Privacy Policy

Brandneeva (“Brandneeva”, “we”, “us” or “our”) respects your privacy. This Privacy Policy describes how we collect, use, share and protect personal data when you visit our website, create an account, or use the Brandneeva platform and related services (together, the “Services”).

This Policy is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, read with the Digital Personal Data Protection Act, 2023. By using the Services, you acknowledge that you have read this Policy.

• “Personal data” (or personal information) means data about an individual who can be identified by or in relation to that data.
• “Sensitive personal data or information” includes information such as passwords, financial information such as bank account, card or payment details, and other categories treated as sensitive under applicable law.
• “Data Principal” is the individual to whom the personal data relates. “Data Fiduciary” is the party that decides why and how the data is processed.
• “Processing” means any operation performed on personal data, such as collection, storage, use, sharing or deletion.

Information you give us

• Account and contact details such as your name, business name, email address, phone number and postal address.
• Business and verification details you provide to operate a store, which may include tax or business identifiers and related documents.
• Billing information needed to process subscription payments, handled through our payment gateway partners.
• Content you upload or create through the Services, and the records of your communications with our support team.

Information we collect automatically

• Technical data such as your IP address, device and browser type, operating system, and referring pages.
• Usage data such as the pages and features you use, actions you take and the dates and times of your visits.
• Cookies and similar technologies, as described in the Cookies section below.

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Services secure, and understand how the Services are used so we can improve them. Some cookies are essential for the Services to function; others are optional.

You can control or delete cookies through your browser settings. Blocking some cookies may affect how parts of the Services work.

We use personal data to:

• Create and manage your account and provide, operate and maintain the Services.
• Process subscriptions, payments and invoices, and send you service and transactional messages.
• Keep the Services secure, and detect, prevent and investigate fraud, abuse and security incidents.
• Provide customer support and respond to your requests and grievances.
• Analyse and improve the Services, and develop new features.
• Send you updates, offers and marketing communications where you have consented or where permitted by law; you can opt out at any time.
• Comply with legal obligations and enforce our terms.

We process personal data on the basis of your consent and for the legitimate uses permitted under applicable law, such as providing a service you have requested, meeting legal obligations and keeping the Services secure. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out, and some processing may be necessary to provide the Services.

When a merchant uses Brandneeva to run a store, that merchant decides what customer data to collect and is the Data Fiduciary for their shoppers’ personal data. In relation to that data, Brandneeva acts as a processor and handles it on the merchant’s instructions to provide the Services.

If you are a shopper and have a question or request about data a store holds, please contact that store directly. We will support merchants in responding to such requests as required by law.

We do not sell your personal data. We share it only as described here:

• With service providers who process data on our behalf — such as cloud hosting, payment gateway, communications, shipping and analytics providers — under obligations of confidentiality and security.
• Where required to comply with applicable law, a legal process, or a lawful request by a government or regulatory authority, or to protect our rights, users or the public.
• In connection with a merger, acquisition, financing or sale of all or part of our business, subject to this Policy continuing to protect your data.
• With your consent or at your direction, for example when you connect a third-party integration.

The Services may link to or integrate with third-party websites and services that we do not control. This Policy does not cover their practices, and we encourage you to review the privacy policies of any third party before using it.

Your personal data may be stored and processed in India and, where our service providers operate, in other countries. Where data is transferred outside India, we take steps to ensure it remains protected and that any transfer is carried out in accordance with applicable law.

We keep personal data for as long as your account is active and for as long as needed to provide the Services. We may retain certain data after that where required to comply with legal, tax, accounting or regulatory obligations, resolve disputes and enforce our agreements, after which it is deleted or anonymised.

We maintain reasonable security practices and procedures — including technical, organisational and physical safeguards such as encryption in transit, access controls and monitoring — designed to protect personal data against unauthorised access, loss, misuse or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; information transmitted over the internet is at your own risk.

The Services are intended for businesses and users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will take appropriate steps to delete it.

Subject to applicable law, you have the right to:

• Access a summary of the personal data we process about you and how we process it.
• Request correction or updating of inaccurate or incomplete data.
• Request erasure of your personal data where it is no longer required and retention is not mandated by law.
• Withdraw a consent you previously gave, and opt out of marketing communications.
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided under applicable law.
• Raise a grievance about how your data is handled.

To exercise any of these rights, write to us using the contact details below. We may need to verify your identity before acting on a request, and we will respond within the timelines required by law.

In accordance with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, you may address any grievance about the processing of your personal data to our Grievance Officer at the contact details below. We will acknowledge your grievance and resolve it within the timelines prescribed under applicable law.

We may update this Policy from time to time. When we make material changes, we will update the “last updated” date above and, where appropriate, notify you. Please review this Policy periodically to stay informed about how we protect your data.

If you have questions about this Policy or how we handle your personal data, or wish to exercise your rights or raise a grievance, please contact us using the details below.