1. Introduction

Scentscape (“Scentscape,” “we,” “us,” or “our“) is a fragrance and perfume brand operated by a Partnership/LLP registered in India (Founders: Ankita Deore and Rupal Dahite). This Privacy Policy explains how we collect, use, disclose, store, and protect personal information of our customers and website visitors (“you,” “your“) when you interact with us through:

• Our website, [INSERT WEBSITE URL];
• WhatsApp; and
• Instagram/social media direct messages,

in connection with the marketing, sale, and delivery of our perfume and fragrance products within India.

By using our website or purchasing from us through any of the above channels, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use our website or provide us with your personal information.

2. Scope

This Privacy Policy applies to personal information collected by Scentscape:

• Through our website (browsing, account creation, checkout, contact forms, cookies);
• Through direct orders and conversations on WhatsApp;
• Through direct orders and conversations on Instagram/social media; and
• Through customer support interactions via email, phone, or WhatsApp.

This Policy does not apply to third-party websites, platforms, or services that we may link to or that you use to contact us (such as WhatsApp, Instagram, or Meta), which are governed by their own privacy policies (see Section 15).

3. Definitions

• “Personal Information” means any information that identifies or can be used to identify you, directly or indirectly, such as your name, contact details, or order information.
• “Processing” means any operation performed on personal information, including collection, storage, use, disclosure, or deletion.
• “Data Fiduciary” means the entity that determines the purpose and means of processing personal data (Scentscape, in respect of your data).
• “Data Principal” means the individual to whom the personal data relates (you, our customer or website visitor).
• “DPDP Act” means India’s Digital Personal Data Protection Act, 2023, together with the Digital Personal Data Protection Rules, 2025, as may be amended, notified, or brought into force from time to time.

4. Information We Collect

4.1 Information you provide to us directly

• Name
• Phone number
• Email address
• Shipping address
• Billing address (where applicable)
• Order details (products purchased, quantities, order history)
• Product preferences and enquiries (e.g., fragrance preferences shared via chat or a fragrance-finder tool)
• Payment/transaction information necessary to process your order (see Section 6 on what we do and do not store)
• Any information you voluntarily share with us over WhatsApp, Instagram DMs, email, or other customer-support channels (which may include your name, preferences, complaints, or other details you choose to share)

4.2 Information collected automatically through our website

• IP address, browser type, device type, and operating system
• Pages visited, time spent on pages, referral source, and browsing behaviour
• Cookies and similar tracking technologies (see Section 10)

We currently use Google Analytics and Meta Pixel on our website to understand website traffic and measure the performance of our marketing.

We do not knowingly collect more information than is reasonably necessary for the purposes described in Section 5, and we do not collect sensitive categories of personal data (such as health, biometric, or financial account credentials) beyond what is necessary to process a payment through our payment gateway.

5. Purposes for Which We Use Your Information

We collect and use your personal information to:

1. Process and confirm your orders;
2. Confirm and reconcile payments;
3. Arrange shipping and delivery of your order;
4. Provide customer support and respond to your enquiries;
5. Handle returns, refunds, replacements, and complaints;
6. Detect, investigate, and prevent fraud, unauthorised transactions, and misuse of our website or services;
7. Maintain business, accounting, tax, and transaction records as required by law;
8. Improve our website, products, and overall customer experience (including through analytics);
9. Send you marketing and promotional communications, where you have consented or where otherwise legally permitted (see Section 16); and
10. Comply with applicable Indian laws, regulations, and lawful requests from government or regulatory authorities.

5.1 Legal basis for processing

Under the DPDP Act, we process your personal information primarily on the basis of:

• Your consent, given at the time you place an order, sign up, or otherwise interact with us (e.g., for marketing communications); and
• Legitimate uses recognised under the DPDP Act, such as processing necessary to fulfil a contract with you (e.g., fulfilling an order you have placed), or as necessary for compliance with any law.

Where our processing relies on your consent, you may withdraw that consent at any time as described in Section 12, without affecting the lawfulness of processing carried out before withdrawal.

6. Payment Processing

Our website processes payments through a third-party payment gateway ([CONFIRM: payment gateway to be used — e.g., Razorpay, CCAvenue, or other]).

• When you make a payment, your card, UPI, net-banking, or wallet details are entered directly into our payment gateway’s secure payment page and are processed by that payment gateway, not by Scentscape.
• Scentscape does not store your complete card number, CVV, UPI PIN, net-banking password, or other sensitive payment credentials on our own systems.
• We may receive limited information from our payment gateway to confirm your order, such as the payment status (successful/failed), transaction ID, order amount, and a masked/partial reference to the payment method used (e.g., last 4 digits of a card, where provided by the gateway).
• Our payment gateway processes your payment information in accordance with its own privacy policy and security standards (such as PCI-DSS compliance maintained by the gateway provider), which we encourage you to review separately. [CONFIRM: link to payment gateway’s privacy policy once finalised]

7. Order Fulfilment and Delivery

To deliver your order, we share the following information with our courier/logistics partners strictly for fulfilment purposes:

• Name
• Phone number
• Shipping address
• Order details (items, quantity, order value where relevant for cash-on-delivery)

Our courier/logistics partners use this information only to fulfil delivery and are responsible for handling it in accordance with their own privacy and data-handling practices.

8. WhatsApp and Instagram/Social Media Communications

You may choose to place orders, ask questions, or share information with us directly through WhatsApp or Instagram/social media direct messages. When you do so:

• We collect and store the information you voluntarily provide (such as your name, phone number, address, order details, and preferences) to process your order and respond to you.
• These conversations take place on platforms owned and operated by third parties (Meta Platforms, Inc., for WhatsApp and Instagram). Your use of these platforms is also subject to their own privacy policies and terms, over which Scentscape has no control.
• We recommend reviewing WhatsApp’s and Instagram’s respective privacy policies to understand how they separately process your information.

9. Cookies and Analytics

9.1 What are cookies?

Cookies are small text files placed on your device when you visit our website. They help our website function properly and help us understand how visitors use our site.

9.2 Types of cookies we use

• Essential/strictly necessary cookies — required for core website functions such as maintaining your shopping cart, enabling checkout, and remembering your login session. The website may not function properly without these.
• Analytics/performance cookies — used by Google Analytics to help us understand how visitors use our website (e.g., pages visited, time spent, navigation paths), so we can improve website performance and user experience.
• Advertising/marketing cookies — used by Meta Pixel to help us measure the effectiveness of our advertising and to show you more relevant ads on Meta platforms (Facebook/Instagram). [CONFIRM: whether any other advertising tools, e.g., Google Ads remarketing, are used]

9.3 Managing cookies

Most web browsers allow you to control cookies through their settings, including blocking or deleting cookies. Please note that disabling certain cookies may affect the functionality of our website (e.g., you may not be able to complete a purchase). You can also manage your ad preferences directly through your Google and Meta account settings.

10. Third-Party Service Providers

We may share your personal information with the following categories of third-party service providers, solely for the purposes described in Section 5, and only to the extent necessary for them to perform their services to us:

• Payment gateways — to process payments (see Section 6)
• Courier/logistics companies — to deliver your orders (see Section 7)
• Website hosting and e-commerce platform providers — to host and operate our website (e.g., Shopify)
• Analytics providers — Google Analytics, to understand website usage
• Advertising/marketing providers — Meta (Facebook/Instagram), for Meta Pixel-based advertising, and any email/WhatsApp marketing or CRM tools we use [INSERT: name of CRM/marketing tool, if applicable]
• Customer support providers/tools, where applicable
• Professional advisers — such as our accountants, auditors, or lawyers, where necessary
• Government or law-enforcement authorities, where required by applicable law, regulation, court order, or legal process

We do not sell or rent your personal information to any third party for their own independent marketing purposes.

11. Data Retention

We retain your personal information only for as long as reasonably necessary for the purposes set out in this Policy, including to:

• Fulfil active and recent orders, and handle any related returns, replacements, or complaints;
• Maintain accounting, tax, and transaction records for the period required under applicable Indian tax and financial regulations;
• Maintain customer support records to resolve any recurring issues or disputes;
• Comply with legal, regulatory, or record-keeping obligations under applicable Indian law; and
• Retain your marketing preferences until you opt out or withdraw consent.

We do not retain personal information for longer than is necessary for these purposes, and we periodically review the information we hold. [INSERT/VERIFY: specific retention periods if determined internally, e.g., “X years from the date of last transaction,” once finalised with your accountant/legal adviser]

12. Data Security

We implement reasonable technical and organisational measures designed to protect your personal information from unauthorised access, alteration, disclosure, or destruction. These may include restricting access to personal information to authorised personnel, using secure connections (such as HTTPS) on our website, and relying on payment gateways that maintain their own industry-standard security certifications.

However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security of your information. You also play a role in protecting your information — for example, by not sharing sensitive payment details over WhatsApp, Instagram, or email.

13. Your Rights

As a Data Principal under the DPDP Act, and subject to its applicable provisions and rules, you may have the right to:

• Access the personal information we hold about you;
• Correct or update inaccurate or incomplete personal information;
• Erasure/deletion of your personal information, where it is no longer necessary for the purpose it was collected, subject to our legal and record-keeping obligations;
• Withdraw consent at any time, where our processing is based on your consent (such as marketing communications), without affecting processing already carried out;
• Grievance redressal — to raise a complaint about how we handle your personal information (see Section 18); and
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, as may be provided under the DPDP Act.

To exercise any of these rights, please contact us using the details in Section 18. We may need to verify your identity before acting on your request, and we will respond within a reasonable time in accordance with applicable law.

Note: the DPDP Act, 2023 and the Digital Personal Data Protection Rules, 2025 were notified in November 2025 and are being brought into force in phases; certain procedural aspects (such as detailed Data Principal grievance timelines) are still being operationalised by the Government of India. This section will be updated as further clarity becomes available. [VERIFY current implementation status before publishing]

14. Children’s Privacy

Our products and website are intended for adult customers. We do not knowingly market to or collect personal information from children. If we become aware that we have inadvertently collected personal information from a child without appropriate parental/guardian consent, as required under the DPDP Act, we will take steps to delete such information. If you believe a child has provided us with personal information, please contact us using the details in Section 18.

15. Data Breach / Security Incidents

In the event of a personal data breach that affects your personal information, we will take reasonable and legally required steps to investigate the incident, mitigate its impact, and — where required under applicable Indian law — notify the Data Protection Board of India and/or affected individuals. [Do not commit to a specific notification timeline unless legally mandated and verified — VERIFY applicable DPDP breach-notification requirements at the time of publishing]

16. International Data Processing/Transfers

Scentscape currently sells only within India. However, some of our third-party service providers (such as our website hosting platform, analytics provider, or advertising provider) may store or process personal information on servers located outside India. **[VERIFY: which specific service providers, if any, store/process data outside India, e.g., Shopify’s hosting infrastructure, Google Analytics, Meta] ** Where this occurs, such providers are responsible for ensuring appropriate safeguards in accordance with their own policies and applicable law.

17. Third-Party Websites and Links

Our website or communications may contain links to third-party websites, social media platforms, or payment services that are not operated by us (such as Instagram, WhatsApp, or our payment gateway). We are not responsible for the privacy practices or content of these third-party services. We encourage you to review their privacy policies separately.

18. Marketing Communications

With your consent, we may send you promotional emails, WhatsApp messages, or other marketing communications about new products, offers, and updates from Scentscape.

• You will not receive marketing messages unless you have opted in or otherwise provided your contact details to us in a context where marketing communications were disclosed.
• You can opt out of marketing communications at any time by [INSERT: unsubscribe link / replying “STOP” / contacting us directly].
• Please note that even after opting out of marketing communications, we may still need to send you essential transactional communications (such as order confirmations, shipping updates, or responses to your support requests), which are not considered marketing.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. Any changes will be posted on this page with a revised “Last Updated” date. We encourage you to review this Policy periodically. Continued use of our website or services after changes are posted constitutes your acknowledgement of the updated Policy.

20. Contact Us and Grievance Redressal

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal information, please contact us at:

Privacy Contact / Grievance Officer: [INSERT NAME/DESIGNATION] Email: [INSERT EMAIL] Phone/WhatsApp: [INSERT NUMBER] Business Address: [INSERT ADDRESS]

We will acknowledge and address your query or complaint in a timely manner, in accordance with applicable Indian law. If you are not satisfied with our response, you may have the right to escalate your complaint to the Data Protection Board of India, once its grievance-handling mechanisms are fully operational, or to any other competent authority under applicable law.

21. Governing Law

This Privacy Policy is governed by the laws of India, including (where applicable) the Digital Personal Data Protection Act, 2023 and its Rules, the Information Technology Act, 2000, the Consumer Protection Act, 2019, and the Consumer Protection (E-Commerce) Rules, 2020. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at [INSERT CITY, e.g., Pune/Mumbai].

This Privacy Policy is a general template prepared for Scentscape based on information provided and is intended as a strong starting point. It has not been reviewed by a qualified Indian lawyer or privacy professional and should not be treated as legal advice. We strongly recommend having this Policy reviewed by an Indian data protection/e-commerce lawyer before publishing it live, particularly given that the DPDP Act, 2023 and its Rules are still being implemented in phases as of 2026.