1. Introduction

Jayesh Jewellers & Aatreya Gold ('Company', 'We', 'Us') is committed to protecting the privacy and personal data of all individuals ('You', 'User', 'Customer') who interact with us through our website, physical store, or any of our communication channels (RCS, WhatsApp, SMS, Email, Voice).

This Privacy Policy explains how we collect, use, store, share, and protect your personal information, and the rights available to you regarding your data. This policy is compliant with India's Information Technology Act, 2000 and aligned with the Digital Personal Data Protection Act, 2023 (DPDPA).

2. Information We Collect

2.1 Information You Provide Directly

• Name, mobile number, email address, postal address, and jewellery preferences (gold, silver, diamond, stones).
• Communication preferences and channel opt‑in/opt‑out choices.
• Enquiry details, service requests, and feedback submissions.

2.2 Information Collected Automatically

• Log Data: IP address, browser type, pages visited, time/date of visit, time spent on pages.
• Device information: device type, operating system, unique device identifiers.
• Cookies and similar tracking technologies (see Section 5).
• Communication engagement: message delivery status, open rates, click rates (for email and RCS).

2.3 Information from Third Parties

• Data from telecom operators and messaging platforms (RCS, WhatsApp, SMS) for message delivery.

3. How We Use Your Information

3.1 Service Delivery
Processing product enquiries, customer requests, and orders, providing jewellery availability and delivery updates, and offering customer support related to our gold, silver, diamond and precious stone jewellery.

3.2 Communication
Sending transactional messages (OTPs, receipts, booking alerts) via SMS, Email, WhatsApp, RCS, and Voice.
Sending promotional communications (with your consent) via the channels you have opted into.
Conducting customer satisfaction surveys and feedback collection.

3.3 Legal and Regulatory Compliance
Complying with applicable Indian laws, TRAI regulations, RBI guidelines, and court orders.
Preventing fraud, money laundering, and unauthorized access.
Responding to law enforcement requests under valid legal process.

3.4 Business Improvement
Analysing website usage patterns to improve our digital services.
Personalizing your experience based on your jewellery preferences and interaction history.
Training and quality assurance for customer‑facing teams.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Consent: Where you have provided explicit opt‑in consent for communications and data processing.
• Contractual Necessity: Where processing is required to perform a contract with you (e.g., processing your jewellery preferences).
• Legal Obligation: Where we are required to process your data under applicable law.
• Legitimate Interest: Where we have a legitimate business interest that is proportionate and does not override your fundamental rights and freedoms (e.g., fraud prevention and internal analytics).

5. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to improve your experience. Types of cookies we use:

• Essential Cookies: Required for the website to function. Cannot be disabled.
• Analytical Cookies: Help us understand how visitors use the site (e.g., Google Analytics). Where Google Analytics is used, certain data including your IP address (in anonymized form), pages visited, session duration, and browser/device information is transmitted to and processed by Google LLC on servers that may be located outside India. Google Analytics operates under Google's Privacy Policy (available at https://policies.google.com/privacy) and Google's Data Processing Terms. The Company has enabled IP anonymization on Google Analytics to minimize personal data transmission. Users may opt out of Google Analytics tracking by installing the Google Analytics Opt‑out Browser Add‑on available at https://tools.google.com/dlpage/gaoptout.
• Marketing Cookies: Track browsing to deliver relevant advertising (only with consent).

You can control cookies through your browser settings. Disabling non‑essential cookies will not affect your access to core services. A cookie consent banner will appear on your first visit to our website.

6. Data Sharing and Disclosure

We do not sell your personal data. We share data only in the following circumstances:

6.1 Service Providers

• Payment gateway operators (for transaction processing).
• Telecom operators and messaging platforms (RCS providers, WhatsApp/Meta, SMS aggregators) for message delivery.
• Email service providers for sending transactional and marketing emails.
• Analytics providers for website usage analysis.

All third‑party service providers are contractually bound to maintain data confidentiality and use data only for the purposes for which it is shared.

6.2 Legal Disclosure

• To comply with valid legal processes such as search warrants, court orders, or statutory requests.
• To protect the legal rights, property, or safety of the Company, its Users, or the public.
• To investigate fraud, security breaches, or illegal activities.

7. Data Retention

We retain your personal data for the following periods:

• Transaction records: 8 years (as required by applicable tax and financial laws).
• Communication logs (SMS, RCS, WhatsApp, Email): 3 years from last interaction.
• Jewellery preferences and order history: Retained as per business needs and legal requirements.
• Opt‑out records: Retained indefinitely to honour your communication preferences.
• Website log data: 12 months.

After the retention period, data is securely deleted or anonymized.

8. Data Security

We implement commercially acceptable technical and organisational measures including encryption, access controls, and firewalls to protect your personal data. Payment data is handled using PCI‑DSS compliant systems. Full card numbers are never stored on Company servers. All communication channels (RCS, WhatsApp, Email) use platform‑level encryption. Despite best efforts, no method of internet transmission is 100% secure. We encourage Users to use strong passwords and report suspected unauthorised access immediately.

9. Children's Privacy

Our services are not directed to children under the age of 18. We do not knowingly collect personal data from minors. In compliance with Section 9 of the Digital Personal Data Protection Act, 2023, where processing of personal data of a minor is necessary, the Company shall obtain verifiable consent from the parent or lawful guardian prior to such processing. If we become aware that a child under 18 has provided personal information without verified parental consent, we will promptly delete such data. Parents or guardians who believe their child's data has been collected should contact us immediately.

10. Your Rights as a Data Principal

Under applicable Indian law (including the DPDPA, 2023), you have the following rights:

• Right to Access: Request a summary of personal data held by us.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to Withdraw Consent: Withdraw consent for processing based on consent, at any time.
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer.
• Right to Nominate: Nominate another individual to exercise your rights in case of incapacity or death, as permitted by applicable law.

To exercise any of these rights, please contact us using the details in Section 14.

11. Links to Third‑Party Websites

Our website may contain links to third‑party sites. These sites operate independently and have their own privacy policies. We are not responsible for their content, privacy practices, or data handling. We encourage Users to review the privacy policies of any third‑party sites they visit.

12. Cross‑Border Data Transfers

Certain communication platform providers (e.g., Meta/WhatsApp) may process your data outside India. Where such transfers occur, they shall be subject to the provisions of Section 16 of the Digital Personal Data Protection Act, 2023, and any rules or notifications issued thereunder. Pending the notification of specific rules on cross‑border transfers, the Company relies on the contractual data protection obligations imposed on third‑party processors. Users are advised to review the privacy policies of such platform providers (e.g., Meta's WhatsApp Privacy Policy) for details of their cross‑border data handling practices. The Company will update this section as DPDPA cross‑border transfer rules are notified.

13. Updates to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in law, technology, or our business practices. Material changes will be notified to registered Users via email or SMS at least 30 days before the changes take effect. The updated policy will be published on our website with the revised effective date.

14. Grievance Officer and Contact Details

For any privacy‑related queries, data access requests, corrections, or complaints:

• Jayesh Jewellers & Aatreya Gold
• Grievance Officer: Jayesh Prakash Vernekar
• Website: jayeshjewellersnaatreyagold.store
• Email: info@jayeshjewellersnaatreyagold.store
• Working Hours: Monday to Saturday, 9:00 AM – 6:00 PM

All grievances will be acknowledged within 48 hours and resolved within 15 business days. If you are not satisfied with our resolution, you may escalate to the Data Protection Board of India (once operational under DPDPA, 2023).