Privacy Policy
Effective Date: September 1, 2026 | Last Revised: September 2026
1. Introduction & Overview
Welcome to Duvelle (the "Platform", "Website", or "Store"), operated by Republic of Clothing("Duvelle", "we", "our", or "us"), having its principal place of business at B2-706, Boomerang Co-op, Chandivali Farm Rd, Andheri East, Mumbai — 400072, Maharashtra, India.
We pride ourselves on offering luxury menswear crafted with uncompromising precision. We hold your personal privacy and trust to the exact same standard. This Privacy Policy sets out how we collect, process, store, transfer, and protect your personal information when you visit, register, browse, or make purchases on our platform.
By accessing or using Duvelle, you acknowledge that you have read, understood, and consented to the practices described in this Privacy Policy, as well as our Terms & Conditions. This policy is formulated in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDPA) of India.
2. Information We Collect
To process your orders, provide dedicated styling assistance, and deliver an elevated shopping journey, we collect specific categories of information:
A. Information You Provide Voluntarily
- Personal & Contact Details: Full name, email address, mobile phone number, and alternate contact numbers.
- Shipping & Delivery Details: Physical shipping address, apartment or suite number, landmark, city, state, postal PIN code, and recipient contact information.
- Account Credentials: Password hash, account preferences, saved addresses, size preferences, and wishlist items.
- Customer Concierge Communications: Transcripts of customer support emails, WhatsApp concierge chats, return/exchange claims, and feedback or reviews submitted by you.
B. Transaction & Order Data
- Order History: Specific garments, styles, fits, and sizes purchased, order timestamps, payment transaction identifiers, invoice records, and delivery status updates.
- Payment Information: Transaction status, bank/UPI reference numbers, and payment method selected (e.g. UPI, Net Banking, Credit/Debit Card, or Cash on Delivery). Please note: We do NOT store card numbers, CVVs, expiry dates, or UPI PINs on our servers.
C. Automatically Collected Device & Usage Data
- Technical Metadata: Internet Protocol (IP) address, browser type, operating system version, screen resolution, referring URLs, and device identifiers.
- Session Activity: Pages viewed, time spent per collection, clickstream patterns, search queries on our store, and cart additions.
3. How We Use Your Information
We process your personal data strictly for legitimate business and fulfillment purposes:
- Order Fulfillment & Delivery: Processing your cart, verifying payment authenticity, dispatching parcels, issuing tax invoices, and facilitating doorstep delivery via national express couriers.
- Shipment Tracking & Real-Time Alerts: Dispatching real-time transactional updates, tracking links, and delivery confirmations via SMS, WhatsApp Business, and transactional email.
- Customer Support & Reverse Pickups: Managing size exchanges, alterations, return pickups, and addressing any fit inquiries through our customer service team.
- Platform Security & Fraud Prevention: Detecting fraudulent transactions, unauthorized account logins, chargeback abuse, and malicious bot activity to protect all shoppers.
- Personalized Experience & Recommendations: Remembering your sizing preferences, displaying relevant menswear styles, and saving your shopping bag for future sessions.
- Promotional Communications (With Opt-Out): Sending curated seasonal lookbooks, private sale invitations, and new collection launches. You can unsubscribe at any time with a single click.
- Statutory Compliance: Fulfilling Goods and Services Tax (GST) invoicing mandates, corporate audits, and regulatory recordkeeping under Indian law.
4. Legal Grounds for Processing (DPDPA 2023)
Under the Digital Personal Data Protection Act, 2023 and applicable data privacy jurisprudence, we collect and process your personal information under the following recognized legal bases:
- Performance of Contract: Processing necessary to fulfill our contract of sale with you — including shipping garments to your doorstep and servicing returns.
- User Consent: Explicit, informed consent provided by you when registering, subscribing to newsletters, or enabling optional browser cookies.
- Legal & Statutory Obligation: Maintaining accounting, tax, and sales invoice records as mandated by Indian GST, corporate, and e-commerce consumer laws.
- Legitimate Business Interests: Safeguarding our digital infrastructure against cyber threats, bot attacks, fraudulent transactions, and optimizing store loading speed.
5. Payment Security & Zero Card Storage
Financial security is paramount at Duvelle. All electronic transactions are executed through PCI-DSS Level 1 certified payment gateway aggregators (such as Razorpay).
When opting for Cash on Delivery (COD), our logistics partner collects cash or initiates digital payment upon physical parcel handover, verified via one-time authentication (OTP) where applicable.
8. Data Retention & Storage
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy:
- Order & Tax Records: Invoices, transaction records, and delivery proofs are maintained for up to 8 years to satisfy statutory mandates under Indian GST, Income Tax, and the Companies Act.
- Active Account Data: Saved addresses and profile information remain stored while your account is active, or until you submit an account closure or deletion request.
- Support Correspondence: Concierge chat logs and customer service emails are retained for up to 24 months to assist in dispute resolution and warranty support.
9. Technical & Operational Safeguards
Duvelle implements comprehensive physical, electronic, and managerial safeguards to protect your personal information against unauthorized access, loss, alteration, or misuse:
- Encryption in Transit: 256-bit SSL/TLS encryption for all web pages, login portals, and checkout screens.
- Cryptographic Hashing: User passwords are never saved in cleartext; they are transformed using industry-standard bcrypt hashing algorithms.
- Role-Based Access Controls: Only authorized personnel who require access to dispatch parcels or resolve customer claims are granted temporary, logged access to customer details.
- Continuous Infrastructure Monitoring: Regular security patching, automated firewall inspection, and intrusion detection measures.
10. Your Privacy Rights (Under DPDPA 2023)
As a Data Principal under Indian data protection legislation, you possess several enforceable rights:
- Right to Access & Summary: You have the right to request a summary of the personal data we hold about you and the processing activities undertaken.
- Right to Correction & Updating: You may correct, rectify, or update incomplete or inaccurate personal data at any time via your account profile or by contacting our concierge.
- Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal account and associated data, provided that retaining such data is not required by statutory taxation or accounting laws.
- Right to Withdraw Consent:You may withdraw consent for promotional marketing, SMS notifications, or newsletters at any time using the "Unsubscribe" link in our emails or messaging our concierge.
- Right to Nominate: You have the right to nominate an authorized representative to exercise your rights in the event of death or incapacity.
To exercise any of these rights, please email our Data Privacy desk at grievance@duvelle.in with the subject line "Data Subject Rights Request". We respond to verified requests within 30 calendar days.
11. Children's Privacy
Duvelle is an online retail platform designed exclusively for adult consumers aged 18 and older. We do not knowingly collect, solicit, or process personal data from children under the age of 18 without verified parental or legal guardian consent. If we become aware that a minor has submitted personal data without authorization, we will promptly delete that data from our production systems.
12. Policy Revisions & Modifications
We may periodically update this Privacy Policy to reflect changes in our operational practices, new features, or evolving statutory frameworks. Any updates will be posted on this page with an updated "Last Revised" date at the top. We encourage you to review this page periodically to stay informed about our data protection standards.
13. Grievance Officer & Contact Details
In accordance with the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020, the designated Grievance Officer for Duvelle / Republic of Clothing is details below: