Privacy Policy

Rupashree Jewellers RB ("we") operates the Jonaki online store at jonaki.online. This policy is our notice under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act 2000 and its Reasonable Security Practices Rules 2011, and the Consumer Protection (E-Commerce) Rules 2020. Last updated: 23 June 2026.

1. Data we collect

• You give us: name, email, phone, shipping address, order history, birthday (optional).
• Automatically: device, browser, IP, pages viewed, cookies (analytics & ads).
• We do not store your card number, CVV, UPI VPA or net-banking credentials at any time — payments are processed end-to-end on Razorpay's PCI-DSS Level 1 platform.
• We do not collect passwords, biometric data, sexual orientation, health, caste, religion or political affiliation. (SPDI Rules 2011 r.3 categories — not applicable to Jonaki.)

2. Why we use your data

• To process and deliver your orders, and to send tracking / packing / delivery updates
• To provide customer support and aftercare (re-polish, returns, queries)
• To send marketing — only after your explicit opt-in; you can opt out from any message in one click
• To improve our products, site, security and ads
• To prevent fraud and meet our tax / accounting / legal obligations

3. Grounds for processing (DPDP s.6)

We process your data on two legal grounds:

• Contract necessity — name, address, phone, email, and payment status are needed to fulfil your order. We process these without separate consent; you cannot opt out of this and still receive the order.
• Your consent — for marketing communications and any non-essential processing. You give this consent by ticking the relevant box at checkout or signing up to our newsletter. You may withdraw consent any time — email us at care@jonaki.online or click "Unsubscribe" in any marketing message. Withdrawal will be as easy as giving consent (DPDP s.6(4)).

4. Who we share data with

We share data only with these named processors, for these specific purposes, all under written contracts:

• Razorpay Software Pvt Ltd (Bengaluru) — payment processing; PCI-DSS Level 1, India servers.
• Shiprocket / BigFoot Retail Solutions Pvt Ltd (Gurugram) — order fulfilment, courier serviceability, label generation; India servers.
• Hostinger International Ltd — website hosting; India region servers.
• Google LLC (USA) — Google Analytics 4 with IP anonymisation; Google Tag Manager.
• Meta Platforms Inc. (USA) — Meta Pixel and Conversions API with hashed (SHA-256) email and phone identifiers only.
• Microsoft Clarity (Microsoft Corporation, USA) — privacy-masked session recordings and heatmaps.
• Hostinger SMTP — transactional email delivery.
• WhatsApp / Meta — order-status and (opt-in) marketing messaging.

We never sell your personal data to advertisers, data brokers, or any third party.

5. Your rights under the DPDP Act

You have the right to:

• Access the personal data we hold about you (s.11)
• Correct or update it (s.12)
• Erasure — request deletion when no longer needed for the original purpose or required by law (s.12)
• Withdraw consent at any time (s.6(4))
• Nominate another person to exercise your rights in case of death or incapacity (s.14)
• File a grievance with our Grievance Officer (see Section 12)
• Escalate to the Data Protection Board of India if we fail to address your grievance, once the Board becomes operational (s.13)

To exercise any right, email care@jonaki.online. We acknowledge within 48 hours and resolve within 30 days.

6. Data retention

We retain order data for as long as the law requires (typically 8 years under the GST and Income Tax Acts for financial records, 3 years under the Consumer Protection Act for complaint records). After the retention period, we delete or anonymise the data. You can request earlier deletion of any non-financial data by writing to the Grievance Officer.

7. Security

We follow Rule 8 of the IT (SPDI) Rules 2011 — reasonable security practices including TLS 1.2+ in transit, bcrypt hashing for passwords, signed Razorpay payment verification, principle of least privilege for staff access, and CSP / X-Frame-Options on every page. No system is 100% secure, but we treat protection seriously.

8. Cookies

We use cookies for essential functionality (session, cart, CSRF), analytics (GA4, Clarity) and advertising (Meta Pixel, Google Ads). You can control non-essential cookies via your browser settings — most browsers let you block or delete cookies on a per-site basis. The cookies we set do not include card or password data. Disabling essential cookies will break login and checkout.

9. Children (DPDP s.9)

Jonaki is intended for adults (18+). We do not knowingly collect personal data from anyone under 18. We do not track minors behaviourally and do not target advertising at children. If you believe a child has submitted data to us, email care@jonaki.online and we will erase it within 7 days.

10. Cross-border transfers (DPDP s.16)

Some processors (Google, Meta, Microsoft Clarity) operate from servers outside India, principally in the United States or European Union. We rely on the Government of India's notified country list under DPDP s.16; if you are in a restricted jurisdiction we will limit the transfer accordingly. Your personal data shared with these processors is either hashed (Meta), anonymised (GA4 IP anonymisation), or session-only (Clarity).

11. Data breach notification (DPDP s.8(6))

If a breach affects your data, we tell the Data Protection Board of India and we tell you directly, within the timeline DPDP s.8(6) requires. You'll get a plain-English note covering what happened, what data was involved, what we're doing about it, and what you can do to protect yourself.

12. Grievance Officer

As required by the DPDP Act s.10 and the Consumer Protection (E-Commerce) Rules 2020 r.5(5), we have designated a Grievance Officer responsible for addressing your queries and complaints. You can reach them at:

• Designation: Grievance Officer, Rupashree Jewellers RB (operator of Jonaki)
• Email: care@jonaki.online
• Phone: +91 98308 82821
• Address: 128 Rash Behari Avenue, Park Crossing, Kolkata 700029, West Bengal, India
• Response window: acknowledgement within 48 hours; resolution within 30 days of receipt

13. Changes

We may update this policy from time to time. The "last updated" date reflects the latest version. When anything material changes, we email customers on our marketing list and run a banner on the site for 30 days.