Privacy Policy
The our website portal and other relevant arokah Apps are owned and operated by arokah. In this Privacy Policy, arokah is referred to as "we," "us," or "our," and the end users are referred to as "you," "your," or "user." The term "portal" or "portals" refers to the different platforms and channels through which a user can engage with the company's offerings, including but not limited to Android App, iOS App, Desktop site, Mobile Web site, Emails, and Social Pages.
Privacy Policy Changes
We may change this Privacy Policy at any time by posting the revised Privacy Policy in the "Privacy Policy" section of the website. The revised Privacy Policy is effective immediately when posted on the website. It is the responsibility of each user to periodically review the website and the Privacy Policy to stay informed about any revisions. Your continued use of the website will be considered as your acknowledgment and acceptance of the terms of the revised Privacy Policy.
Data Controller
The data controller in respect of our portal is arokah, registered in India. If you have any questions about this Privacy Policy, you can contact the data controller by writing to:
arokah
Mumbai
Email: james_nguyen559@mailinator.com
Lawful Basis for Processing (DPDP Act 2023, §6)
We process personal data only when one of the lawful bases below applies. The table maps each processing activity to its basis so you can see why we hold each category of data.
| Activity | Lawful basis | Why |
|---|---|---|
| Order placement & fulfilment (name, address, phone, payment outcome) | Contract | Required to perform the sale contract you initiated. |
| Invoice / GST records retention (6+ years) | Legal obligation | Statutory retention under the GST Act and the Income Tax Act. |
| Account registration & profile | Contract | You asked us to create an account so we keep what's needed to log you back in. |
| Marketing emails & WhatsApp messages (newsletter, offers) | Consent | Sent only after explicit double opt-in; you can withdraw at any time. |
| Fraud detection & account-takeover prevention | Legitimate interest | Protects both you and us from unauthorised use; balanced against your right to privacy. |
| Customer support tickets & chat history | Legitimate interest | Lets us resolve queries quickly and improve future service. |
| Cookies — strictly necessary | Contract / legitimate interest | Keeps the cart, session, and security tokens working. |
| Cookies — analytics & marketing | Consent | Only loaded after you accept on the cookie banner. |
Cross-Border Data Transfers (DPDP Act 2023, §4)
Most of your data is processed in India. A subset is shared with the following processors who may operate servers outside India:
- Razorpay (India + United States) — domestic (INR) payment authorisation and settlement; data shared per their Standard Contractual Clauses.
- PayPal (United States + European Union) — international (USD) payment authorisation and settlement; data shared per their Standard Contractual Clauses.
- MSG91 (India + Singapore relay) — transactional WhatsApp / OTP message delivery; relay infrastructure may route via Singapore for redundancy.
- Brevo (European Union) — transactional and marketing email delivery; protected under EU GDPR adequacy decisions.
- Cloud hosting (Amazon Web Services ap-south-1, Mumbai) — primary database and application servers in India.
Where data leaves India, we rely on contractual safeguards (Standard Contractual Clauses or equivalent) with the receiving party. You can request a copy of the relevant agreement by emailing the DPO contact above.
Data Retention
We retain each category of data only as long as needed:
- Order & invoice records: 6 years (GST Act requirement).
- Account data: until you request deletion or 3 years after last login, whichever comes first.
- Consent withdrawal logs: 1 year after withdrawal.
- Failed payment attempts & security logs: 12 months.
- Support tickets: 2 years after the ticket is closed.
After the retention period the data is either deleted or fully anonymised so it can no longer be linked back to you.
Information We Collect When You Visit Our Website
Web Server Log Information
When you access our website, our third-party server automatically logs the IP address you use to access our website, as well as other information about your visit, such as the pages accessed, information requested, the date and time of the request, the source of your access to our website (e.g., the website or URL that referred you to our website), and your browser version and operating system.
Use of Website Server Log Information for IT Security Purposes
Our third-party hosting provider stores server logs to ensure network and IT security, and to maintain the integrity of the server and website. This includes analyzing log files to identify and prevent unauthorized access to our network, the distribution of malicious code, denial of service attacks, and other cyber attacks by detecting unusual or suspicious activity. However, unless we are investigating suspicious or potential criminal activity, we do not attempt to identify you from the information collected via server logs.
Cookies
We use cookies, including essential, functional, and analytical cookies, which are data files sent from a website to a browser to record information about users for various purposes. You can reject some or all of the cookies we use on our website by changing your browser settings, but this may impair your ability to use our website or some of its features.
Our web server automatically recognizes the following information for each user:
- Host origin of the request
- Referrer
- Session data
- Page viewed
- Your browser type
- Operating system information
arokah uses cookies to ensure that our website runs on your computer and that you can access content on our site. Cookies do not store any passwords or credit card information.
Accepting or Rejecting Cookies
There are several ways you can accept or reject some or all cookies. Some of the main methods include:
- Changing Browser Settings
- Google Analytics Opt-out Add-ons
- Clearing Existing Cookies
You are welcome to block the use of some or all of the cookies we use on our website. However, please be aware that doing so may impair the functionality of our website or render it unusable. Clearing all cookies from your browser will also delete any cookies that store your preferences, such as whether you have accepted cookies on a website.
Contact Us
arokah
Mumbai
Email: james_nguyen559@mailinator.com
Phone: 6087872013