Privacy Policy

This Privacy Policy explains how Vyoora Jewels India Pvt. Ltd. (“Vyoora Jewels”, “we”, “us” or “our”) collects, uses, shares and protects your personal data when you visit vyoorajewels.com, contact us, visit our showroom, or buy from us. It is our notice to you under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it.

For the purposes of the DPDP Act, Vyoora Jewels India Pvt. Ltd. is the Data Fiduciary for the personal data described here, and you are the Data Principal.

1. Scope

This policy applies to personal data we process through:

• this website, vyoorajewels.com, and its contact forms;
• our showroom and in-person transactions, including purchases, exchanges and buybacks;
• communications with us by phone, email, messaging apps or social media; and
• our online store and digital gold platform when they launch, unless a separate privacy notice is provided for them.

It does not apply to third-party websites or services that we link to; please read their privacy policies.

2. Personal data we collect

We do not collect or store your full card details, UPI PINs, net-banking passwords or OTPs. Online payments are processed by regulated payment aggregators, who handle that information under their own security standards.

3. Why we use your data

We process personal data only for specified, lawful purposes, either with your consent or for a legitimate use permitted by Section 7 of the DPDP Act:

• To respond to you — answering enquiries and booking appointments (based on your consent, or because you voluntarily provided the data for that purpose).
• To sell, deliver and service our products — processing orders, payments, deliveries, returns, exchanges, buybacks and after-sales care.
• To meet legal obligations — GST invoicing, income-tax requirements (such as PAN for high-value transactions), customer due diligence and reporting under the Prevention of Money-laundering Act, 2002, and responding to lawful requests from authorities.
• To keep people and assets safe — preventing fraud, securing our website and premises, and protecting our customers’ gold.
• To improve our services — understanding, in aggregate, how our website and services are used.
• To send updates you ask for — such as launch updates for our online store or digital gold platform, only with your consent. You can opt out at any time.

We will not use your data for a new purpose without telling you and, where required, asking for your consent.

4. Consent and withdrawal

Where we rely on consent, it will be free, specific, informed and given through a clear affirmative action, such as ticking a box on our contact form. You may withdraw consent at any time — as easily as you gave it — by writing to grievance@vyoorajewels.com. Withdrawal does not affect processing already carried out, and we may continue to keep data that the law requires us to retain. If you withdraw consent, we may be unable to provide the related service.

5. Who we share data with

We do not sell your personal data. We share it only as needed, with:

• Service providers (Data Processors) acting on our instructions under contract — website hosting, email, IT support, payment aggregators, logistics and transit-insurance partners, KYC verification agencies and, for digital gold, vault custodians;
• Government and regulators where required by law — including GST and income-tax authorities, the Financial Intelligence Unit – India (FIU-IND), courts and law-enforcement agencies;
• Professional advisers such as auditors and lawyers, under a duty of confidentiality; and
• A successor entity in the event of a merger, acquisition or restructuring, subject to this policy.

6. Where your data is stored

Your data may be stored and processed in India or, through our service providers, in other countries. Any transfer outside India is made only in compliance with the DPDP Act and any restrictions notified by the Government of India.

7. How long we keep it

We keep personal data only as long as needed for the purpose for which it was collected, or as long as the law requires. For example:

• KYC and transaction records under the Prevention of Money-laundering Act, 2002 — at least five years after the transaction or end of the business relationship;
• invoices and accounting records — for the periods required under GST law and the Companies Act, 2013 (generally up to eight years);
• website enquiries that do not lead to a purchase — up to 24 months, unless you ask us to delete them sooner; and
• CCTV footage — overwritten periodically, unless needed to investigate an incident.

When data is no longer needed, we delete or anonymise it securely.

8. How we protect it

We take reasonable security safeguards to prevent personal data breaches, including encrypted connections (HTTPS), access controls on a need-to-know basis, secure storage of KYC documents, confidentiality obligations for staff and contracts with our service providers. If a personal data breach occurs, we will inform the Data Protection Board of India and affected individuals as required by law.

9. Your rights

Under the DPDP Act, you have the right to:

• Access information — a summary of the personal data we process about you, the processing activities, and the identities of other Data Fiduciaries and Data Processors we have shared it with;
• Correction and erasure — to correct, complete or update your data, and to have it erased when it is no longer needed, unless we must retain it by law;
• Grievance redressal — to have your complaints about our handling of your data addressed by us; and
• Nominate — to nominate another person to exercise your rights in the event of your death or incapacity.

To exercise these rights, write to our Grievance Officer (details below). We may need to verify your identity before acting on a request. We will respond within the time required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

You also have duties under the Act — for example, not to impersonate another person, not to suppress material information when providing data, and not to file false or frivolous complaints.

10. Children

Our products and services are intended for adults. We do not knowingly collect personal data of children (persons under 18) without verifiable consent from a parent or lawful guardian. If you believe a child has given us personal data, please contact us and we will delete it.

11. Cookies

Our website uses only strictly necessary cookies. See our Cookie Policy for details.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. Significant changes will be highlighted on this website and, where appropriate, communicated to you directly.

13. Contact and Grievance Officer

For questions, requests or complaints about your personal data, contact:

You may request this notice in English or any language listed in the Eighth Schedule to the Constitution of India.