Privacy Policy

CLOWE SHOP — www.cloweshop.com

Operated by CLOWE PARTNERS LLP.

Last updated: 16 October 2026

This Privacy Policy is published under Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and constitutes the notice required under Sections 5 and 6 of the Digital Personal Data Protection Act, 2023.

In relation to the personal data described here, the Company acts as a Data Fiduciary and You are the Data Principal.

1. Personal Data We Collect

1.1 Information You give Us

• Identity and contact data: name, mobile number, e-mail address, date of birth, gender;
• Address data: billing and delivery addresses;
• Account data: username, password (stored in hashed form), preferences, wish lists;
• Transaction data: order history, invoices, returns, exchanges, communications with Customer Support;
• Payment data: limited card particulars in tokenised form, UPI handle, bank account details furnished for refunds. We do not store complete card numbers or CVV;
• Size and fit data: body measurements and size preferences voluntarily furnished;
• User Images uploaded for the AI Virtual Try-On feature, dealt with separately in Clause 3;
• Content You post: reviews, ratings, photographs, questions and feedback;
• For Vendors: constitution documents, PAN, GSTIN, KYC of signatories, bank particulars and brand authorisations.

1.2 Information collected automatically

• Device and technical data: IP address, device identifier, device model, operating system, browser type, language and time zone;
• Usage data: pages viewed, products browsed, search queries, clickstream, session duration, referring URL;
• Location data: approximate location derived from IP address, and precise location only where You expressly permit it on Your device;
• Cookies and similar technologies, dealt with in the Cookie Policy.

1.3 Information from third parties

• Payment service providers: transaction status, authorisation and chargeback data;
• Logistics partners: delivery status, proof of delivery;
• Social or federated login providers, where You elect to sign in through them: name, e-mail address and profile identifier;
• Fraud-prevention and verification agencies.

1.4 We do not knowingly collect the personal data of a person below eighteen (18) years of age. In accordance with Section 9 of the Digital Personal Data Protection Act, 2023, We do not process a child’s personal data without verifiable consent of the parent or lawful guardian, and We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

2. Purposes and Lawful Basis of Processing

2.1 We process personal data for the following purposes, each on the basis of Your consent under Section 6 of the Digital Personal Data Protection Act, 2023, or, where applicable, for the legitimate uses specified in Section 7 of that Act:

Purpose — Data used

• Creating and administering Your account — Identity, contact, account data
• Processing and fulfilling orders — Identity, contact, address, transaction, payment data
• Arranging shipping and delivery — Identity, contact, address data
• Processing cancellations, exchanges and refunds — Transaction, payment, bank data
• Generating AI Virtual Try-On renderings — User Images, size and fit data
• Customer support and grievance redressal — All relevant data
• Fraud detection, security and prevention of abuse — Device, usage, transaction data
• Statutory and regulatory compliance, including tax — Identity, transaction, GSTIN, PAN
• Personalisation and recommendations — Usage, transaction, preference data
• Marketing communications, where separately consented — Contact, usage, preference data
• Analytics and improvement of the Platform — Usage and device data, in aggregated or de-identified form

2.2 We do not process personal data for any purpose incompatible with those stated above without furnishing a fresh notice and obtaining fresh consent.

3. The AI Virtual Try-On Feature

3.1 What is collected. Where You use the AI Virtual Try-On, We collect the photograph, video or scan uploaded by You (the User Image), any avatar selection, and derived body-shape or measurement estimates generated from that image, together with session metadata.

3.2 Voluntary. Use of the feature is entirely voluntary and is not a condition of purchasing any Product.

3.3 Consent. By uploading a User Image You give Your express, specific and informed consent, within the meaning of Section 6 of the Digital Personal Data Protection Act, 2023 and Rule 5 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the collection, storage and automated processing of that image, including facial and body imagery, for the sole purpose of generating and displaying the try-on rendering to You.

3.4 Eligibility. The feature may be used only by persons aged eighteen (18) years or above. You must not upload an image of any person below that age, or of any other person without that person’s express and demonstrable consent.

3.5 Limits on use. We shall not:

• use User Images for advertising, marketing or public display;
• disclose User Images to Vendors, other Users or any person other than a processor engaged under Clause 5;
• sell, trade or transfer User Images; or
• use User Images to train, fine-tune or improve any artificial intelligence or machine-learning model, unless You give separate, distinct and express opt-in consent for that purpose, which You may withdraw at any time.

3.6 Processing. Processing is automated and consists of image segmentation, body-shape estimation and synthesis of the rendering. No human review is undertaken save where necessary to investigate a complaint, a suspected contravention of the Terms of Use, or a direction of an authority.

3.7 Retention. User Images are retained only so long as necessary for the purpose in Clause 3.3 and in any event not beyond 24 hours from upload, or until withdrawal of consent, whichever is earlier, whereafter they are erased, save where retention is required by Applicable Law or for the establishment, exercise or defence of legal claims.

3.8 Withdrawal of consent. You may withdraw consent at any time through Platform settings or by writing to the Grievance Officer. On withdrawal We shall cease further processing and cause erasure in accordance with Clause 3.7. Withdrawal does not affect the lawfulness of processing carried out before it. The consequence of withdrawal is that the AI Virtual Try-On will cease to be available to You.

3.9 You retain all rights in Your User Image. No proprietary right therein is transferred to Us.

4. Disclosure of Personal Data

4.1 We share personal data, on a need-to-know basis and subject to contractual safeguards, with:

• Vendors, to the extent necessary to fulfil an order — name, delivery address, contact number and order particulars. User Images are never shared with Vendors;
• Logistics partners, for delivery and reverse pickup;
• Payment aggregators, gateways and banks, for processing payments and refunds;
• Cloud infrastructure and technology service providers, including the provider hosting and operating the AI Virtual Try-On, engaged as Data Processors under contract;
• Analytics, communication and customer-support service providers;
• Professional advisers, including advocates, auditors and insurers;
• Governmental, regulatory, investigative and law-enforcement authorities, and courts, where required under Applicable Law or in response to a lawful direction; and
• an acquirer or successor, in the event of any amalgamation, merger, demerger, restructuring or sale of business, subject to this Policy continuing to apply.

4.2 We do not sell personal data.

5. Processors and Transfers

5.1 Every processor engaged by Us is bound by a written contract restricting processing to the purposes in this Policy and imposing obligations of confidentiality, security and deletion, as required by Section 8(2) of the Digital Personal Data Protection Act, 2023.

5.2 Personal data is ordinarily stored on servers located in India. Where any processing or storage occurs outside India, it shall be undertaken only in accordance with Section 16 of the Digital Personal Data Protection Act, 2023 and shall not be to any territory in respect of which transfer is restricted by the Central Government.

6. Security Safeguards

6.1 We implement reasonable security practices and procedures within the meaning of Section 43A of the Information Technology Act, 2000, and reasonable security safeguards under Section 8(5) of the Digital Personal Data Protection Act, 2023, including:

• encryption of data in transit (TLS) and at rest;
• role-based access control and the principle of least privilege;
• hashing of passwords;
• tokenisation of card data in accordance with Reserve Bank of India directions;
• logging, monitoring and periodic review of access;
• periodic vulnerability assessment and penetration testing; and
• contractual security obligations on all processors.

6.2 No system is entirely immune from compromise. You are responsible for safeguarding Your credentials and OTPs and for not sharing them with any person.

7. Personal Data Breach

7.1 In the event of a personal data breach, We shall give intimation to the Data Protection Board of India and to each affected Data Principal in the form and manner prescribed under the Digital Personal Data Protection Act, 2023 and the rules made thereunder, and shall take steps to mitigate the breach.

8. Retention

8.1 Personal data is retained only for so long as necessary for the purposes for which it was collected, or for such longer period as is required by Applicable Law.

8.2 Indicative retention periods:

Category — Period

• Account data — Until account closure, and thereafter 180 days as required under Rule 3(1)(l) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
• Transaction, invoice and tax records — Eight (8) years, as required under tax and company law
• User Images (AI Try-On) — 24 Hours from upload, or until withdrawal of consent
• Support and grievance records — 3 Years
• Server and access logs — 180 days

8.3 On expiry of the applicable period, personal data is erased or irreversibly anonymised.

9. Your Rights as a Data Principal

9.1 Under Sections 11 to 14 of the Digital Personal Data Protection Act, 2023, You have the right to:

• obtain a summary of the personal data processed and of the processing activities undertaken, and the identities of the Data Fiduciaries and processors with whom it has been shared;
• correction, completion and updating of Your personal data;
• erasure of Your personal data, save where retention is necessary for the specified purpose or for compliance with Applicable Law;
• withdraw consent at any time, with the same ease with which it was given;
• grievance redressal in the first instance through the Grievance Officer; and
• nominate another individual to exercise Your rights in the event of Your death or incapacity.

9.2 Requests may be made to the Grievance Officer named in Clause 12, and shall be responded to within 7 working days and in any event within the period prescribed by law.

9.3 We may require verification of identity before acting on a request.

9.4 You are under a duty, under Section 15 of the Digital Personal Data Protection Act, 2023, to furnish only authentic information and not to raise false or frivolous grievances or impersonate another person.

10. Marketing and Opting Out

10.1 Transactional communications relating to Your account, orders, deliveries, payments and grievances are necessary for the performance of the contract and cannot be opted out of while Your account subsists.

10.2 Promotional communications are sent only where consented and may be opted out of at any time through the unsubscribe link, Platform settings, or by writing to the Grievance Officer.

11. Cookies

11.1 The use of cookies and similar technologies is governed by the Cookie Policy, which forms part of this Privacy Policy.

12. Grievance Officer and Escalation

Grievance Officer (under Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 13 of the Digital Personal Data Protection Act, 2023)

Name: Amit Designation: Grievance officer E-mail: support@cloweshop.com Hours: 9AM to 5PM, Monday to Friday (excluding public holidays)

12.1 Complaints are acknowledged within twenty-four (24) hours and disposed of within fifteen (15) days. Consumer complaints are acknowledged within forty-eight (48) hours and redressed within one (1) month.

12.2 A Data Principal not satisfied with the response may approach the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.

13. Changes to this Policy

13.1 This Policy may be amended by publishing a revised version with the date of revision. Material changes shall be notified by e-mail or in-web/app notification not less than 1 days before taking effect, save where immediate effect is required by law.

14. Governing Law and Jurisdiction

14.1 This Policy is governed by the laws of India, and the courts at New Delhi have exclusive jurisdiction, without derogating from the jurisdiction of the Data Protection Board of India or the rights of a consumer under the Consumer Protection Act, 2019.