own details. We do not knowingly collect personal data from anyone under eighteen. If we learn that we have collected a child’s personal data without the required consent, we will take reasonable steps to delete it.

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, and thereafter only as required or permitted by law. In particular:

1. (a)order, invoice and payment records: for the periods required under applicable tax, accounting and consumer-protection laws;
2. (b)customer-support and claims records: for as long as needed to resolve the matter and any related dispute, and for no longer than three years after the matter is closed, unless the law requires longer; and
3. (c)hosting logs: for the period set by our hosting provider’s configuration, and for no longer than ninety days.

When personal data is no longer required, we will delete it or anonymise it so that it can no longer identify you.

We take reasonable security safeguards, including technical and organisational measures appropriate to the nature of the personal data, to protect it against unauthorised access, disclosure, alteration, loss and personal data breach. These include limiting access to personal data to people who need it, and choosing service providers that maintain appropriate safeguards.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will act as required by applicable law, including notifying the relevant authority and affected individuals where required.

Subject to applicable law, you have the right to:

1. (a)obtain a summary of the personal data we process about you and the processing activities undertaken;
2. (b)obtain the identities of the Data Fiduciaries and Data Processors with whom your personal data has been shared, and a description of the data shared;
3. (c)correct, complete or update inaccurate or incomplete personal data;
4. (d)have your personal data erased where it is no longer necessary for the purpose for which it was processed, unless retention is required by law;
5. (e)withdraw consent (see clause 5.3);
6. (f)have your grievances redressed (see section 14); and
7. (g)nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, write to haehani.official@gmail.com. We may need to verify your identity before acting on a request, and we will respond within the timelines prescribed by applicable law.

If you are not satisfied with our response, you may be entitled to approach the Data Protection Board of India, once constituted and as provided under the DPDP Act, after exhausting our grievance redressal mechanism.

Some of our service providers, including Shopify, Vercel and Meta, store or process personal data outside India. Where that happens, we will do so only in accordance with applicable law, including any restrictions notified by the Government of India, and we will require appropriate safeguards from those providers.

If you have a question, request or complaint about this Policy or how we process your personal data, please contact us. We will acknowledge and address grievances within the timelines prescribed by applicable law.

We may update this Policy from time to time, for example when we add or change a service we use. We will publish the updated Policy on this page with a new effective date and, where the change is material or where required by law, notify you or seek your consent.

This Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and the rules made under it as and when in force, the Information Technology Act, 2000 and the rules made under it (including, to the extent applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), and the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020, each as amended from time to time.

Subject to any mandatory provision of applicable law, courts at Bhopal, Madhya Pradesh shall have jurisdiction over any dispute arising out of this Policy. Nothing in this clause limits your right to approach any authority, forum or body available to you under applicable law.