Privacy Policy

1. Commitment to India DPDP Act 2023

MEHAKVA ("we", "our", "us") operates from A Laxmi Garden, Loni, Ghaziabad, Uttar Pradesh 201102, India. We are committed to protecting your personal data in full compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act). We collect only the minimum information necessary to deliver your fragrance orders and provide customer support. By placing an order or creating an account, you provide consent to processing of your personal data as described herein, in accordance with Section 6 of the DPDP Act 2023.

2. Information We Collect

We collect personal data only when you voluntarily provide it. Categories include:

• Contact information: Name, phone number, and email address — required to confirm orders and send dispatch notifications.
• Delivery address: Pincode and full postal address — required for courier dispatch.
• Payment tokens: Encrypted transaction references generated by our RBI-authorised payment gateway (Razorpay). We never store card numbers, UPI PINs, or CVV codes.
• Order history: Products purchased, quantities, and order status — required for support and returns.
• Analytics data (with consent only): Anonymised page views and browser type collected via optional analytics cookies only after you grant explicit consent.

We do not collect Aadhaar numbers, PAN numbers, biometric data, or sensitive financial information.

3. Purpose of Processing

• Fulfilling and dispatching orders via courier partners (NimbusPost, Shiprocket, Bluedart, Delhivery).
• Sending order confirmation, shipment tracking, and delivery alerts via SMS or WhatsApp.
• Responding to customer service queries via WhatsApp (+91-8287725668) or email.
• Preventing and detecting fraudulent Cash on Delivery (COD) bookings.
• Processing refunds and managing return requests as per our Cancellation Policy.
• Sending promotional offers — only if you have explicitly subscribed via our newsletter form.

4. Data Security

All data in transit between your browser and our server is protected by 256-bit SSL/TLS encryption (HTTPS). Customer records are stored in secure cloud infrastructure with role-based access control. Payment processing is handled entirely by Razorpay, which is PCI-DSS Level 1 compliant and regulated by the Reserve Bank of India. We do not retain raw card or UPI credentials on our servers.

In the event of a personal data breach likely to cause harm, we will notify the Data Protection Board of India (DPBI) and affected individuals as required by the DPDP Act 2023.

5. Data Principal Rights

• Right of Access (Section 11): Request a summary of personal data we hold about you.
• Right of Correction (Section 12): Request correction of inaccurate or outdated personal data.
• Right of Erasure (Section 12): Request deletion of your personal data, subject to legal retention obligations.
• Right to Withdraw Consent (Section 6): Withdraw consent for non-essential data processing at any time. Withdrawal will not affect the lawfulness of prior processing.
• Right to Grievance Redressal (Section 13): File a complaint with our Grievance Officer (details below).

To exercise any right, email support@mehakva.com with your registered phone number or order reference. We will respond within 72 hours.

6. Cookies & Tracking

We use a layered cookie consent framework compliant with DPDP Act 2023. You control preferences via "Cookie Settings" in our footer:

• Strictly Essential Cookies: Required for cart, secure login, and checkout. Cannot be disabled.
• Analytics Cookies (Optional): Anonymised page data — activated only with your explicit consent.
• Marketing Cookies (Optional): Personalised fragrance recommendations — activated only with your explicit consent.

7. Third-Party Sharing

We share personal data only with service providers strictly necessary for order fulfilment:

• Courier partners: Receive your name, phone, and delivery address for dispatch.
• Razorpay: Receives your name and email for payment processing. Razorpay is regulated by RBI.

We do not sell, rent, or trade your personal data to any marketing company, data broker, or third party for commercial gain.

8. Data Retention

Order and transactional data is retained for a minimum of 7 years in compliance with Indian tax and GST regulations. After that period, data is securely deleted or anonymised. If you request erasure before this period, we will retain only the minimum data required for legal compliance and delete all other personal details.

9. Children's Privacy

Our website and products are intended for adults. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that personal data of a minor has been submitted without verifiable parental consent, we will delete it immediately.

10. Contact & Grievance Officer

If your complaint is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India (DPBI) once it becomes operational under the DPDP Act 2023 framework.