Privacy policy
Effective from 1st October 2026, LWYD Interactive LLP (“the Company”, “we”) is the Data Fiduciary for personal data collected. We collect only what we need to sell, deliver and support your order. This policy follows the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000 and the IT (Reasonable Security Practices) Rules, 2011.
1. What we collect
|
Category |
Examples |
Source |
|
Identity and contact |
Name, email, phone, billing and shipping address |
You, at checkout or sign-up |
|
Order |
Order ID, items, sizes, tracking number |
Our store system, courier |
|
Payment |
Transaction ID, payment mode, masked card or UPI reference |
Payment gateway |
|
Device and usage |
IP address, browser, device type, pages visited |
Cookies and analytics |
We do not collect government IDs, biometric or health data. We never see or store your full card or bank details.
2. Why we use it
|
Purpose |
Basis under DPDPA |
|
Process, ship and deliver your order |
Your consent; voluntarily provided data |
|
Send order and delivery updates |
Legitimate use |
|
Handle replacements, refunds and complaints |
Legitimate use |
|
Prevent fraud, bots and bulk buying on drops |
Legitimate use; legal obligation |
|
Meet tax, invoicing and audit requirements |
Legal obligation |
|
Improve the Site through analytics |
Consent (cookie banner) |
|
Send marketing and drop alerts |
Explicit opt-in consent |
We will not use your data for any other purpose without telling you and, where needed, asking first.
3. Cookies
We use essential cookies to run the cart and checkout, and optional cookies for analytics and advertising. On your first visit, a banner lets you accept all, reject non-essential, or choose by category. You can change this anytime.
4. Who we share it with
|
Recipient |
Why |
Data shared |
|
Payment gateway |
Process payments |
Name, contact, transaction details |
|
Courier partner |
Deliver orders, returns |
Name, phone, address, order details |
|
Hosting and store platform |
Run the Site |
Account, order and technical data |
|
Email and SMS providers |
Order updates, opt-in marketing |
Email, phone |
|
Analytics and ad tools |
Site performance, campaigns |
Cookie and usage data |
|
Auditors and legal advisers |
Tax, compliance, disputes |
As needed |
|
Government authorities |
When required by law |
As legally required |
These parties may use your data only to provide their service to us, under confidentiality terms. We do not sell, rent or trade your personal data. We may share anonymised, aggregated statistics that cannot identify you.
5. Data outside India
Our data is stored in India. Some service providers may process data outside India; any such transfer follows Section 16 of the DPDPA and government notifications on restricted countries.
6. How long we keep it
|
Data |
Kept for |
|
Order, invoice and payment records |
8 years, for tax and accounting law |
|
Contact and account data |
3 years after your last order or activity |
|
Support and claim records |
3 years after the issue closes |
|
Marketing preferences |
Until you unsubscribe |
|
Analytics data |
Up to 18 months |
After this, data is deleted or anonymised. Records under a legal hold are kept as the law requires.
7. Security
We use HTTPS encryption, access controls on a need-to-know basis, secure payment gateways and regular system updates. No online system is fully secure, so please keep your login details private and tell us immediately at grievances@lwyd.in if you suspect misuse.
8. Data breaches
If a breach affects your personal data, we will contain it, report it to CERT-In within 6 hours of becoming aware of it and to the Data Protection Board of India as required, and inform affected users of what happened, what data was involved and what steps to take.
9. Your rights
|
Right |
What it means |
Our response time |
|
Access |
Know what data we hold and how it is used |
15 working days |
|
Correction |
Fix inaccurate or incomplete data |
10 working days |
|
Erasure |
Delete data no longer needed, subject to legal retention |
15 working days |
|
Nominate |
Name someone to act for you in case of death or incapacity |
On receipt |
Email grievances@lwyd.in with your request. We may verify your identity first.
10. Children
The Site is for users aged 18 and above. We do not knowingly collect data from anyone under 18, and will delete it promptly if we find we have.
11. Change of ownership
If the Company’s business or this Site is merged, sold or restructured, your data may move to the new owner and will stay protected under this policy until you are notified of any change.
12. Changes to this policy
We may update this policy from time to time. Material changes will be shown on the Site and, where possible, emailed to you. The effective date at the top will always show the latest version.
13. Grievance Officer
For privacy questions, data requests or complaints, write to our Grievance Officer at grievances@lwyd.in (Monday to Friday, 10:00 AM to 6:00 PM IST). We acknowledge complaints within 48 hours and aim to resolve them within 15 working days. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India under the DPDPA.