1. Introduction

Astarr Pvt. Ltd. ("Astarr") operates the website www.astarr.co.in. We respect your privacy and are committed to protecting personal data in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000, and international privacy best practices (GDPR & CCPA principles where relevant).

2. Scope

This Policy applies to all visitors, customers, and users of our site and services. It covers information collected online and via our customer support channels. It does not apply to third-party websites or services that we do not own or control.

3. Information We Collect

4. How We Use Your Information

• To process and fulfill orders, returns and refunds.
• To provide customer support and respond to inquiries.
• To send transactional messages, order updates and legal notices.
• To personalize and improve products, marketing and website experience.
• To prevent fraud, abuse and to comply with legal obligations.

We never sell your personal information for advertising or marketing purposes. Any sharing of data with service providers is limited to what is necessary to deliver services and is governed by strict contracts and confidentiality obligations.

5. Legal Basis for Processing

Where applicable, our lawful bases for processing include:

• Consent — when you explicitly opt-in (e.g., newsletters).
• Contractual necessity — to perform our contract with you (order processing).
• Legitimate interests — for fraud prevention, security and business improvements balanced against your rights.
• Legal obligations — compliance with tax, accounting and law enforcement requirements.

6. Cookies & Tracking

We use cookies, pixels and similar technologies to remember settings, analyze site performance and provide personalized experiences. You can manage cookie preferences through your browser or our cookie control (where available). Disabling certain cookies may affect functionality.

7. Data Retention

We retain personal data only as long as necessary:

• Order records & invoices: retained for up to 7 years for legal compliance.
• Account information: retained until you request deletion or account closure.
• Marketing records: retained until you unsubscribe.

Irrelevant or expired personal data is permanently and securely deleted or anonymized.

8. Data Sharing & Disclosure

We share personal data with third parties only as necessary to provide services or where required by law. Typical recipients include:

• Payment processors (PCI-DSS compliant)
• Delivery and logistics partners
• Analytics and marketing providers
• Legal, audit and professional advisors

All third-party partners are contractually required to implement appropriate technical and organizational measures to protect your data.

9. Security Measures

We employ industry-standard security controls including TLS/SSL encryption, firewalls, access controls, vulnerability scanning and employee training. While we use commercially reasonable measures to protect data, no system can be guaranteed 100% secure. We will notify affected users and authorities as required by law in the event of a qualified data breach.

10. Your Rights & Choices

You have rights regarding your personal data. Subject to applicable law, you may:

• Request access to the personal data we hold about you.
• Request correction or deletion of inaccurate or unnecessary data.
• Withdraw consent where processing is based on consent.
• Object to processing based on legitimate interests.
• Request portability of certain personal data to another service.

To exercise any right, contact our Grievance Officer (details below). We will respond within applicable legal timeframes (not to exceed 30 business days unless otherwise permitted by law).

11. Children’s Privacy

Our services are not directed to children under 18. We do not knowingly collect personal data from minors. If we become aware that a minor’s data has been collected without parental consent, we will promptly delete it.

12. Cross-Border Transfers

We may transfer data to service providers located in other jurisdictions. We ensure such transfers are governed by appropriate safeguards (standard contractual clauses, data processing agreements and equivalent protections) required by law.

13. Marketing & Promotional Communications

We will contact you for marketing only if you have opted in. All marketing emails contain a simple and immediate unsubscribe option. You may also manage preferences in your account settings or contact support.

14. Policy Changes

We may update this Policy to reflect legal, technical or business changes. When we make significant changes, we will provide prominent notice and update the effective date at the top of this Policy. Continued use of the service after notice constitutes acceptance of the updated Policy.

15. Grievance Redressal & Contact

If you have concerns, questions or complaints about our data practices, please contact our Grievance Officer:

We will investigate and attempt to resolve any legitimate privacy complaint promptly and in accordance with applicable law. If you remain unsatisfied, you may approach the relevant supervisory authority in your jurisdiction.

16. Governing Law & Jurisdiction

This Policy and any disputes arising from it are governed by the laws of India and the courts of New Delhi shall have exclusive jurisdiction, except where mandatory local law provides otherwise.