Privacy policy

# Privacy Policy & Cookie Policy
**We Think Cosmetics LLP**
Effective Date: 22 July 2026

> ⚠️ **Outstanding from client before publishing:** registered office address, GSTIN, and CIN/LLPIN were not provided in the questionnaire response — placeholders are marked `[ ]` below. The Grievance Officer's name and designation were also not given (only the email `alshat@wethinkcosmetics.com`) — confirm both before this goes live, since Indian law requires a named individual, not just an inbox.

---

## 1. Introduction
We Think Cosmetics LLP ("we", "us", "our", "Company") operates [website URL] ("Site"). This Privacy Policy explains what personal data we collect from you ("you", "Data Principal") when you use the Site, why we collect it, how we use, store, share and protect it, and the rights available to you under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian law.

By using the Site, you agree to the collection and use of your personal data as described in this Policy. If you do not agree, please do not use the Site.

## 2. Who We Are
- Company: We Think Cosmetics LLP
- Registered office: [ ]
- GSTIN: [ ]
- LLPIN/CIN: [ ]
- Contact for privacy queries: [ ] *(recommend a dedicated inbox, e.g. privacy@wethinkcosmetics.com, or route through the Grievance Officer below)*

## 3. Personal Data We Collect
- **Identity & contact data:** name, email, phone number, delivery and billing address, date of birth (for age verification)
- **Account data:** username, password (stored in encrypted/hashed form), order history, wishlist
- **Transaction data:** order details, payment status, payment method type (we do not store your full card or UPI credentials — see Section 8)
- **Technical data:** IP address, device and browser type, cookies, log data, pages visited, click and scroll behaviour
- **Marketing preferences:** newsletter/WhatsApp opt-in status, communication preferences
- **Customer support data:** content of queries, complaints, and any attachments (e.g. photos of a damaged product) you share with support

## 4. Why We Collect It
| Purpose | Data used |
|---|---|
| Processing and delivering your order | Contact, address, order and payment-status data |
| Account creation and login | Identity and account data |
| Customer support | Contact, order and complaint data |
| Marketing communications (email/SMS/WhatsApp) | Email, phone, preferences — sent only with your opt-in consent, withdrawable anytime |
| Fraud prevention and site security | Technical and transaction data |
| Legal and tax compliance (GST records, consumer-protection recordkeeping) | Transaction and identity data |
| Site analytics, performance monitoring and advertising | Technical/cookie data — see Section 5 |

## 5. Cookies & Tracking Technologies
We use cookies and similar technologies for the following purposes. *(The exact toolset below reflects a standard baseline for an Indian D2C site, since the specific list wasn't confirmed by the client — this section should be reviewed against the actual Google Tag Manager container or developer confirmation before launch, and updated if the toolset differs.)*

| Category | Purpose | Example tools |
|---|---|---|
| Strictly necessary | Cart, login session, checkout security | Site platform's own session cookies |
| Functional | Remembering preferences, delivery PIN code | Site platform |
| Analytics | Understanding site usage and improving the Site | Google Analytics (GA4) |
| Advertising/retargeting | Showing you relevant ads on other platforms | Meta Pixel, Google Ads |
| Marketing/CRM | Sending order updates and offers via email/WhatsApp | Email/WhatsApp CRM platform |
| Payment | Enabling secure checkout | Razorpay |

**Your choices:** When you first visit the Site, a cookie banner lets you **Accept All**, **Reject Non-Essential**, or **Manage Preferences** to control analytics/advertising cookies individually. Strictly necessary cookies cannot be disabled as they're required for the Site to function. You can also block or delete cookies via your browser settings at any time — this may affect some Site features.

## 6. Sharing of Your Data
We share personal data only with:
- **Razorpay** (our payment gateway) — to process your payment securely
- **Courier/logistics partners** — to deliver your order (we ship pan-India)
- **Analytics and advertising platforms** (Google, Meta) — to understand Site usage and show relevant ads, only where you've consented to non-essential cookies
- **Email/WhatsApp/SMS CRM platform** — to send order updates and, where opted in, marketing messages
- **Customer support tools**, if used
- **Statutory authorities**, where legally required (e.g. tax authorities, courts, law enforcement)

**We do not sell your personal data to third parties.**

## 7. Cross-Border Data Transfer
Some of the platforms we use (e.g. Google, Meta) may process data on servers located outside India. Under Section 16 of the DPDP Act, 2023, we may transfer personal data outside India except to countries the Central Government restricts. We require our service providers to maintain reasonable security safeguards over your data regardless of where it is processed.

## 8. Payment Security
We do not store your full card, UPI, or net-banking credentials. All payments are processed through **Razorpay**, an RBI-authorised, PCI-DSS-compliant payment gateway. Card details, where saved for repeat use, are tokenised in line with RBI's card-on-file tokenisation framework.

## 9. Data Retention
- Account data: retained until you request account deletion
- Order/transaction data: retained for 6–8 years in line with GST recordkeeping requirements
- Marketing/communication data: retained until you unsubscribe or withdraw consent
- Support query data: retained for as long as needed to resolve your query and for a reasonable period after, for record-keeping

## 10. Your Rights as a Data Principal
Under the DPDP Act, 2023, you have the right to:
- Access a summary of the personal data we hold about you and how it is processed
- Correct or update inaccurate or incomplete personal data
- Request erasure of your personal data once the purpose it was collected for is served (subject to our legal retention obligations, e.g. tax records)
- Withdraw consent at any time, as easily as you gave it
- Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
- Seek grievance redressal (see Section 12)

To exercise any of these rights, email [ ] (dedicated privacy inbox, or the Grievance Officer's email below). We will acknowledge your request within 48 hours and resolve it within 30 days.

## 11. Children's Data
The Site is not intended for individuals under 18. We do not knowingly collect personal data from children without verifiable parental/guardian consent, and we do not carry out tracking, profiling, or targeted advertising directed at children, in line with Section 9 of the DPDP Act, 2023.

## 12. Grievance Officer
In accordance with the Consumer Protection (E-Commerce) Rules, 2020 and applicable IT Rules, our Grievance Officer can be reached at:
- Email: alshat@wethinkcosmetics.com
- Name & Designation: [ ] *(to be confirmed and published — required by law)*
- We will acknowledge your grievance within 48 hours and resolve it within 30 days.
- If unresolved, you may escalate to the Data Protection Board of India (once operational) or approach the appropriate consumer forum.

## 13. Data Security
We implement reasonable security practices and procedures, including encryption, access controls, and secure payment tokenisation, to protect your personal data against unauthorised access, alteration, or disclosure, in line with the IT Act, 2000 and applicable rules.

## 14. Changes to This Policy
We may update this Privacy Policy from time to time. The "Effective Date" at the top will reflect the latest revision. Material changes affecting how we use your data (e.g. adding a new advertising or analytics tool) will be communicated to you separately where required.

## 15. Contact Us
We Think Cosmetics LLP
[Registered address]
Email: alshat@wethinkcosmetics.com