1.1 Adept Solar Grown Diamond LLP, which owns and operates the Kavera brand, is responsible for your personal data as the data fiduciary. Our contact details are in clause 11.

1.2 This Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what rights you have. It is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is designed to meet the Digital Personal Data Protection Act, 2023 and the rules made under it.

2.1 Information you give us: your name, email address, mobile number, delivery and billing addresses, date of birth and anniversary (if you choose to share them), ring and bangle sizes, gift messages and recipient details, design references for bespoke orders, reviews and photographs you post, and the content of your messages and calls with us.

2.2 Verification and KYC information: where required under clause 10 of the Terms of Use, your PAN, a government-issued photo identity document of your choice (we ask that any Aadhaar copy be masked), proof of address, and bank account details for refunds and buy-back payments.

2.3 Transaction information: your orders, payments, returns, exchanges, buy-back and warranty requests, and unboxing videos or photographs you send us. Card details are entered on our payment partners' secure pages and are not stored by Kavera.

2.4 Device and usage information: your IP address, device and browser type, pages viewed, products browsed, referring links and similar data collected through cookies and similar technologies, as described in the Cookie Policy.

2.5 Information from others: delivery status from logistics partners, payment status from payment partners and financiers, verification results from identity or bank verification providers, and information from advertising platforms about how you reached the Platform.

2.6 We do not knowingly collect personal data of anyone under 18. If you believe a minor has given us personal data, write to us and we will delete it.

3.1 We use your personal data only for the purposes below:

(a) to create and manage your Account, and to process, deliver and support your orders;

(b) to handle cancellations, returns, refunds, exchanges, buy-back, warranty, after-care and bespoke requests, which can arise for as long as you own a Product;

(c) to verify identity and payments and to prevent and investigate fraud;

(d) to meet our legal obligations, including tax, accounting, hallmarking, consumer protection and anti-money-laundering requirements, and to respond to lawful requests from authorities;

(e) to respond to queries and complaints, and to improve our Products, Platform and service;

(f) with your consent, to send you promotional communications and personalise your experience and the advertising you see; and

(g) to establish, exercise or defend legal claims.

3.2 Where we rely on your consent, we will ask for it through a clear notice, and you may withdraw it at any time as easily as you gave it. Withdrawal does not affect processing done before withdrawal, or processing needed to fulfil orders, comply with law or honour your rights under the Policies.

4.1 We send promotional emails, SMS, WhatsApp messages and calls only with your consent. You can unsubscribe through the link in any email, by replying STOP to an SMS or WhatsApp message, through your Account settings, or by writing to care@kavera.in. We will act on your request within 7 Business Days.

4.2 Transactional messages about your orders and Account will continue after you unsubscribe from promotional communications.

5.1 We do not sell your personal data.

5.2 We share personal data only to the extent necessary with: logistics partners (to deliver and collect Products); payment gateways, banks and financiers (to process payments, EMI and refunds); identity and bank verification providers; our e-commerce platform, cloud hosting, customer support, messaging and email service providers; analytics and advertising partners such as Google and Meta, where you have consented to the relevant cookies; SGL (where a stone is sent for re-grading at your request); our professional advisers, auditors and insurers; and a successor to our business. [Kavera to list its current principal providers here.]

5.3 We may disclose personal data to government, regulatory, tax or law enforcement authorities where required by law or to protect against fraud.

5.4 Our service providers process personal data only on our instructions, under contracts that require them to keep it secure and confidential.

5.5 Some of our service providers may store or process personal data outside India. We transfer personal data only to countries not restricted by the Government of India, and with safeguards that protect it to the standard of this Policy.

6.1 We keep personal data only as long as needed for the purposes in clause 3:

(a) Account information, for as long as your Account is open and for 3 years after it is closed or after your last interaction, whichever is later;

(b) order, invoice and product records, for as long as your Products remain eligible for warranty, exchange or buy-back, and in any case for the period required under GST, income-tax and accounting laws;

(c) KYC records, for the period required by applicable law;

(d) unboxing videos, complaint records and call recordings, for 3 years from the resolution of the matter, or longer while a dispute is pending; and

(e) marketing data, until you withdraw consent.

6.2 At the end of the retention period, we delete or anonymise personal data, unless the law requires us to keep it longer.

7.1 We use reasonable security practices and procedures as required by the Information Technology Act, 2000, including encryption of data in transit, access controls limited to staff who need the data, and security standards required of our service providers. Payment card data is handled only by payment partners that comply with the Payment Card Industry Data Security Standard (PCI-DSS) and RBI's card tokenisation requirements.

7.2 No system is completely secure. If a personal data breach occurs, we will notify affected individuals and the authorities as required by law.

8.1 Subject to applicable law, you have the right to:

(a) obtain a summary of the personal data we hold about you and the processing we carry out;

(b) correct, complete or update inaccurate or incomplete personal data;

(c) have your personal data erased, except where we must keep it under clause 6 or by law;

(d) withdraw any consent you have given;

(e) nominate a person to exercise your rights in the event of your death or incapacity; and

(f) have your grievances about your personal data redressed.

8.2 To exercise these rights, write to care@kavera.in or the Grievance Officer. We may need to verify your identity first. We will respond within the timelines in the Grievance Redressal Policy. If you are not satisfied, you may complain to the Data Protection Board of India once its procedures apply to your complaint.

9.1 Our use of cookies and similar technologies is explained in the Cookie Policy.

10.1 We may update this Policy by publishing a revised version with its effective date. Where a change materially affects how we use personal data you have already given us, we will notify you and, where required, ask for your consent again.

11.1 Questions, requests and complaints about personal data may be sent to care@kavera.in or to the Grievance Officer, whose details are in the Grievance Redressal Policy.