Privacy policy

This policy explains what personal data we collect about you, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

We have written it to the standard of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The substantive obligations under that Act commence on 13 May 2027. We are applying them now rather than waiting, so nothing about how we handle your data has to change on that date.

If anything here is unclear, write to us. A person will answer.

1. Who is responsible for your data

Jaitam Jewels Private Limited, trading as Carat Hills, decides why and how your personal data is collected and used. Under the DPDP Act we are the Data Fiduciary for that data. Principal place of business: Ghee Walo Ka Rasta, Johari Bazar, Jaipur, Rajasthan 302001

Email: info@carathills.com   |   Phone: +91 94628 09598   |   WhatsApp: +91 94628 09598

Our data protection contact

We are not a Significant Data Fiduciary and are not required to appoint a Data Protection Officer. We have named a person who can answer any question about how we handle your data:

Name: Mr. Abhishek Jain

Email: info@carathills.com

Phone: +91 94628 09598

This person handles access, correction and erasure requests, consent questions, and any complaint about your data.

2. What we collect

We collect only what we need. Here is the full list.

Information you give us

•   Name

•   Email address

•   Phone number

•   Shipping address and billing address

•   Ring size, preferences and any personalisation details you provide

•   Account login details, if you create an account

•   Messages you send us by email, WhatsApp, contact form or social media

•   Reviews and photographs you choose to post

•   Bank account details, but only if we owe you a refund on a cash on delivery order

•   For a custom order, any drawing, reference image or description you send us

Information created when you order

•   Order history — what you bought, when, at what price

•   Invoice and tax records

•   Delivery status and courier tracking information

•   Returns, exchange, resizing and warranty claim records

•   Marketing preferences — what you have consented to and what you have withdrawn

Information collected automatically

•   Device type, operating system and browser

•   IP address, and approximate location derived from it

•   Pages you view, how you arrived, and how you move through the site

•   Cookie and similar identifiers

•   Google Analytics measurement data

•   Meta pixel event data, such as items viewed and added to cart

The last two are collected only if you accept analytics and advertising cookies. Section 6 explains this.

What we do not collect

We do not receive or store your card number, CVV, UPI PIN or netbanking credentials. Those go directly to Razorpay or Cashfree on their own systems. We see only whether a payment succeeded and the last few digits of the instrument used.

We do not ask for your Aadhaar, PAN or any government identifier. If you send one to us unprompted, we will delete it.

We do not buy personal data from anyone, and we do not build profiles on people who have not dealt with us.

3. Why we use it, and on what basis

Indian law requires us to be specific about purpose. "Business purposes" is not an adequate explanation, so here is the actual breakdown.

What we use it for	What we use	Our basis
Taking, processing and delivering your order	Name, contact, address, order details	Necessary for the transaction you asked for
Taking payment and handling refunds	Order value, payment status, bank details for COD refunds	Necessary for the transaction
Issuing your GST invoice	Name, address, order details	Legal obligation
Returns, exchange, resizing and warranty claims	Order history, photographs you send, claim records	Necessary for the transaction
Answering your questions and resolving complaints	Contact details, message history, order history	Necessary for the transaction
Preventing fraud and failed deliveries	Order patterns, delivery history, contact details	Necessary for the transaction and our legitimate interest in preventing loss
Keeping tax, accounting and statutory records	Invoices, order records	Legal obligation
Sending you offers and news	Name, email, phone, purchase history	Your consent
Measuring how the site is used	Analytics data	Your consent
Showing you our advertising, and measuring it	Meta pixel and Google data	Your consent

 

Two things follow from this table, and both matter to you.

First, the data we need to fulfil your order is used because the order cannot happen without it, not because you ticked a box. That means withdrawing marketing consent never interferes with an order you have already placed, or with your warranty and return rights.

Second, marketing, analytics and advertising all sit on consent, separately from each other. You can accept one and refuse another.

4. Consent

Where we rely on your consent, that consent is free, specific, informed and given by a positive action from you.

•   We never use pre-ticked boxes

•   We never bundle marketing consent into checkout

•   Placing an order does not put you on a marketing list — joining is a separate, deliberate choice

•   We ask separately for email marketing, WhatsApp marketing, analytics and advertising

•   We keep a record of what you consented to and when, so that we can show it if asked

Withdrawing consent

You can withdraw any consent at any time, and it must be as easy as giving it was. You can:

•   Click unsubscribe in any marketing email

•   Reply STOP to any marketing WhatsApp message

•   Change your cookie choices through the link in our website footer

•   Write to Abhishek Jain at info@carathills.com

We act on a withdrawal within 7 days and instruct our service providers to do the same.

Withdrawing marketing consent stops marketing. It does not stop messages about an order you have placed — confirmation, dispatch, tracking, delivery and refund updates are part of the order itself and continue.

If you gave us consent before this policy

If you dealt with us before this policy came into effect, we will give you this notice and ask you to confirm your marketing preferences. Until you tell us otherwise, we continue on the basis you originally agreed to. You can withdraw at any time.

5. Language

This policy is available in English and Hindi. Both versions say the same thing. If you would like it in another language, write to us and we will do our best.

6. Cookies, analytics and advertising

Essential cookies

These keep the site working — your cart, your session, your login, fraud checks at checkout, and your cookie preferences themselves. The site cannot function without them, so they run without consent. They are not used for advertising.

Analytics and advertising

Google Analytics and the Meta pixel do not run until you accept them. If you decline, or ignore the banner, they stay switched off. Nothing about your shopping experience changes if you decline — you simply see less relevant advertising elsewhere.

You can change your mind at any time through the cookie settings link in our footer.

An honest note about Google and Meta

When you consent to analytics and advertising, Google and Meta receive data through our site. For some of their own purposes, they decide independently what to do with that data — which means for those purposes they are responsible for it, not us. We tell you this because it affects what we can and cannot control, and because their own privacy policies apply alongside ours.

We do not send Google or Meta your name, address or phone number.

Children

We do not knowingly show behavioural or targeted advertising to anyone under 18. See section 11.

7. Who we share your data with

We share only what a partner needs to do its job. We do not sell your data, we do not rent it, and we will not.

Who	Why	What they get
Shopify	Runs our website, checkout and order system	Order and account data
Razorpay and Cashfree	Process payments and refunds	Name, contact, order value
Shiprocket and its delivery partners	Deliver your order and handle returns	Name, address, phone, order weight
Google	Website analytics, where you consent	Usage data, cookie identifiers
Meta	Advertising and measurement, where you consent	Event data, cookie identifiers
[[EMAIL / WHATSAPP / REVIEW TOOLS]]	Send order updates and, with consent, marketing	Name, email, phone, order status
Our accountants and auditors	Statutory accounts and tax filing	Invoice and order records
Our legal advisers	Where we need advice on a dispute	Only what is relevant
Government authorities	Where the law requires it	Only what is required

 

Each of these is bound by a written contract that requires them to use your data only for the service they provide to us, to keep it secure, and to delete it when we tell them to.

If our business is ever sold or restructured, your data may transfer to the new owner. Your rights under this policy travel with it, and we will tell you before it happens.

8. Where your data is held

Some of our service providers, including Shopify, hold data on servers outside India. Indian law permits this. The Government may restrict transfers to particular countries or entities; where it does, we will comply.

Wherever your data sits, our contracts require the same protections.

9. How long we keep it

What	How long	Why
Order records, invoices, tax records	7 years from the end of the financial year	Tax and accounting law
Warranty and claim records	7 years	To honour warranty claims and defend disputes
Account details	While your account is open, then 7 years for the order history attached to it	Order and tax records
Marketing data and preferences	Until you withdraw consent, then deleted	No longer needed
Enquiries that did not lead to an order	2 years	To handle follow-up questions
Website and processing logs	At least 1 year	Required by the DPDP Rules
Bank details given for a COD refund	Deleted once the refund clears and the statutory dispute window has passed	No longer needed

 

When a retention period ends we delete the data, or anonymise it so that it can no longer identify you.

One point worth being clear about: if you ask us to erase your data, we will — except where we are legally required to keep it. Tax law requires us to hold invoice records for years, and we cannot delete those on request. We will delete everything else and tell you exactly what we have kept and why.

10. Your rights

You have these rights over your personal data.

The right to know

You can ask us for a summary of the personal data we hold about you, what we are doing with it, who we have shared it with, and what we shared.

The right to correct, complete or update

If anything we hold is wrong, incomplete or out of date, tell us and we will fix it.

The right to erase

You can ask us to delete your data. We will, unless we still need it for the purpose you gave it for, or a law requires us to keep it.

The right to withdraw consent

Covered in section 4. As easy to withdraw as it was to give.

The right to nominate someone

You can nominate one or more people to exercise these rights on your behalf if you die or become unable to act. Write to us and we will record the nomination.

The right to complain

You can complain to us first — section 12 tells you how. If you are not satisfied, you can complain to the Data Protection Board of India.

How to exercise any of these

Write to [[DATA PROTECTION CONTACT NAME]] at info@carathills.com, or WhatsApp +91 94628 09598.

Tell us which right you are exercising and give us the email address or phone number you used with us, or your order number, so we can find your records. We may ask you to confirm your identity before we act — this protects your data from someone else asking for it.

We respond within 30 days. Where a request is complex we may need longer, and we will tell you why; in no case will we take more than 90 days.

There is no charge for any of this.

11. Children

Our website and products are intended for adults. You must be 18 or older to place an order.

We do not knowingly collect data about anyone under 18. We do not track children, monitor their behaviour, or direct advertising at them.

If a child has given us data, or a parent or guardian believes we hold a child’s data, write to [[DATA PROTECTION CONTACT NAME]] at info@carathills.com and we will delete it promptly.

12. Keeping your data safe

We take these measures:

•   Encrypted connections across the site and at checkout

•   Access limited to the few people who need it to do their work

•   No card, UPI or banking credentials held by us at all

•   Written contracts with every service provider requiring appropriate security

•   Logging and monitoring of access to customer data, retained for at least a year

•   Regular backups

•   Periodic review of whether these measures are actually working

No system is completely secure, and we will not claim otherwise. What we can promise is that we take reasonable and appropriate measures, and that we will tell you honestly if something goes wrong.

If there is a breach

If a breach affects your personal data, we will tell you without delay, through your account or the contact details we hold. We will explain what happened, how far it extends, when it occurred, what it is likely to mean for you, what we are doing about it, what you can do to protect yourself, and who to contact.

We will also inform the Data Protection Board of India without delay, and provide full details within 72 hours of becoming aware.

13. Complaints

If you are unhappy with how we have handled your data, start with our data protection contact:

Name: [[DATA PROTECTION CONTACT NAME]]

Email: info@carathills.com

Phone: [[DATA PROTECTION CONTACT PHONE]]

We acknowledge every complaint and respond within 30 days.

If we have not resolved matters to your satisfaction, you can complain to the Data Protection Board of India. You do not need our permission to do so and you do not have to come to us first.

For complaints about an order rather than your data, our Grievance Redressal page sets out a separate process with its own timelines.

14. Other websites

Our site links to other places — social media, payment pages, courier tracking. Once you leave our site, this policy no longer applies. Those services have their own privacy policies and we do not control them.

15. Changes to this policy

We will update this policy as our practices, our tools or the law change. The effective date at the top tells you which version is current, and we keep earlier versions on file.

Where a change materially affects how we use your data, we will tell you directly rather than quietly updating the page. Where a change requires fresh consent, we will ask for it.