Privacy Policy

01. Privacy Philosophy & Scope

At ARVEN, we treat patron discretion with the same reverence we accord our olfactory formulations. Whether you explore our fragrance archives, acquire a flacon through guest checkout, or maintain an authenticated vault account, we are committed to transparent, lawful, and purpose-limited handling of your personal information.

This Privacy Policy sets forth how ARVEN collects, uses, stores, shares, and protects your information in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and associated statutory privacy guidelines of India.

02. Information We Collect

We only gather data necessary to deliver your flacons, process allocations, and ensure account security:

• Identity & Contact Data: Full name, email address, telephone number (in international format), and delivery postal address.
• Transactional Records: Order identification numbers, purchased flacons, batch designations, order dates, totals paid, and fulfillment statuses.
• Technical & Telemetry Data: IP address, browser type, operating system, and session tokens utilized to maintain your active shopping bag and verify geo-pricing.
• Vault Preferences (Optional): Wishlisted compositions, saved delivery destinations, and newsletter subscription preferences (only if explicitly opted-in).

03. Purposes of Data Processing

Your data is processed strictly for legitimate, declared commercial purposes:

• Generating and verifying order fulfillment through our logistics network.
• Transmitting transactional dispatches (order receipts, tracking credentials, delivery notices).
• Facilitating secure online payments and preventing fraudulent chargeback attempts.
• Handling customer care requests, flacon consultations, and grievance redressals.
• Complying with statutory tax, invoicing, and corporate audit obligations under Indian law.

ARVEN never sells, rents, or commercializes patron personal data to third-party advertisers or data brokers.

04. Cashfree Payments & Financial Security

Online financial transactions on ARVEN are facilitated exclusively through Cashfree Payments, an RBI-regulated and PCI-DSS Level 1 certified payment gateway.

Our servers only receive transaction metadata (e.g., Cashfree Payment ID, payment method type, verification status, and timestamp) to authorize and confirm your order in our database.

05. Essential Service Disclosures

To complete fulfillment, personal data is shared solely with vetted operational partners bound by strict data processing agreements:

• Logistics & Courier Partners: Recipient name, destination address, and phone number are shared with our logistics aggregators and express carriers (e.g., NimbusPost, BlueDart, Delhivery) to facilitate physical parcel delivery and delivery OTP verification.
• Payment Aggregators: Transaction amount, customer email, and phone number are provided to Cashfree for anti-fraud validation and payment receipt dispatch.
• Legal & Regulatory Authorities: We may disclose data if legally required by valid judicial order, law enforcement summons, or statutory tax inspection.

06. Data Retention & Security Safeguards

We employ industry-standard 256-bit TLS encryption across all digital communications. Data in transit and at rest within our database is protected using role-based access controls and row-level security.

We retain transactional records for the duration required by statutory financial, accounting, and tax regulations in India (typically up to 7 years from transaction date). Non-essential telemetry tokens expire automatically within standard cookie lifespans.

07. Your Statutory Rights under DPDP Act 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you hold the following statutory rights:

• Right to Access: Request a summary of the personal data held about you and the processing activities undertaken.
• Right to Correction & Completion: Request correction of inaccurate, misleading, or outdated personal information.
• Right to Erasure: Request deletion of your personal data, subject to legal and statutory retention mandates.
• Right of Grievance Redressal: Submit a complaint regarding the handling of your data to our designated Privacy Desk.
• Right to Nominate: Nominate an individual to exercise your privacy rights in the event of incapacity.

To exercise any of these rights, you may submit a request using our online DPDP Data Subject Request Portal or contact our privacy team directly.

08. Privacy Officers & Contact Information

For questions, concerns, or requests regarding this Privacy Policy, our designated team may be reached at: