What we collect, why we collect it, who ever sees it and how long we keep it — written to be read rather than skimmed. Compliant with the Digital Personal Data Protection Act, 2023 and the Information Technology Rules, 2011.
| What we hold | Why we hold it | Kept for |
|---|---|---|
| Name, email, mobile | To confirm the order, send dispatch and tracking updates, and reach you if something goes wrong. | 8 years |
| Delivery address & PIN code | To check serviceability at checkout and to get the parcel to your door. | 8 years |
| Order & invoice records | To fulfil the order, raise a GST invoice, and meet tax and consumer-protection obligations. | 8 years |
| Payment reference number | To reconcile a payment and to process a refund back to the same instrument. | 8 years |
| Correspondence with us | To answer your question and to keep a record of how a complaint was resolved. | 3 years |
| Device & usage data | To keep the site working, detect fraud, and understand which pages people actually use. | 26 months |
| Marketing consent | To send you occasional email about new arrivals, only where you have asked for it. | Until withdrawn |
We never hold your UPI PIN, OTP, card number or banking credentials — those never reach our servers.
Under the Digital Personal Data Protection Act, 2023 you are the Data Principal and these rights are yours by law, not by our permission. To exercise any of them, write to grievance@aretashub.com. We respond within 15 days.
Ask for a copy of the personal data we hold about you, and a summary of how it is being processed.
Have inaccurate or incomplete data corrected or completed — a misspelt address, a changed mobile number.
Ask us to delete your data, save for records we are legally obliged to retain for tax and consumer law.
Withdraw consent as easily as it was given, for anything processed on the basis of consent.
Name someone to exercise these rights on your behalf in the event of death or incapacity.
Complain to our Grievance Officer, and escalate to the Data Protection Board of India if unresolved.
This Privacy Policy applies to Aretas Hub (the “Website”), operated by ARETAS RETAIL PRIVATE LIMITED, a private limited company registered in New Delhi (GSTIN 07AATCA7799N2ZD). For the purposes of the Digital Personal Data Protection Act, 2023, ARETAS RETAIL PRIVATE LIMITED is the Data Fiduciary.
Registered office: 3RD, G BLOCK, T-15, S.J. Soldier Tower, Vikasapuri Banks/Road, Paschim Vihar, New Delhi, West Delhi, Delhi, 110018.
UPI payments are processed end to end by our payment gateway partner, MMADPay. We do not receive or store any UPI ID, UPI PIN, OTP, card number or banking credential. We retain only the transaction reference issued by the gateway, which is what allows us to reconcile a payment and refund it later.
We process personal data only where we have your consent, or another lawful basis under the DPDP Act, 2023 — principally the performance of the contract you enter into when you place an order, and compliance with legal obligations.
We do not sell your personal data, ever. We share the minimum necessary with:
Retention periods are set out in the ledger above. In short: order, invoice and tax records are retained for eight years as required by Indian tax law; customer-care correspondence for three years; analytics data for up to 26 months; and marketing-consent records until you withdraw consent. Data no longer required for any of these purposes is deleted or irreversibly anonymised.
The Website runs on HTTPS/TLS encryption end to end. Personal data is held on access-controlled servers, and administrative access is limited to the individuals who need it to do their work. We follow reasonable security practices and procedures as prescribed under Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
No transmission over the internet is ever entirely secure, and we do not claim otherwise. Where a personal-data breach affects you, we will notify you and the Data Protection Board of India as the law requires.
We use a small number of cookies and browser storage entries: one to hold your shopping bag, one to keep your session alive through checkout, and — where analytics is enabled — measurement cookies set by Google Analytics 4. You may block or clear these in your browser at any time, but checkout will not function correctly without the first two.
We sell boyswear, but the Website is intended for adults: only a person aged 18 or over may place an order. We do not knowingly collect personal data from a child, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, as required by section 9 of the DPDP Act, 2023. If you believe a child has provided us with personal data, write to us and we will delete it.
We may update this policy to reflect changes in our practices or in the law. The current version and its date of last update are always published on this page. Material changes affecting how your data is used will be notified to you by email where we hold your address.
Appointed under the Information Technology Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:
Complaints are acknowledged within 24 hours and resolved within 15 days of receipt. The full procedure and escalation route are set out on our Grievance Redressal page.
This Privacy Policy is governed by the laws of India. Any dispute arising in connection with it is subject to the exclusive jurisdiction of the courts at New Delhi.