PARQIS Consumer Privacy Policy

F.1 Electronic record statement

This Privacy Policy is an electronic record under the Section 4 of Information Technology Act, 2000. It is generated by a computer system and does not require any physical or digital signature.

It is published in accordance with Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which requires us to publish our rules, privacy policy and terms of use.

F.2 Translation precedence

This Privacy Policy is published in English. Where we publish a translation, the English version prevails in the event of any discrepancy or conflict.

F.3 Who we are

Gigazoid Technology Private Limited (CIN: U47912UP2025PTC228331), with its registered office at A-13, Graphix Tower-2, Sector 62, Noida, Gautam Buddha Nagar – 201301, Uttar Pradesh, India operates PARQIS. In this Privacy Policy, “PARQIS”, “we”, “us” and “our” mean Gigazoid Technology Private Limited.

The Platform means the website at www.parqis.com, all its sub-domains, and the PARQIS mobile application.

For the personal data described in this Privacy Policy, PARQIS is the Data Fiduciary and you are a Data Principal under the Digital Personal Data Protection Act, 2023. That means we are accountable for how your data is handled, including when someone handles it on our behalf.

F.4 Scope and application

This Privacy Policy applies to you if you visit, browse, register on, or buy through the Platform.

You can browse much of the Platform without telling us who you are. You need an account to place an order, save addresses, rate a product, or use most personalised features. Where a field is optional, we mark it as optional.

This Privacy Policy does not cover:

• Sellers. If you sell on PARQIS, your data is covered by the PARQIS Merchant Privacy Notice at brands.parqis.com/brandsprivacypolicy
• Creators. If you publish content under a creator arrangement with PARQIS, that is covered by the PARQIS Creator Privacy Notice at creator.parqis.com/creatorprivacypolicy
• What sellers do with your data outside our instructions. We give a seller what they need to fulfil your order, and they may use it only for that. Their obligations are set out in our agreement with them. See Section 6.1.
• Other websites and apps. Links out are not covered. See Section 16.

If you are both a buyer and a seller, both this Privacy Policy and the Merchant Privacy Notice apply to you, each to its own relationship.

F.5 Where your data is processed

We store your personal data in India. Some of the services we use process limited personal data outside India — see Section 15.

PARQIS sells and delivers only within India. We do not offer products or services for purchase or delivery outside India.

F.6 Relationship to other PARQIS policies

If this Privacy Policy and any other PARQIS document conflict on how we handle your personal data, this Privacy Policy prevails.

F.7 Definitions

F.8 Version, effective date and prior versions

Version: 1.0 · Effective from: 5th August 2026

Earlier versions are available at parqis.com/privacypolicy/previousversions. The version in force when we collected your data governs that collection & the version live governs all actions taken in current time. Section 18 explains how we tell you about changes.

We collect what we need to run your account, fulfil your orders, keep the Platform safe, and meet our legal obligations. Where something is optional, you can decline it and still shop.

1.1 Data you give us

To create and run your account

Name, mobile number, email address, and password or login method. Your date of birth, so we can confirm you are 18 or over. Your gender, where you choose to give it.

To receive orders

Delivery addresses, delivery instructions, and — where an order is going to someone other than you — the recipient’s name, phone number and address.

To pay

Payment method details. We do not store your full card number, CVV, or UPI PIN — see Section 6.3.

When you contact us

Your messages, call recordings, and anything you send us to resolve a problem, including photographs of a damaged or wrong item.

When you return or exchange something

The reason for return, photographs where we ask for them, and pickup details.

When you rate or review a product

Your star rating. Your rating is published only as part of that product’s overall score. We do not show your name with it, and we do not tell the seller who gave which rating.

When you write a review

Your review text, and any photographs or videos you add. A review is published with your display name and is visible to anyone. See Section 16.

When you use social features

Likes, saves, shares, comments, and the sellers or creators you follow.

Ordering for someone else. When you give us a recipient’s name, phone number or address, you are confirming that you are allowed to share their details with us. We use them only to deliver that order and to send delivery updates about it. We do not add a recipient to our marketing lists. If a recipient contacts us about their data, we will help them — see Section 11.

1.2 Data we collect automatically when you use the Platform

What you do on the Platform

Products and pages you view, searches you run, filters you apply, items you add to your cart or wishlist, orders you place, and returns you request.

Your device and connection

IP address, device identifiers, device model, operating system, browser, app version, screen size, language, time zone, and mobile network or connection type.

How the Platform performs for you

Page and screen load times, errors and crashes, and diagnostic logs.

Where you came from, and where you go next

• The web address, app or advertisement you came from when you arrived at the Platform, including any campaign, referral or tracking information contained in the link you followed.
• The links you follow to leave the Platform — for example to a Seller's own website, a payment provider, a delivery tracking page, or a social media platform.
• The path you take through the Platform: the pages and screens you visit, in what order, how long you spend on each, and what you click or tap.

Cookies and similar technologies

See Section 7.

1.3 Data we get from other sources

• Delivery updates from our logistics partners, including corrected or verified addresses.
• Payment outcomes from our payment partners — whether a payment succeeded, failed, or was refunded. Not your card details.
• Login data if you sign in using another service, such as a Google account. We receive your name and email address, not your password.
• Fraud and risk signals from providers who help us spot fraudulent orders and account takeovers.
• How you found us. If you installed our app or came to the Platform after seeing one of our advertisements, our measurement partners tell us which advertisement or campaign brought you to us, so that we can understand which of our own marketing works. They do not tell us what else you do on other apps or websites.

1.4 Permissions the app asks for

The app works without most of these. We ask only when a feature needs it, and you can refuse or change your mind later in your device settings.

We do not ask for access to your contacts, SMS messages, or call logs. If anything claiming to be PARQIS asks for those, it is not us.

1.5 Data we ask you not to send us

Please do not send us, or post on the Platform:

• identity documents we have not asked for, such as your Aadhaar, passport or PAN;
• health or medical information;
• your card number, CVV, OTP or UPI PIN — we will never ask for these; or
• other people's personal data beyond what an order needs.

If we receive something in this list that we do not need, we may delete it.

1.6 Data that no longer identifies you

We produce aggregated and anonymised data — for example, how many people in a city bought a category last month. Once data can no longer identify anyone, it is not personal data, and this Privacy Policy does not apply to it. We use it for analytics, reporting, planning and research.

1.7 Videos and content interaction

The Platform includes shoppable videos. When you watch or interact with them, we collect:

• which videos you watched, in what order, and for how long;
• whether you finished, replayed, skipped or muted a video;
• likes, saves, shares, comments, and sellers or creators you follow;
• playback quality data — resolution, buffering, and connection speed — so we can serve video that works on your connection.

We use this to decide what content to show you next, and to improve what we recommend. See Sections 2 and 8.

Where you upload your own video or images, that content and what you do with it is covered here too.

The DPDP Act allows us to process your personal data on two grounds only: your consent, or a legitimate use listed in the Act. There is no general “business interest” ground, and we do not rely on one.

The two legitimate uses relevant here are:

• You gave it to us for this purpose — you provided the data yourself for a stated purpose and have not told us you object.
• The law requires it — we must do something, or give information to a government authority.

Three things this table means in practice.

• We do not need your consent to fulfil an order. You asked us to, and that is the ground — so there is nothing you can withdraw that would leave an order half-delivered.
• Everything marked Your consent is optional. Turn off personalisation and the Platform still works: you will see products and content ranked by popularity and recency rather than by your interests. Section 4 explains how.
• We do not sell your personal data. We use it to personalise what you see on PARQIS — products, content, and which promotions and banners you're shown, including promotions a seller or brand has paid for. That is the row above, and you control it. We do not use data about you from other websites or apps, we do not share your data with advertising networks, and no seller or advertiser can identify you.

3.1 The two grounds we rely on

Under the DPDP Act, we may process your personal data on two grounds only:

• your consent; or
• a legitimate use listed in the Act.

The list of legitimate uses is fixed by the Act. It is not a general permission to process data whenever it suits us, and there is no “business interest” or “performance of contract” ground under Indian law. Where we cannot point to your consent or to one of the listed legitimate uses, we do not process your data.

Section 2 sets out every purpose we process your data for, and the ground for each.

3.2 When we rely on your consent

We rely on your consent for things you can say no to without losing the ability to shop:

• personalising what you see, based on what you browse, buy and watch;
• publishing your ratings, reviews and other content;
• social features, such as likes, saves, shares, follows and comments; and
• promotional messages and offers.

Section 4 explains how we ask for consent, and how you withdraw it.

3.3 When we rely on a legitimate use

Two of the legitimate uses in the Act apply to us.

You gave us the data for this purpose. Where you provide data yourself so that we can do something specific — create your account, deliver your order, take your payment, answer your question — we may process it for that purpose without asking separately for consent. This is what makes it possible to place an order without a consent form at every step.

This ground depends on you not objecting. You can tell us at any time that you object to us using your data this way. If you do, we stop — but where we cannot provide something without that data, it may mean we can no longer provide it. Contact details are in Section 17.

The law requires it. Some processing is not ours to choose. We must issue invoices, keep tax records, retain records of transactions, respond to a court order or a notice from a regulator, and give information to a government authority where a law requires it. Consent does not apply here, and withdrawing consent does not affect it.

3.4 What we tell you when we collect your data

Where we rely on your consent, we tell you at that moment — separately from this Policy — what data we want, what we will do with it, how to withdraw your consent, how to exercise your other rights, and how to complain to the Data Protection Board of India.

Where we rely on the fact that you gave us your data for a particular purpose, we do not ask for separate consent, and this Policy is the notice.

That notice is available in English and in the other languages set out in the Eighth Schedule to the Constitution of India.

4.1 How we ask for your consent

Where we rely on your consent, we ask for it separately, in clear language, at the point we collect the data or before we use it for that purpose. You give consent by taking a clear action — ticking a box, moving a toggle, tapping a button.

Using the Platform is not consent. Browsing PARQIS, holding an account, or placing an order does not mean you have agreed to everything in this Privacy Policy. Anything that needs your consent is asked for, separately, and you can decline.

Each consent request tells you what data it covers, what we will do with it, and who to contact about it. You can read it in English or in any of the languages listed in the Eighth Schedule to the Constitution of India.

We ask only for the data we need for the purpose we are asking about.

4.2 What is optional, and what is not

Optional, and what is on to begin with. You can decline any of these, or change your mind later, and still use the Platform and place orders.

Not optional. We cannot run your account or fulfil your orders without these, so they are not offered as choices:

• taking, processing, delivering and returning your orders;
• taking payment and making refunds;
• service messages about your orders, your account and your security;
• keeping your account secure and detecting fraud; and
• what the law requires of us, including invoices, tax records and responding to lawful demands.

If you do not want us to process your data for these purposes, the practical answer is not to place an order, or to close your account.

4.2A Personalisation. We personalise what you see from the moment you create your account, using what you browse, buy and watch on PARQIS. We tell you this when you sign up. This is not something you opt into — but you can turn it off at any time in your account settings, and if you do, we stop and delete the profile we built from your activity. See Section 8.2.

4.3 How to withdraw your consent

You can withdraw any consent at any time. Withdrawing is as easy as giving it — in your account settings, in the same number of steps.

You do not need to email us, write to us, or explain why. If you would rather contact us, you can — see Section 17 — but you should not have to.

4.4 What happens when you withdraw

We stop. We stop the processing you withdrew consent for, without undue delay, and in any event within 30 days.

It is not backdated. Withdrawing consent does not undo processing that was lawful before you withdrew. For example, if you delete your published reviews, reviews you posted earlier are taken down going forward, but the fact that they were published is not undone.

We delete what we no longer need. If we have no other ground to keep the data, we may delete it. Where a law requires us to keep something — a tax record, an invoice, a transaction record — we keep that, and only that. Section 12 sets out what we keep and for how long.

Some things do not change. Withdrawing consent does not affect processing we do because you gave us the data to fulfil your order, or because the law requires it. Your orders will still be delivered, your refunds still processed, and your invoices still issued.

Orders already placed are unaffected. Withdrawing consent does not cancel an order or stop a delivery. If you want to cancel an order, use the order page or the Returns & Refunds Policy.

You bear the consequences. The Act puts this plainly, and so do we: if withdrawing consent means a feature stops working or the Platform is less useful to you, that is the consequence of your choice, not a failure on our part.

5.1 PARQIS is for adults

You must be 18 or over to hold a PARQIS account, place an order, or post content on the Platform. This is a condition of using the Platform, not a preference.

Two reasons. Under the Indian Contract Act, 1872, a person under 18 cannot form a binding contract — and buying something is a contract. And under Section 9 of the DPDP Act, processing a child’s personal data carries obligations we have chosen not to take on, because PARQIS is not built for children.

5.2 How we check

We ask for your date of birth when you create an account, and we do not let you register if it shows you are under 18.

We know a date of birth can be entered incorrectly. Asking is how we make sure we are not knowingly processing a child’s data — it is not a guarantee, and we do not claim it is one.

5.3 What we do not do

Because we do not allow children on the Platform:

• we do not seek verifiable parental consent, because we do not process children's data;
• we do not track or monitor the behaviour of children; and
• we do not direct advertising at children.

5.4 Children’s data can still reach us

Barring children from holding accounts does not mean no child’s data ever reaches us. Two situations are worth being clear about.

Ordering for a child. If you send an order to someone else — a gift for a niece, nephew, or your own child — you may give us that person’s name, and they may be a child. We do not ask for a recipient’s age and we do not try to find out. We use a recipient’s details only to deliver that order. We do not build a profile of a recipient, personalise anything for them, or add them to any marketing list. Section 1.1 explains this.

Images of children. Do not upload photographs or videos of a child in a rating, review, return request, or any other content on the Platform, even if the child is your own. If you do, we will remove it. In case it misses our checks, you shall be legally liable for harm done in any manner, given that PARQIS is stated to be a platform NOT for children.

5.5 If we find out

If we learn that an account belongs to someone under 18, or that we hold a child’s personal data we should not have, we will delete that data and close the account.

If you believe a child holds an account on PARQIS, or that we hold a child’s personal data, tell us — see Section 17 — and we will look into it.

We share your personal data only as set out below. Everyone we share it with is bound by a written contract requiring them to protect it, use it only for the purpose we give it to them for, and apply proper security.

We do not sell your personal data.

6.1 Sellers, to fulfil your order

Products on PARQIS are sold by independent sellers. When you place an order, we give that seller what they need to pack and dispatch it: the delivery name, the delivery address, and a contact phone number.

What a seller may do with it. Fulfil that order, and nothing else.

What a seller may not do. Our agreement with sellers prohibits them from:

• using your details for marketing, advertising or promotion of any kind;
• contacting you for anything other than fulfilling your order;
• keeping your details after the order is complete;
• adding you to any list, database or CRM of their own;
• putting promotional leaflets, discount vouchers, contact numbers or website addresses inside your parcel to get you to buy from them directly; or
• moving your data outside India.

Who is accountable. We are. In law we are the Data Fiduciary for your personal data and the seller acts as our Data Processor — meaning they handle it on our instructions and are answerable to us for it. If a seller misuses your data, that is our problem to fix, and you should tell us. See Section 17.

Sellers who deliver their own orders. In limited cases we allow a seller to deliver directly rather than through our delivery partners. Where that happens the seller receives the same details, is bound by the same restrictions, and we remain accountable in the same way.

6.2 Sellers and creators, when you interact publicly

Some of what you do on PARQIS is public, and the seller or creator involved can see it.

• Reviews and content you post appear publicly on the Platform with your display name. Anyone can see them, including the seller whose product you reviewed.
• Ratings are different. Your rating contributes to the product's overall score. We do not display your name with it, and we do not tell the seller which buyer gave which rating.
• Likes, comments, shares and follows are visible to the seller or creator you interacted with, and comments are visible to other users.

Aggregated performance data. We give sellers and creators figures about how their products and content perform — views, engagement, conversion, broad audience patterns. This is aggregated. We do not tell a seller or creator that you specifically watched, viewed or bought something, except where your interaction is already public as described above.

If you would rather none of this were visible, do not use the social features, or turn them off — Section 4.3.

6.3 Delivery partners

We use Shiprocket to arrange pickup, delivery and returns. We share the delivery name, address, phone number and order details.

Shiprocket is an aggregator: it passes these details to the courier company that actually collects and delivers your parcel, and which courier that is changes from order to order. So your name, address and phone number reach the courier as well. Each of them is required by contract to use those details only for the delivery and to protect them.

Delivery staff may contact you by phone about your delivery.

6.4 Payment partners

We use Razorpay to process payments and refunds.

We do not store your full card number, CVV or UPI PIN. These go directly to the payment provider. Where your card is saved for future use, it is stored as a token — a substitute number that cannot be used elsewhere — in line with Reserve Bank of India requirements. Payment handling follows the Payment Card Industry Data Security Standard.

Payment system data is required to be stored in India under RBI directions.

Deferred payment, or “pay later”, options. Razorpay’s checkout may offer you deferred payment options provided by banks or other lenders. These are Razorpay’s payment methods. They are not a PARQIS product, and PARQIS does not lend you money.

If you choose one, you deal with that provider directly through Razorpay’s checkout. That provider decides whether to offer you credit, and handles your data under its own privacy policy and terms.

We do not assess your eligibility, we do not extend credit, and we do not obtain credit reports about you.

We do not share your personal data with lenders or credit bureaus. Whatever the provider needs, you give it directly, or Razorpay passes on as part of processing the payment.

All we receive is confirmation that the payment succeeded, failed, or was refunded.

Your agreement about the credit is with that provider. If you have a question about the credit itself — repayment dates, charges, or your limit — that is a matter for them, not us.

6.5 Service providers who work for us

We use other companies to run parts of the Platform. They act on our instructions, may use your data only for what we have asked them to do, and may not use it for their own purposes.

6.6 Regulators, authorities and courts

We disclose personal data where we are required to — to a tax authority, a regulator, the police, or in response to a court order, summons or other lawful demand.

We also disclose it where we reasonably believe it is necessary to investigate suspected fraud or unlawful activity, to enforce our Terms of Use, or to protect the rights, property or safety of PARQIS, our users, or the public.

6.7 If our business changes

If PARQIS merges with another business, is acquired, or restructures, your personal data may transfer as part of the business. The organisation receiving it will remain bound by this Privacy Policy, or will give you notice before anything changes.

We do not sell your personal data.

6.8 What we do not do

• We do not sell your personal data to anyone.
• We do not share your personal data with advertising networks so they can build a profile of you or advertise to you elsewhere.
• We do not give sellers your data for their own marketing.
• We do not market to a person whose address you used as a delivery recipient.
• We do not allow any service provider to use your data for their own purposes.

7.1 What they are

Cookies are small files placed on your device when you visit a website. We also use similar technologies in our app and on our website — local storage, software development kits, and pixels — which do the same job.

Some of these hold data that identifies you or your device, such as a session identifier or a device identifier. Where they do, that data is personal data, and this Privacy Policy applies to it.

7.2 What we use them for

Where the controls are. Some of the choices described in this section are ours to offer, and some belong to your browser or your device. Cookies, similar technologies, and app permissions — including notifications, location and camera — are controlled in your browser settings or your device settings, not in PARQIS. Your PARQIS settings control personalisation and promotional messages. Section 1.4 lists each app permission and what declining it affects.

7.3 Third-party technologies

Some of the above are provided by companies working for us — our analytics and performance monitoring providers, for example. They are listed in Section 6.6, they act on our instructions, and they may not use the data for their own purposes.

We do not allow third-party advertising networks to collect your personal data through the Platform for their own advertising purposes.

7.4 How to control them

In your browser. Every browser lets you block or delete cookies, and most let you block third-party cookies while keeping the rest. The Help menu in your browser explains how. If you block necessary cookies you will not be able to sign in, add to your cart, or check out.

In your device settings. Your phone lets you reset or limit the advertising identifier, and control app permissions. See Section 1.4.

In your account. Turning off personalisation (Section 4.3) stops us using your browsing and viewing behaviour to tailor what you see, whatever your cookie settings are.

8.1 How we personalise what you see

If you have agreed to personalisation, we use what you browse, search for, buy and watch to decide:

• which products to recommend to you;
• how to order your video feed;
• what appears on your home screen; and
• how search results and category pages are arranged for you.
• which promotions, banners and featured collections appear to you.

The purpose is to show you things you are more likely to want. All of this happens on PARQIS, using data we hold. We do not send it to anyone else for this.

Personalisation is on when you create your account. We tell you this at signup, and you can turn it off at any time in your account settings — see Section 8.2. If you turn it off, we stop using your activity to tailor what you see, and we delete the profile we built from it.

8.2 Turning personalisation off

You can turn personalisation off at any time in your account settings — Section 4.3. Banners and promotions become generic rather than chosen for you.

The Platform keeps working. Instead of being ranked by your interests, products and content are ranked by popularity, recency, category and what you are looking at. You may find things less relevant. Nothing else about your account changes.

8.3 Promotions and featured products

Some promotions are the same for everyone — a seasonal edit, or a sale announcement shown across the Platform.

Others are chosen for you. If you have looked at or bought something in a category, we may show you a banner or featured collection from that category. This uses what you have done on PARQIS and nothing else, and it is part of the personalisation described in 8.1.

Some promotions are paid for. A seller or brand may pay for a promotional slot, and we may show it to you because your activity suggests it is relevant. Where a placement is paid for, we label it. We decide who sees it — the seller or brand does not receive your details and cannot identify who was shown their promotion.

Turn personalisation off and these become generic rather than chosen for you.

8.4 What we do not do

• We do not track you across other websites or apps.
• We do not use data about you from outside PARQIS to decide what to show you here.
• We do not share your personal data with advertising networks, and we do not let them collect it through the Platform.
• We do not give sellers or advertisers your identity, your contact details, or any way to identify you individually.
• We do not sell your personal data.
• Everything we show you is based on what you do on PARQIS.

8.5 Children

PARQIS is for adults only, and we do not direct advertising at children. See Section 5.

9.1 Two kinds of message

Service messages are part of your order and your account. Order confirmations, dispatch and delivery updates, delivery attempts, payment and refund confirmations, return updates, password resets, security alerts, and changes to our terms or policies.

You cannot turn these off while you have an active order or an open account. They are not marketing, and we do not need your consent for them — you gave us your contact details so we could tell you about your order.

Promotional messages are offers, discounts, sale announcements, new arrivals, and campaign messages. We do not send promotional messages unless you have asked for them. They are not switched on when you create your account. If you have not opted in, you will hear from us only about your orders and your account.

These need your consent. You can decline at signup, or turn them off later, and it makes no difference to your ability to shop.

9.2 Channels

With your consent, we may send promotional messages by:

• email;
• SMS;
• push notification, if you have allowed notifications;
• WhatsApp, if you have opted in on that channel; and
• phone call.

You can turn off any channel without turning off the others.

9.3 How to stop promotional messages

You can also register on the National Do Not Disturb register through your telecom provider, which blocks commercial calls and SMS from all senders.

We act on an opt-out within 7 working days. Messages already queued may reach you in that window.

9.4 Alerts you ask for

If you ask to be told when something is back in stock, or when a price drops, that is a message you requested. We send it once, and asking for it does not opt you in to promotional messages.

9.5 Rules we follow

We follow the Telecom Regulatory Authority of India’s rules on commercial communication, including registration of senders and message templates, honouring the Do Not Disturb register, and the restrictions on when commercial messages may be sent.

9.6 What we do not do

• We do not sell or rent your contact details.
• We do not send you marketing on behalf of other companies.
• We do not market to a person whose address you used as a delivery recipient.
• We will never ask you for your password, OTP, card number, CVV or UPI PIN in any message. If a message claiming to be from PARQIS does, it is not from us — report it to us at support@parqis.com.

9.7 Notifications in the app

Whether we can send you a notification at all is controlled by your device, not by us. Your phone asks your permission the first time, and you can change it at any time in your device settings.

Once you have allowed notifications, we send you service notifications about your orders and your account — order confirmed, dispatched, out for delivery, delivered, return picked up, refund processed, and security alerts such as a sign-in from a new device. These are part of your order and your account, and they are on by default.

Promotional notifications are separate and need your consent. Sale announcements, new arrivals, price drops, and offers are only sent if you have opted in to promotional messages. Allowing notifications on your device does not opt you in to these.

So there are two things, and they work independently:

If you turn off promotional messages, you will still get notifications about your orders. If you turn off notifications on your device, you will get neither — and we will use email or SMS for order updates instead.

10.1 Taking part is your choice

We sometimes ask customers to help us understand what works and what does not — through a survey, a feedback form, an interview, or a usability session.

Taking part is always voluntary. You can ignore an invitation, start and stop partway, or decline any individual question. Nothing about your account, your orders, or the prices you see changes because you did or did not take part.

10.2 What we collect

Only what the research needs, and only what you choose to give:

• your answers;
• contact details, if we need to follow up or send you a reward;
• background details you choose to share, such as age range, city, or shopping preferences; and
• your comments and suggestions.

Where a session is recorded — a call, a screen share, or a video interview — we ask for your consent separately before recording starts.

10.3 Who runs them

Some research is run by us. Some is run by a research agency on our behalf. An agency acts on our instructions, may use your data only for that research, and must delete it afterwards.

If a survey is run by anyone else on their own account, we will say so, and their privacy policy will apply.

10.4 What we do with the results

We use research to improve the Platform, our products, our service and our communications.

Results are reported in aggregate. When we share findings inside PARQIS or with a seller, we report patterns and themes, not individuals. We do not attribute a quote or an answer to you by name without asking you first.

10.5 Rewards

Where we offer a voucher, credit or other reward for taking part, we need enough detail to give it to you. Accepting a reward does not change anything else in this Privacy Policy.

10.6 Our ground, and how to stop

We rely on your consent for research. You can withdraw at any time — during the session, or afterwards by contacting us (Section 17) — and we will remove your responses from any analysis not yet completed.

Declining research invitations does not opt you out of anything else, and agreeing to one survey does not sign you up for future ones.

You have rights over your personal data under the DPDP Act. Exercising them is free, and we will not treat you differently for it.

11.1 What you can see and change yourself

Most of what you might want is already in your account, and you do not need to ask us:

11.2 Right to know what we hold

You can ask us for:

• a summary of the personal data we hold about you;
• a summary of what we do with it; and
• who we have shared it with — the identities of other organisations we have shared your data with, and a description of what was shared.

One limit, set by the Act. We do not have to tell you about data shared for preventing, detecting or investigating an offence or a cyber incident, or for prosecuting one. If we withheld something on that basis we would not be able to investigate fraud effectively.

11.3 Right to correct, complete and update

If anything we hold about you is wrong, incomplete or out of date, you can have it fixed. Most of it you can change yourself — see 11.1. For anything else, ask us and we will correct it.

Where we have shared inaccurate data with someone who is still using it, we will pass the correction on.

11.4 Right to have your data erased

You can ask us to delete your personal data.

We will, unless we still need it for the purpose you gave it to us for, or a law requires us to keep it. Section 12 sets out exactly what we keep, why, and for how long.

If we cannot delete something, we will tell you what we are keeping and which obligation requires it. We will not keep more than that.

11.5 Right to withdraw consent

You can withdraw any consent at any time, as easily as you gave it. Section 4.3 explains where, and Section 4.4 explains what happens next.

11.6 Right to nominate someone

You can nominate another person to exercise these rights on your behalf if you die or become unable to act yourself.

This matters more than it sounds. Your account may hold saved addresses, order history and invoices that your family may need. Without a nomination, nobody has a clear right to deal with it.

You can add or change a nominee at Account → Add Nominee

11.7 Right to raise a grievance

You can complain to us about anything in this Privacy Policy — how we have handled your data, or how we have handled a request. We must give you a working way to do that, and we must respond.

Section 17 has the contact details and our response times.

11.8 How to exercise a right

Where to ask.In your account at Profile > Help, or by writing to grievance@parqis.com.

We will check who you are. Before we disclose data or change anything, we need to be confident it is you asking. We may ask you to confirm details we already hold, or to verify your registered mobile number or email address. We will not ask for a document we do not already have.

How long we take. We acknowledge your request within 48 hours, and respond within 30 days. If a request is complex and will take longer, we will tell you why and when to expect an answer.

No fee. We do not charge for any of this.

If we say no. We will tell you which right we could not action, the reason, and what you can do next — including your right to complain (11.7) and to escalate (11.9).

Someone else asking on your behalf. A nominee, or a person legally authorised to act for you, may exercise these rights. We will ask for proof of their authority.

If you are a delivery recipient, not a customer. If someone sent you an order and you want to know what we hold about you or have it deleted, you have the same rights. Contact us and we will help — you do not need a PARQIS account.

11.9 Complaining to the Data Protection Board

If we do not resolve your complaint, you can escalate it to the Data Protection Board of India.

The Act asks you to use our grievance process first, so please give us the chance to put it right.

11.10 Your side of it

The Act also places a few duties on you when you exercise these rights. In plain terms:

• do not impersonate someone else when giving us data or making a request;
• do not hide material information when we are required to collect it;
• give us authentic information when you ask us to correct or erase something; and
• do not file a complaint you know to be false.

The Act provides for a penalty where these duties are breached. We mention it for completeness, not because we expect it to arise.

12.1 The principle

We keep your personal data only as long as we need it for the purpose we collected it for, or as long as a law requires — whichever is longer. When neither applies any more, we delete it or anonymise it.

Two things trigger deletion under the Act: you withdraw your consent, or the purpose is no longer being served. Whichever happens first is when we act, unless a law says otherwise.

12.2 How long we keep things

12.3 Some things we cannot delete straight away

While an order is live. We cannot delete order data during delivery, the return window, or a refund. Ask us afterwards. We may or may not be able to do so considering the situation, purpose, & governing laws.

Tax and accounting records. These are not ours to delete. If you ask us to erase your data, we keep the invoice and transaction record for the period above, and delete the rest.

Where a dispute is running. If there is a complaint, chargeback, claim or investigation involving your order, we keep what relates to it until it concludes.

12.4 Closing your account, and what happens to your content

You can close your account at any time at Profile > Account > Delete Account

When you do, we delete your personal data within 180 days, apart from what the table above says we keep.

Your reviews. Reviews help other customers decide what to buy, so we do not remove them automatically when you close your account. Instead we remove your display name, so they stay useful but no longer identify you. If you would rather they were deleted entirely, ask us over the grievance email and we will delete them.

Your ratings. Your rating stays in the product’s overall score after you close your account. It was never published with your name, and once your account is closed we no longer hold a link between you and it.

Deleting your account is not reversible. Order history, saved addresses and preferences will be gone. Download any invoices you need first.

12.5 Accounts you stop using

If you have not used your account for 3 years, we will email you at your registered email address. If we do not hear from you, we will delete your personal data, keeping only what the table above requires.

We do this so that we are not holding data for someone who has moved on.

12.6 What deletion actually means

When we delete your data, we remove it from our live systems straight away. It may remain in encrypted backups for a short period before those are overwritten in the ordinary cycle — we do not restore deleted data from a backup except to recover from a system failure.

13.1 What we do

We take reasonable security safeguards to prevent your personal data being lost, misused, or accessed without authorisation:

• Encryption. Your data is encrypted in transit, and encrypted where it is stored.
• Access control. Only staff who need your data to do their job can reach it, and access is granted by role rather than by request.
• Masking. Where our teams do not need to see your full details, they see a masked version.
• Monitoring and logging. We log access to personal data and monitor for unusual activity.
• Backups. Encrypted, tested, and held in India.
• Contracts. Every provider who handles your data is contractually required to protect it to a standard at least as strong as ours.
• Review. We test and review our safeguards, and fix what needs fixing.

13.2 What we ask of you

Some of it is in your hands:

• keep your password to yourself, and use one you have not used elsewhere;
• never share an OTP with anyone, including someone claiming to be from PARQIS;
• sign out on shared or public devices; and
• tell us straight away if you think someone has got into your account — Section 17.

We will never ask you for your password, OTP, card number, CVV or UPI PIN. Not by phone, not by email, not by message, not in chat. Anyone who does is not us.

We do not ask you to pay to release an order, unlock a refund, or claim a prize.

13.3 What we cannot promise

No system is completely secure, and data sent over the internet always carries some risk. We cannot guarantee that your data will never be compromised, and we do not claim to.

That does not reduce our obligations. We remain accountable for protecting your data under the DPDP Act, and this paragraph does not limit that.

If your personal data is breached — lost, disclosed, altered, or accessed without authorisation — here is what happens.

14.1 We tell you

We will notify you without delay, in your account and at your registered email address or mobile number.

We will tell you, as far as we know it: what happened and when, what data was affected, what the likely consequences are for you, what we have done to contain it, what we are doing to prevent it happening again, and what you should do — for example changing your password or watching for suspicious messages.

We will also tell you who to contact for more information.

14.2 We tell the regulator

We notify the Data Protection Board of India as soon as we become aware of a breach, and provide the fuller details the law requires within the period it prescribes.

14.3 We investigate and fix it

We contain the breach, find out how it happened, fix the cause, and tell you the outcome where it affects you.

14.4 If it happened at a seller or a provider

We remain accountable for your personal data even when someone else is handling it on our behalf. Sellers and our service providers are contractually required to report any incident to us promptly, and we will notify you and the Board as set out above regardless of where the breach occurred.

We store your personal data in India. Our main servers and backups are located in India.

Some of the services we use process limited personal data outside India. These include content delivery, push notifications, and email delivery.

These services are required by contract to protect your personal data. We do not transfer your personal data to any country restricted by the Central Government.

16.1 Links to other websites and apps

The Platform may link to websites and apps we do not run — a seller’s own site, a payment provider, a delivery tracking page, a social media platform.

Once you follow a link, you are on their service and their privacy policy applies, not ours. We do not control what they collect or what they do with it. Read their policy before you give them anything.

16.2 Content from sellers and creators

Product listings, descriptions, images, videos on the Platform are supplied by sellers and creators, not written by us.

We require them to be accurate and lawful, and we act when they do not. But, we do not write them, and this Privacy Policy does not cover how a seller or creator handles data on their own account, outside what we have instructed them to do.

16.3 Your public content

Your reviews, comments and uploads are public. Anyone can see them, along with your display name, including people who are not PARQIS customers, and search engines may index them.

Your ratings are not published with your name. They appear only as part of a product’s overall score.

Two consequences worth knowing:

• Do not put personal details in public content. Your phone number, address, order number or email address do not belong in a review. Nor does anyone else's.
• Once something is public, we cannot fully unpublish it. We can delete it from the Platform, and we will if you ask. But if someone has already copied it, screenshotted it, or a search engine has cached it, that is beyond our reach.

16.4 Social media

If you interact with PARQIS on a social media platform, that platform’s privacy policy governs what it collects. We see only what the platform shows us.

Appointed under the Information Technology Act, 2000 and the rules made under it, and under the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020.

If we have not resolved your data protection complaint, you can take it to the Data Protection Board of India.

Please come to us first — the Act asks you to use our grievance process before approaching the Board, and most things we can simply put right.

We acknowledge your request within 48 hours, and respond within 30 days. If a request is complex and will take longer, we will tell you why and when to expect an answer.

We update this Privacy Policy from time to time — when the law changes, when we add a feature, or when we change how something works.

How we tell you. For any change that materially affects how we handle your personal data, we will tell you before it takes effect, by email to your registered address, by notification in your account or the app, or by a notice on the Platform. For minor changes — clearer wording, a corrected link — we update the version and date at the top.

Where to find earlier versions. At parqis.com/privacypolicy/perviousversions. The version in force when we collected your data governs that collection.

Where we need your consent. If a change means processing your data for something new that requires consent, we will ask you separately. We will not treat continued use of the Platform as agreement to that.

One thing we will not do. We will not change this Privacy Policy to reduce the protection of personal data we already hold about you, retrospectively, without telling you and — where the law requires it — asking you first.

This Privacy Policy is governed by the laws of India.

The courts at Noida, Uttar Pradesh have exclusive jurisdiction over any dispute arising out of it.

Nothing here affects your right to complain to the Data Protection Board of India under the DPDP Act, or to a consumer forum under the Consumer Protection Act, 2019. Those routes stay open to you regardless of this clause.

This annexure sets out, item by item, the personal data we process, why we process it, the ground we rely on, how long we keep it, and who we share it with. It brings together in one place what Sections 1, 2, 6, 7 and 12 describe separately.

Nothing in this annexure adds to or changes those sections. Where it differs from them, the section prevails.

Source: You = you give it to us · Auto = collected automatically as you use the Platform · 3P = we receive it from a third party · Us = we generate it

Ground: Given = you gave us the data for this purpose · Consent = your consent, and you can withdraw it · Law = the law requires it

A. Identity and account

Any information taken for registration, called “Registration Information” is held for 180 days post account deletion owing to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021.

B. Orders, payment and delivery

C. Your content and interactions

D. Behaviour and personalisation

E. Device, technical and security

F. Consent, preferences and permissions

G. Research

H. Data that is not personal data

Overriding periods

Two things override the retention periods above.

• A live dispute, claim or investigation. Where data relates to an ongoing complaint, chargeback, claim, regulatory query or investigation, we keep it until that concludes, plus 1 year.
• A legal obligation. Where a law requires us to keep something for longer than stated above, we keep it for the period that law requires, and only that data.