Privacy policy

Last updated: April 2026

This Privacy Policy describes how Cosmo Brands Private Limited ("we", "us", "our", or "Alaya Select") collects, uses, processes, and protects your personal information when you visit alayaselect.com or make a purchase from us.

This policy is published in compliance with:

The Information Technology Act, 2000
The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
The Digital Personal Data Protection Act, 2023 ("DPDP Act")
The Consumer Protection (E-Commerce) Rules, 2020

By accessing our website or providing your information, you consent to the practices described in this policy.

1. Information We Collect

Personal Information you provide directly:

Name
Email address
Phone number
Shipping and billing address
Payment information (processed securely by third-party payment gateways; we do not store card details)
Communication preferences
Date of birth (if voluntarily provided)
Any other information you voluntarily share

Sensitive Personal Data or Information (under SPDI Rules):

Financial information (bank account, card details — handled only by PCI-DSS compliant payment partners)
Passwords (stored only in encrypted form)

We do not collect biometric data, sexual orientation, medical records, or any other categories of sensitive data not necessary for our services.

Information collected automatically:

Browser type, device information, operating system
Pages visited, time spent on site, click behaviour
IP address (used for security, fraud detection, and analytics)
Cookies and similar tracking technologies
Referring website URL

2. How We Use Your Information

We use your personal information for the following purposes:

Order fulfilment — to process, ship, and deliver your orders
Communication — to send order confirmations, shipping updates, delivery notifications, and respond to your queries
Customer support — to assist you with returns, refunds, and product-related queries
Marketing — to send you newsletters, new collection updates, and promotional offers (only with your explicit consent)
Personalisation — to improve your shopping experience and recommend relevant products
Analytics — to understand website usage, improve our products, and optimize the user experience
Fraud prevention & security — to detect, prevent, and address fraudulent or unauthorised activity
Legal compliance — to comply with applicable laws, regulations, and lawful requests by authorities

3. Legal Basis for Processing (under DPDP Act)

We process your personal data on the following legal grounds:

Your consent (which you may withdraw at any time)
Performance of a contract (e.g., processing your order)
Compliance with legal obligations
Our legitimate business interests (e.g., fraud prevention)

4. Sharing Your Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We share your information only with:

Shipping partners (Delhivery, Bluedart, Shiprocket, DTDC, etc.) — for order delivery
Payment gateways (Razorpay, Shopify Payments, etc.) — for processing payments securely
Email and SMS service providers (Klaviyo, SendWILL, MSG91, etc.) — for transactional and marketing communications
Analytics providers (Google Analytics, Meta Pixel, etc.) — for understanding website usage
Cloud and hosting providers — for data storage and website operations
Legal and regulatory authorities — when required by law, court order, or government request

All third parties are contractually bound to protect your data and use it only for the purposes specified.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to:

Maintain your shopping cart
Remember your preferences
Personalise your experience
Analyse website traffic and performance
Show relevant advertisements on Meta, Google, and other platforms

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

6. Marketing Communications

By signing up for our newsletter or placing an order, you may receive marketing emails about new arrivals, sales, and exclusive offers.

You can unsubscribe at any time by:

Clicking the "Unsubscribe" link in any marketing email
Messaging us on WhatsApp at +91-8168130301
Emailing hello@alayaselect.com

Unsubscribing will stop marketing communications but you will continue to receive transactional messages related to your orders.

7. Data Retention

We retain your personal information only for as long as necessary to:

Fulfil the purposes outlined in this policy
Comply with legal, accounting, or reporting requirements (typically 8 years for tax records)
Resolve disputes and enforce our agreements

After this period, your data is securely deleted or anonymised.

8. Data Security

We implement reasonable security practices and procedures in accordance with the SPDI Rules, 2011, including:

SSL encryption on all pages and during data transmission
PCI-DSS compliant payment processing (we never store card details)
Limited internal access to personal data on a need-to-know basis
Regular security audits and vulnerability assessments
Encrypted password storage
Firewalls and intrusion detection systems

While we take every reasonable precaution, no method of online transmission or storage is 100% secure. By using our services, you acknowledge this inherent risk.

9. Your Rights (under DPDP Act 2023)

As a data principal, you have the following rights:

Right to access — request information about what personal data we hold about you
Right to correction — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your personal data (subject to legal and contractual obligations)
Right to grievance redressal — escalate complaints to our Grievance Officer
Right to nominate — nominate another individual to exercise your rights in case of incapacity or death
Right to withdraw consent — withdraw your consent for data processing at any time

To exercise any of these rights, contact us at hello@alayaselect.com or our Grievance Officer (details below).

10. Children's Privacy

Our website and services are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we discover that we have collected personal data from a child, we will delete it immediately. If you believe a child has provided us with personal information, please contact us.

11. Third-Party Links

Our website may contain links to third-party websites (e.g., social media, payment gateways). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before sharing any information.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in significant harm to you, we will notify you and the Data Protection Board of India in accordance with the DPDP Act, 2023, within the prescribed timeline.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The latest version will always be available on this page with the "Last updated" date. Material changes will be communicated via email or a notice on our website.

14. Grievance Officer

In compliance with the Information Technology Act, 2000, the SPDI Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020, we have designated a Grievance Officer to address complaints related to your personal data and our services:

Grievance Officer
Name: Jatin Grover
Email: J@cosmobrands.in
Phone: +91-8448863937
Address: Plot No. 883, Phase 5, Udyog Vihar, Gurugram, Haryana – 122015

The Grievance Officer will acknowledge your complaint within 48 hours and resolve it within 30 days of receipt.