Privacy Policy

1. Who we are

This privacy policy applies to the website rejuvra.in and all services offered under the Rejuvra brand, operated by New Sun Global Enterprise ("Rejuvra", "we", "us", "our") with its registered office at 1st Floor, Mohan Plaza, Ramte Ram Road, Ghaziabad – 201001, Uttar Pradesh, India.

We act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) for personal data collected through this website.

2. Information we collect

We collect the minimum data needed to serve you. Specifically:

You give us directly

• Contact details — name, email, phone number, delivery address, PIN code (collected at checkout, enquiry forms, or when you subscribe to updates)
• Order details — the products you select, size, firmness, custom specifications, quantity, promo codes, order history
• Communication — anything you send us via contact form, email, WhatsApp, or at our showroom
• Account preferences — your firmness picks, saved PIN code, cart contents (stored locally in your browser)

We collect automatically

• Device & browser — IP address, browser type, device type, operating system, screen size, language
• Usage — pages visited, time on page, referring URL, buttons clicked, searches made on the FAQ
• Approximate location — city-level, derived from your IP (used for delivery estimates and language)
• Cookies and local storage — see "Cookies & tracking" below

From our payment partner

• Payment confirmation — Razorpay sends us a payment ID, status, and method after you pay. We never see or store your card number, CVV, UPI PIN, or net-banking password.

3. How we use your information

We use your data only for these specific purposes:

• Fulfilment — processing orders, handling payments, arranging white-glove delivery, confirming slots over phone/WhatsApp, issuing invoices
• Customer service — answering questions, resolving issues, processing returns and refunds within the 100-night trial
• Order updates — sending shipping and delivery notifications via email, SMS, and WhatsApp
• Legal and tax — issuing GST-compliant invoices, retaining records as required by Indian tax law
• Site improvement — anonymised analytics to understand which pages help customers choose the right mattress
• Marketing (with consent) — sending offers, product news, sleep tips (you can unsubscribe any time)
• Fraud prevention — detecting unusual activity, protecting both you and us from fraudulent orders

We rely on these legal bases under the DPDP Act: your consent (marketing, non-essential cookies), performance of our contract with you (fulfilling your order), and our legitimate interests (fraud prevention, site security, improving our products).

4. Who we share it with

We never sell your data. We share it only with the specific service providers who help us run Rejuvra:

• Razorpay Software Private Limited — payment processing (PCI-DSS Level 1 certified)
• Netlify, Inc. — website hosting and content delivery
• Resend — transactional email delivery (order confirmations, shipping updates)
• Meta Platforms, Inc. — WhatsApp Business messages for order status
• Omnisend Ltd. — email marketing automation (only if you've subscribed)
• Google LLC — Google Tag Manager and Google Analytics (anonymised traffic metrics)
• Logistics partners — our white-glove delivery courier receives your name, address, phone, and order details (not payment data)
• Legal authorities — only if required by a valid Indian court order, subpoena, or statutory obligation

All our service providers are contractually required to use your data only for the purposes we specify, and to apply appropriate security measures.

5. Cookies & tracking

We use cookies and local storage for the following purposes:

• Essential cookies — cart contents, saved address, session security. Cannot be disabled; the site won't work properly without them.
• Preference cookies — your firmness pick, saved PIN code, chosen language. Make the site more useful for you.
• Analytics cookies — Google Analytics (anonymised) to understand site usage. You can opt out at any time via your browser settings.
• Marketing cookies — Omnisend session tracking, Meta pixel (if active). Only loaded if you've consented or subscribed.

You can clear cookies and local storage at any time via your browser's privacy settings. Doing so will log you out and empty your cart.

6. Email, SMS & WhatsApp marketing

We send transactional messages (order confirmations, delivery updates, refund notifications) to every customer — these are necessary for your order and cannot be opted out of.

Marketing messages (new launches, offers, sleep tips) are only sent if you've explicitly opted in. You can unsubscribe at any time by:

• Email — click the "unsubscribe" link at the bottom of any email
• WhatsApp — reply "STOP" to any marketing message
• Any channel — email privacy@rejuvra.in

7. Payment data & Razorpay

All payments are processed by Razorpay, India's PCI-DSS Level 1 certified payment gateway. When you check out:

• Your card number, CVV, UPI PIN, net-banking password, and OTP are entered on Razorpay's secure servers, not on ours.
• Rejuvra receives only a payment confirmation (payment ID, amount, method, success/failure status).
• We never store your card details. If you choose to save a card for faster checkout, it is tokenised and stored by Razorpay, not by us.

Razorpay's privacy policy applies to any data they collect: razorpay.com/privacy.

8. How long we keep data

• Order records — retained for 8 years from the date of the order, as required by Indian GST and income-tax law.
• Marketing subscriptions — retained until you unsubscribe, then deleted within 30 days.
• Contact enquiries — retained for 2 years after your last interaction.
• Analytics data — anonymised and retained for 26 months.
• Payment confirmations — retained for 8 years alongside the related order.

After these periods, we securely delete or anonymise your data.

9. Data security

We take data security seriously. Our safeguards include:

• 256-bit SSL/TLS encryption on all pages (not just checkout)
• PCI-DSS Level 1 compliance through Razorpay for all payment data
• Signed webhooks — payment events are cryptographically verified before being processed
• Access controls — only authorised employees can access customer data, and only for the specific task at hand
• Hosted infrastructure — our site runs on Netlify with automatic security patching and DDoS protection
• No local card storage — card details are never stored on our servers under any circumstances

No system is 100% secure, so we commit to notifying you and the Data Protection Board of India within 72 hours of becoming aware of any breach that affects your personal data, as required by the DPDP Act.

10. Your rights under the DPDP Act, 2023

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access — request a copy of all personal data we hold about you
• Correct — request correction of inaccurate or incomplete data
• Erase — request deletion of your data (subject to statutory retention requirements, e.g. tax law)
• Withdraw consent — withdraw your consent to marketing or non-essential processing at any time
• Nominate — nominate another person to exercise your rights in case of death or incapacity
• Grievance redressal — raise a complaint with our Grievance Officer (details below)
• Appeal — if unsatisfied with our response, approach the Data Protection Board of India

To exercise any of these rights, email privacy@rejuvra.in with the subject line "DPDP Request". We will respond within 30 days.

11. Children's privacy

Rejuvra does not knowingly collect personal data from individuals under the age of 18. If you are under 18, please do not submit any information to us. If we become aware that we have collected data from a minor without verifiable parental consent (as required by the DPDP Act), we will delete it promptly.

12. International data transfers

Some of our service providers (Netlify, Resend, Google) are headquartered outside India and may process your data on servers located abroad. Where this happens, we rely on standard contractual safeguards to ensure your data is protected to the same standard as under Indian law.

The Government of India has not yet notified specific restrictions on cross-border transfers under the DPDP Act. If and when such restrictions are notified, we will update our practices and this policy accordingly.

13. Changes to this policy

We may update this policy from time to time to reflect changes in law, our services, or how we handle data. The "Last updated" date at the top of this page will always show when the policy was last revised. For significant changes, we will notify you by email (if you've shared one) and by a banner on the homepage.

We encourage you to review this page periodically.

14. How to contact us

For general enquiries, order help, or anything else, write to us at care@rejuvra.in or visit our contact page.