DRAFT FOR LAWYER REVIEW — Pending Legal & Compliance Sign-Off
This privacy policy drafts DPDP Act 2023 compliance terms. Verify all third-party data processing agreements and cross-border transfer mechanisms with legal counsel.
Privacy Policy
Last Updated: September 2026 | Compliant with IT Act 2000 & DPDP Act 2023 | Ambika Jewels
1. Introduction & Scope
Ambika Jewels (“we”, “our”, or “us”) is committed to honoring and protecting the privacy of our customers and visitors. We operate our flagship fine jewelry showroom and online store from Shop no.3, E.W.S colony, Sector 1, Lower Roop Nagar, Jammu, Jammu & Kashmir 180013, India.
This Privacy Policy describes our practices regarding the collection, storage, processing, and disclosure of personal data collected through our website (ambikajewelsshop.com) in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable Indian data protection frameworks.
2. Personal Information We Collect
We collect information necessary to fulfill luxury fine jewelry purchases, provide concierge support, and comply with Indian statutory requirements:
- Identity & Contact Information: Full name, verified mobile phone number, email address, and delivery destination.
- Statutory Tax Identifiers (CBDT Rule 114B): Permanent Account Number (PAN) or Form 60 declaration where mandated by Indian tax law for transactions meeting statutory thresholds. PAN data is encrypted using AES-256-GCM.
- Transactional Records: Purchased jewelry items, purity specifications (e.g. 22K 916 BIS Hallmarked), gross/net weight in grams, GST tax invoice numbers, and payment transaction IDs.
- Technical & Session Data: Masked IP address, device telemetry, and essential browser storage required for cart persistence and rate-limiting defenses.
3. Authorized Third-Party Data Processors
We do not sell, rent, lease, or monetize your personal information. Data is shared exclusively with verified data processors strictly necessary for executing our e-commerce operations:
1. Supabase Inc. (Database & Cloud Infrastructure)
Role: Secure storage of customer orders, product catalogs, and encrypted records. Hosted in AWS Asia-Pacific (Mumbai, ap-south-1) region with strict Row Level Security (RLS) policies.
2. Razorpay Software Private Limited (Payment Gateway)
Role: PCI-DSS Level 1 certified payment processing for UPI, NetBanking, debit/credit cards. Ambika Jewels never captures, receives, or stores raw card or banking credentials.
3. BVC Logistics Private Limited (High-Value Armored Courier)
Role: Secure armored transit, tamper-evident security pouch tracking, and OTP verification for delivery of high-value precious gold cargo across India.
4. Groq Inc. (AI Concierge Cloud Inference)
Role: Real-time language processing for our virtual jewelry concierge (Aanya). Strictly subject to automated client-side PII redaction prior to transmission.
5. Cloud Hosting & Edge Delivery (Netlify / Vercel)
Role: Content delivery network (CDN), serverless edge functions, SSL/TLS certificate termination, and DDoS protection.
4. Cross-Border Data Transfers & Redaction Safeguards
Automated Redaction Protocol: Before any customer query is processed by our AI concierge powered by Groq Inc., our server automatically detects and redacts phone numbers, email addresses, PAN numbers, Aadhaar identifiers, and street addresses.
All core financial, order, and customer database records remain stored securely within India (AWS ap-south-1 Mumbai via Supabase). Any ephemeral cross-border transit for LLM inference is conducted under contractual confidentiality safeguards consistent with the DPDP Act, 2023.
5. Data Retention & Purge Schedule
We retain personal information strictly for as long as required to fulfill transactional purposes and statutory obligations:
- Tax & GST Invoices (HSN 7113): Retained for 8 financial years in accordance with Section 36 of the CGST Act, 2017 and Section 44AB of the Income Tax Act, 1961 (verify with CA/lawyer).
- Encrypted PAN & Form 60 Records: Retained for statutory audit periods mandated by CBDT Rule 114B and Prevention of Money Laundering Act (PMLA) regulations.
- AI Concierge Chat Histories: Chat conversation histories and rate-limiting counters are purged after 30 calendar days.
- Ephemeral Session Cookies: Expire automatically upon closing your browser or completing checkout.
6. Data Principal Rights (DPDP Act, 2023)
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Right to Access: Request a summary of personal data held about you and processing activities undertaken.
- Right to Correction & Updating: Request correction of inaccurate, misleading, or outdated personal contact information.
- Right to Erasure / Deletion: Request deletion of your personal data, subject to mandatory statutory tax and accounting retention requirements under Indian law.
- Right to Nominate: Nominate an individual to exercise your data rights in the event of incapacity.
- Right to Grievance Redressal: Register any concerns or complaints regarding your personal data with our Grievance Officer.
7. Grievance Redressal & Compliance Officer
In compliance with Rule 5(6) of the Consumer Protection (E-Commerce) Rules, 2020 and Section 13(1) of the DPDP Act, 2023:
Officer: Lakesh Kumar
Designation: Grievance Redressal & Compliance Officer
Organization: Ambika Jewels
Physical Address: Shop no.3, E.W.S colony, Sector 1, Lower Roop Nagar, Jammu, Jammu & Kashmir 180013, India
Direct Email: contact@ambikajewelsshop.com
Phone: +919682589725
Statutory Response: Acknowledgement within 48 hours; resolution within 30 days (verify with CA/lawyer under Consumer Protection Rules)