Last Updated: 06-08-2026

Bulawa ("we", "us", "our") operates the website [www.bulawainvites.com] (the "Platform"). We are committed to protecting your privacy and ensuring that your personal information is handled with the highest standards of security and transparency. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit or make a purchase from our Platform.

By accessing or using the Platform, you consent to the collection, storage, use, and disclosure of your information in accordance with this Privacy Policy. If you do not agree, please discontinue use immediately.

---

1. DEFINITIONS

“Personal Information” means any information that relates to a natural person, which either directly or indirectly, in combination with other information available or likely to be available with us, can identify such person.

“Sensitive Personal Data or Information” (SPDI) has the meaning given under the SPDI Rules and includes passwords, financial information (bank account, credit card, debit card, or other payment instrument details), physical, physiological and mental health conditions, sexual orientation, medical records and history, and biometric information.

“User”, “you”, “your” refers to any individual accessing or purchasing from the Platform.

---

2. INFORMATION WE COLLECT

We may collect the following categories of information:

a) Personal Information

- Full name

- Email address

- Shipping and billing address

- Phone number

- Payment information (such as credit/debit card details, UPI ID, net banking credentials) – such details are tokenized/encrypted and not stored by us except as mandated by regulatory guidelines.

- Any other information you voluntarily provide (e.g., product reviews, survey responses).

b) Sensitive Personal Data or Information (SPDI)

- Passwords (stored using one-way hashing)

- Financial data processed for transactions (handled by PCI-DSS compliant payment gateways)

- Any other SPDI you explicitly provide with consent.

We do not collect SPDI without your explicit consent and only collect such data as is necessary for the stated purpose.

c) Device and Technical Information

- IP address

- Browser type and version

- Operating system

- Device identifier and hardware model

- Time zone setting and geolocation data (with consent, where required)

- Log data (access times, pages viewed, referring URL, system activity)

d) Usage and Behavioural Information

- Navigation patterns, clickstream data, search queries, product preferences, time spent on pages

- Interaction with emails and advertisements

e) Information from Third Parties

- If you log in via a third-party service (e.g., Google), we receive profile information permitted by that service.

- Publicly available data, social media interactions, and data from marketing affiliates.

---

3. HOW WE COLLECT INFORMATION

We collect information through:

- Direct interactions: when you create an account, place an order, subscribe to newsletters, enter a contest, or contact customer support.

- Automated technologies: cookies, web beacons, pixels, and similar tracking technologies as you navigate the Platform.

- Third-party sources: payment gateways, delivery partners, analytics providers, and advertising networks.

---

4. PURPOSE AND LAWFUL BASIS OF PROCESSING

We use your information for the following purposes, relying on the lawful bases of consent, performance of a contract, compliance with legal obligations, and legitimate interests:

Order Fulfilment & Service Delivery: Processing payments, shipping products, managing returns/refunds, communicating transactional updates (contract performance).

Account Management: Creating and maintaining your user account, verifying identity, providing customer support.

Personalisation & Improvement: Tailoring your shopping experience, recommending products, improving Platform usability, conducting analytics (legitimate interest / consent).

Marketing & Promotions: Sending promotional emails, SMS, push notifications about offers, new launches, and curated content. You may opt out at any time (consent).

Security & Fraud Prevention: Monitoring for suspicious activity, protecting against fraud, enforcing our Terms of Service (legitimate interest).

Legal & Regulatory Compliance: Cooperating with law enforcement, responding to legal requests, complying with applicable Indian laws (legal obligation).

Aggregated & De-Identified Data: For research, statistical analysis, and business intelligence — such data cannot identify you.

Where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

---

5. DISCLOSURE AND SHARING OF INFORMATION

We do not sell, rent, or trade your Personal Information. We may share your data only under the following circumstances:

- Service Providers & Partners: With trusted third parties who perform services on our behalf, including payment processors (e.g., Razorpay, Paytm, Stripe), logistics and courier companies, cloud hosting providers, email/SMS communication platforms, and customer analytics tools. All such entities are contractually bound to comply with data protection standards at least as stringent as ours.

- Legal Obligations & Enforcement: If required by a court order, government agency, or to comply with applicable laws in India, including the Information Technology Act, 2000. Also to protect our rights, property, or safety of users and the public.

- Business Transfers: In the event of a merger, acquisition, or sale of all or part of our assets, your information may be transferred as part of that transaction, subject to equivalent privacy commitments.

- With Your Consent: Any other disclosure will occur only after obtaining your explicit consent.

---

6. DATA RETENTION

We retain your Personal Information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law (e.g., tax records, dispute resolution, fraud prevention). After the retention period expires, we securely delete or anonymise your data.

- Account information: retained as long as your account is active or as needed to provide services.

- Order and payment records: retained for a period compliant with the Income Tax Act, 1961 and GST regulations (typically 8 years).

- Marketing data: retained until you withdraw consent or unsubscribe.

- Usage logs and analytics: retained in an aggregated/de-identified form.

---

7. SECURITY PRACTICES

We implement reasonable security practices and procedures as required under Section 43A of the IT Act and the SPDI Rules. This includes:

- Encryption of data in transit using TLS/SSL protocols.

- Tokenisation and encryption of payment card data (PCI-DSS Level 1 compliant gateways).

- Hashing of account passwords with salt.

- Role-based access controls and regular internal security audits.

- Physical, electronic, and managerial procedures to prevent unauthorised access, misuse, alteration, or destruction.

While we strive to protect your data, no internet-based system is completely invulnerable. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account password.

---

8. YOUR RIGHTS AND CHOICES

Under the prevailing legal framework and in alignment with upcoming data protection law, you are entitled to:

Access & Correction: Request a copy of your Personal Information we hold and correct inaccuracies.

Erasure: Request deletion of your data where processing is not required by law or pending dispute.

Withdrawal of Consent: Withdraw any consent previously given, including for marketing or SPDI processing. Note that withdrawal may affect our ability to provide certain services.

Data Portability: In a structured, machine-readable format, to the extent technically feasible.

Opt-Out of Marketing: Unsubscribe via the link in emails or by contacting us. Transactional communications will still be sent.

Grievance Redressal: Raise any concerns regarding your data handling with our Grievance Officer (details below).

To exercise any of these rights, email us at privacy@bulawa.com with the subject “Data Subject Request”. We will verify your identity and respond within 30 days as per statutory timelines.

---

9. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies (pixels, tags, SDKs) to recognise you, enhance your experience, analyse usage, and deliver relevant advertisements.

Categories of cookies used:

- **Essential:** Necessary for core Platform functions (e.g., session management, shopping cart).

- **Performance & Analytics:** Help us understand visitor behaviour (e.g., Google Analytics).

- **Functional:** Remember preferences and customisations.

- **Advertising & Targeting:** Serve interest-based ads and measure campaign effectiveness.

You can manage cookie preferences via your browser settings. Disabling certain cookies may impair the Platform’s functionality. By continuing to use our Platform without changing settings, you consent to our use of cookies.

---

10. THIRD-PARTY LINKS AND SERVICES

Our Platform may include links to external websites, plug-ins, or payment gateways not operated by us. This Privacy Policy does not apply to such third-party services. We encourage you to review their privacy policies. We assume no liability for their data practices.

---

11. DATA TRANSFER

Your data is primarily stored on servers located in India. If any data is processed or transferred to servers outside India, we ensure that the receiving entity maintains equivalent levels of data protection as mandated under Indian law, and such transfer is only for purposes consistent with this Policy.

---

12. CHILDREN’S PRIVACY

The Platform is not intended for individuals under the age of 18. We do not knowingly collect or solicit Personal Information from children. If we learn that a child’s data has been inadvertently collected, we will delete it immediately. Parents/guardians can contact us to report any such concerns.

---

13. GRIEVANCE OFFICER

In compliance with the Information Technology Act, 2000 and SPDI Rules, we have appointed a Grievance Officer to address any data privacy-related concerns or disputes. You may contact:

Designation: Grievance Officer – Bulawa

Email: grievance@bulawa.com

The Grievance Officer will acknowledge your complaint within 24 hours and resolve it within 30 days from the date of receipt.

---

14. CHANGES TO THIS PRIVACY POLICY

We reserve the right to update this Privacy Policy at our discretion. Any material changes will be notified via email and/or a prominent notice on the Platform. The “Last Updated” date will be revised. Continued use after such modifications constitutes acceptance of the updated Policy. We encourage you to review this page periodically.

---

15. CONTACT US

For any questions not addressed above, or to exercise your rights, reach out at:

Email: privacy@bulawa.com

Website: [www.bulawa.com]

---

This document is a legally binding statement of the privacy practices of Bulawa. It has been prepared in accordance with Indian law and global best practices.