Privacy Policy

Who is responsible for your data

Oye Kudiye (GSTIN 27ACEPJ3716G1ZT), 4th Floor, A-403, Blue Bell, Eksar Road, Mumbai, Mumbai Suburban, Maharashtra 400092. E-mail: [email protected]. Phone: +91 89286 13701.

Questions or requests about your data go to our Grievance Officer (see Grievance Officer and complaints).

What personal data we collect and why

We collect only what we need for the purposes below. Each purpose is specific, and we do not use the data for anything unrelated without asking you again.

We do not collect Aadhaar, PAN, bank account or card details from you at the time of buying; payments are handled by our payment partner. Refunds for cash on delivery orders are given as store / wallet credit in your OyeKudiye account, so we do not need your bank account or UPI details for them.

Your consent

• We ask for consent in a clear, separate request before we use your data for anything that is not needed for your order. Consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action such as ticking a box or turning on a switch. We do not pre-tick boxes, and we do not make a purchase depend on you agreeing to marketing.
• At sign-up we ask for one required box that is never pre-ticked: that you have read and agree to our Terms and Conditions and this policy, and consent to our processing your personal data for the purposes listed in the "How we use your data" notice and in this policy. We record it as two consents (acceptance of the Terms, and consent to processing under this policy) so that each can be shown and withdrawn separately. It is needed to create an account, because without it we cannot lawfully open one; nothing else is bundled with it. Offers by e-mail is a separate, optional box. If you do not tick the required box, no account is created and no personal data you typed is kept.
• Where you give us data to place an order, we use it to complete that order (a "legitimate use" under section 7 of the DPDP Act), even without a separate tick.
• You can withdraw consent at any time, as easily as you gave it: switch off a preference under My Account, Profile, use the unsubscribe link or reply STOP, or e-mail [email protected]. Withdrawal is as easy as giving consent and takes effect promptly; we will stop the processing that depended on it unless the law requires us to keep the data (for example tax records). Withdrawing does not affect what we did before you withdrew. If you withdraw something we need to fulfil an order in progress, we may not be able to complete that order.
• Consent record. When you create your account we record each consent separately in our consent log: what you agreed to, the date and time, the version of this policy and of the notice wording that was shown (currently version 2026-10-09-v1), a fingerprint of the exact text shown, the channel (web) and a one-way hash of your IP address and browser. You can ask us for a copy of your consent history and withdraw any choice as described below; we keep the history so that we can show what you agreed to.
• Where the law allows, we may also process data for compliance with legal obligations, responding to a court or authority, preventing fraud, and protecting life or safety.

This notice is available in English. On request we will provide it, and the consent request, in any of the languages listed in the Eighth Schedule to the Constitution of India; write to [email protected].

Who we share data with

We do not sell your personal data. We share it only with service providers who process it on our behalf under written contracts that require them to protect it and use it only for our purposes ("Data Processors"), and where the law requires:

• Payment gateway (Razorpay): to take payment and process refunds.
• Courier and logistics partners: your name, address, pincode and phone number, to deliver and collect parcels.
• Messaging providers: SMS, WhatsApp and e-mail services that send one-time passwords, order updates and, if you opted in, offers.
• Hosting, cloud and IT service providers: to store the data and run the site securely.
• Accountants, auditors and legal advisers: for tax, accounting and legal work, bound by confidentiality.
• Government, regulators and courts: when we are legally required to disclose, for example under tax law or a lawful order.
• A buyer or successor of our business, if it is ever sold or merged, who must continue to honour this policy.

Our current partners can be named on request at [email protected].

Transfers outside India

We store your data on servers located in India. Some of our service providers (for example an e-mail or messaging provider) may process limited data outside India. The DPDP Act permits this except to countries the Government of India restricts by notification, and we will not transfer data to any restricted country. We take care that overseas processors are bound by the same protections.

How long we keep your data

We keep personal data only as long as the purpose needs it, or the law requires. When the purpose is over we erase it or make it anonymous.

How we protect it

We use reasonable security safeguards: encrypted (HTTPS) connections, access limited to staff who need the data, one-time-password sign-in, hashed and protected credentials, separation of payment data (which stays with the payment gateway), logging and monitoring, regular backups, and contracts with our processors. No system is perfectly secure, so please also protect your own device and OTPs.

If there is a personal data breach, we will inform the Data Protection Board of India and each affected Data Principal, in the form and time the DPDP Rules require, and tell you what happened, the likely effect, what we are doing and what you can do.

Cookies and similar technologies

When you browse the Discover feed, we also record which pieces you view or tap, with your device type, IP address and the page. If you are signed in, we link that to your account name and mobile number so we can improve recommendations. We do not run third-party advertising or analytics trackers on the storefront at present. If we add any, we will ask for your consent first and update this section. Personalisation is optional: you can clear or block cookies in your browser, or write to us to stop Discover activity records, and the store will still work.

Marketing messages

Today we send offers and news by e-mail only, and only if you ticked the optional e-mail offers box (at sign-up or later under My Account). We do not send offers by SMS or WhatsApp yet; if we start, we will ask for your consent for each channel separately and will not assume it from your e-mail choice. Order and delivery messages (OTPs, confirmations, tracking) are service messages needed to complete your order and are sent regardless. Turn any channel off under My Account, Profile, use the unsubscribe link in each e-mail, or reply STOP. We act on it promptly.

If you leave items in your cart, we may email you reminders about that cart, and you can opt out with one click.

The Journal newsletter is separate: it needs a form on our blog, a ticked (never pre-ticked) box and a confirmation e-mail with a link you must press before anything is sent to you. It only tells you about new articles. Every newsletter has a one-click unsubscribe link; after you unsubscribe we erase your address and keep only a one-way fingerprint so that you are not e-mailed again by mistake.

Children

Our store is for adults. By creating an account you confirm that you are 18 or older; a person under 18 must not register, and a parent or lawful guardian must create and hold the account for them. If you enter a date of birth that shows you are under 18 we do not create the account. We do not knowingly collect data of anyone under 18 (a "child" under the DPDP Act) unless a parent or lawful guardian gives verifiable consent. We do not track or monitor the behaviour of children, and we do not show them targeted advertising. If you think a child has given us data without consent, tell us at [email protected] and we will delete it.

Your rights

Under the DPDP Act you have the right to:

• Access: get a summary of your personal data we hold and how we use it, and the names of those we have shared it with.
• Correction, completion and updating: have inaccurate or incomplete data fixed. You can also edit most of it yourself under My Account.
• Erasure: ask us to erase your data. We will do so unless we must keep it for a legal reason (for example tax records), and will tell you what we are keeping and why.
• Withdraw consent at any time (see Consent above).
• Grievance redressal: complain to us and get a response.
• Nominate another person to exercise your rights if you die or become unable to do so. Send us the nominee's name and contact details in writing, signed by you.

How to use your rights

1. E-mail [email protected] from the address registered with us, with the subject "Data request", saying which right you want to use. We may ask you to verify your identity so that nobody else can obtain your data.
2. We acknowledge within 48 hours and respond or complete the request within 30 days, in any case within the maximum period set by the DPDP Rules.
3. There is no charge for making a request.

Registered Consent Managers under the DPDP Act may also act for you; once the framework is operating we will honour requests that come through them.

Grievance Officer and complaints

Grievance Officer / contact for data questions: Rohit Pandey, Customer Care Manager
E-mail: [email protected]
Phone: +91 89286 13701
Address: 4th Floor, A-403, Blue Bell, Eksar Road, Mumbai, Mumbai Suburban, Maharashtra 400092

Please complain to us first. We acknowledge within 48 hours and resolve within 30 days. If you are not satisfied, or we do not respond in time, you may complain to the Data Protection Board of India (the Board) as provided in the DPDP Act, and it will accept complaints once it is operational and through the process it announces. You may also have other remedies under Indian law. Under the Act you are expected to use our grievance route before approaching the Board.

Your responsibilities

The DPDP Act also asks Data Principals to follow the law, give accurate information, not file false or frivolous complaints and not impersonate anyone. Please give us correct details and tell us when they change.

Changes to this policy

We may update this policy when our practices or the law change. The "Last updated" date above shows the latest version. If a change affects how we use your data in a way that needs your consent, we will ask you again before applying it (for example by showing the new notice and asking for your consent the next time you sign in), and we will tell you about other important changes by e-mail or a notice on the site.