Privacy Policy | Casa360

Effective Date: [DD Month YYYY] Last Updated: [DD Month YYYY]

This Privacy Policy explains how [Legal Entity Name], operating as Casa360 ("Casa360," "we," "us," or "our"), collects, uses, stores, shares, and protects personal information when you access or use our website casa360.in (the "Website"), including our sub-brands Rivaayat, Shilara, and Mritika (collectively, the "Stores"), and any related mobile-web, customer account, configurator, or professional-registration ("Casa Pro") services (together, the "Services").

By using the Services, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Services.

This Policy is published in accordance with:

Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
The Consumer Protection (E-Commerce) Rules, 2020; and
The Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, to the extent their provisions are in force.

1. Who We Are

Casa360 is a Direct-to-Consumer furniture and home décor brand headquartered in Jaipur, Rajasthan, India, operating through three brand pillars:

Rivaayat — heritage wood furniture
Shilara — stone arts and marble décor/furniture
Mritika — kitchen and tableware

For the purposes of applicable data protection law, Casa360 acts as the Data Fiduciary / Data Controller in respect of personal data collected through the Website. Our registered details are:

[Legal Entity Name] Registered Office: [Full Registered Address, Jaipur, Rajasthan] CIN / Business Registration No.: [Number] GSTIN: [Number] Email: [privacy@casa360.in]

2. Scope of This Policy

This Policy applies to personal information collected:

When you browse the Website, whether or not you create an account or make a purchase;
When you use the product configurator on any Store;
When you create an account, place an order, or contact customer support;
When you register as a design/architecture professional via /register-pro;
When you interact with us through CasaConnect, email, WhatsApp, phone, or social media linked from the Website.

This Policy does not apply to third-party websites, payment processors, or logistics partners linked from or integrated with our Website; those parties have their own privacy policies, which we encourage you to read.

3. Personal Information We Collect

We collect the following categories of information:

3.1 Identity and Contact Information

Full name
Email address
Phone number
Billing and delivery address(es)
City, state, PIN code

3.2 Account Information

Login credentials (email and password, stored in encrypted/hashed form)
Account preferences and saved addresses
Order history and saved configurations/wishlists

3.3 Order, Transaction, and Payment Information

Products ordered, quantities, prices, applied offers/coupons
Order status and delivery tracking information
Payment method selected (Prepaid / Cash on Delivery)
Limited payment metadata (transaction ID, payment status, last four digits of card/UPI ID where applicable)

We do not collect or store full debit/credit card numbers, CVV, or net-banking credentials. All online payments are processed by RBI-authorised, PCI-DSS-compliant third-party payment gateways, who collect and process your payment instrument details directly and in accordance with their own privacy and security policies.

3.4 Customisation and Configurator Data

Because customisation is central to how Casa360 works, we collect additional information specific to made-to-order products, including:

Selected dimensions, materials, finishes, hardware, engraving text, and other configurator inputs
Room measurements, space constraints, or reference photographs you choose to upload or share for design guidance
Design briefs, special instructions, or notes shared with our team or with manufacturing/artisan partners for the purpose of fabricating your order

This data is treated as directly tied to your order and is shared only as necessary with our manufacturing and artisan partners in Jaipur to produce your product (see Section 6).

3.5 Professional / B2B Information

If you register via /register-pro as an interior designer, architect, or property developer, we additionally collect:

Firm/studio name, professional designation, portfolio links or work samples
Business registration, GST, or professional credential details you choose to provide
Project scale, typical order volume, and areas of interest, where shared

3.6 Communications Data

Messages sent through our contact form, chat, email, or CRM/support tickets
Call recordings or notes from customer support interactions, where applicable and disclosed to you at the time
Marketing communication preferences and consent records

3.7 Technical and Usage Data

Collected automatically when you use the Website:

IP address, approximate geolocation (city/region level)
Browser type and version, device type, operating system
Pages visited, time spent, click patterns, configurator interaction paths, referral source
Cookies and similar tracking technologies (see Section 7)

3.8 Information from Third Parties

We may receive limited information about you from:

Payment gateways (transaction confirmation status)
Logistics and courier partners (delivery status, delivery attempts)
Social media platforms, if you interact with our official pages or choose to log in/connect via a social account (where such functionality is offered)

4. How We Collect Information

Directly from you — when you create an account, browse the configurator, place an order, fill a contact/registration form, or communicate with us.
Automatically — through cookies, log files, SDKs, and analytics tools as you use the Website.
From third parties — as described in Section 3.8.

5. Purposes for Which We Use Your Information

We use personal information only for purposes that are specified, lawful, and necessary, including to:

Create and manage your account
Process, fulfil, and deliver your orders, including made-to-order/customised products
Calculate dynamic, configuration-based pricing at checkout
Communicate order confirmations, shipping updates, delivery attempts, and after-sales support
Manufacture your customised product by sharing relevant specifications with our production partners
Process payments and refunds, and prevent payment fraud
Respond to customer support queries, complaints, and warranty/service requests
Send transactional communications (order-related) and, where you have opted in, marketing communications (offers, new collections, restock alerts)
Personalise your browsing experience, including product recommendations and configurator defaults based on past activity
Operate and improve the Website, configurator, and Services, including diagnosing technical issues
Evaluate and process professional/trade registrations for B2B relationships
Detect, investigate, and prevent fraud, abuse, or security incidents
Comply with applicable tax, accounting, consumer-protection, and other legal obligations
Enforce our Terms of Use and protect our legal rights

Legal Basis for Processing

Where the DPDP Act's consent-based framework applies, we process personal data on the basis of:

Your consent, freely given for specified purposes (e.g., marketing communications, optional profile data);
Performance of a contract, where processing is necessary to fulfil an order you have placed;
Legitimate use, including for purposes such as responding to a request initiated by you, or as otherwise permitted under the DPDP Act; and
Compliance with law, where required under tax, corporate, or consumer-protection legislation.

You may withdraw consent at any time for purposes based on consent, without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent may limit our ability to provide certain features (for example, we cannot process an order without delivery-address information).

6. How We Share Your Information

We do not sell your personal information to third parties. We share information only with the following categories of recipients, and only to the extent necessary:

Recipient Category	Purpose	Example
Manufacturing & artisan partners (Jaipur)	Fabricate your customised order	Dimensions, material selections, delivery address
Logistics & courier partners	Deliver your order	Name, address, phone number, order details
Payment gateways	Process payments and refunds	Order value, transaction reference
Cloud infrastructure & hosting providers	Store and serve Website data securely	Account, order, and configurator data (see Section 8 on international transfer)
Analytics and marketing platforms	Understand usage, send opted-in marketing	Technical/usage data, email (with consent)
Customer support / CRM tools	Manage support tickets and communications	Contact details, communication history
Professional advisors	Legal, audit, insurance purposes	As strictly necessary
Government or regulatory authorities	Comply with legal obligations, court orders, lawful requests	As required by law
Prospective acquirers/successors	In the event of a merger, acquisition, or asset sale	Subject to equivalent privacy protections

All third parties who process personal data on our behalf are contractually bound to use it only for the specified purpose and to maintain reasonable security safeguards.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Website. These fall into the following categories:

Strictly necessary cookies — required for core functionality such as cart persistence, login sessions, and checkout. These cannot be disabled without affecting site functionality.
Functional cookies — remember preferences such as theme (light/dark), recently viewed products, and saved configurator selections.
Analytics cookies — help us understand how visitors use the Website (pages visited, configurator drop-off points, device/browser data) so we can improve the experience.
Marketing cookies — used, where you consent, to measure and personalise marketing communications and retargeting.

You can control or disable cookies through your browser settings. Disabling non-essential cookies may limit certain features, such as saved configurations or personalised recommendations. Where required by law, we will present a cookie consent banner allowing you to accept or reject non-essential cookies before they are set.

8. International Data Transfer

Casa360's Website is built on infrastructure hosted with our technology provider Appwrite, whose relevant cloud region for our project is located in Singapore. This means personal data you provide may be transferred to, stored, and processed outside India.

We take the following steps in connection with this transfer:

We use providers who maintain industry-standard technical and organisational security measures;
Access to stored data is restricted through authenticated, server-side access only — no client application communicates directly with the underlying database;
We will update this section to reflect specific cross-border transfer safeguards, restricted-country lists, or approval requirements once corresponding provisions of the DPDP Rules, 2025 come into force (currently expected in phases through May 2027).

If you have concerns about international transfer of your data, please contact us using the details in Section 14.

9. Data Security

We implement reasonable security practices and procedures appropriate to the sensitivity of the information we hold, including:

Encrypted data transmission (HTTPS/TLS) across the Website
Signed, HTTP-only session cookies for authenticated admin access, with server-side verification on every administrative action
Role-based access control restricting administrative data access to authorised personnel only
Media and file access served through authenticated proxy endpoints rather than public storage links
Segregation of the public storefront from the administrative system, so customer-facing infrastructure never holds direct database credentials
Regular review of access permissions and security configuration

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security, and any transmission of information is at your own risk.

10. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, including to satisfy legal, accounting, or reporting obligations:

Account data — retained for as long as your account remains active, and for a reasonable period thereafter in case you wish to reactivate it
Order and transaction records — retained for a minimum of [8] years in accordance with applicable tax and corporate record-keeping requirements
Customisation/configurator data tied to an order — retained for the product's warranty period plus a reasonable period thereafter, to support after-sales service
Marketing consent and communication records — retained until you withdraw consent or unsubscribe, plus a reasonable period to record that withdrawal
Support/CRM records — retained for a reasonable period to resolve related future queries

Once retention is no longer necessary, we will delete or anonymise the relevant personal information, except where we are required to retain it by law.

11. Your Rights

Subject to applicable law, and as rights under the DPDP Act come into force, you have the right to:

Access — request a copy of the personal information we hold about you
Correction — request correction of inaccurate or incomplete personal information
Erasure — request deletion of your personal information, subject to our legal obligation to retain certain records
Withdraw consent — withdraw previously given consent for consent-based processing, at any time
Grievance redressal — raise a complaint about how your personal information has been handled
Nominate a representative — nominate another individual to exercise your rights on your behalf in the event of death or incapacity, once this mechanism is operationalised under the DPDP Rules
Opt out of marketing — unsubscribe from promotional emails, SMS, or WhatsApp communications at any time, without affecting transactional communications related to your orders

To exercise any of these rights, please contact us using the details in Section 14. We will respond within a reasonable time and in any case within the timeframe prescribed under applicable law (generally 30 days).

12. Children's Privacy

The Services are not directed at, or intended for use by, individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child without appropriate consent, we will take steps to delete such information promptly.

13. Marketing Communications

Where you have opted in, we may send you emails, SMS, or WhatsApp messages about new collections, offers, or configurator features. You can opt out at any time by:

Clicking "unsubscribe" in any marketing email
Replying "STOP" to SMS/WhatsApp marketing messages
Updating your communication preferences in your account settings
Contacting us directly using the details in Section 14

Opting out of marketing communications does not affect transactional messages necessary for order processing, delivery, and customer support.

14. Grievance Officer and Contact Us

In accordance with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, 2023, we have appointed a Grievance Officer to address your questions, concerns, or complaints regarding this Policy or the handling of your personal information.

Grievance Officer: [Name] Designation: [Designation] Email: [grievance@casa360.in] Phone: [Phone Number] Address: [Registered Office Address, Jaipur, Rajasthan] Response Timeline: Complaints will be acknowledged within 48 hours and resolved within 30 days, or as prescribed by applicable law.

For general privacy queries, you may also write to us at [privacy@casa360.in].

If you are not satisfied with our response, you may approach the Data Protection Board of India, or other applicable consumer/regulatory authority, once such grievance mechanisms are operationalised for your category of complaint.

15. Third-Party Links

The Website may contain links to third-party websites, including social media platforms accessible via CasaConnect. This Policy does not apply to, and we are not responsible for, the privacy practices of any third-party site. We encourage you to review the privacy policy of every site you visit.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last Updated" date at the top of this Policy indicates when it was last revised. Material changes will be notified through a prominent notice on the Website or by direct communication (email) where appropriate, before the changes take effect. We encourage you to review this Policy periodically.

17. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Jaipur, Rajasthan.

18. Contact Us

For any questions about this Privacy Policy or our data practices, please contact:

[Legal Entity Name] (Casa360) [Registered Address, Jaipur, Rajasthan, India] Email: [privacy@casa360.in] Phone: [Phone Number]