Privacy Policy

This Privacy Policy explains how HUZZAY DIGITAL LLP, having its registered office at 414-416, Bezzola Complex, VN Purav Marg, Chembur, Mumbai 400071 ("Huzzay", "we", "us" or "our"), collects, uses, shares, stores and protects personal data when you access or use the Huzzay website, mobile application, gift and event registry, merchant marketplace, payment-enabled features, communications and related services (collectively, the "Platform").

Please read this Privacy Policy with our Terms of Use and any notice presented when personal data is collected. By using the Platform, you acknowledge this Privacy Policy. Where consent is required, Huzzay will seek it through an appropriate affirmative action; merely reading this Privacy Policy does not by itself constitute consent for every processing activity.

1. ABOUT THIS POLICY AND APPLICABLE LAW

(i) Huzzay processes personal data in accordance with applicable Indian law, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), applicable directions of the Indian Computer Emergency Response Team ("CERT-In"), and the Digital Personal Data Protection Act, 2023 and rules made under it ("DPDP Law"), in each case to the extent in force and applicable.
(ii) This Privacy Policy applies to Buyers, Registry Owners, Guests, Merchants, visitors and other users of the Platform (each, a "User" or "you"). Capitalised terms not defined here have the meanings given in the Terms of Use.
(iii) Huzzay determines the purposes and means of processing personal data collected for operating the Platform and, when the relevant DPDP Law provisions apply, acts as a Data Fiduciary for that processing. A Merchant or Payment Provider may separately determine how it processes information for its own purposes and may therefore act as an independent data fiduciary, controller or regulated entity, as applicable.

2. PERSONAL DATA WE COLLECT

(i) Account and profile data: name, mobile number, email address, profile image, account identifiers, login and verification information, preferences and communication settings.
(ii) Registry and event data: registry title, event type and date, host or recipient details, guest lists, invitation responses, messages, photographs, delivery preferences, gift selections, contributions and other content you choose to provide. Depending on the settings selected by the Registry Owner, some registry or event information may be visible to invitees or the public.
(iii) Transaction and payment data: items viewed or selected, merchant and order details, billing or delivery address, price, taxes, Platform Fees, payment status, transaction reference, refund, chargeback and reconciliation data. Payments are processed by Razorpay or another Payment Provider. Huzzay does not intend to collect or store full card numbers, CVV, UPI PINs, banking passwords or comparable payment credentials, although it may receive masked payment details and transaction metadata.
(iv) Merchant data: business and contact details, authorised representative information, listings, tax or registration details, bank or settlement information, verification or know-your-business records, complaints, fulfilment records and other information required to onboard, administer or review a Merchant.
(v) Communications and content: enquiries, support requests, complaints, reviews, feedback, call or correspondence records and content submitted to the Platform.
(vi) Device, cookie and usage data: IP address, device and browser type, operating system, app version, device identifiers, access time, referral information, clickstream, session, diagnostic, security and fraud signals, approximate location inferred from IP, and cookie or similar-technology data.
(vii) Data from others: information received from Registry Owners, Guests, Merchants, Payment Providers, logistics or communications providers, identity or fraud-prevention services, social sign-in providers and publicly available or lawful sources. We may combine such information with information already held by us.

3. HOW WE USE PERSONAL DATA

(i) We process personal data to create and administer Accounts; provide gift and event registries, invitations, guest responses and related features; personalise the User experience; and provide free and paid Services.
(ii) We use relevant information to display Merchant Offerings; transmit orders and delivery details; facilitate checkout, payment, settlement, refunds and chargebacks; reconcile Platform Fees; and provide transaction and service communications. The sale contract for a Merchant Offering remains directly between the Merchant and Buyer as stated in the Terms of Use.
(iii) We may use personal data to verify Users and Merchants; prevent fraud, abuse and security incidents; moderate listings and content; enforce our agreements; investigate complaints; protect Users, Huzzay and third parties; and establish, exercise or defend legal claims.
(iv) We process information to operate, troubleshoot, analyse, audit, test, secure and improve the Platform; understand feature usage; develop new services; and generate aggregated or anonymised insights that do not identify an individual.
(v) We may use contact details for updates, offers and promotional communications where permitted by law or with consent where required. You may opt out of marketing at any time. Opting out does not stop essential Account, registry, order, payment, security or legal messages.
(vi) We may also process personal data for a purpose disclosed when collected, with your consent, or where permitted or required by applicable law.

4. CONSENT AND OTHER PERMITTED PROCESSING

(i) Where Huzzay relies on consent, the request will describe the specified purpose and personal data required and will be presented in clear language. Additional consent may be requested for optional marketing, device permissions, publication of identifiable testimonials or other non-essential processing.
(ii) You may withdraw consent through the available Platform setting or by contacting us. Withdrawal does not affect processing already carried out lawfully. It may prevent Huzzay from providing a feature that necessarily depends on the relevant data, but we will explain the material consequence where practicable.
(iii) Huzzay may process personal data without separate consent where applicable law permits or requires it, including to complete a transaction you requested, comply with law or a court order, respond to emergencies, prevent fraud, protect legal rights or perform other lawful and legitimate uses.

5. REGISTRIES, GUESTS AND DATA ABOUT OTHER PEOPLE

(i) A Registry Owner controls the registry's privacy and sharing settings. Public or widely shared registries may be indexed, copied or reshared by others. Registry Owners should select settings appropriate to the event and avoid publishing home addresses, phone numbers, children's information or other unnecessary personal data.
(ii) If you provide another person's personal data, including through a guest list, invitation, delivery instruction or recipient profile, you represent that you are authorised or otherwise have a lawful basis to do so and have provided any notice required by law. You must not use the Platform to collect or disclose another person's personal data unlawfully.
(iii) Huzzay may send an invitation or operational message at a User's request. The recipient may contact us to object, request deletion where applicable or prevent further non-essential communications. Huzzay may preserve limited suppression and compliance records so that the request can be honoured.

6. WHEN WE SHARE PERSONAL DATA

(i) Merchants: We share information reasonably necessary to process an order, deliver or provide a Merchant Offering, issue an invoice, handle returns, warranty or support, prevent fraud and resolve a complaint. A Merchant is independently responsible for its subsequent collection and use of personal data for fulfilment, legal compliance and any purpose it separately determines. Review the Merchant's privacy notice before transacting.
(ii) Payment Providers: Payment and verification information may be collected directly by Razorpay or another Payment Provider under its terms, privacy notice, security standards and regulatory obligations. Huzzay may exchange order, payer, transaction, refund and fraud information needed to facilitate and support the payment.
(iii) Service providers: We may share personal data with hosting, cloud, analytics, communications, customer-support, cybersecurity, identity-verification, logistics and professional-service providers that assist Huzzay. Where they process data on Huzzay's behalf, we require appropriate confidentiality, security and purpose restrictions.
(iv) Authorities and protection of rights: We may disclose information where reasonably necessary to comply with law, a court or regulatory direction; report or investigate a security incident; prevent unlawful activity; protect safety, property or rights; enforce our agreements; or establish, exercise or defend a claim.
(v) Corporate transactions: Information may be disclosed in connection with a proposed or completed merger, financing, restructuring, acquisition or transfer of all or part of Huzzay's business, subject to appropriate confidentiality and applicable law.
(vi) Huzzay does not sell personal data for money. Huzzay is not responsible for a Merchant's, Payment Provider's or other independent third party's separate processing, but this does not limit any non-excludable obligation of Huzzay under applicable law.

7. COOKIES AND SIMILAR TECHNOLOGIES

(i) The Platform may use cookies, software development kits and similar technologies that are necessary for authentication, preferences, security, payments and Platform operation, and optional technologies for analytics or advertising. Where required, non-essential technologies will be used only after an appropriate choice or consent.
(ii) You may manage cookies through the Platform or browser settings. Blocking necessary cookies may affect core functionality. Huzzay will provide a cookie banner or settings tool if and to the extent required for the technologies deployed.

8. YOUR CHOICES AND RIGHTS

(i) Subject to applicable law and verification of your identity, you may request information about Huzzay's processing of your personal data; correction or completion of inaccurate or incomplete data; erasure of data no longer required for a lawful purpose; withdrawal of consent; and grievance redressal. When the relevant DPDP Law provisions apply, you may also exercise the right to nominate another individual in the manner prescribed by law.
(ii) You can update certain Account, registry and communication preferences directly through the Platform. Requests that cannot be completed through the Platform may be sent using the contact details below. We may request information reasonably necessary to verify and action the request.
(iii) These rights are not absolute. Huzzay may retain or continue processing information where required for an existing order, payment, refund, fraud prevention, security, tax, accounting, legal claim, regulatory obligation or other lawful purpose. We will respond within the period required by applicable law.

9. RETENTION AND DELETION

9.1 Huzzay retains personal data only for as long as reasonably necessary for the purposes described here, including while an Account, registry, transaction or Merchant relationship remains active, and thereafter for legal, tax, accounting, fraud-prevention, dispute, security, backup and regulatory requirements.

9.2 Retention periods vary by data type and context. When personal data is no longer required, Huzzay will delete, de-identify or securely isolate it, subject to technically necessary backup cycles and lawful retention. Aggregated or anonymised information that cannot reasonably identify you may be retained and used without time limit.

10. SECURITY AND INCIDENT RESPONSE

10.1 Huzzay uses reasonable and proportionate administrative, technical and organisational safeguards designed to protect personal data, including access controls, secure transmission where appropriate, vendor controls, monitoring, backups and incident-management procedures. No system is completely secure, and Huzzay cannot guarantee absolute security.

10.2 You are responsible for keeping login credentials confidential, securing your devices and promptly notifying Huzzay of suspected unauthorised use. Do not send full payment credentials or unnecessary sensitive information through messages, reviews or support channels.

10.3 Huzzay will investigate personal-data breaches and cyber incidents and will make notifications to affected individuals, the Data Protection Board, CERT-In or other authorities where and within the period required by applicable law.

11. CHILDREN'S DATA

11.1 The Platform is intended for persons who are at least eighteen years old and legally competent to transact. Huzzay does not knowingly permit a child to create an Account or independently enter a Merchant Transaction.

11.2 An adult Registry Owner may create a registry concerning a child only where the adult is the child's parent or lawful guardian, or is otherwise authorised by law. The adult must minimise the child's data and must not publish unnecessary identifying information, location, school, health information or photographs.

11.3 If Huzzay learns that a child's personal data has been processed without required authorisation or verifiable parental consent, Huzzay may restrict the relevant content or Account and delete the data, subject to lawful retention and child-safety obligations. Contact us if you believe this has occurred.

12. CROSS-BORDER PROCESSING

Huzzay and its service providers may process or store personal data in India or another jurisdiction where they operate. Any cross-border transfer will be made in accordance with applicable law, including any government restriction, and with safeguards appropriate to the nature of the information and recipient.

13. THIRD-PARTY SERVICES AND LINKS

The Platform may link to a Merchant, Payment Provider, social network or other third-party service. Their collection and use of personal data is governed by their own privacy notices, not this Privacy Policy. Huzzay does not control their independent privacy practices and encourages you to review their notices before providing information.

14. CHANGES TO THIS PRIVACY POLICY

Huzzay may update this Privacy Policy to reflect changes in the Platform, business practices or law. The updated version will state its last-updated date and be published on the Platform. Where a change materially affects your rights or requires fresh consent, Huzzay will provide additional notice or obtain consent as required by law.

15. GRIEVANCE REDRESSAL AND CONTACT

For a privacy question, request or complaint, contact:
Grievance Officer: Ms. Deepali
Grievance Email: oops@huzzay.com
Contact Number: +918454830307
Postal address: 414-416, Bezzola Complex, VN Purav Marg, Chembur, Mumbai - 400071
Timings: Mon – Fri | 10am – 5pm IST on Business Days

Please state your name, Account contact details, the nature of the request and sufficient information to identify the relevant data or transaction. Huzzay will acknowledge and resolve complaints within the timelines required by applicable law. If the relevant DPDP Law provisions apply and you remain dissatisfied after using Huzzay's grievance process, you may pursue the remedy available before the Data Protection Board of India in the manner prescribed by law.