The Information Technology Act, 2000 (IT Act)

The IT Act is the primary legislation governing electronic commerce and digital data in India. Section 43A of the IT Act requires any body corporate that handles sensitive personal data or information (SPDI) to implement and maintain reasonable security practices. Section 72A makes unauthorised disclosure of personal information without consent a punishable offence with imprisonment of up to 3 years or a fine of up to Rs. 5 lakh, or both. Alvencia is bound by this law and complies fully with its requirements.

The IT (SPDI) Rules, 2011 — Sensitive Personal Data or Information Rules

These rules, notified under Section 43A of the IT Act, define what constitutes Sensitive Personal Data or Information (SPDI) and impose obligations on how it must be collected, stored, transferred, and disclosed. Under these rules, SPDI includes passwords, financial information such as bank account, credit card, and debit card details, physical, physiological, and mental health conditions, and other similarly sensitive categories. These rules require us to obtain your consent before collecting SPDI, use it only for the purpose for which it was collected, and not retain it longer than necessary. You have the right to withdraw your consent at any time by contacting us.

The Digital Personal Data Protection Act, 2023 (DPDPA)

The Digital Personal Data Protection Act, 2023 was enacted by the Parliament of India and received Presidential assent on 11 August 2023. It is the most comprehensive personal data protection legislation in India to date. While its rules and operational provisions are being notified in phases, Alvencia is proactively aligning its data practices to comply with its requirements. Under the DPDPA, you have the following rights as a Data Principal (a person whose personal data is processed): the right to obtain information about your personal data being processed; the right to correction and erasure of inaccurate or outdated personal data; the right to grievance redressal from the Data Fiduciary (us); the right to nominate another individual to exercise rights on your behalf in case of your death or incapacity; and the right to approach the Data Protection Board of India if your grievance is not resolved satisfactorily. Alvencia, as a Data Fiduciary, is obligated under this Act to process personal data only for lawful purposes with your consent, maintain accuracy of data, implement appropriate security safeguards, notify you in the event of a personal data breach, and not retain your data beyond the period for which it is necessary.

The Consumer Protection (E-Commerce) Rules, 2020

These rules require every e-commerce entity operating in India to clearly disclose its privacy policy, inform users about the personal data it collects and how it is used, and ensure that users are not subjected to unfair data practices. Alvencia complies fully with these rules and this policy constitutes our required disclosure under Rule 4 and Rule 5 of these regulations.

The Right to Privacy — Article 21 of the Constitution of India

The Supreme Court of India in its landmark judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, unanimously held that the right to privacy is a fundamental right guaranteed under Article 21 of the Constitution of India, which protects the right to life and personal liberty. This constitutional recognition forms the foundational basis of all data protection frameworks in India. Alvencia acknowledges this right and treats the protection of your personal information as a fundamental obligation, not merely a compliance requirement.

Essential Cookies

These are necessary for the website to function — they keep you logged in during your visit, remember items in your shopping cart, and enable core site features. You can disable cookies via your browser, but some parts of our site may not work properly if you do.

Analytics — Google Analytics 4 (GA4)

We use Google Analytics 4 (GA4) to collect information about website traffic and user behaviour — which pages are most visited, how users move through the site, and where they come from (e.g. a Google search or a social media link). This data is aggregated and anonymised; we look at trends, not individual user behaviour. GA4 may collect your IP address (which provides general location info), but we do not allow it to collect personally identifiable information like your name or email. If you wish, Google provides an opt-out browser add-on that prevents GA from collecting your data on any website.

Advertising & Conversion Tracking — Meta Pixel

The Facebook Pixel (Meta Pixel) helps us measure the results of our advertising on Facebook and Instagram — whether you visited our site or took specific actions (like adding to cart or purchasing) after seeing our ad. The Pixel may collect information such as your Facebook User ID (if logged in), your IP, and other device info, used in accordance with Meta's data policy. We see aggregated reports only, not your personal Facebook data. You can adjust your ad preferences on Facebook or block third-party cookies in your browser to limit this.

Advertising & Conversion Tracking — Google Ads

We participate in Google Ads, which means you may see Alvencia™ ads on Google search results or other websites. Google Ads conversion tracking uses cookies to tell us if someone clicked one of our ads and then made a purchase, using an anonymous identifier rather than your personal details. This lets us measure ad effectiveness and manage our advertising spend. You can manage your preferences via Google's Ad Settings, and opt out of personalised advertising if you wish.

Other Third-Party Tools

From time to time we may use other tools or plugins (for example, a chatbot widget or an email newsletter service) that also use cookies or tracking pixels. We will update this policy if any such tool collects personal data not already covered here. Any partner we work with is vetted for strong privacy practices.

Courier and Logistics Partners

We share your name, delivery address, and mobile number with our courier/logistics partners solely to deliver your order. They only receive what is necessary to perform delivery and do not receive any of your financial information.

Payment Gateway Provider — Razorpay

We share your name, email, phone number, and order value with our payment gateway partner, Razorpay, to facilitate secure, PCI-DSS-compliant payment processing. Razorpay handles your card or UPI details directly under its own security framework. We do not receive or store your full card number, CVV, or net banking credentials.

IT, Hosting, and Communication Service Providers

We work with IT service providers for hosting our website, and with email/SMS service providers to send order confirmations and updates. All such providers are contractually obligated to protect your data and use it solely for the task we hire them for.

Analytics and Advertising Partners

Platforms like Google and Meta process certain data when we use their analytics and advertising services (see Section 5). This sharing is limited to what's needed for those functions and is often pseudonymised or aggregated. We do not directly hand over your personal contact information to these platforms for advertising — the tools themselves collect data via cookies.

Legal Requirements

We may disclose your information if required by law or in response to a valid request by a government or law enforcement agency — for example, to comply with a court order or a lawful subpoena. We assess such requests carefully and provide only what is legally mandated.

Protection of Rights

If we believe an investigation is necessary, we may share information to enforce our Terms of Service or investigate potential violations (fraud, security breaches, misuse of our site), or where someone's actions threaten the rights, property, or safety of Alvencia™, our customers, or the public.

Business Transfers

In the unlikely event that Roziyo Trading Private Limited undergoes a merger, acquisition, reorganisation, or sale of assets, your personal information may be transferred to the successor entity as part of that transition. Any successor will be bound by the same commitments made in this Privacy Policy. We will notify you (for example, by email or a prominent notice on our site) of any such change and any choices you may have regarding your information.

Encryption

Our website is secured with SSL/TLS encryption — look for "https://" and the lock icon in your browser's address bar on any page where you enter personal information. Any data transfer, such as logging in or entering payment details, is encrypted in transit.

Secure Payment Processing

We use a PCI-DSS-compliant payment gateway. Sensitive payment information is transmitted directly to the payment processor over encrypted connections. We never see or store your full card number or CVV on our servers.

Access Controls

Access to personal data is restricted to authorised personnel who need it to do their job. For example, our support team can see your order details to help you, but cannot see your password or payment details. Staff are trained in data privacy and security best practices.

Secure Infrastructure

Our hosting and databases employ firewalls, anti-virus, and intrusion detection systems. We keep our software and platforms updated to patch vulnerabilities and regularly monitor our systems for signs of breaches or attacks.

Data Minimisation

We only keep personal data as long as necessary (see Section 7). By not unnecessarily hoarding data we reduce risk, and we dispose of data securely once it is no longer needed.

Third-Party Audits and Certifications

Where applicable, we work with infrastructure providers who hold industry-recognised security certifications (such as ISO 27001 or SOC 2) and undergo regular security audits.

Access and Correction

You have the right to access the personal data we hold about you, including your profile details and order history. If any of it is inaccurate or incomplete, you may request correction — many fields can also be updated directly in your account settings.

Data Portability

Under the DPDPA and other applicable laws, you may have the right to request your data in a commonly used electronic format so it can be transferred to another service provider. We will assist as far as technically feasible and as required by law.

Withdrawal of Consent

Where we rely on your consent (such as for marketing emails, cookies, or personalisation), you may withdraw it at any time — click "unsubscribe" in any marketing email, or contact us for other consents. Withdrawing consent does not affect processing carried out before the withdrawal, and if you withdraw consent for something essential (like processing your order), we may not be able to fulfil our services to you.

Deletion (Right to be Forgotten)

You may request that we delete your personal information or close your account. We will honour deletion requests to the extent required by law; however, we may retain certain information for record-keeping, to complete transactions you initiated, or to comply with legal obligations (for example, invoice records required by tax law). Any data we retain continues to be handled in accordance with this Policy.

Objection to Processing

You may object to our processing of your data, for instance for direct marketing. Let us know and we will stop; if you believe our processing impacts your rights and freedoms more broadly, you may object and we will review whether we have a legal requirement to continue.

Grievance Redressal

If you have concerns about how your data is handled, you may raise a grievance with us. We take complaints seriously and respond within the timeframe required by law — see Section 17 for our dedicated Grievance Officer contact and process. If unsatisfied, you may also lodge a complaint with the Data Protection Board of India (once constituted) or the relevant supervisory authority.

Right to Nominate

Under the DPDPA, 2023, you have the right to nominate another individual to exercise your data protection rights on your behalf in the event of your death or incapacity. To register a nomination, contact us at privacy@alvencia.com.

Registered Mobile Number

Order Number(s) (Optional — helps us locate your records faster)

Specific Data You Are Requesting (Optional)

I confirm that I am the account holder named above and that the information provided is accurate. I understand that Alvencia™ may ask me to verify my identity before processing this request.

Submit Data Access Request

What Information Is Incorrect or Outdated? *

What Should the Correct Information Be? *

I confirm that I am the account holder named above and that the corrected information I have provided is accurate and complete.

Submit Correction Request

Please note: We may be legally required to retain certain data — such as transaction and tax records — for the period mandated under applicable Indian tax law before it can be deleted. Data not subject to a legal retention requirement will be deleted or anonymised following your verified request, within the timeframe required by law. Deletion of your account is permanent and cannot be reversed.

What Would You Like Deleted? * Please select what you would like deleted My entire account and all associated personal data My marketing and communication preferences data only My browsing history and analytics data only Specific data categories (please describe below)

Additional Details or Specific Data to Delete

I confirm that I am the account holder named above, I understand that account deletion is permanent and irreversible, and I acknowledge that certain data required for legal compliance may be retained for the period specified in this policy before deletion.

Submit Deletion Request

Mobile Number to Unsubscribe from SMS (Leave blank if not applicable)

Which Channels Do You Want to Unsubscribe From? *

Unsubscribing from marketing will not affect transactional communications such as order confirmations, shipping updates, and refund notifications, which are necessary for order fulfilment and cannot be disabled.

Submit Unsubscribe Request

Nature of Your Grievance * Please select the nature of your complaint I believe my data was shared without my consent I believe my account or data may have been compromised I am still receiving marketing after unsubscribing My data access request was not fulfilled My data deletion request was not completed My correction request was not addressed Other privacy-related concern

Describe Your Grievance in Detail *

What Resolution Are You Seeking?

I confirm that the information provided in this complaint is accurate and complete to the best of my knowledge, and I understand that Alvencia™ will investigate this matter and respond within the timeframe required by law.

Submit Privacy Grievance

Google Ads Conversion Tracking

We use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. When you click a Google Ad and complete a purchase on alvencia.com, a cookie records the conversion. This data is aggregated and does not personally identify you to us — it is used solely to measure and improve our ad campaigns.

Google Remarketing

We use Google Remarketing to show our advertisements to users who have previously visited alvencia.com when they browse other websites in the Google Display Network or use Google Search. You can opt out of Google Remarketing at any time via Google's Ad Settings at adssettings.google.com, or by using the Google Analytics Opt-Out Browser Add-on.

Meta (Facebook/Instagram) Pixel

The Meta Pixel helps us measure the results of our advertising on Facebook and Instagram and understand whether you took an action (such as adding to cart or purchasing) after seeing our ad. This data is used in accordance with Meta's data policy. You can adjust your ad preferences directly on Facebook or Instagram.