Privacy Policy.

This Privacy Policy describes how KultaKult (“we”, “us”, “our”) collects, uses, stores, shares and protects personal data of visitors and customers (“you”, “your”) of our website, brand channels and related services (collectively, the “Services”).

We are committed to handling your personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and any rules, regulations, and guidelines issued under it.

Data Fiduciary: KultaKult
Registered address: Rumsu Village, Naggar, Kullu, Himachal Pradesh, India 175130
Website: kultakult.com

We collect only the personal data necessary for the purposes described in this policy. The categories below are what we currently collect across the Services.

We do not knowingly collect personal data of children under the age of 16. Users aged 16 or 17 may use the Services only with verifiable consent of a parent or legal guardian. If you believe we have collected data of a child below this age without such consent, please contact us so we can delete it.

Under the DPDP Act, we may process your personal data only for a specific, clear and lawful purpose. The legal grounds we rely on are:

• Consent — for marketing communications, analytics, non-essential cookies, and any processing not covered by another ground.
• Performance of a contract — to create your account, fulfil orders, deliver products, and provide customer support.
• Compliance with law — to maintain tax, accounting and other statutory records.
• Legitimate uses — for security, fraud prevention, and resolving disputes, where this does not override your rights.

If we ever need to use your data for a purpose not listed above, we will obtain your consent before doing so.

We do not sell your personal data. We share it only with the following categories of recipients, strictly as needed to operate the Services:

• Supabase Inc. — our database and authentication provider. Stores account, wishlist and form-submission data on our behalf. Data may be stored on servers located outside India.
• Vercel Inc. — our website hosting and content delivery provider. Receives request logs (IP, user agent) as part of normal hosting operations.
• Google LLC (Google Analytics) — for aggregated, pseudonymous usage analytics. You can opt out using the Google Analytics opt-out browser add-on.
• Logistics and payment partners — courier services and payment gateways, used only to deliver your order and process payment. (Applicable when an order is placed.)
• Professional advisors and authorities — auditors, legal advisors, tax authorities or law-enforcement agencies, where we are legally required to disclose.

Where any recipient is located outside India, we take reasonable steps to ensure your data is protected to a standard comparable to the DPDP Act.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or for longer where required by law. Indicative periods are:

• Account data: while your account is active, and up to 30 days after account deletion (for backup/recovery), after which it is permanently erased.
• Order & transaction data: up to 8 years from the date of transaction, as required by Indian tax and accounting law.
• Contact & Stylist form submissions: up to 12 months from the last interaction, unless the enquiry relates to an order (then order-data retention applies).
• Wishlist data: until you remove the item or delete your account.
• Analytics data: up to 24 months, after which it is aggregated or deleted.

Subject to the DPDP Act, you have the right to:

• Access a copy of the personal data we hold about you.
• Correction of inaccurate or incomplete data.
• Erasure of your personal data, subject to our legal record-keeping obligations.
• Withdrawal of consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Grievance redressal — the right to complain to our Grievance Officer, and, if unresolved, to the Data Protection Board of India.
• Nomination — the right to nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact us at contact@kultakult.com. We will respond within 30 days, as required under the DPDP Act.

We use reasonable organisational and technical safeguards designed to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include encrypted connections (HTTPS/TLS), hashed passwords, access controls on our backend systems, and restricted access to personal data on a need-to-know basis. No method of transmission or storage, however, is 100% secure. If you believe your data has been compromised, please contact us immediately.

A cookie is a small text file stored on your device. We use:

• Essential cookies — required for the site to work, such as keeping you signed in. These cannot be disabled.
• Analytics cookies — set by Google Analytics to help us understand how the site is used. You can decline these using your browser settings or the Google Analytics opt-out tool.

We do not currently use advertising or cross-site tracking cookies. If this changes, we will update this policy and seek consent where required.

In accordance with the DPDP Act, we have appointed a Grievance Officer to address your questions or complaints about the processing of your personal data.

We will acknowledge your complaint within 7 days and resolve it within 30 days of receipt. If you are not satisfied with our response, you have the right to escalate the matter to the Data Protection Board of India.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will notify you by email (if you have an account) or by a prominent notice on the website before the change takes effect.