Privacy Policy

1. Who We Are

Wristsy (wristsy.studio) is a luxury watch retailer based in Indore, Madhya Pradesh, India. For the purposes of this Policy, Wristsy is the "Data Fiduciary" (controller) of your personal data.

Contact our Data Protection Officer: [email protected]

2. Data We Collect

2.1 Information You Provide

• Identity data: Full name, date of birth (if provided)
• Contact data: Email address, phone number, postal address
• Transaction data: Order history, product preferences, payment method (not card numbers)
• Communication data: Messages, emails, and enquiries sent to us

2.2 Automatically Collected Data

• Technical data: IP address, browser type, device type, operating system
• Usage data: Pages visited, time spent, clicks, referral source
• Cookie data: Session cookies, preference cookies (see Section 8)

2.3 Payment Data

Payment transactions are processed by Cashfree Payments (a PCI-DSS compliant payment processor). We do not store your card number, CVV, or banking credentials. We only receive a transaction reference ID and status.

3. How We Use Your Data

We process your personal data under the following lawful bases:

• Contract performance: Processing orders, arranging delivery, handling returns and refunds
• Legitimate interests: Fraud prevention, website security, customer analytics
• Consent: Marketing emails (only if you opt in); you may withdraw consent at any time
• Legal obligation: Maintaining GST records, complying with law enforcement requests

4. Data Sharing

We do not sell your personal data. We share it only with:

• Cashfree Payments – payment processing
• Logistics partners (BlueDart, Delhivery, FedEx) – delivery and tracking
• Email service providers – transactional and marketing emails
• Analytics providers – anonymised website usage data
• Legal authorities – when required by law or court order

All third-party processors are contractually bound to protect your data and use it only as instructed by us.

5. Data Retention

We retain your data for as long as necessary to fulfil the purpose for which it was collected:

• Order and transaction records: 7 years (GST compliance)
• Marketing preferences: Until you unsubscribe or request deletion
• Customer support records: 3 years from last contact
• Technical/log data: 90 days

6. Your Rights (DPDPA 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access – obtain a summary of your personal data we process
• Correction – request correction of inaccurate or incomplete data
• Erasure – request deletion of your data (subject to legal retention requirements)
• Grievance redressal – raise a complaint with our DPO
• Nominate – designate a person to exercise rights on your behalf

To exercise any right, email [email protected] from your registered email. We will respond within 30 days.

7. Data Security

We implement industry-standard security measures including:

• 256-bit SSL/TLS encryption for all data in transit
• Encrypted database storage for personal information
• Access controls limiting data to authorised personnel only
• Regular security audits and vulnerability assessments
• Two-factor authentication for administrative access

Despite these measures, no internet transmission is 100% secure. In the event of a data breach that risks your rights, we will notify you as required by applicable law.

8. Cookies

We use cookies to:

• Essential cookies: Maintain your shopping cart and session (cannot be disabled)
• Analytics cookies: Understand how visitors use our site (Google Analytics, anonymised)
• Preference cookies: Remember your language and display preferences

You can control non-essential cookies through your browser settings. Disabling cookies may affect website functionality.

9. Children's Privacy

Our services are not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, please contact us immediately and we will delete it.

10. Cross-Border Transfers

Your data is primarily stored and processed in India. Some of our third-party service providers (such as analytics tools) may process data in other jurisdictions. Where this occurs, we ensure adequate safeguards are in place consistent with DPDPA requirements.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated by email (for registered customers) and a notice on our website for 30 days before they take effect.

12. Grievance Officer