Privacy policy

Privacy Policy

POSHIS GLOBAL PRIVATE LIMITED (operating the brand “a i c e”)

Effective Date: 7 August 2026
Last Updated: 7 August 2026
Supersedes: Privacy Policy dated 06/05/2025

1. Introduction

POSHIS GLOBAL PRIVATE LIMITED (“Company”, “we”, “us”, or “our”) operates the website https://shopataice.com (the “Site”) under the brand “a i c e”. We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, store, and protect it, and the rights available to you. It applies when you visit the Site, create an account, place an order, subscribe to our communications, contact us, or otherwise interact with us.

This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, read with the Information Technology Act, 2000 and rules made thereunder.

For the purposes of the DPDP Act, POSHIS GLOBAL PRIVATE LIMITED is the Data Fiduciary in respect of your personal data, and you are the Data Principal.

Please read this Policy carefully. If you do not agree with it, please do not use the Site or provide us with your personal data.

2. Key Definitions

  • Personal data — any data about an individual who is identifiable by or in relation to such data.
  • Processing — any operation performed on personal data, including collection, recording, storage, use, sharing, disclosure, and erasure.
  • Data Principal — the individual to whom the personal data relates (i.e., you). Where the individual is a child, this includes the parent or lawful guardian; where the individual is a person with disability, it includes the lawful guardian.
  • Data Fiduciary — the entity that determines the purpose and means of processing personal data (i.e., us).
  • Data Processor — a person who processes personal data on behalf of a Data Fiduciary (e.g., our hosting, payment, and logistics providers).
  • Consent Manager — a registered entity through which a Data Principal may give, manage, review, and withdraw consent, as contemplated under the DPDP Act.

3. Notice: What Personal Data We Collect and Why

The table below itemises the categories of personal data we process and the specific purpose for each. We collect only what is necessary for the stated purpose.

Category Specific data items Purpose of processing
Identity and contact data Full name, email address, mobile/phone number, billing address, shipping address, PIN code To create and manage your account, process and fulfil your orders, arrange delivery, and communicate with you about your order
Account credentials Username, password (stored in hashed form), one-time passwords (OTPs), login history To authenticate you, secure your account, and prevent unauthorised access
Transaction data Order history, items purchased, order value, invoices, payment status, refund and return records, payment method type (card/UPI), last four digits and card network as returned by the gateway To process transactions, issue invoices, handle returns and refunds, provide customer support, and meet tax and accounting obligations
Payment data Payment instrument details entered at checkout To collect payment. Full card numbers, CVV, UPI PINs, and banking passwords are collected and processed directly by our payment gateway — we do not receive or store them.
Communications data Customer service emails, chat transcripts, call records, WhatsApp messages, feedback, survey responses To respond to your queries, resolve complaints, maintain a service record, and improve our service quality
User-generated content Product reviews, ratings, photographs, testimonials, social media tags To publish reviews, showcase customer content, and improve our products
Marketing preferences Newsletter subscription status, communication channel consents, opt-out records To send you communications you have consented to receive, and to honour your opt-outs
Technical and usage data IP address, device type, browser type and version, operating system, device identifiers, referring URL, pages viewed, time on page, clickstream, cart activity, session recordings (where enabled) To operate and secure the Site, detect and prevent fraud, diagnose technical faults, measure performance, and understand how the Site is used
Cookie and tracking data Cookie identifiers, pixel and tag data, advertising identifiers As set out in Clause 6 below
Optional profile data Date of birth, gender, size or style preferences, interests — only where you choose to provide them To personalise product recommendations and offers. Providing this data is entirely optional and refusing does not affect your ability to shop with us.

Note on sensitive data: We do not knowingly collect health data, biometric data, genetic data, caste or religious affiliation, sexual orientation, or political beliefs. Please do not submit such information to us. We do not collect Aadhaar numbers or PAN unless legally required for a specific transaction, in which case we will tell you at the point of collection.

4. Legal Basis for Processing

We process your personal data on the following bases under the DPDP Act:

  • Your consent — freely given, specific, informed, unconditional, and unambiguous, indicated by a clear affirmative action. You may withdraw consent at any time (see Clause 13).
  • Certain legitimate uses permitted under Section 7 of the DPDP Act, including where you voluntarily provide data for a specified purpose and have not indicated objection, for compliance with a legal obligation or court order, and for responding to a medical emergency or threat to life.

Where processing is based on consent, withdrawal will not affect the lawfulness of processing carried out before withdrawal, and we may continue to retain data where required by law.

5. How We Use Your Information

In addition to the purposes itemised in Clause 3, we use personal data to:

  • Verify your identity and prevent, detect, and investigate fraud, abuse, and security incidents;
  • Send transactional and service communications (order confirmations, dispatch and delivery updates, payment receipts, refund notifications, security alerts, and policy changes). These are not marketing messages and cannot be opted out of while you have an active order or account;
  • Send promotional communications where you have consented (see Clause 9);
  • Personalise your experience, including recommending products and tailoring the content you see;
  • Conduct internal research, analytics, and reporting to improve our products, Site, and service;
  • Enforce our Terms and Conditions and other policies, and establish, exercise, or defend legal claims;
  • Comply with applicable law, including tax, accounting, consumer protection, and record-keeping obligations, and respond to lawful requests from public authorities.

6. Cookies and Similar Tracking Technologies

We and our service providers use cookies, pixels, tags, SDKs, and local storage to operate the Site and to understand and improve how it is used. The categories we use are:

  • Strictly necessary — required for the Site to function: maintaining your session, remembering your cart, enabling secure checkout, load balancing, and fraud prevention. These cannot be switched off.
  • Functional — remember your preferences such as language, region, and recently viewed items.
  • Analytics and performance — help us measure traffic, understand user journeys, and identify errors and slow pages.
  • Advertising and retargeting — used to show you relevant advertising on the Site and on third-party platforms, and to measure campaign effectiveness.

Analytics and advertising cookies are set only with your consent, which you may give, decline, or change at any time through the cookie banner or the cookie preferences link on the Site. You can also block or delete cookies through your browser settings, though doing so may impair Site functionality.

We do not respond to browser “Do Not Track” signals at this time, as no uniform industry standard exists.

7. How We Share Your Information

We do not sell your personal data. We share it only as described below:

  • E-commerce platform and hosting: Shopify Inc., which hosts our online store and processes order and customer data on our behalf.
  • Payment processors and gateways: to authorise and settle card and UPI payments, process refunds, and manage chargebacks.
  • Logistics and delivery partners: couriers and fulfilment partners receive your name, delivery address, and phone number solely to deliver your order and provide tracking.
  • Communications providers: email, SMS, and WhatsApp service providers used to send transactional and, where consented, marketing messages.
  • Analytics and advertising providers: to measure Site performance and, where you have consented, to deliver and measure advertising.
  • Professional advisers: auditors, accountants, and lawyers, bound by confidentiality obligations.
  • Law enforcement and government authorities: where we are compelled to disclose by a summons, court order, statutory notice, or similar legal process, or where disclosure is necessary to protect our rights, safety, or property, or that of others.
  • Corporate transactions: in connection with a merger, acquisition, restructuring, financing, or sale of all or part of our assets, subject to the recipient honouring this Policy.

All Data Processors act on our documented instructions under contracts requiring appropriate security safeguards, confidentiality, use limitation, and deletion or return of data on termination.

Change from our previous policy: we no longer share personal data with marketing partners or affiliates for their own independent marketing purposes. Sharing with advertising providers now occurs only where you have given cookie or marketing consent, and only for our own campaigns.

8. Automated Processing, Personalisation, and AI

  • We may use automated systems, including recommendation engines and machine learning tools, to personalise product suggestions, tailor offers, sort search results, and detect fraudulent or abusive activity.
  • We may use AI-assisted chat or email tools to help respond to customer queries. Conversations handled this way may be reviewed by our staff for quality and training.
  • We do not make decisions producing legal or similarly significant effects about you based solely on automated processing without human involvement. Fraud checks that result in an order being held or cancelled are reviewed by a person on request — contact us to have any such decision reviewed.
  • We do not use your personal data to train third-party general-purpose AI models.

9. Marketing Communications and Consent

  • We send promotional emails, SMS, and WhatsApp messages only where you have opted in, and we maintain a record of your consent.
  • You may withdraw consent at any time by clicking “unsubscribe” in any marketing email, replying STOP to a marketing SMS or WhatsApp message, adjusting preferences in your account, or emailing contact@poshisglobal.com. Requests are actioned within 7 working days.
  • Our commercial communications are sent in accordance with TRAI regulations, including the Telecom Commercial Communications Customer Preference Regulations, and WhatsApp Business messaging policies.
  • Withdrawing marketing consent does not stop transactional messages relating to orders you have placed.

10. Data Retention and Erasure

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law — whichever is longer.

  • Order, invoice, and tax records: retained for at least 8 years, as required under the Companies Act, 2013, and for the periods prescribed under GST and income tax law.
  • Account data: retained while your account is active. If you close your account or remain inactive for an extended period, we erase or anonymise your account data, except records we are required to keep.
  • Marketing data: retained until you withdraw consent, after which we keep a minimal suppression record to ensure we do not contact you again.
  • Customer service records: retained for up to 3 years from the date of the interaction.
  • Cookie and analytics data: retained for the lifespan of the relevant cookie, typically not exceeding 24 months.

Where personal data becomes due for erasure and no longer needs to be retained, we will erase it. Where advance notice of erasure is required under the DPDP Rules, 2025, we will notify you at least 48 hours before erasure, and you can prevent erasure by logging into your account or contacting us.

We may retain anonymised or aggregated data, from which you cannot be identified, indefinitely for analytics and business reporting.

11. Data Security

We implement reasonable security safeguards to protect personal data against unauthorised access, disclosure, alteration, loss, and destruction, including:

  • Encryption of data in transit using TLS/HTTPS across the Site;
  • Encryption or hashing of sensitive stored data, including account passwords;
  • Role-based access controls limiting access to personnel who need it, with multi-factor authentication on administrative accounts;
  • Use of PCI-DSS compliant payment gateways so that card and UPI credentials never reach our systems;
  • Regular review of access logs and monitoring for unusual activity;
  • Backups and business continuity measures;
  • Contractual security obligations imposed on our Data Processors;
  • Confidentiality obligations and privacy training for staff with access to personal data.

You are responsible for keeping your account password confidential and for using a strong, unique password. No method of transmission over the internet or method of electronic storage is completely secure, and while we strive to protect your data we cannot guarantee absolute security.

12. Personal Data Breach Notification

In the event of a personal data breach, we will:

  • Notify each affected Data Principal without delay, in a clear and plain-language notice describing the nature, extent, and timing of the breach, its likely consequences, the measures we have taken to mitigate risk, safety measures you may take, and our contact details for further information; and
  • Notify the Data Protection Board of India without delay, and provide the detailed follow-up information required under the DPDP Rules, 2025 within the prescribed timeline.

13. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the right to:

  • Access information — obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of other Data Fiduciaries and Processors with whom your data has been shared, along with a description of the data shared.
  • Correction, completion, and updating — have inaccurate or misleading personal data corrected, incomplete data completed, and data updated.
  • Erasure — request erasure of personal data that is no longer necessary for the purpose for which it was collected, unless retention is required by law.
  • Withdraw consent — withdraw your consent at any time, as easily as it was given.
  • Grievance redressal — have your grievance addressed by us through the mechanism in Clause 17, before approaching the Data Protection Board.
  • Nominate — nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

How to exercise your rights: Email contact@poshisglobal.com with the subject line “DPDP Rights Request”, stating the right you wish to exercise and the account email or order number that identifies you. We may ask for reasonable verification of identity before acting. We will respond within 30 days of receiving a valid request. There is no fee for exercising your rights, though we may charge a reasonable fee or decline to act on manifestly excessive or repetitive requests.

Your duties: Under Section 15 of the DPDP Act, you must not impersonate another person, suppress material information, register false or frivolous grievances or complaints, or furnish false particulars. Penalties may apply.

14. Children’s Data

  • Our Site and products are intended for adults. We do not knowingly collect personal data from children under 18 years of age without verifiable consent from a parent or lawful guardian.
  • Where we process a child’s personal data, we will obtain verifiable consent from the parent or lawful guardian before doing so, in accordance with the DPDP Act and Rules.
  • We do not undertake tracking or behavioural monitoring of children, and we do not direct targeted advertising at children.
  • We do not undertake any processing of a child’s personal data that is likely to cause a detrimental effect on the wellbeing of the child.
  • The same protections apply to persons with disability who have a lawful guardian.
  • If you believe a child has provided us with personal data without appropriate consent, contact us at contact@poshisglobal.com and we will delete it promptly.

15. Cross-Border Data Transfers

Some of our service providers — including our e-commerce platform, email, analytics, and cloud hosting providers — may store or process personal data on servers located outside India. Where this occurs:

  • We transfer data only to countries not restricted by the Central Government under Section 16 of the DPDP Act;
  • We ensure appropriate contractual safeguards are in place with the recipient, including obligations equivalent to those in this Policy;
  • We remain accountable to you for the protection of your personal data regardless of where it is processed.

16. Third-Party Links

The Site may contain links to third-party websites, plugins, and social media platforms. Clicking those links may allow third parties to collect data about you. We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy policy of every site you visit.

17. Grievance Officer and Escalation

If you have any question, concern, or complaint about this Policy or how we handle your personal data, please contact our Grievance Officer:

  • Name: Alan
  • Designation: Grievance Officer, POSHIS GLOBAL PRIVATE LIMITED
  • Email: contact@poshisglobal.com
  • Phone: +91 90350 42857
  • Address: Bangalore, Karnataka, India – 560068
  • Working Hours: Monday to Friday, 10:00 AM to 6:00 PM IST (excluding public holidays)

We will acknowledge your grievance within 48 hours and resolve it within one (1) month of receipt.

Escalation: If you are not satisfied with our response, or if we fail to respond within the stated period, you may lodge a complaint with the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

18. Consent Managers

Once the Consent Manager framework under the DPDP Act becomes operational, you may give, manage, review, and withdraw your consent through a Consent Manager registered with the Data Protection Board of India. We will update this Policy and the Site when we begin accepting consent through registered Consent Managers.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The revised version will be posted on this page with an updated “Last Updated” date. Where changes are material, we will notify you by email or through a prominent notice on the Site before the changes take effect, and where required by law we will seek your fresh consent. We encourage you to review this Policy periodically.

20. Contact Us

For any questions about this Privacy Policy or our privacy practices:

  • POSHIS GLOBAL PRIVATE LIMITED
  • Email: contact@poshisglobal.com
  • Phone: +91 90350 42857
  • Address: Bangalore, Karnataka, India – 560068
  • Website: https://shopataice.com