For the purposes of the DPDP Act, 2023, Aviana Diamonds LLP is the Data Fiduciary in respect of personal data collected through the Website. The Data Fiduciary's details are as follows:

2.1 This Policy applies to all personal data collected from:

• Website visitors (whether or not they create an account or place an order);
• Registered account holders;
• Guest checkout users;
• Newsletter and marketing communication subscribers;
• Individuals who contact customer support;
• Wishlist users; and
• WhatsApp and SMS communication subscribers.

2.2 This Policy does not apply to the privacy practices of third-party websites, platforms, or services that may be linked from the Website. Aarunya is not responsible for the data practices of such third parties. You are encouraged to review their respective privacy policies independently.

2.3 This Policy is to be read together with Aarunya's Terms & Conditions, Cookie Policy, and all other policies published on the Website.

We collect only such personal data as is necessary for the purposes described in this Policy. The categories of personal data we collect are as follows:

3.1 Identity & Contact Information

• Full name
• Email address
• Mobile number
• Billing address
• Shipping / delivery address
• State, city, and PIN code

3.2 Account Information

• Username and encrypted password (for registered account holders)
• Account preferences and settings
• Wishlist items saved to account
• Order history associated with the account

3.3 Transaction & Order Information

• Order details and product specifications
• Invoice and payment status records
• Refund, exchange, and return records
• Warranty and service records
• Custom jewellery design specifications and approval records

3.4 Payment Information

Payments are processed through authorized third-party payment gateways (Razorpay and/or CCAvenue). Aarunya does not collect, store, or have access to card numbers, CVV codes, UPI PINs, net banking credentials, or any payment authentication data. We receive only transaction confirmation data (such as payment status, transaction ID, and amount) necessary to process and confirm your order.

3.5 Technical & Device Information

When you access the Website, we may automatically collect the following technical data through cookies and similar technologies:

• IP address
• Browser type and version
• Device type and operating system
• Screen resolution
• Session duration and page interactions
• Referral source and navigation path

This information is collected through the tools described in Clause 8 of this Policy. Detailed information about cookies and tracking technologies is set out in our Cookie Policy.

3.6 Marketing & Communication Preferences

• Email subscription status
• SMS opt-in or opt-out status
• WhatsApp communication consent status
• Product interest and wishlist activity

3.7 Customer Support & Grievance Information

• Details of queries, complaints, and grievances submitted
• Correspondence records (email, phone, chat, WhatsApp)
• Supporting documents and photographs submitted with a complaint

3.8 Identity Verification Information (High-Value Orders)

For selected high-value orders, or where required for fraud prevention or regulatory compliance, we may request:

• Government-issued identity document (for verification purposes only)
• Proof of address

Such documents will be collected, used, and retained solely for the specific verification purpose and in accordance with this Policy and applicable law.

We collect personal data through the following means:

Under the DPDP Act, 2023, personal data may be processed only for a lawful purpose on the basis of consent or on a legitimate use basis as prescribed. The following table sets out the categories of personal data we process, the specific purposes, the legal basis, and the applicable retention period:

6.1 Where Aarunya relies on your consent as the legal basis for processing your personal data, we will:

• present a clear, specific, and plain-language consent request before processing commences;
• ensure consent is not bundled with acceptance of general terms and conditions;
• not make the provision of a product or service conditional upon consent to processing that is not necessary for that product or service; and
• maintain a record of the consent provided by you.

6.2 You may withdraw consent for any consent-based processing activity at any time by:

• updating your communication preferences through your registered account;
• clicking the "unsubscribe" link in any marketing email;
• replying STOP to any promotional SMS or WhatsApp message;
• adjusting your cookie preferences through the cookie consent banner on the Website; or
• contacting us directly at info@aarunya.co.

6.3 Withdrawal of consent shall not affect the lawfulness of any processing carried out on the basis of consent before its withdrawal. Withdrawal of consent for transactional communications necessary for an active order may affect our ability to provide order updates.

6.4 Where you withdraw consent for marketing communications, Aarunya will cease such communications within a reasonable period of processing your withdrawal request, subject to applicable technical limitations of communication service providers.

Aarunya does not sell, rent, or trade your personal data to any third party for independent commercial use. We share personal data only in the following circumstances and only to the extent necessary for the specified purpose:

7.1 Logistics & Delivery Partners

We share your name, delivery address, and contact number with our authorized logistics partners (BVC Logistics and India Post / Speed Post) solely for the purpose of fulfilling your order. These partners are required to handle your data only for delivery purposes.

7.2 Payment Gateway Partners

We share transaction-relevant data (order value, order reference) with our authorized payment gateway partners (Razorpay and/or CCAvenue) to enable secure payment processing. These providers process payment data independently under their own privacy and security frameworks, which comply with applicable RBI and PCI DSS standards.

7.3 Technology & Service Providers

We may share data with authorized technology service providers engaged to operate and maintain the Website, including hosting providers, security and monitoring services, and email communication platforms. Such providers process data only on our behalf and are bound by confidentiality and data processing obligations.

7.4 Analytics & Advertising Platforms

Technical and behavioural data may be shared with the following platforms where you have provided consent through the cookie consent mechanism:

• Google Analytics 4 — for website traffic and usage analytics;
• Microsoft Clarity — for session recording, heatmaps, and usability analysis;
• Meta Pixel (Facebook) — for conversion tracking and advertising campaign optimization; and
• Google Ads / Remarketing — for advertising campaign measurement and targeted advertising.

Each of these platforms processes data under their own terms of service and privacy policies. You may withdraw consent for these tracking technologies through the cookie consent banner on the Website.

7.5 Professional Advisors

We may share data with our legal advisors, auditors, and accountants where strictly necessary for the provision of professional services. Such disclosures are subject to applicable professional confidentiality obligations.

7.6 Legal & Regulatory Disclosures

We may disclose personal data where required by applicable law, court order, or regulatory direction, including to:

• courts and judicial authorities;
• tax authorities (Income Tax Department, GST authorities);
• law enforcement agencies; and
• financial intelligence and regulatory bodies where required under applicable law.

We will, where legally permissible, notify you of such disclosures.

8.1 The Website uses cookies, pixels, web beacons, and similar tracking technologies to enhance functionality, analyze usage, and support advertising activities. A summary of the technologies deployed on the Website is set out below:

8.2 Consent-based cookies and tracking technologies will only be activated after you have provided your consent through the cookie consent banner displayed on the Website. You may modify your consent preferences at any time through the cookie settings accessible on the Website.

8.3 Detailed information about specific cookies, their duration, and management options is available in Aarunya's Cookie Policy.

9.1 Aarunya primarily processes personal data within India. However, certain technology service providers, analytics platforms, and advertising platforms used by Aarunya may process data outside India, including in the United States, the European Economic Area, and other jurisdictions. Specifically:

• Google Analytics 4 and Google Ads data may be processed by Google LLC in the United States;
• Meta Pixel data may be processed by Meta Platforms, Inc. in the United States; and
• Microsoft Clarity data may be processed by Microsoft Corporation in jurisdictions outside India.

9.2 These cross-border transfers occur only in respect of technical and behavioural data processed through the tracking technologies described in Clause 8, and only where you have consented to such tracking through the cookie consent mechanism.

9.3 Aarunya takes reasonable steps to ensure that transfers to third-party processors outside India are governed by appropriate contractual arrangements and that such processors maintain security standards consistent with applicable law.

9.4 As and when the Central Government notifies specific countries or conditions for cross-border data transfer under the DPDP Act, 2023, Aarunya will ensure compliance with such notifications and update this Policy accordingly.

Aarunya retains personal data only for as long as is necessary to fulfil the purpose for which it was collected, or for such longer period as is required by applicable law. Once the applicable retention period has expired, personal data will be securely deleted, anonymized, or archived in accordance with our internal data retention procedures. Specific retention periods for each category of data are set out in Clause 5 of this Policy. The following principles govern our retention approach:

Under the Digital Personal Data Protection Act, 2023, you have the following rights in relation to your personal data. These rights may be exercised by contacting us at info@aarunya.co. We will respond to your request within a reasonable time, and no later than the period prescribed under applicable law or regulations.

11.1 Right to Access Information (Section 11, DPDP Act)

You have the right to obtain from Aarunya:

• a summary of the personal data we hold about you;
• the processing activities carried out on your personal data; and
• information about the third parties to whom your personal data has been disclosed.

11.2 Right to Correction and Erasure (Section 12, DPDP Act)

You have the right to request that we:

• correct any personal data that is inaccurate or incomplete; and
• erase personal data where: (a) the purpose for which it was collected no longer exists; (b) you have withdrawn your consent and there is no other lawful basis for continued retention; or (c) retention is no longer necessary for legal compliance.

Certain data may be retained notwithstanding an erasure request where retention is required by applicable law (for example, transaction records retained for GST compliance).

11.3 Right to Withdraw Consent (Section 6(4), DPDP Act)

You may withdraw consent at any time for any processing activity based on your consent. Withdrawal of consent shall not affect the lawfulness of processing carried out before withdrawal. The mechanisms for withdrawing consent are described in Clause 6.2 of this Policy.

11.4 Right to Grievance Redressal (Section 13, DPDP Act)

You have the right to register a grievance with Aarunya's Grievance Officer regarding the processing of your personal data. We will acknowledge your grievance within 48 hours and endeavour to resolve it within 30 calendar days.

11.5 Right to Nominate (Section 14, DPDP Act)

You have the right to nominate another individual to exercise your rights under the DPDP Act on your behalf in the event of your death or incapacity, to the extent permitted by applicable regulations. Details of the nomination mechanism will be made available as prescribed under the DPDP Act and associated rules.

11.6 Right to Approach the Data Protection Board

If you are not satisfied with Aarunya's response to your grievance, you have the right to lodge a complaint with the Data Protection Board of India, once it is constituted and operational under the DPDP Act, 2023.

12.1 The DPDP Act, 2023 prohibits the processing of personal data of children (individuals below the age of 18 years) without verifiable parental or guardian consent.

12.2 The Website does not knowingly collect personal data from individuals below the age of 18 without verifiable parental or guardian consent. Aarunya does not implement age-gating for Website access; however, the processing of personal data of a child requires consent to be provided by the parent or legal guardian.

12.3 If you are a parent or guardian and you believe that your child has provided personal data to Aarunya without your consent, please contact us immediately at info@aarunya.co. We will take prompt steps to delete such data in accordance with the DPDP Act, 2023.

12.4 Aarunya does not engage in behavioural monitoring of children or serve targeted advertising to children.

13.1 Aarunya implements commercially reasonable technical, administrative, and organizational security measures designed to protect your personal data from unauthorized access, loss, misuse, disclosure, or destruction. These measures include:

• SSL/TLS encryption for data transmitted through the Website;
• secure server infrastructure;
• access controls limiting personal data access to authorized personnel only;
• encrypted storage of account passwords; and
• regular security monitoring and software updates.

13.2 Aarunya will never request OTP codes, card numbers, CVV codes, UPI PINs, or net banking passwords through any channel other than the official payment gateway interface. If you receive any communication purporting to be from Aarunya requesting such information, please treat it as fraudulent and report it to us immediately.

13.3 Despite all reasonable precautions, no method of electronic transmission or data storage can be guaranteed to be entirely secure. You provide personal data at your own risk, and Aarunya cannot guarantee absolute security against all possible threats.

14.1 In the event of a personal data breach that is likely to result in risk to the rights of Data Principals, Aarunya will:

• promptly investigate and contain the breach;
• notify the Data Protection Board of India as required under Section 8(6) of the DPDP Act, 2023 and applicable regulations within the prescribed timeline; and
• notify affected Data Principals in such form and manner as may be prescribed under applicable law.

14.2 The timing, scope, and content of any notification will be determined in accordance with applicable legal requirements and the nature of the breach.

15.1 Aarunya may send marketing and promotional communications by email, SMS, and WhatsApp, subject to your prior consent.

15.2 Marketing communications are entirely optional. Refusal to consent to marketing communications shall not affect your ability to place orders or receive transactional communications necessary for your order.

15.3 All promotional SMS communications will be sent in compliance with applicable TRAI regulations governing unsolicited commercial communications.

15.4 You may opt out of marketing communications at any time using the mechanisms described in Clause 6.2. Transactional communications related to an active order (such as order confirmation, dispatch notification, and delivery updates) will continue irrespective of your marketing communication preferences.

16.1 Registered account holders may create and maintain a product wishlist on the Website. Wishlist data (the products saved and the account to which they are saved) is personal data processed on the basis of your consent provided at account registration.

16.2 Wishlist data may be used by Aarunya to:

• maintain and display your saved wishlist across sessions;
• send you reminders or updates relating to wishlisted products, subject to your marketing communication preferences; and
• aggregate anonymized wishlist data for product demand analysis and inventory planning.

16.3 You may delete wishlist items or your entire wishlist at any time through your account settings.

The Website may contain links to third-party websites or platforms (including social media platforms such as Instagram, Facebook, or Pinterest). Aarunya is not responsible for the privacy practices or content of such third-party platforms. Clicking on such links and interacting with those platforms is subject to their respective privacy policies. We encourage you to review those policies before sharing any personal information on third-party platforms.

In accordance with the Consumer Protection (E-Commerce) Rules, 2020, the IT Act, 2000, and the DPDP Act, 2023, Aarunya has designated the following individual as its Grievance Officer for the purposes of this Policy and all applicable laws:

19.1 Aarunya reserves the right to update, amend, or revise this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements.

19.2 Where a revision materially affects the manner in which we process your personal data or reduces your rights, we will notify you by email or prominent notice on the Website at least 14 calendar days before the revised Policy takes effect, and obtain fresh consent where required by the DPDP Act, 2023.

19.3 Minor updates (such as corrections, clarifications, or updates required by law) will become effective immediately upon publication on the Website.

19.4 The effective date displayed at the top of this Policy indicates the date on which the current version came into effect. We recommend reviewing this Policy periodically.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact:

© Aviana Diamonds LLP. All Rights Reserved. This Privacy Policy is drafted in compliance with the Digital Personal Data Protection Act, 2023.