Privacy Policy

PRIVATE REVOLUTION, trading as PRVRT, operates https://prvrt.in. We are the Data Fiduciary in respect of the personal data described in this policy, which means we decide why and how that data is processed and we are accountable for it.

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what you can require us to do with it. It applies to visitors to our website, customers who place an order, and anyone who contacts us or subscribes to our newsletter.

It is written to comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them.

• Personal data means any data about an individual who is identifiable by or in relation to such data.
• Data Principal means the individual to whom the personal data relates. That is you.
• Data Fiduciary means the person who determines the purpose and means of processing personal data. That is us.
• Data Processor means a person who processes personal data on our behalf, such as our payment gateway or email provider.
• Processing means any operation performed on personal data, including collection, storage, use, sharing and erasure.

We collect only what we need in order to sell you a product and deliver it. Specifically:

• Identity and contact data — your name, email address and telephone number.
• Delivery data — the shipping address and PIN code you provide. The PIN code additionally determines the shipping charge applied to your order.
• Order data — the products and sizes you purchased, quantities, the amount charged, any promotional code applied, the order number, and the status and history of the order.
• Payment metadata — the payment reference issued by our payment gateway, the amount, the method used and whether the transaction succeeded.
• Communications — the content of messages you send through our contact form or by email, and our replies.
• Marketing preferences — your email address, the product preference you select, and a record of the consent you gave, including the date and time it was given.
• Technical data — data generated automatically when you visit, such as your IP address, browser type and the pages you requested. This is processed by our hosting provider for security and reliability.

Under the DPDP Act, personal data may be processed for a lawful purpose for which you have given consent, or for certain specified legitimate uses. Our purposes are:

• To perform your order — to create it, take payment, reserve stock, dispatch the goods, and handle any exchange, refund or cancellation.
• To communicate about your order — order confirmations, dispatch notices, and responses to your enquiries.
• To meet our legal obligations — issuing GST tax invoices and retaining accounting records as required by tax law.
• To prevent fraud and abuse — verifying payments and detecting misuse of promotional codes or attempts to tamper with pricing.
• To send marketing communications — only where you have subscribed and given consent, which you may withdraw at any time.

Where we rely on your consent, we ask for it clearly and separately at the point of collection, and we record when it was given. Our newsletter sign-up, for example, requires you to tick a box confirming that you have read this policy, and we store the timestamp of that confirmation.

You may withdraw your consent at any time by writing to support@prvrt.in, or by using the unsubscribe link in any marketing email. Withdrawal takes effect prospectively and does not affect the lawfulness of processing carried out before it.

Withdrawing consent to marketing does not stop transactional messages about an order you have already placed, since those are necessary to perform the contract between us.

We think this is as important as what we do, so we state it plainly:

• We do not sell, rent or trade your personal data to anyone, for any purpose.
• We do not run Google Analytics, or any other third-party analytics product, on this website.
• We do not use advertising or retargeting pixels, including those operated by Meta or Google.
• We do not build advertising profiles about you or track you across other websites.
• We do not make automated decisions that produce legal or similarly significant effects for you.

We do measure how the site is performing, using the audience measurement built into our hosting provider. It counts page views and reports them to us in aggregate. It sets no cookie, assigns you no identifier, and cannot follow you to any other website. We see how many people viewed a product page; we do not see who they were.

We do not sell, rent or trade your personal data. We do not hand it to advertisers, data brokers, or anyone who wants it for their own purposes. There is no arrangement under which a third party receives your data in exchange for anything.

A small number of service providers do come into contact with your data, because they are the services that make the website work. We use each of them only for the stated function, they act on our instructions, and they are not permitted to use your data for their own purposes. We set out below exactly what each one receives, so that you are not left to guess.

We may also disclose personal data where we are required to do so by law, by a court, or by a governmental or regulatory authority acting within its powers, or where disclosure is necessary to establish, exercise or defend a legal claim.

Payments are processed by Razorpay Software Private Limited, a payment aggregator authorised by the Reserve Bank of India.

When you reach the payment step, Razorpay's own checkout window opens in your browser. Your name, email address and phone number are passed into that window so that you do not have to type them again, and your card, UPI or net-banking details are entered directly into it. Those payment details never reach our servers. Your delivery address is not sent to Razorpay at all — we send them only the amount payable and our order number.

Razorpay stores payment system data on servers located in India, in accordance with the Reserve Bank of India's directions on the storage of payment system data. In respect of the data you enter into their checkout window, Razorpay also determines its own purposes as a regulated payment institution, and its handling of that data is governed by its own privacy notice, which we encourage you to read.

Our website is hosted by Vercel and our order emails are delivered by Resend. Both operate infrastructure outside India, which means that personal data processed by them — as described in clause 7 — is processed outside India.

This is a consequence of where those services run, not a decision to send your data abroad for any additional purpose. Such transfers are made in accordance with section 16 of the DPDP Act, are limited to the purposes described in this policy, and are subject to the terms on which we engage each provider.

Your order record itself — the copy we work from — is stored on a database in the Mumbai region, within India.

We keep personal data only for as long as the purpose for which it was collected continues to be served, or for as long as the law requires, whichever is longer.

• Order, invoice and tax records are retained for 8 years from the end of the relevant financial year. This is not a matter of choice for us: the Central Goods and Services Tax Act, 2017 and the Income Tax Act, 1961 require it.
• Marketing data is retained until you withdraw consent or unsubscribe, after which it is deleted.
• Contact form messages are retained for as long as needed to resolve the matter raised and to handle any follow-up.

You may ask us to erase your personal data at any time. We will do so for everything we are not legally required to retain, and we will tell you specifically what has been kept and why.

• All traffic between your browser and our servers is encrypted in transit using TLS.
• Payment credentials are never transmitted to or stored on our systems.
• Our database is not publicly addressable, and access to it is restricted to the application and to authorised partners of the firm.
• Order lookups require both the order number and the email address on the order, so knowing an order number alone does not disclose anything.
• Payment notifications from our gateway are cryptographically verified before being acted on, so an order cannot be marked paid by a forged message.

No system can be guaranteed perfectly secure. We commit to applying reasonable security safeguards proportionate to the data we hold, and to acting promptly if something goes wrong.

Under the DPDP Act you have the right to:

• Access — obtain a summary of the personal data we hold about you and how it has been processed, together with the identities of the processors it has been shared with.
• Correction and completion — have inaccurate or misleading data corrected, incomplete data completed, and data updated.
• Erasure — have your personal data deleted, except where retention is required by law.
• Grievance redressal — have a complaint about our handling of your data addressed by our Grievance Officer.
• Nomination — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

Write to support@prvrt.in with the subject line "Data Request", stating what you want us to do. So that we do not disclose your data to somebody else, please write from the email address associated with your orders, and include an order number where you have one.

We acknowledge every request within 48 hours and complete it within 30 days. There is no charge for making a request.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Our website and products are directed at adults. We do not knowingly process the personal data of a child under 18 years of age without the verifiable consent of a parent or legal guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, as prohibited by section 9 of the DPDP Act.

If you believe a child has provided us with personal data, write to support@prvrt.in and we will delete it.

We use browser storage only for what the website needs in order to work. Your shopping cart is kept in your browser's local storage so that it survives a page refresh; it holds the identifiers and quantities of the items you selected, and a cart reference. It does not hold prices, personal data or payment information.

Our hosting provider may set essential cookies for security, load balancing and abuse prevention. We do not set advertising, personalisation or third-party analytics cookies.

You can clear this storage at any time through your browser settings. Doing so will empty your cart.

If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal in the form and manner prescribed under the DPDP Act, without undue delay. Our notification will describe what happened, what data was affected, what we have done in response, and what you can do to protect yourself.

We may update this policy to reflect changes in our practices or in the law. The revision date is shown at the top of this page. Where a change materially affects how we use your data, we will notify subscribers by email before it takes effect.

For any question about this policy or about your personal data, write to support@prvrt.in or call +91 96188 87415 during Monday to Sunday, 10:00 AM – 6:00 PM IST. Our registered office is at Plot No. 46, S/P, Anand Nagar, Anmagal, Hayath Nagar, Rangareddy, Telangana 501505, India.