Privacy Policy

1. Introduction & Commitment to Privacy

Aoi Blossom Atelier ("we", "us", or "our") is committed to protecting the privacy and personal data of our clients in India and worldwide. This policy governs how we collect, store, process, and protect your personal data when you visit our website, place orders, or communicate with our concierge.

2. Compliance with India's DPDP Act, 2023

In accordance with India's Digital Personal Data Protection Act (DPDP Act, 2023), we operate as a Data Fiduciary. We process digital personal data only with your explicit, informed consent or for specified lawful purposes, such as fulfilling commercial contracts and complying with tax and statutory requirements.

3. Categories of Personal Data Collected

• Identity & Contact Data: Full name, shipping and billing address, email address, and verified telephone number.
• Order & Transaction Data: Items purchased, sizes, styling choices, order identifiers, and payment status.
• Zero Card Storage: We do NOT store payment card numbers, CVVs, or bank net banking credentials on our servers. All transactions are securely routed through PCI-DSS Level 1 certified payment gateways (Razorpay).
• Technical & Session Data: IP address, device type, operating system, and secure session tokens used to safeguard your shopping cart across visits.

4. Lawful Grounds for Data Processing

We process your personal data solely for:

• Processing, inspecting, encasing, and dispatching bespoke atelier orders.
• Fraud prevention, account credential security, and bot mitigation.
• Issuing GST-compliant invoices and retaining required tax records under Indian statutory law.
• Responding to your concierge inquiries and size consultations with your consent.

5. Your Rights as a Data Principal

Under the DPDP Act 2023, you have the right to:

• Access & Summary: Request a summary of personal data held about you and how it has been processed.
• Correction & Erasure: Request rectification of inaccurate information or deletion of data no longer required for statutory purposes.
• Withdrawal of Consent: Withdraw consent for marketing communications or optional cookies at any time.
• Grievance Redressal: Raise inquiries or complaints with our designated Grievance Officer.

6. Cookies & Tracking Technologies

We use strictly necessary cookies to manage authentication sessions, anti-CSRF protection, and cart continuity. With your consent, we also utilize privacy-preserving aggregated telemetry to understand page performance. You may modify your cookie preferences through your browser settings or our Cookie Consent Banner at any time.

7. Data Retention & Security Measures

Account data is retained as long as your account remains active or until you request its deletion. Under Indian tax laws (including the Central Goods and Services Tax Act), sales transaction receipts and invoicing logs are retained for 7 years. All stored passwords utilize Scrypt cryptographic hashing with unique random salts, and all data transmissions are secured using TLS 1.3 encryption.