Privacy Policy
Last updated: July 2026
This policy explains how Vasana Retail Private Limited collects, uses, stores, shares, and protects your personal data when you use the Vasana website, app, and related services (the “Platform”). It applies to you as a visitor, guest, or registered consumer. If you are a brand partner, the Vendor Privacy Policy applies to you instead.
By using the Platform, you acknowledge this policy. Where your consent is required by law — such as for non-essential cookies — we ask for it separately, as described below.
Who We Are
Vasana Retail Private Limited is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) for the personal data described in this policy. This means we determine why and how your personal data is processed.
Registered office:54/55, Surya Apartments, Fraser Road, Maurya Lok Complex, Jamal Road, Patna – 800 001, Bihar, India.
Contact for data protection matters: info@vasanaindia.com
What Data We Collect
Identity and account data: Your name, email address, and mobile number when you register. Your mobile number is your primary identifier. We do not collect your date of birth.
Order and transaction data: Delivery address, order history, items purchased, payment status, and related transaction details. We do not store your full card or payment instrument details — these are handled by our payment processing partners.
Refund and banking data: If you pay by Cash on Delivery and later become entitled to a refund, we ask you for the bank account details needed to pay you back — account holder name, account number, and IFSC code. We collect this only when a refund is actually due to you, we use it only to pay that refund, and we never use it to take money from your account. If you pay online, refunds go back to your original payment method and we do not need these details at all.
Preference and behavioural data: Your browsing activity, items viewed and saved, search queries, and responses to our preference mapper, used to personalise your experience and recommendations.
Communication data: Messages you send through Customer Support, and any correspondence with us.
Technical data:IP address, device type, browser information, and cookies — collected automatically when you visit the Platform. See “Cookies” below.
Why We Use Your Data
To fulfil your orders: processing payment, sharing the minimum necessary delivery details with the relevant Brand Partner and our logistics partner, and providing order tracking and support. Legal basis: necessary to perform your purchase contract.
To personalise your experience: using your preferences and behaviour to recommend products and tailor what you see on the Platform. Legal basis: your consent, which you may withdraw at any time without affecting your ability to browse or purchase.
To provide customer support: responding to your queries, complaints, and grievances. Legal basis: necessary to perform our agreement with you / legitimate interest.
To keep the Platform safe:detecting fraud, preventing misuse, and enforcing our Terms & Conditions. Legal basis: legitimate interest.
To comply with the law: maintaining records required under the Income Tax Act, GST law, the Consumer Protection Act 2019, and the Consumer Protection (E-Commerce) Rules 2020. Legal basis: legal obligation.
To send you communications: order updates and transactional messages always; marketing communications only if you have opted in, and you may opt out at any time. Legal basis: contract performance for transactional messages; consent for marketing.
We do not sell your personal data to any third party.
Cookies
We use cookies and similar technologies to operate the Platform and, with your consent, to personalise your experience.
Essential cookies (session management, security, fraud prevention) are placed regardless of your choice — the Platform cannot function without them.
Analytics and marketing cookies are placed only if you click Accept on the cookie banner. If you click Reject, these are not placed. You can change your choice at any time through your browser or account settings.
A full breakdown of what we currently use — and what we don’t — is on our Cookies page.
Children’s Data
The Platform — browsing and guest checkout — is open to everyone. Account registration is restricted to users aged 18 and above. We do not collect a date of birth; we rely on self-certification at registration, as set out in our Terms & Conditions.
If we identify that a registered account belongs to someone under 18, we will suspend the account, stop all processing of that person’s data, and delete it. This approach is designed to meet the children’s data protections in Section 9 of the DPDP Act without restricting access to browsing or purchasing for anyone.
Who We Share Your Data With
We share your data only where necessary, and only with these categories of recipients:
Brand Partners — strictly for order fulfilment. When you order a product, we share only your name, delivery address, and phone number with the relevant Brand Partner, solely so they can prepare and dispatch your order. Brand Partners are contractually bound to use this data only for that purpose, never to contact you directly for marketing, and never to share or sell it. They must delete it once it is no longer needed for fulfilment, subject to their own statutory record-keeping obligations.
Logistics partners: your name, delivery address, and phone number, to enable pickup and delivery. We use Shiprocket as our logistics aggregation partner; Shiprocket and the courier assigned to your shipment receive these details solely to deliver your order and to collect payment from you if you chose Cash on Delivery.
Payment processors: your payment details, to process your transaction. We do not store full payment instrument data ourselves. Where you pay by Cash on Delivery, the courier collects payment on our behalf and no card or bank data is involved in that collection.
Legal and regulatory authorities: where required by law, legal process, or government request.
Professional advisors: our legal, accounting, and audit advisors, under confidentiality obligations.
Service providers: hosting, cloud storage, and communications providers who process data on our behalf, under contractual data-protection obligations.
We do not share your personal data with other consumers, and we do not sell it to anyone.
Vasana Spotlight
Vasana Spotlight is an analytics service we offer to Brand Partners. It provides aggregated category and engagement analytics — never information about you individually.
- Spotlight is built only on anonymised, aggregated data. The anonymisation process is designed to be irreversible, and no individual consumer can be identified from it.
- We enforce a minimum group size before any data segment can be shared. If a segment is too small to rule out identifying an individual, it is suppressed entirely rather than shared.
- No Brand Partner can request information about you specifically through Spotlight, and Spotlight data is never segmented in a way that could identify you, even indirectly.
- Spotlight does not change anything about how your individually identifiable data is handled — that continues to be governed by this Privacy Policy in full.
Data Security
We use access controls, encryption in transit and at rest, and periodic security testing to protect your data. We maintain a documented incident response process and will notify you without undue delay if a breach affects your personal data. No system is completely secure, and we cannot guarantee absolute security — please also keep your own account credentials confidential.
Data Retention
We keep your data only as long as necessary, or as required by law.
| Data Category | Retention Period | Why |
|---|---|---|
| Account data | While your account is active, plus up to 2 years of inactivity before deletion | Industry-standard inactive-account practice |
| Order and transaction records | 8 years from the transaction date | Income Tax Act, 1961; GST law |
| Refund banking details (COD refunds only) | Deleted once the refund has settled and the 90-day dispute window has closed, unless a statutory record requires otherwise | Collected for one purpose only — paying you back — and not kept beyond it |
| Consent and cookie records | 8 years from the date of consent | Evidence of lawful processing |
| Customer support communications | 3 years from the date of the communication (longer if linked to an active dispute) | Dispute resolution; service quality |
| Technical and security logs | 1 year from generation (longer if linked to a security investigation) | Platform security |
When a retention period expires, we delete the data or irreversibly anonymise it. Anonymised data may be retained indefinitely, as it is no longer personal data.
Your Rights Under the DPDP Act, 2023
Right to information (Section 11): You can ask for a summary of the personal data we hold about you, why we process it, and who we have shared it with. Write to info@vasanaindia.com — we respond within 30 days.
Right to correction and erasure (Section 12): You can ask us to correct inaccurate data or delete data we no longer need, by writing to info@vasanaindia.com. We cannot delete data we are legally required to retain, such as 8-year financial records.
Right to grievance redressal (Section 13): If you are not satisfied with our response, contact our Grievance Officer (below). If you remain unsatisfied, you may complain to the Data Protection Board of India.
Right to nominate (Section 14): You may nominate someone to exercise your data rights on your behalf if you pass away or become incapacitated, by writing to info@vasanaindia.com.
Right to withdraw consent: Where we rely on your consent (such as for personalisation or marketing cookies), you can withdraw it at any time at info@vasanaindia.com or through your account settings. Withdrawing consent does not affect your ability to browse and purchase on the Platform, and does not affect processing we already carried out before withdrawal.
We will never deny you access to the Platform for exercising your data rights.
Data Breach Notification
If a breach affects your personal data, we will notify you without undue delay, describing what happened, what data was affected, and what we are doing about it. We will also notify the Data Protection Board of India within 72 hours of becoming aware of the breach, as required under the DPDP Rules 2025.
Cross-Border Data Transfers
We store and process your data in India. We do not transfer your personal data outside India except where necessary for specific services (such as cloud hosting), and only to countries permitted under the DPDP Act 2023 and any government notification, with contractual safeguards in place.
Changes to This Policy
We may update this policy from time to time. For material changes — such as new categories of data collected or new purposes of processing — we will notify you via a website banner or registered email at least 30 days before they take effect. For minor or clarifying changes, we will update the “Last updated” date without separate notice. The current version is always available at vasanaindia.com/legal/privacy-policy.
Grievance Officer
Name: Aayush Raj
Designation: Grievance Officer, Vasana Retail Private Limited
Email: info@vasanaindia.com
Phone: +91 82920 80657
We acknowledge your grievance within 48 hours and aim to resolve it within 90 days. If you remain unsatisfied, you may approach the Data Protection Board of India.
Contact Us
Email: info@vasanaindia.com
Phone: +91 82920 80657
Vasana Retail Private Limited
54/55, Surya Apartments, Fraser Road
Maurya Lok Complex, Jamal Road
Patna – 800 001, Bihar, India
Questions? Email info@vasanaindia.com · Contact us