Privacy policy

Got it. I have updated the first paragraph with your website link. Here is the final, complete Privacy Policy ready to be copied directly to your site:

PRIVACY POLICY Last updated: October 11, 2026

Vaar ("we", "us", "our") operates www.vaar.in (the "Site"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our Site, create an account, or make a purchase.

This policy complies with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 of India. If you are located outside India, please note that your data will be processed in accordance with Indian law, which may differ from the laws of your jurisdiction.

1. WHO WE ARE Data Fiduciary: Vaar Registered Address: 341 Bhidbajan Society, Near Piyesh Point, Pandesra, Surat 394221, Gujarat, India Email: vaaronline@gmail.com

Grievance Officer: Yash Rank Grievance Officer Email: vaaronline@gmail.com Grievance Officer Phone: +91 9978936740 Grievance Officer Address: 341 Bhidbajan Society, Near Piyesh Point, Pandesra, Surat 394221, Gujarat, India

Our store is hosted on Shopify Inc., which provides us with the online e-commerce platform that allows us to sell our products to you.

1. WHAT PERSONAL DATA WE COLLECT We collect only the personal data that is necessary for the purposes stated below. "Personal Data" means any information that can identify you directly or indirectly.

A. Information You Provide Directly: Identity Data: Your name Contact Data: Email address, phone number Address Data: Billing address, shipping address Order Data: Products purchased, order value, payment confirmation Account Data: Username, password (encrypted), account preferences Customer Support Data: Messages, emails, or communications you send us Review Data: Product reviews or ratings you submit

B. Information Collected Automatically: Device Data: IP address, browser type and version, operating system Usage Data: Pages visited, time spent, products viewed, search terms Cookie Data: Cookie identifiers, preferences stored in cookies Location Data: General location derived from IP address

C. Information from Third Parties: Payment Data: Our payment processors (Shopify Payments / Razorpay / Stripe) collect payment instrument details (credit/debit card, UPI, net banking). We do NOT store your full card number or CVV. Analytics Data: Google Analytics and Shopify Analytics provide aggregated data about how visitors use our Site. Advertising Data: Meta (Facebook/Instagram) and Google may provide data about ad interactions, but only if you have consented to marketing cookies.

We do NOT collect government-issued national identity numbers, biometric data, health data, or any sensitive personal data as defined under the DPDP Act, 2023.

1. WHY WE COLLECT YOUR DATA (PURPOSES) We process your personal data ONLY for the following specific purposes:

• Order Fulfillment: Name, address, phone, email, order details (Legal Basis: Performance of contract)

• Payment Processing: Payment confirmation, billing address (Legal Basis: Performance of contract)

• Shipping & Delivery: Name, shipping address, phone (Legal Basis: Performance of contract)

• Customer Support: Name, email, phone, order history, messages (Legal Basis: Performance of contract)

• Fraud Prevention: IP address, device info, payment patterns (Legal Basis: Legitimate interest)

• Account Management: Username, password, order history, loyalty points (Legal Basis: Performance of contract)

• Marketing & Promotions: Email, phone, purchase history (Legal Basis: Your explicit consent ONLY)

• Website Analytics: IP address, browsing behavior, device info (Legal Basis: Your explicit consent ONLY)

• Personalized Advertising: Email hash, purchase behavior, browsing data (Legal Basis: Your explicit consent ONLY)

• Legal Compliance: Order records, tax data (Legal Basis: Compliance with law)

We do NOT use your data for any purpose other than those listed above. We do NOT use automated decision-making that produces legal or similarly significant effects.

1. HOW WE COLLECT YOUR DATA Direct Collection: When you fill out forms, place orders, create an account, or contact us. Automated Collection: Through cookies, pixels, web beacons, and similar technologies when you browse our Site. Third-Party Collection: Our service providers (Shopify, payment processors, shipping partners) collect data on our behalf as necessary to provide their services.

2. LEGAL BASIS FOR PROCESSING (DPDP ACT, 2023) Under the DPDP Act, 2023, we process your personal data based on: Consent: For marketing communications, analytics cookies, advertising cookies, and sharing data with advertising partners. You have the right to withdraw this consent at any time. Performance of Contract: For processing orders, payments, shipping, and account management — necessary to fulfill our contract with you. Compliance with Law: For maintaining tax records, responding to legal requests, and complying with applicable regulations. Legitimate Uses: For fraud prevention, network security, and ensuring the integrity of our services.

3. YOUR RIGHTS AS A DATA PRINCIPAL Under the DPDP Act, 2023, you have the following rights:

A. Right to Access You may request a copy of all personal data we hold about you. We will provide this in a structured, commonly used format within 30 days of your request.

B. Right to Correction & Erasure You may request that we correct inaccurate or misleading data, complete incomplete data, update outdated data, or erase your personal data. We will action this within 30 days, unless retention is required by law.

C. Right to Grievance Redressal If you have any concern about how we handle your data, you may contact our Grievance Officer (details in Section 1). We will acknowledge your complaint within 24 hours and resolve it within 30 days. If you are unsatisfied with our response, you may escalate to the Data Protection Board of India.

D. Right to Nominate You may nominate any other individual who shall exercise your rights in case of your death or incapacity.

E. Right to Withdraw Consent Where we rely on your consent, you may withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing before withdrawal. You can withdraw consent by:

• Clicking "Withdraw Consent" in our cookie banner

• Clicking "Unsubscribe" in any marketing email

• Emailing vaaronline@gmail.com with subject "Withdraw Consent"

1. HOW TO EXERCISE YOUR RIGHTS To exercise any of your rights, please contact us: Email: vaaronline@gmail.com Subject Line: "DPDP Data Request — Yash Rank"

Please include:

• Your full name

• Email address associated with your account

• Phone number

• Order number (if applicable)

• Specific request (access / correction / erasure / grievance)

We may need to verify your identity before processing your request. We will NOT discriminate against you for exercising your rights.

1. DATA RETENTION We retain your personal data only for as long as necessary for the purposes for which it was collected:

• Active Orders: Until delivery is completed + 30 days (for returns/exchanges)

• Order Records: 3 years from the date of your last purchase, after which personal identifiers are deleted or anonymized

• Account Information: Until you delete your account or request erasure

• Marketing Data: Until you withdraw consent or unsubscribe, after which it is deleted within 30 days

• Customer Support Records: 1 year from the date of resolution

• Cookie & Analytics Data: 1 year from collection, or until you withdraw consent

• Tax & Legal Records: As required by Indian law (business records retained; personal identifiers removed where possible)

After the retention period expires, your data is permanently deleted from our active systems. Backups may retain data for up to 90 additional days before being overwritten.

1. DATA SHARING & DISCLOSURE We do NOT sell your personal data. We share your data ONLY with the following categories of recipients, and only for the purposes stated:

A. Service Providers (Data Processors):

• Shopify Inc. — E-commerce platform hosting, payment processing, data storage (Location: Canada / USA)

• Payment Processors — Razorpay, Stripe, or Shopify Payments for transaction processing (Location: India / USA)

• Shipping Partners — Delhivery, Shiprocket, or similar for order fulfillment (Location: India)

• Email Service Providers — For order confirmations and support communication

• Cloud Storage Providers — For secure data backup These providers process data ONLY on our instructions and are contractually bound to protect your data.

B. Advertising Partners (With Your Explicit Consent Only):

• Meta Platforms, Inc. (Facebook/Instagram) — For ad targeting and measurement

• Google LLC — For Google Ads and remarketing

• Shopify Audiences — For lookalike audience creation We share ONLY: Email hash, purchase behavior (anonymized where possible), and browsing patterns. We do NOT share your name, phone number, or address with advertising partners.

C. Legal & Regulatory Disclosures: We may disclose your data if required by law, court order, or government request, or to protect our rights, property, or safety, or that of our users.

D. Business Transfers: If Vaar is acquired by or merged with another company, your data may be transferred to the new owner, who must honor the commitments in this Privacy Policy.

1. CROSS-BORDER DATA TRANSFERS Your personal data may be transferred to and processed in countries outside India, including Canada and the United States, where Shopify and some of our service providers are located.

We ensure appropriate safeguards for such transfers through:

• Standard Contractual Clauses (SCCs) with Shopify

• Shopify's Data Processing Addendum (DPA)

• Google's and Meta's standard data protection terms

The Government of India has not currently notified any restricted countries for data transfers under the DPDP Act. We monitor notifications from the Data Protection Board and will update this policy if restrictions change.

1. COOKIES & TRACKING TECHNOLOGIES We use cookies and similar technologies to:

• Enable essential site functionality (shopping cart, checkout, account login)

• Analyze site usage and improve performance

• Deliver personalized advertising (ONLY with your consent)

Cookie Categories:

• Essential: Site functionality, security, checkout (Consent Required? No — Required)

• Analytics: Google Analytics, Shopify analytics (Consent Required? Yes — Explicit consent)

• Marketing: Meta Pixel, Google Ads, retargeting (Consent Required? Yes — Explicit consent)

• Preferences: Language, region, currency (Consent Required? Yes — Explicit consent)

You can manage your cookie preferences at any time by clicking "Cookie Settings" in the footer of our Site. You may also withdraw consent for non-essential cookies by clicking "Withdraw Consent." For more details, see our full Cookie Policy or visit: https://www.shopify.com/legal/cookies

1. CHILDREN'S DATA Our Site and services are intended for individuals who are 18 years of age or older. We do not knowingly collect personal data from children under 18.

If you are under 18:

• You must NOT create an account or make a purchase without verifiable parental or guardian consent.

• If you believe a child under 18 has provided us with personal data without parental consent, please contact us immediately at vaaronline@gmail.com.

• Upon receiving such notice, we will delete the child's data within 7 days.

We do NOT:

• Track or profile children for advertising purposes

• Send marketing communications to users known to be under 18

• Use children's data for behavioral analysis

1. DATA SECURITY We implement reasonable technical and organizational security measures to protect your personal data:

• Encryption: All data transmission uses SSL/TLS encryption (HTTPS)

• Password Protection: Account passwords are hashed using industry-standard algorithms

• Access Control: Only authorized personnel (Yash Rank) can access customer data

• Two-Factor Authentication (2FA): Enabled on all admin accounts

• Payment Security: Full card numbers are never stored on our servers; processed directly by PCI-DSS compliant payment gateways

• Regular Updates: Shopify platform security updates are applied automatically

• Backup: Encrypted backups are maintained for disaster recovery

Please note that no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

1. DATA BREACH NOTIFICATION In the unlikely event of a personal data breach, we will:

• Take immediate steps to contain and investigate the breach

• Notify the Data Protection Board of India without delay (within 72 hours where feasible)

• Notify affected users via email with details of:

  • What happened

  • What data was involved

  • Steps we are taking

  • Steps you should take

• Document the breach and our response for at least 1 year

1. THIRD-PARTY LINKS Our Site may contain links to third-party websites (e.g., social media platforms, payment gateways). We are not responsible for the privacy practices of these websites. We encourage you to read their privacy policies before providing any personal data.

2. CHANGES TO THIS PRIVACY POLICY We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will notify you by:

• Posting the updated policy on this page with a new "Last updated" date

• Sending an email to registered users (for significant changes)

• Displaying a notice on our Site

We encourage you to review this policy periodically. Continued use of our Site after changes constitutes acceptance of the updated policy.

1. GOVERNING LAW & JURISDICTION This Privacy Policy and your use of our Site are governed by the laws of the Republic of India. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in Surat, Gujarat, India.

This policy is drafted in compliance with:

• The Digital Personal Data Protection Act, 2023

• The Digital Personal Data Protection Rules, 2025

• The Information Technology Act, 2000 (as applicable)

1. CONTACT US For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Vaar Email: vaaronline@gmail.com Address: 341 Bhidbajan Society, Near Piyesh Point, Pandesra, Surat 394221, Gujarat, India

For grievances related to data protection: Grievance Officer: Yash Rank Email: vaaronline@gmail.com Phone: +91 9978936740 Address: 341 Bhidbajan Society, Near Piyesh Point, Pandesra, Surat 394221, Gujarat, India

If you are not satisfied with our response, you may escalate your complaint to: Data Protection Board of India Website: dpdpboard.gov.in

© 2026 Vaar. All rights reserved.