Privacy Policy

The Fragrance Theoryis operated by the entity named in the Seller & Contact Details at the foot of this page, which is the data fiduciaryresponsible for your personal data under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Information you give us:

• Name, email address, and phone number when you create an account or place an order.
• Delivery and billing addresses.
• Order history, wishlist, cart contents, and product reviews you write.
• Any information you send us by email, WhatsApp, or the contact form.

Information collected automatically:

• IP address, browser type, device type, and operating system.
• Pages viewed, products viewed, time on site, and referring URL.
• Cookies and similar technologies (see section 6).

We never see or store your full card number, CVV, or UPI PIN.All payments are processed on Razorpay's PCI-DSS compliant systems. We receive only a payment reference, the amount, and whether the payment succeeded.

• To process, ship, and support your orders — necessary to perform our contract with you.
• To send transactional messages (order confirmations, dispatch and delivery updates, OTPs) — necessary to perform our contract.
• To prevent fraud, abuse, and to keep the site secure — our legitimate interest and legal obligation.
• To comply with tax, accounting, and consumer-protection law — legal obligation.
• To send marketing emails or WhatsApp messages — only with your consent, which you may withdraw at any time.
• To improve the site through analytics — with your consent where required.

We do not sell your personal data to anyone, and we do not use it to make automated decisions that produce legal effects for you.

We share only what is necessary, only with:

• Payment gateway (Razorpay) — to process your payment.
• Courier and logistics partners — your name, address and phone number, to deliver your order.
• Communication providers (email/SMTP and WhatsApp Business API) — to send you order and OTP messages.
• Analytics and advertising providers (Google Analytics, Meta Pixel) — where you have consented.
• Government or law-enforcement authorities — where we are legally required to.

These providers are bound to use your data only for the purpose we engaged them for. Some may process data outside India; where they do, we take steps to ensure it remains protected to the standard set out in this policy.

• Order, invoice and tax records: 8 years, as required by Indian tax and company law.
• Account details: for as long as your account is active, plus a reasonable period afterwards.
• Marketing consents: until you withdraw them.
• Analytics data: typically up to 26 months.

When data is no longer needed for any of the purposes above, we delete or anonymise it.

We use cookies that are strictly necessary to run the site (your session, your cart, and security). These cannot be switched off. We also use analytics and advertising cookies to understand how the site is used and to measure campaigns — these are optional and are set only where you have consented.

You can block or delete cookies in your browser settings, but the site may not work correctly without the strictly necessary ones.

Under the DPDP Act, 2023 you have the right to:

• Access the personal data we hold about you and a summary of how it is processed.
• Correct or complete data that is inaccurate or incomplete.
• Erase your personal data, where we are not legally required to keep it.
• Withdraw consent at any time, where processing was based on consent.
• Nominate another person to exercise your rights in the event of your death or incapacity.
• Raise a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if unresolved.

To exercise any of these, email hello@thefragrancetheory.in. We respond within 48 hours and resolve within 30 days. Note that we cannot delete records we are legally obliged to retain, such as tax invoices.

Passwords are stored hashed with bcrypt and are never readable by us or by our staff. Data is transmitted over HTTPS, sessions are protected with signed tokens, and access to customer data is restricted to staff who need it.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by law.

This site is not intended for anyone under 18. We do not knowingly process the personal data of children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy. The "last updated" date at the top will always reflect the current version, and material changes will be communicated to registered users.