Privacy & Data Protection Policy

1. Commitment to Data Dignity & DPDP Compliance

At PM Couture (operated by SRG Creations, West Bengal, India), we view client confidentiality as an indispensable hallmark of true luxury. We treat your personal data with the same uncompromising care, precision, and respect that goes into our handcrafted Bengal textiles and couture ensembles.

This Privacy Policy sets forth our practices regarding the collection, processing, storage, and protection of personal data in compliance with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act);
• The Information Technology Act, 2000 (Sections 43A and 72A);
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and
• The Consumer Protection (E-Commerce) Rules, 2020.

2. Categories of Personal Data We Collect

We only collect data strictly necessary to fulfill your couture orders, provide concierge consultations, and maintain seamless account services:

• Identity & Contact Data: Full name, telephone/WhatsApp mobile number, and email address provided during account registration, Google authentication, or order checkout.
• Delivery & Billing Data: Recipient name, complete shipping address, postal pin code, landmark, and state for door-to-door insured logistics delivery via Shiprocket.
• Couture Measurement & Sizing Data: Bust, waist, hip, blouse length, lehenga flare height, shoulder-to-wrist, and custom tailoring notes provided during bespoke bridal tailoring or virtual fittings.
• Transactional Records: Order identification numbers, purchased items, invoices, payment status (Success/Failed), and transaction tokens generated by our payment processor (Razorpay).
• Technical & Device Data: IP address, device type, browser specifications, and session tokens utilized strictly for account session preservation and fraud prevention.

3. Purposes & Legal Grounds for Processing

Under Section 4 and Section 7 of the DPDP Act 2023, we process your personal data under the lawful grounds of your explicit consent and for legitimate uses including:

• Contract Performance: Custom tailoring, assembling, quality-checking, and delivering your purchased couture to your verified Indian address;
• Real-Time Transit Tracking: Dispatching automated SMS and WhatsApp delivery status alerts via our logistics network;
• Statutory Invoicing: Generating GST-compliant tax invoices as mandated by Indian tax authorities;
• Concierge Assistance: Addressing sizing inquiries, fitting modifications, or order status requests through our client concierge team;
• Security & Anti-Fraud: Protecting your account against credential stuffing, brute-force intrusions, and fraudulent transactions.

4. Google Single Sign-On (SSO) & User Profiles

When you select "Continue with Google" to register or log into your PM Couture account:

• We authenticate your identity using Google Identity Services (GIS) via a cryptographically signed OAuth ID token.
• We strictly receive only your verified Google email address, full name, Google unique profile identifier (sub), and public avatar image URL.
• We never request, access, or store access to your private Google Drive, Gmail, contacts, search history, or any other personal Google services.
• You may revoke PM Couture's connection at any time via your personal Google Account Security settings.

5. Payment Security & Zero Card Storage Policy

All electronic monetary transactions on PM Couture are conducted through Razorpay Software Private Limited, an RBI-licensed Payment Aggregator operating under PCI-DSS Level 1 compliance.

• Zero Card Storage: PM Couture does not capture, process, or store credit card numbers, debit card numbers, CVVs, or bank net banking passwords on our local or cloud servers.
• Tokenization: In full compliance with RBI tokenization directives, all recurring checkout conveniences rely entirely on encrypted tokenized vaults managed directly by certified payment gateways.
• End-to-End Encryption: All transaction payloads are encrypted using industry-standard TLS 1.3 / AES-256 protocols during transit.

6. Logistics Fulfillment & Third-Party Disclosure

We only share strictly relevant personal information with trusted service providers bound by contractual non-disclosure and data protection covenants:

• Logistics Operators: We transmit your shipping address, recipient contact name, and mobile number to Shiprocket (BigFoot Retail Solutions Pvt. Ltd.) and affiliated carrier networks (BlueDart, Delhivery, DTDC) exclusively to accomplish physical doorstep delivery and SMS OTP verification.
• Transactional Notifications: SMS/WhatsApp notifications are routed through licensed enterprise telecommunication gateways for real-time tracking updates.
• Cloud Infrastructure: Encrypted databases hosted on enterprise cloud servers adhering to ISO 27001 and SOC 2 security standards.
• Legal Compulsion: We may disclose data only if strictly required under a lawful order issued by an Indian court or statutory regulatory authority.

7. Data Retention, Encryption & Storage Protocols

We retain your personal data only for as long as necessary to fulfill the purposes set out in this Policy:

• Active account information is maintained until you request closure or deletion.
• Order records and GST invoices are preserved for eight (8) financial years to comply with statutory requirements under the Companies Act, 2013 and CGST Act, 2017.
• All user data at rest is protected using industry-standard AES-256 encryption, role-based access control (RBAC), and continuous vulnerability monitoring.

8. Your Statutory Rights & Data Protection Controls

The Government of India has enacted the Digital Personal Data Protection Act, 2023 (DPDP Act), whose operative provisions and rules are being notified by the Central Government in phases. In alignment with both the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the DPDP framework as brought into force, you hold the following rights:

• Right to Access Information: Request confirmation and a summary of your personal data processed by our atelier, including the identities of logistics and payment partners with whom your data has been shared.
• Right to Correction & Erasure: Request the correction of inaccurate or misleading data, updating of incomplete records, or erasure of personal data that is no longer required for the purpose for which it was collected or for compliance with statutory laws.
• Right of Grievance Redressal: Access our readily available, time-bound grievance redressal mechanism through our designated Data Protection Officer.
• Right to Nominate: Nominate another individual to exercise these data rights on your behalf in the event of death or incapacity, in accordance with applicable rules.
• Right to Withdraw Consent: Under Section 6(4) of the DPDP Act 2023, you may withdraw your consent for any processing that is based on consent at any time. The withdrawal of consent will not affect the legality of processing carried out prior to withdrawal. If you withdraw consent for processing essential to order fulfillment, custom tailoring, or account delivery, our ability to provide those specific dependent services may cease.

To exercise any of these statutory rights, please send an email from your registered email account to grievance@pmcouture.in with the subject line "Data Subject Privacy Request".

9. Cookies, Tracking & Web Storage Preferences

Our web platform uses essential and functional cookies solely to enable core e-commerce capabilities:

• Essential Session Cookies: Maintain your active login session and retain items placed in your shopping bag.
• Security Tokens: Validate cross-site request authenticity and prevent unauthorized account access.
• We do not employ cross-site intrusive ad-tracking beacons or sell visitor tracking logs to third-party ad brokers.

10. Data Protection Officer & Grievance Redressal

In accordance with Section 8 of the DPDP Act 2023 and the Information Technology Act, 2000, our designated Data Protection & Grievance Redressal Officer is: