Privacy Policy

Effective from 5 November 2026. This notice is given under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it.

1. Who we are

RUVI by Nishalin ("RUVI", "we", "us"), from the house of Nishalin Diamonds, runs this website and decides why and how your personal data is used. Under the DPDP Act we are the Data Fiduciary. You are the Data Principal.

Contact: info@ruvibynishalin.com | WhatsApp / phone +91 88884 55558.

2. Personal data we collect

• Account details: name, mobile number, email address, password (stored only in encrypted form).
• Order and delivery details: delivery address, PIN code, products ordered, order value, payment status, shipment tracking.
• Verification codes: one-time passwords (OTPs) sent to your mobile number or email to verify your account, login or password change.
• Communication and preferences: messages you send us, product reviews, wishlist, cart, WhatsApp or email opt-ins and opt-outs, newsletter subscription.
• Rewards and referrals: reward or wallet balance and referral code, if you use them.
• Technical data: IP address, approximate location (city, country), browser and device type, and login time, used for security and fraud prevention.

We do not store your card, UPI or net-banking details. Payments are made on our payment partner's secure page.

3. Why we use your data

Purpose	Data used	Basis
Create and secure your account, verify you by OTP	Name, mobile, email, OTP, technical data	Your consent
Process, deliver, track, replace or refund your orders	Name, contact, address, order and payment status	Your consent, and the legitimate use of data you voluntarily provide for a purchase
Send order updates and service messages (SMS, email, WhatsApp)	Name, mobile, email, order details	Your consent
Send offers and news (WhatsApp, SMS, email)	Name, mobile, email	Your separate, optional consent
Prevent fraud and misuse, keep the site secure	Technical data, order and account data	Legitimate use as permitted by law
Meet tax, accounting and other legal obligations	Order and invoice records	Compliance with law

We use your data only for the purposes above. We do not sell your personal data.

4. Consent and how to withdraw it

We ask for your consent in clear words, for each purpose, before we use your data. Marketing messages are optional and are never a condition for creating an account or buying from us. Your consent is given by a clear action such as ticking a box or submitting a form.

You can withdraw consent at any time, as easily as you gave it:

• Reply STOP to any WhatsApp or SMS marketing message, or use the unsubscribe link in any email.
• Email info@ruvibynishalin.com or message us on WhatsApp at +91 88884 55558.

Withdrawing consent does not affect processing done before withdrawal. If you withdraw consent that is needed to deliver a service (for example your address for an order in progress), we may not be able to complete that service.

5. Who we share your data with

We share only the data needed, with service providers who process it on our behalf under contract:

• Payment partner (Razorpay) to collect payments and process refunds.
• Courier and logistics partners to deliver and pick up orders (name, address, mobile).
• SMS and WhatsApp service providers to send OTPs, order updates and, if you agree, offers.
• Hosting and technology providers that store and run the website securely.
• Address search (Google Maps), where enabled, to help you fill in your address. Google Fonts may be loaded on our pages.

We may also disclose data when required by law, a court or a government authority. We do not share your data with other companies for their own marketing.

6. How long we keep your data

• Account data: until you ask us to delete your account or you stop using it for a long period, after which we erase or anonymise it.
• Order and invoice records: for as long as tax, accounting or other laws require us to keep them.
• Marketing preferences: until you withdraw consent. We keep a minimal opt-out record so that we do not contact you again.
• Technical logs: for a limited period needed for security.

When the purpose is over, and no law requires us to keep it, we erase the data.

7. Your rights as a Data Principal

• Access: get a summary of the personal data we process, the processing we do, and who we have shared it with.
• Correction and updating: correct inaccurate data, complete incomplete data, or update it. You can also edit your profile and addresses from your account.
• Erasure: ask us to erase your personal data, unless we must keep it by law.
• Withdraw consent: as explained in section 4.
• Grievance redressal: raise a complaint about how we handle your data.
• Nominate: name another person to exercise your rights if you die or become unable to do so.

To use any right, email info@ruvibynishalin.com from your registered email, or WhatsApp +91 88884 55558 from your registered mobile number, mentioning your name, the right you want to use and your order or account details. We may ask you to confirm your identity first.

8. Grievance redressal

For any concern about your personal data, write to our Grievance Officer at info@ruvibynishalin.com or call / WhatsApp +91 88884 55558. We will acknowledge your complaint promptly and respond within the time allowed by law, and in any case within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. Please contact us first, as the Board expects Data Principals to use the grievance process of the Data Fiduciary before approaching it.

9. Children

Our website and products are meant for adults. A person below 18 years should use the site only through a parent or legal guardian. We do not knowingly process the personal data of a child without verifiable consent of the parent or guardian. We do not track or monitor the behaviour of children, and we do not show them targeted advertising. If you believe a child has given us data, contact us and we will erase it.

10. Security and data breaches

We protect your data with reasonable safeguards such as encrypted connections (HTTPS), hashed passwords, OTP verification, access controls and secure payment pages. If a personal data breach affects you, we will inform you and the Data Protection Board of India as required by law.

11. Cookies

We use cookies and similar technologies. See our Cookie Policy for details.

12. Where your data is stored

Your data is stored on secure servers and may be processed by our service providers. We transfer personal data outside India only where the DPDP Act allows it.

13. Changes to this notice

We may update this notice when our practices or the law change. The latest version, with its effective date, is always on this page. For a material change that needs fresh consent, we will ask you again.