Privacy Policy

This Privacy Policy ("Policy") describes how Hide Lifestyle ("Company", "we", "our", or "us"), operating the e-commerce website www.hidelifestyle.in ("Website" or "Platform"), collects, receives, possesses, stores, deals in, handles, and transfers personal information and sensitive personal data or information ("SPDI") of its users ("User", "you", or "your") in connection with the use of the Website and the purchase of products.

This Policy is published in compliance with the following applicable laws of India:

• The Information Technology Act, 2000 ("IT Act")
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
• The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020
• The Digital Personal Data Protection Act, 2023 ("DPDPA"), to the extent notified and in force
• The Indian Contract Act, 1872

By accessing or using this Website, you confirm that you have read, understood, and agreed to this Policy. If you disagree with any part of this Policy, please discontinue use of the Website immediately.

• Personal Data: Any data about an individual who is identifiable by or in relation to such data, directly or indirectly.
• Sensitive Personal Data or Information (SPDI): Includes passwords; financial information such as bank account, credit or debit card details; physical, physiological, and mental health conditions; biometric information; and any detail relating to the above provided to the Company for processing under a lawful contract.
• Data Principal: The User whose personal data is collected and processed.
• Data Fiduciary: Hide Lifestyle, which determines the purpose and means of processing personal data.
• Data Processor: Any person who processes personal data on behalf of Hide Lifestyle, including our third-party service providers.
• Processing: Any operation performed on personal data, including collection, recording, storage, alteration, retrieval, use, disclosure, transfer, and erasure.
• Consent: Free, specific, informed, unconditional, and unambiguous agreement by the Data Principal, signified through a clear affirmative action.
• Cookie: A small text file placed on a User's device when they visit the Website, used to store information about the visit.

A.2.1 Information You Provide Directly

When you register an account, browse, wish-list items, place an order, contact us, or otherwise interact with our Website, we may collect the following:

• Identity Data: Full name, username or display name, and date of birth (optional)
• Contact Data: Email address, mobile number, and WhatsApp number
• Delivery Data: Billing address, shipping address, landmark, city, state, PIN code
• Order Data: Products selected, quantities, order value, order status, and invoice details
• Payment Reference Data: Payment method type and transaction reference numbers only. We do not store full card numbers, CVV, UPI PINs, or net banking credentials all payment data is processed exclusively by Razorpay, our PCI-DSS Level 1 certified payment gateway
• Account Credentials: Username and cryptographically hashed password (passwords are never stored in plain text)
• Communication Data: Messages, queries, complaints, reviews, and feedback submitted via email, WhatsApp, or contact form
• Corporate Data: Company name, GSTIN, authorized representative name, designation, purchase order numbers, and brand/logo artwork files (for corporate and bulk orders)
• Wishlist Data: Products saved to your wishlist and associated timestamps
• Marketing Preferences: Newsletter subscription status, opt-in and opt-out records with timestamps

A.2.2 Information Collected Automatically

When you visit our Website, certain technical and behavioral data is automatically collected by our servers and third-party analytics providers:

• Device and Browser Data: IP address, browser type and version, operating system and version, screen resolution, and device type (mobile, tablet, desktop)
• Usage Data: Pages visited, products viewed, time spent on each page, scroll depth, links clicked, search queries entered on the Website, add-to-cart and checkout events
• Session Data: Session tokens, login timestamps, cart state, and session duration
• Location Data: Approximate geographic location (city, state, and country level) derived from your IP address. We do not access precise GPS or device location data
• Referral and Traffic Data: The URL, platform, or search engine from which you arrived at the Website, including UTM campaign parameters
• Cookie and Tracking Technology Data: See Section A.5 for full details

A.2.3 Information Received from Third Parties

• Payment Confirmation Data: Transaction reference numbers, payment status, and fraud risk scores received from Razorpay upon payment processing
• Social Login Data (if applicable): If you choose to log in using Google, Facebook, or another social identity provider, we receive your name, email address, and profile picture as permitted by that provider and your privacy settings on that platform
• Logistics and Delivery Data: Shipment tracking events, estimated delivery windows, delivery confirmation status, and courier notifications from our logistics partners
• Analytics Aggregates: Aggregated and anonymized behavioral insights from analytics platforms such as Google Analytics, used for Website improvement

We process personal data only for specific, explicit, and legitimate purposes. The table below provides a comprehensive overview of our processing activities and the legal basis for each:

We retain personal data only as long as necessary for the stated purpose, and subject to applicable legal obligations. The following retention schedules apply:

• Order and transaction records (invoices, payment references, delivery confirmations): 7 years (required under GST Act, Income Tax Act, and accounting standards)
• Customer account data: Duration of account existence, plus 2 years post-closure for dispute resolution and legal claims
• Customer service communications and complaint records: 3 years from the date of resolution
• Marketing consent records (opt-in/opt-out timestamps): Until withdrawal of consent, plus 1 year thereafter
• Payment transaction reference data: As required by Razorpay's terms, RBI guidelines, and applicable financial regulations
• Server access logs and IP address logs: 90 days (routine); extended indefinitely if under investigation or linked to a legal matter
• Wishlist and browsing data: Duration of account existence plus 12 months

Upon expiry of the applicable retention period, data is securely deleted or anonymized such that it can no longer be associated with or used to identify any individual.

A.5.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our Website. They enable the Website to remember your actions and preferences, provide personalized experiences, and support analytics and marketing functions. Similar tracking technologies we may use include web beacons (pixel tags), local storage objects, and session storage.

A.5.2 Categories of Cookies We Use

• Strictly Necessary Cookies: These are essential for the Website to function and cannot be disabled without impairing core functionality. They include: session management tokens, shopping cart state, login authentication tokens, security CSRF tokens, and checkout session data. No consent is required for strictly necessary cookies under applicable law.
• Performance and Analytics Cookies: These collect anonymized and aggregated information about how visitors interact with our Website. We use Google Analytics (and may use Hotjar or similar tools) to analyze page performance, user flows, drop-off points, and traffic sources. This data is used solely to improve our Website and user experience. These cookies do not identify individual users.
• Functionality Cookies: These enable the Website to remember your preferences and selections, such as your delivery PIN code, recently viewed products, language preferences, and currency display settings. Disabling these cookies may result in reduced personalization.
• Targeting and Marketing Cookies: These cookies are set by third-party advertising platforms including Google Ads and the Meta (Facebook) Pixel. They track your browsing behavior across websites to build a profile of your interests and deliver relevant advertisements. We use remarketing cookies to re-engage users who have visited our Website. These cookies are subject to the privacy policies of the respective third-party platforms.

A.5.3 Your Choices Regarding Cookies

You may manage, block, or delete cookies through your browser settings. The process varies by browser consult your browser's help documentation for instructions. Please note:

• Blocking strictly necessary cookies will prevent you from completing purchases or accessing your account
• Blocking analytics cookies means we cannot improve Website performance based on your usage
• Blocking marketing cookies will not reduce the number of advertisements you see, but they will be less relevant to your interests

NOTE: We currently do not operate a dedicated cookie consent management platform. We recommend implementing one to collect explicit, granular consent for non-essential cookies, in line with best practices under the DPDPA 2023 once fully operative.

We do not sell, lease, rent, barter, or trade your personal data to any third party for their independent use. Disclosure of your personal data occurs only in the following limited circumstances:

A.6.1 Service Providers (Data Processors)

We share personal data with carefully selected third-party service providers who process data on our behalf, under contractual data processing agreements that prohibit them from using your data for any purpose other than the services they provide to us:

• Razorpay Financial Solutions Pvt. Ltd.: Payment processing, fraud detection, and payment gateway services. Razorpay's privacy policy governs their processing: razorpay.com/privacy
• Courier and logistics partners (BlueDart, Delhivery, DTDC, Ekart, and others as applicable): Shipment dispatch, tracking, and delivery confirmation
• Email and SMS service providers: Transactional and marketing communications delivery
• Google LLC: Google Analytics (Website analytics), Google Ads (remarketing). Google's privacy policy: policies.google.com/privacy
• Meta Platforms Inc.: Meta Pixel for advertising and retargeting. Meta's privacy policy: facebook.com/privacy/policy
• Webify.Ai: Website development, maintenance, and hosting support
• Cloud infrastructure and hosting providers: Secure server hosting and data storage services

A.6.2 Legal and Regulatory Disclosure

We may disclose your personal data when required by law, court order, government directive, or the request of a competent regulatory authority in India, including under the IT Act, FEMA, GST legislation, the Prevention of Money Laundering Act, or any other applicable Indian law. We will, where permitted by law, notify you of such disclosure.

A.6.3 Protection of Rights and Safety

We may disclose data to protect the rights, property, or safety of Hide Lifestyle, our employees, customers, or others including to investigate and prevent fraudulent transactions, unauthorized access, or other illegal activities.

A.6.4 Business Restructuring or Transfer

If Hide Lifestyle undergoes a merger, acquisition, restructuring, joint venture, or sale of all or a substantial part of its assets, your personal data may be transferred to the acquiring or successor entity. Such transfer will be subject to equivalent data protection obligations. You will be notified of such a change via email and through a notice on our Website at least 30 days in advance.

A.6.5 With Your Explicit Consent

For any sharing of your data beyond the purposes described in this Policy, we will obtain your prior explicit consent, which you may withdraw at any time without affecting the lawfulness of processing before withdrawal.

Our Website is operated in India and your personal data is primarily stored on servers located within India. However, certain third-party service providers (including Google and Meta) may process your data on servers located in other countries. Where such transfers occur, we ensure they are subject to adequate safeguards including standard contractual clauses, or that the recipient country's data protection framework provides an equivalent level of protection as required under Indian law.

We implement appropriate and reasonable technical and organizational measures to safeguard your personal data from unauthorized access, modification, disclosure, loss, or destruction:

• SSL/TLS encryption for all data transmitted between your browser and our servers (verified by the padlock icon and https:// prefix in your browser)
• PCI-DSS Level 1 compliant payment processing exclusively through Razorpay we never store card numbers, CVV codes, or PIN data on our servers
• Password hashing using industry-standard cryptographic algorithms (we never store passwords in plain text)
• Role-based access controls (RBAC) limiting employee access to personal data on a need-to-know basis
• Regular security patches, vulnerability assessments, and software updates
• Secure data storage with encrypted backups and documented recovery procedures
• Segregation of production and development environments to protect live customer data

Despite these measures, no method of electronic data transmission or storage is completely secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users and relevant authorities within the timeframes required under applicable law.

NOTE: We will never ask for your OTP, UPI PIN, CVV, net banking password, or full card number via any channel (email, WhatsApp, phone, or SMS). Any such request should be treated as fraudulent and reported to us and your bank immediately.

Under the DPDPA 2023, the SPDI Rules 2011, and the Consumer Protection Act 2019, you have the following rights regarding your personal data. To exercise any of these rights, please contact our Grievance Officer at info@hidelifestyle.in.

A.9.1 Right to Access and Confirmation

You have the right to obtain confirmation of whether we hold personal data about you, and to receive a copy of that data in a readable format. We will process such requests within 30 calendar days.

A.9.2 Right to Correction and Completion

You may request correction of inaccurate, incomplete, or outdated personal data we hold about you. Most information (name, contact details, address) can be updated directly through your account dashboard. For other corrections, contact us in writing.

A.9.3 Right to Erasure (Right to be Forgotten)

You may request deletion of your personal data where: (a) it is no longer necessary for the purpose for which it was collected; (b) you have withdrawn consent and there is no other legal basis for processing; or (c) the data has been unlawfully processed. We will honor erasure requests subject to our legal data retention obligations under the GST Act, Income Tax Act, and other applicable laws.

A.9.4 Right to Withdraw Consent

Where our processing of your data is based on consent (e.g., marketing emails, targeting cookies), you may withdraw that consent at any time by: (a) clicking the "Unsubscribe" link in any marketing email; (b) adjusting your cookie preferences; or (c) contacting us directly. Withdrawal of consent does not affect the lawfulness of processing undertaken before withdrawal.

A.9.5 Right to Grievance Redressal

You have the right to have your privacy-related complaints addressed by our Grievance Officer within the timelines specified in Part H of this document (acknowledgement within 24 hours; resolution within 30 calendar days).

A.9.6 Right to Nominate

Under the DPDPA 2023, you may nominate another individual to exercise your data rights on your behalf in the event of your incapacity or death.

A.9.7 Right Not to be Subject to Automated Decision-Making

We do not make decisions that significantly affect you solely on the basis of automated processing. Any decisions affecting your account, orders, or eligibility for services involve human review.

Our Website, products, and services are intended exclusively for individuals who are 18 years of age or older. We do not knowingly collect personal data from minors (persons under 18 years of age). If you are under 18, you must not use this Website, create an account, or provide any personal information.

If we become aware that we have inadvertently collected personal data from a minor without verifiable parental or guardian consent, we will take immediate steps to delete such information from our systems. Parents or legal guardians who believe their child has submitted personal data to us are requested to contact our Grievance Officer at info@hidelifestyle.in with proof of the child's age and a request for deletion.

Our Website may contain links to third-party websites (including Instagram, WhatsApp Business, Facebook, and YouTube), embedded social media widgets, and partner content. These third parties operate under their own privacy policies, and we have no control over their data collection and processing practices. We are not responsible for the privacy practices or content of any linked third-party website. We strongly encourage you to read the privacy policy of every third-party website or service you visit.

We reserve the right to update or modify this Policy at any time to reflect changes in our data practices, applicable laws, or business operations. Changes will take effect upon posting to the Website with a revised "Last Updated" date. For material changes that significantly affect your rights, we will provide at least 14 days' prior notice via email to all registered users. Continued use of the Website following notice of changes constitutes your acceptance of the revised Policy. We recommend reviewing this Policy at least quarterly.

• Designation: Privacy and Data Grievance Officer Hide Lifestyle
• Email: info@hidelifestyle.in
• Postal Address: Hide Lifestyle, A-113 ,114 SAKAR-7 Nehrubridge Corner beside Reform Club above Sun Point Ashram Road Ahmedabad, Gujarat - 380007
• Working Hours: Monday to Saturday, 10:00 AM – 6:30 PM IST (excluding public holidays)
• Response Timeline: Acknowledgement within 24 hours; Resolution within 30 calendar days as required under Rule 5(9) of the SPDI Rules, 2011 and the Consumer Protection (E-Commerce) Rules, 2020