What we hold, and why.

This policy applies to: visitors to craftedcircle.in; individuals who submit an enquiry, brief or form; corporate clients and their authorised personnel; individual (B2C) clients; gift recipients whose details are shared with us by a client; and vendors and partners who engage with us.

a) Data you give us directly

Name, designation, company, email address, phone number, billing address, GSTIN, communication preferences, and the content of your enquiries, briefs, calls, WhatsApp and email correspondence with us.

b) Recipient data given to us by our clients

For gifting execution and our standing gifting calendar, our clients share recipient details: name, delivery address, contact number, occasion and relevant dates, relationship to the client, and preference or personalisation notes. Where you are a corporate client, you confirm that you have the lawful authority and, where required, the consent or other valid basis to share this data with us, and that you have informed those individuals as required by law. Crafted Circle processes such data on your instructions for the purpose of fulfilling your gifting programme.

c) Preference and feedback data

Where we conduct post-delivery feedback conversations, we record likes, dislikes, dietary or lifestyle preferences and gift history. This is used to improve future curation and to ensure a gift is never repeated for the same recipient.

d) Transaction data

Invoice, order, quotation and payment records. We do not collect or store full card numbers, CVV or net-banking credentials. Payments are processed by PCI-DSS compliant third-party payment gateways; we receive only a transaction reference, status, amount and masked instrument details.

e) Technical and usage data collected automatically

IP address, approximate location derived from IP, browser and device type, operating system, referring URL, pages viewed, time on page, clicks, and cookie or pixel identifiers. See Sections 5 and 6.

f) Sensitive personal data

We do not seek sensitive personal data. Please do not include health, financial account, biometric or similar sensitive information in free-text fields unless we have specifically requested it for a defined purpose (for example, an allergy note required for a food hamper).

• To respond to enquiries, prepare proposals and quotations, and conduct discovery conversations
• To design, source, personalise, pack and deliver gifts, including sharing delivery details with logistics partners
• To operate the client portal, gifting calendar and account records
• To maintain the recipient preference history that underpins our non-repetition commitment
• To raise invoices, process payments, and meet tax, accounting and statutory record-keeping obligations
• To communicate service updates, order status and delivery confirmations
• To send marketing communications where you have opted in, and to run and measure advertising (Section 6)
• To improve our website, services and internal operations
• To detect and prevent fraud, misuse and security incidents, and to establish or defend legal claims

We process personal data on the basis of your consent, which you provide when you submit a form, accept cookies, or engage us; for the performance of a contract or steps taken at your request prior to entering into one; and for legitimate uses permitted under the DPDP Act and other applicable law, including compliance with legal obligations. Consent may be withdrawn at any time (Section 10), though withdrawal may prevent us from continuing to deliver a service.

We use cookies, pixels, tags and local storage to operate the website, remember preferences, measure traffic, understand how visitors use the site, and deliver and measure advertising. Categories used: strictly necessary; performance and analytics; functional; and advertising or targeting. Non-essential cookies are set only where you consent through our cookie banner, and you can change or withdraw that choice at any time via the banner or your browser settings. Blocking cookies may affect site functionality.

Meta Business Tools

We use Meta Business Tools — including the Meta Pixel, the Conversions API, and Meta’s advertising platforms — to advertise Crafted Circle on Facebook, Instagram and Meta’s partner network. These tools may collect information about your interaction with our website, such as pages viewed, buttons clicked, enquiry form submissions, and technical identifiers including IP address, browser and device information, and cookie IDs.

What this is used for

To measure the performance of our advertisements; to understand which campaigns generate enquiries; to show you Crafted Circle advertising after you have visited our website (retargeting); and to build Custom Audiences and Lookalike Audiences so that our advertising reaches individuals with similar profiles.

Data shared with Meta

Where you have consented, we may share limited contact information — such as an email address or phone number — with Meta in hashed form so that it can be matched to a Meta account for audience building and conversion measurement. Hashing is applied before transmission; we do not share the content of your enquiry, your recipient lists, your gift history or your commercial terms with Meta or any advertising platform. Meta processes this data as described in its own Data Policy, over which we have no control.

Other advertising and analytics partners

We may similarly use Google Analytics, Google Ads and LinkedIn advertising tools for measurement and audience targeting.

Your controls

You can (i) reject non-essential cookies in our cookie banner; (ii) adjust your Facebook and Instagram Ad Preferences and off-Facebook activity settings within your Meta account; (iii) use Google’s Ads Settings and analytics opt-out browser add-on; (iv) enable “Do Not Track” or block third-party cookies in your browser; and (v) write to info@craftedcircle.com to be excluded from our advertising audiences. Opting out reduces the relevance of ads you see; it does not stop advertising altogether.

We share personal data only as necessary, with:

• Fulfilment partners — artisans, vendors, printers, packaging and personalisation partners, and courier and last-mile logistics providers, limited to what is required for delivery
• Technology providers — website hosting, CRM, email, cloud storage, form and scheduling tools, communication platforms
• Payment gateways and financial institutions — for processing payments and reconciliation
• Advertising and analytics platforms — as described in Section 6
• Professional advisers — accountants, auditors and legal advisers, under confidentiality obligations
• Authorities — where disclosure is required by law, regulation, court order or lawful government request
• A successor entity — in a merger, acquisition or restructuring, subject to this policy continuing to apply

We do not sell personal data, and we do not rent or trade client or recipient lists.

We retain personal data only as long as needed for the purposes above. Enquiry data that does not convert is retained for up to 24 months. Client account, recipient preference and gift-history records are retained for the duration of the relationship and for a reasonable period thereafter, because our non-repetition commitment and standing gifting calendar depend on that history. Invoices, tax records and statutory books are retained for the period prescribed by Indian law. On termination of an engagement, a client may request deletion or return of recipient data, subject to statutory retention requirements.

We apply reasonable security safeguards appropriate to the sensitivity of the data, including access controls on a need-to-know basis, encrypted transmission (HTTPS), password protection, restricted access to the client portal, vendor confidentiality obligations, and internal handling protocols for recipient data. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If a personal data breach occurs, we will notify affected persons and the Data Protection Board of India as required under the DPDP Act.

Subject to applicable law, you may:

• Access a summary of the personal data we hold about you and how it is processed
• Correct or complete inaccurate or incomplete data
• Erase data where it is no longer required and no legal obligation requires retention
• Withdraw consent previously given, including for marketing and advertising audiences
• Nominate an individual to exercise your rights in the event of death or incapacity
• Grieve — raise a complaint with us and, if unresolved, escalate to the Data Protection Board of India

To exercise any right, write to info@craftedcircle.com with sufficient detail to identify yourself and your request. We will respond within the timelines prescribed by law and, in any event, without undue delay. We may need to verify identity before acting.

Recipients: if your details were shared with us by a company or an individual client, contact us at the address above and we will act on your request and, where appropriate, direct you to the client who provided the data.

Where you have opted in, we may send occasional updates on seasonal collections, gifting calendars and services. Every marketing email contains an unsubscribe link, and you can opt out at any time by writing to info@craftedcircle.com. Transactional and service messages relating to a live order will continue.

Our services are directed at adults and businesses. We do not knowingly collect personal data of children under 18 years of age, and we do not run behavioural advertising directed at children. Where a gift is intended for a minor, we accept only the details necessary for delivery, provided by the adult client, who confirms they are authorised to share them. If you believe a child’s data has been shared with us in error, write to info@craftedcircle.com and we will delete it.

Some of our technology and advertising providers process data on servers outside India. Where personal data is transferred outside India, we do so in accordance with the DPDP Act and applicable restrictions, and require appropriate contractual protections from our providers.

We may update this policy to reflect changes in our services, technology or the law. The revised version will be posted here with a new “Last updated” date. Material changes will be notified to active clients by email.

In accordance with the Information Technology Act, 2000 and rules thereunder, and the DPDP Act, 2023:

Complaints are acknowledged within 24 hours and resolved within the timelines prescribed by applicable law.