Privacy policy

DZignX Products Private Limited (“the Company”, “we”, “us” or “our”), a company incorporated under the Companies Act, 2013 bearing Corporate Identity Number (CIN) U51909KA2022PTC164084 and having its registered office at S. No. 26/1, GF, Indiqube Aura, IBIS Hotel, Bommanahalli, Bangalore South, Karnataka – 560068, owns and operates the website yourbasil.com together with its associated mobile applications, sub-domains and digital interfaces (collectively, the “Platform”).

Through the Platform we offer design-led products for children and young people, including the signature 20L Basil Wander bags and related accessories. We respect your privacy and are committed to protecting the personal data we collect and process about you.

This Privacy Policy (“Policy”) explains how we collect, use, store, share, retain and erase your personal data when you access or transact on the Platform. It has been prepared in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and, to the extent applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), the Consumer Protection (E-Commerce) Rules, 2020, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

For the purposes of the DPDP Act, the Company is the “Data Fiduciary” that determines the purpose and means of processing your personal data, and you, the individual who accesses or transacts on the Platform, are the “Data Principal”. We are guided by the principles of purpose limitation, data minimisation and accountability.

By accessing, browsing or transacting on the Platform, you acknowledge that you have read and understood this Policy. Where the DPDP Act requires your consent, we will seek it through a clear, affirmative action, and we process your data only for the purposes described in this Policy or otherwise permitted by law.

2.  Definitions

“Personal Data” means any data about an individual who is identifiable by or in relation to such data.

“Sensitive Personal Data or Information” (under the SPDI Rules) includes, among other things, financial information such as payment instrument details, passwords, and other categories treated as sensitive under applicable law.

“Processing” means any operation performed on personal data, including collection, recording, storage, use, sharing, disclosure, retention or erasure.

“Consent” means your free, specific, informed, unconditional and unambiguous agreement, given through a clear affirmative action, to the processing of your personal data for a specified purpose.

“Processor” / “Service Provider” means any person who processes personal data on our behalf and under our instructions.

“Cookies” means small text files and similar tracking technologies (such as pixels and local storage) placed on your device to enable and improve your use of the Platform.

3.  Information We Collect

3.1  Information you provide to us

We collect the information you actively provide when you create an account, place or enquire about an order, contact us, or otherwise interact with the Platform. This includes:

• Identity and contact data - your name, business name (for wholesale/B2B customers), billing and shipping addresses, phone number and email address;
• Account and authentication data - your password (stored only in cryptographically hashed form), one-time passwords (OTPs) sent by SMS, and email verification tokens;
• Transaction and tax data - order details and, where applicable for business customers, your Goods and Services Tax Identification Number (GSTIN) for tax invoicing;
• Customer-support data - chat transcripts, email correspondence, call recordings, support-ticket content and any photographs you share (for example, to support a return, warranty or defect claim). Where we record calls, we will notify you before doing so;
• Marketing preferences - your opt-in choices for promotional communications by email, SMS and WhatsApp.

3.2  Information we collect automatically

When you use the Platform (which is hosted on the Shopify e-commerce infrastructure), our systems and our service providers automatically collect certain technical and usage information, including your Internet Protocol (IP) address, browser type and version, operating system, device identifiers, language settings, and error/crash logs.

We also collect usage data such as the pages you view, the date and time of access, referral URLs, session duration, products viewed, and additions to or removals from your cart. We use tracking identifiers and pixels to support analytics and advertising. Where this information is not linked to an account or identifier, we treat it as pseudonymised or aggregated data.

3.3  Device storage permissions

Where you use our mobile applications or progressive web app, we may request permission to access local storage on your device. Such access is used solely to cache data, store offline catalogues and save your preferences for faster access. We do not use this permission to access, monitor or collect other, non-Platform data on your device.

3.4  Information from third parties

If you purchase our products through a third-party marketplace, that marketplace may share order and fulfilment details (such as delivery name, address and contact number) with us so that we can dispatch your order. If you sign in using a third-party single sign-on (such as Google, Meta or Apple), that provider may share basic profile information (typically your name and email) with us, in accordance with its own terms and your privacy settings with that provider.

4.  How We Use Your Information and Our Lawful Basis

We process your personal data only for specified purposes, and each purpose is supported by a lawful basis under the DPDP Act, principally your consent, the performance of our contract with you, our legitimate uses/interests, or compliance with a legal obligation. We do not process your data for unrelated purposes without seeking fresh consent.

4.1  Order fulfilment and logistics

We use your name, address and contact details to process, pack, ship and deliver your orders; to send order confirmations and tracking updates; to manage returns, replacements and warranty claims; and to resolve delivery issues. To deliver your order, we share the minimum necessary information (name, delivery address, phone number and product details) with our courier and logistics partners.

4.2  Payments

We do not collect, process or store your raw card numbers, primary account numbers (PANs) or banking credentials on our servers. All payments are processed by regulated, PCI-DSS-compliant Payment Service Providers such as Razorpay, Easebuzz or PayU. Card and payment-instrument data is transmitted directly to the payment gateway over an encrypted (SSL/TLS) connection. We receive and store only tokenised references or transaction identifiers, which we use to reconcile accounts, process refunds (typically reflected in 3–5 business days) and detect suspicious or fraudulent activity.

4.3  Communications and marketing

We use your contact details to send you service and transactional messages relating to your account and orders (for example, order confirmations, delivery updates and support responses). Where you have opted in, we also send promotional communications by email, SMS and WhatsApp.

By voluntarily providing your mobile number and opting in to marketing, you consent to receive promotional communications from us on that number. This consent is intended to operate as your consent for the purposes of the Telecom Commercial Communications Customer Preference Regulations, 2018. You may withdraw your marketing consent at any time using the opt-out method in any message or by contacting us. Withdrawal takes effect prospectively and does not affect service or transactional messages relating to your orders.

4.4  Analytics, security and improvement

We use technical and usage data to keep the Platform secure and stable, to prevent fraud and abuse, to measure and improve performance, and to understand how customers use the Platform so that we can improve our products and services.

5.  Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Platform, remember your preferences, analyse usage and support advertising. We use the following categories:

• Strictly necessary cookies - essential to core functions such as your shopping cart, secure checkout and logged-in sessions
• Functional cookies - remember your preferences such as language and currency;
• Analytics cookies - help us measure traffic and performance (for example, Google Analytics);
• Advertising cookies - support interest-based advertising and retargeting through partners such as Meta and Google.

You can manage non-essential cookies through our cookie-consent banner and through your browser or device settings. Please note that disabling strictly necessary cookies may affect core functions such as the cart, login and checkout. We are not responsible for cookies set by third-party services outside our control.

6.  How We Share Your Information

We share personal data only as necessary and only to the minimum extent required. We share data with the following categories of recipients:

• Hosting and platform provider - the Platform is hosted on Shopify; consequently your data may be stored and processed on Shopify’s global infrastructure;
• Logistics and courier partners - who receive only the delivery name, address, contact number and product details, and are contractually prohibited from using that data for their own marketing or profiling;
• Payment service providers - to process payments and refunds;
• Other service providers - including CRM, analytics, marketing, auditing/tax and security providers, engaged under written data-processing agreements that restrict them to processing data on our instructions;
• Legal and regulatory disclosures - where required by law, a valid court order, or a lawful request from a governmental or regulatory authority, or where necessary to protect our legal rights, property or safety.

We enter into Data Processing Agreements with our processors requiring them to protect your data and to process it only for the agreed purposes.

7.  Children’s Data

The Platform is intended for use by persons who are 18 years of age or older. We do not knowingly permit account creation or transactions by children (persons under 18 years) without the involvement of a parent or lawful guardian. Where our products are intended for children, any personal data relating to a child is to be provided by, and processed on the basis of the verifiable consent of the child’s parent or lawful guardian, as required under Section 9 of the DPDP Act.

In line with the DPDP Act, we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If we become aware that we have collected a child’s personal data without the required parental consent, we will delete that data promptly.

8.  Data Security

We maintain reasonable security safeguards designed to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include encryption in transit (SSL/TLS), access controls that restrict access to authorised personnel, and organisational and technical measures appropriate to the risk.

However, no method of transmission or storage over the internet is completely secure. While we work to protect your data, we cannot guarantee absolute security, and you provide information to the Platform at your own risk. We will handle any personal data breach in accordance with our obligations under applicable law.

9.  International Data Transfers

Some of our service providers (including Shopify and certain analytics, communications and marketing partners) may store or process your personal data on servers located outside India. Where we transfer personal data across borders, we do so in accordance with the DPDP Act and applicable law, and we take steps to ensure your data continues to receive an appropriate level of protection.

10.  Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, or for longer where required to meet legal, tax, accounting or regulatory obligations.

When personal data is no longer required, we will securely delete it or anonymise it so that it can no longer be linked to you. We may decline an erasure request where we are legally required or permitted to retain the data.

11.  Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Right to access - to obtain a summary of the personal data we hold about you and how we process it;
• Right to correction and updating - to have inaccurate or outdated data corrected or completed;
• Right to erasure - to request deletion of your personal data, subject to our legal retention obligations;
• Right to withdraw consent - to withdraw consent at any time, with prospective effect; withdrawal does not affect processing carried out before withdrawal;
• Right to grievance redressal - to raise a complaint with our Grievance Officer (see below);
• Right to nominate - to nominate another individual to exercise your rights in the event of your death or incapacity.

You may browse the Platform without providing personal data; however, if you decline to provide information that is necessary to fulfil a transaction (such as a delivery address), we may be unable to provide the relevant product or service. To exercise any of these rights, please contact our Grievance Officer using the details below.

12.  Grievance Redressal

In compliance with the DPDP Act, the Consumer Protection (E-Commerce) Rules, 2020 and the SPDI Rules, 2011, we have appointed a Grievance Officer to address your privacy-related concerns and requests.

Grievance Officer	Mr. Mahesh Muraleedharan
Email	mahesh@yourbasil.com
Address	26/1, GF, Indiqube Aura, IBIS Hotel, Bommanahalli, Bangalore, Karnataka – 560068
Phone	+91 86600 39812

 

For general queries, you may also contact our customer-support team at help@yourbasil.com (Monday to Saturday, 9:00 AM – 6:00 PM). We aim to acknowledge and resolve grievances within the timelines prescribed under applicable law.

13.  Changes to this Policy

We may update this Policy from time to time to reflect changes in law, technology or our practices. We will post the updated Policy on this page and revise the “Last Updated” date above. Your continued use of the Platform after an update constitutes your acceptance of the revised Policy. If you do not agree with any change, you may stop using the Platform and request deletion of your account and data through the Grievance Officer.

14.  Contact Us

If you have any questions about this Policy or our data practices, please contact us at mahesh@yourbasil.com or write to DZignX Products Private Limited, 26/1, GF, Indiqube Aura, IBIS Hotel, Bommanahalli, Bangalore, Karnataka – 560068.