Privacy Policy

1.Introduction

Chiblu India (OPC) Private Limited (“Chiblu”, “we”, “us”) operates the website chiblu.com and its associated applications (the “Platform”). This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Platform.

This Privacy Policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable rules and regulations thereunder.

By using the Platform, you consent to the collection and use of your personal data as described in this Privacy Policy and the specific consent notices provided during registration and at various points of data collection on the Platform. Chiblu acts as a Data Fiduciary under the DPDP Act.

2.Data We Collect

3.Purpose of Collection

We collect and process your personal data for the following purposes:

• To operate the Platform and provide the Services, including account creation, Order processing, and payment facilitation
• To verify Seller identity and conduct KYC compliance
• To process payments, settlements, refunds, and TCS obligations through our Payment Partner (Razorpay)
• To communicate transactional information (Order confirmations, shipping updates, payment receipts)
• To send promotional communications (only with your explicit opt-in consent)
• To improve the Platform, analyse usage patterns, and enhance user experience
• To detect, prevent, and address fraud, abuse, or security threats
• To comply with legal obligations, including tax filings (GSTR-8, TCS), law enforcement requests, and regulatory requirements
• To facilitate dispute communication and enforce our Terms & Conditions

4.Lawful Basis for Processing

Under the DPDP Act, we process your personal data on the following bases:

• Consent: For account registration, marketing communications, and KYC verification. Consent is obtained through specific consent notices provided at the time of data collection, which clearly state the purpose of processing.
• Contractual Necessity: For processing Orders, payments, and providing the Services you have requested.
• Legal Obligation: For tax compliance (GST, TCS), regulatory filings, and responding to lawful government or court orders.
• Legitimate Interest: For fraud prevention, platform security, and service improvement, where such processing does not override your fundamental rights.

5.Data Sharing

We share your personal data only in the following circumstances:

6.Data Retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter to fulfil the purposes outlined in this Policy. Specific retention periods:

After the retention period, data will be securely deleted or anonymised. If we close the Chiblu marketplace, Section 16 explains what we keep and what we delete.

7.Your Rights as a Data Principal

Under the DPDP Act, you have the following rights:

8.Data Security

We implement reasonable security practices and procedures, including encryption of data in transit (TLS/SSL), secure storage of sensitive data, access controls, regular security audits, and incident response procedures. All payment data is processed by our RBI-licensed Payment Partner (Razorpay), which is PCI DSS Level 1 compliant. Chiblu does not store sensitive payment credentials.

Despite our efforts, no method of transmission or storage is completely secure. Chiblu does not guarantee or assure the absolute security of your data. In the event of a data breach, we will notify affected Data Principals and the Data Protection Board of India within 72 hours of becoming aware of the breach, or within such timeline as prescribed by the DPDP Act and rules thereunder.

9.Cookies and Tracking Technologies

The Platform uses cookies and similar technologies to keep you signed in, secure your session, remember your preferences, and understand how the Platform is used so we can improve it. These fall into two broad categories:

• Essential cookies — required for the Platform to function (for example, authentication, cart, and security). The Platform cannot work properly without them.
• Analytics cookies — help us measure traffic and usage patterns through third-party analytics services (such as Google Analytics) so we can improve the experience.

You can control or delete cookies at any time through your browser settings; most browsers let you block or remove cookies. Please note that disabling essential cookies may affect core functionality such as logging in or completing a purchase.

In line with India’s Digital Personal Data Protection Act, 2023, we are enhancing our cookie controls and will introduce an in-Platform consent option for non-essential cookies as these requirements take effect.

10.Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child's data has been collected, we will take steps to delete it promptly. Verifiable consent of a parent or lawful guardian is required for processing personal data of children as mandated under the DPDP Act.

11.Data Storage and Transfers

Personal data is stored on secure servers operated by our infrastructure provider (Supabase) located in Australia. Chiblu has entered into a Data Processing Agreement with Supabase that includes appropriate safeguards for cross-border data transfer, including encryption at rest and in transit, access controls, and data isolation.

Data transfers are conducted in compliance with the DPDP Act, 2023 and applicable rules. The Government of India has not, as of the date of this Policy, restricted data transfers to Australia under the DPDP Act. If cross-border transfer to any jurisdiction is restricted by the Central Government in the future, Chiblu shall migrate data to compliant infrastructure within the prescribed timeline.

Where cross-border transfer is necessary, appropriate safeguards including encryption and access controls are implemented.

12.Grievance Officer

In compliance with the DPDP Act and the IT (Intermediary Guidelines) Rules, 2021, Chiblu has appointed the following Grievance Officer:

The Grievance Officer shall acknowledge complaints within forty-eight (48) hours and resolve them within one (1) month. If the Data Principal is not satisfied with the resolution provided by the Grievance Officer within 30 days, the Data Principal may file a complaint with the Data Protection Board of India as established under the DPDP Act, 2023.

13.Modifications

We may update this Privacy Policy from time to time. Material changes will be communicated at least thirty (30) days before the effective date through email or prominent notice on the Platform. Continued use constitutes acceptance of the revised Policy.

14.Contact

For any privacy-related queries or concerns, contact:

15.Personal Data on Seller Websites

Some sellers operate their own standalone website powered by Chiblu (see the Seller Terms § 15). When you place an order on such a seller’s own website, the seller is the data fiduciary (controller) for the personal data you provide for that order — such as your name, phone number and delivery address — and Chiblu acts as a processor on the seller’s behalf, handling that data only to operate the website and complete the order. That data is shared with the seller so they can fulfil your order, and payment is handled through the seller’s own payment provider. If the seller stops using Chiblu, some information may be retained where required by law or necessary for accounting, security, fraud prevention, dispute resolution, or the establishment or defence of legal claims. For questions about how a particular seller uses your data, please refer to that website’s own privacy notice or contact the seller directly.

16.If the Chiblu Marketplace Closes

If we decide to close the Chiblu marketplace, we will handle your personal data as set out below.

We keep only what the law requires, or what we need to resolve an open complaint or legal claim:

• your name, email address and phone number, for 180 days after the marketplace closes, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require;
• records of Orders, invoices, payments, refunds and Seller payouts, for as long as tax laws require (up to eight (8) years from the date of the transaction);
• records of complaints, disputes and legal claims, until they are resolved and for up to three (3) years afterwards; and
• security logs, for up to two (2) years from when they were collected.

We store these records securely, use them only for the reason we kept them, and delete or anonymise them when that period ends. Until then, you can ask our Grievance Officer (Section 12) for a copy of anything we still hold about you.