PRIVACY POLICY

Quirks (“Quirks”, “we”, “our”, “us”) operates wearquirks.in (the “Site”) and provides products and services under the brand name Quirks (collectively, the “Services”).

This Privacy Policy is drafted in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It explains how we collect, use, disclose, and protect your personal information when you visit the Site, place an order, contact us, or otherwise interact with us.

Please read this Policy carefully. By using the Site, you agree to the collection and use of your information as described here. If you do not agree with this Policy, please do not use the Site.

a) Information You Provide Directly

• Name, email address, and phone number

• Billing address and shipping address

• Order details (products, sizes, quantities, order history)

• Payment-related information (see Section 6 - Payments)

• Communications you send us (customer support queries, feedback, reviews)

• Information submitted when signing up for our newsletter, WhatsApp updates, or SMS/email marketing

b) Information Collected Automatically

• IP address, browser type, device type, and time zone

• Pages and products viewed, items added to cart or wishlist

• Referring/exit pages and search terms that led you to the Site

• General location inferred from your IP address (we do not collect precise device location) Collected using cookies, log files, pixels, tags, and web beacons - see Section 3.

c) Information From Third Parties

• We may receive payment confirmation from our payment gateway, or delivery status updates from our logistics partner.

• We do not knowingly collect sensitive categories of data such as biometric or health information, and we do not collect government ID numbers (e.g. Aadhaar, PAN) unless legally required or specifically provided by you for a stated purpose.

• Process, fulfill, and ship your orders (including through our logistics partner)

• Process payments and manage our partial-COD payment option (including through our payment gateway)

• Communicate with you about your order, account, or support requests

• Send marketing communications (drop announcements, offers, restock alerts) where you’ve opted in, via email, SMS, or WhatsApp

• Run and measure advertising on platforms such as Meta (Instagram, Facebook) and Google

• Detect, investigate, and prevent fraud or unauthorised activity

• Improve the Site, our products, and your shopping experience

• Comply with applicable law, and enforce our Terms of Service and other policies

Where we rely on your consent (e.g. marketing), you may withdraw it at any time, see Section 8. Where we process data to fulfill your order or for legal/tax obligations, this is necessary to provide the Services and isn’t dependent on separate consent.

• We use cookies and similar tracking technologies to remember your preferences, understand how visitors use the Site, and deliver relevant advertising. You can manage or disable cookies through your browser settings, though some Site features may not work properly without them.

• We advertise on Meta (Instagram/Facebook) and Google, which may use cookies and pixels to show relevant ads on and off our Site and measure campaign performance

We do not sell your personal information. We share it only where necessary to run our business, including with:

• The website hosting provider hosts and operates the site and may receive order, account, and usage data.

• The payment gateway processes payments securely and may receive your name, contact details, transaction details, and masked payment information.

• The logistics partner delivers and tracks orders and may receive your name, contact details, address, and order details.

• Meta and Google may receive your IP address, browsing behaviour, and cookies to run and measure advertising campaigns.

• Customer support tools may receive your name, contact details, and chat or order history to manage queries and support tickets.

• Legal or regulatory authorities may receive information when legally required for compliance or law enforcement requests.

 
Third parties who process data on our behalf are only permitted to use it for the stated purpose. We may also share information in connection with a business transaction such as a merger, acquisition, or sale of assets.

Cross-border transfers: We currently store and process personal data on servers within India. Where any service provider processes data outside India, we take reasonable steps to ensure it is handled with an equivalent standard of protection.

We process your personal information only where we have a lawful basis to do so, which may include:

• Your consent - e.g. signing up for marketing, opting into cookies

• Performance of a contract - e.g. processing and delivering an order you place

• Legal obligation - e.g. retaining records for tax and audit purposes

• Legitimate use - e.g. fraud prevention, or data you voluntarily provide us for support

Payments are processed securely. Quirks does not store your full card or payment credentials on its own servers. For details on refunds of the prepaid deposit (including cancellation before shipping), please refer to our Refund & Cancellation Policy.

If you sign up for our newsletter, WhatsApp updates, or SMS marketing, you consent to receive promotional messages about new drops, offers, and restocks. This consent is not a condition of purchase.

Opt out at any time:

• Email: click “unsubscribe” in any marketing email

• SMS: reply STOP

• WhatsApp: message us to opt out

Even after opting out of marketing, we may still send non-promotional messages related to your order or account.

Under the DPDP Act, 2023, you have the following rights in relation to your personal data.

• You have the Right to Access, which allows you to know what personal data we hold about you and how it is being used; you can exercise this by emailing us as specified in Section 12.

• You have the Right to Correction, which allows you to request correction of inaccurate or incomplete data by emailing us with the relevant details.

• You have the Right to Erasure, which allows you to request deletion of your data where it is no longer needed or where consent has been withdrawn; you can exercise this by emailing us with your request.

• You also have the Right to Withdraw Consent, allowing you to withdraw consent for processing based on consent, including consent for marketing, at any time by using available unsubscribe links or by contacting us via email.

• The Right to Grievance Redressal allows you to raise a complaint regarding how your personal data has been handled by contacting our Grievance Team as specified in Section 11.

• Finally, you have the Right to Nominate, which allows you to nominate another person to exercise your rights on your behalf in the event of your death or incapacity; this can be done by emailing us with a signed nomination.

We aim to acknowledge requests within 48 hours and resolve them within 15 working days. Withdrawing consent doesn’t affect processing already carried out, and may limit our ability to provide certain services (e.g. we can’t send order updates without your contact details).

We keep personal data only as long as necessary for the purpose it was collected, or as required by law:

• Order and transaction records are typically retained for up to 8 years to meet tax and accounting requirements.

• Account and contact details are retained for the duration of your account, plus a reasonable period after inactivity.

• Marketing consent and preferences are retained until you withdraw your consent.

• Customer support records are typically retained for up to 3 years from the last contact.

• Cookies and analytics data are typically retained for 12–18 months.

After this period, data is deleted or anonymised so it can no longer identify you.

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or loss - including secure (SSL/TLS) transmission, access controls, and working only with reputable, secure infrastructure providers. That said, no method of transmission or storage is 100% secure, and we can’t guarantee absolute security.

In the event of a data breach that risks your rights or interests, we will take prompt steps to contain and assess it, and notify affected individuals and the relevant authorities as required under applicable law.

In accordance with the DPDP Act, 2023 and IT Rules, 2011, if you have concerns about how we’ve handled your personal data, you can contact our team:

Email: help@wearquirks.in

Whatsapp: +91 8097400109

We aim to acknowledge grievances within 48 hours and resolve them within 15 working days. If you’re not satisfied with our response, you may escalate the matter to the Data Protection Board of India.