Privacy Policy

This website is run by House of Thea, a made-to-order jewellery business based in Chennai, Tamil Nadu, India ("House of Thea", "we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for the personal data you share with us.

By using this website, creating an account, or sending us a request, you agree to the practices described here. If you do not agree, please do not use the website.

We collect only what we need to design, quote, make and deliver your jewellery and to run your account:

• Account details: your name, email address, phone number and password. Passwords are stored only in a scrambled (hashed) form; we cannot read them.
• Delivery details: your address, city, state and PIN code.
• Request details: the piece you want, ring size or other measurements, your budget, approximate weight, preferences, notes and any reference images you upload.
• Order and payment records: quote and order history, and the record of payments you make to us by bank transfer, UPI or other manual methods. We never see or store your card or net-banking credentials.
• Reviews and testimonials that you choose to submit, and items you save to your wishlist.
• Newsletter subscription: your email address, and your confirmation that you want to receive it.
• Technical and security information: IP address, browser type, and sign-in and account-security events. We keep these to protect accounts and to investigate misuse.

• To respond to your requests, prepare quotes, take orders, make your jewellery and arrange delivery or collection.
• To send you service messages: email verification, password resets, quotes, order and payment updates.
• To keep your account and our website secure, prevent fraud and comply with the law.
• To send you our newsletter, only if you have subscribed. You can unsubscribe at any time from the link in every email.
• To display a review you have submitted on our website, with the name you gave us.

We do not sell your personal information, and we do not use it for advertising by third parties.

We process your personal data with your consent, for example when you register, submit a request or subscribe to the newsletter, and for the "legitimate uses" the DPDP Act allows, such as fulfilling an order you asked for, meeting legal obligations, and keeping the service secure.

We share personal information only where necessary, and only with:

• Delivery and courier partners, to deliver your order. They receive your name, phone number and address.
• Our email provider (Google Workspace), which delivers the emails we send to you.
• Our hosting and technology providers, who store and run the website on our behalf and are bound to keep it secure.
• Hallmarking, certification or refining partners, where a piece requires it. We share only what is needed for that.
• Government or law-enforcement authorities, courts or regulators, when the law requires or a valid legal order is made.

If our business is ever sold or reorganised, your information may move to the new owner, who must continue to protect it as described here.

We use only what the website needs to work: your sign-in session and small preferences stored in your browser (for example your saved sign-in and a few display choices). We do not use advertising or tracking cookies. Some pages show videos or maps hosted by other services; those services may set their own cookies when you play the content.

We keep your account information for as long as your account is open. Order, payment and invoice records are kept for as long as Indian tax and accounting law requires (currently up to eight years). Security logs are kept for a limited period. When information is no longer needed, we delete or anonymise it.

We take reasonable security practices and procedures in line with the Information Technology Act, 2000 and the SPDI Rules, 2011. These include encrypted connections (HTTPS), hashed passwords, one-time passcodes for administrator sign-in, limits on repeated sign-in attempts, automatic sign-out after inactivity, and restricted access to customer records. No system is completely secure, so please choose a strong, unique password and keep it private.

Under the DPDP Act you have the right to:

• ask for a summary of the personal data we hold about you and how it is used;
• correct or update inaccurate or incomplete information (you can also do this yourself in My Account);
• ask us to erase your personal data, unless the law requires us to keep it;
• withdraw your consent at any time, for example by unsubscribing from the newsletter, or by writing to us to close your account;
• nominate another person to exercise your rights if you are unable to; and
• make a complaint about how your data is handled.

To use any of these rights, write to us at the address in section 12. We will respond within a reasonable time, and in any case within the time the law allows.

Our website is intended for adults. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or guardian. If you believe a child has given us information, please contact us and we will delete it.

We may update this policy from time to time. The date at the top shows when it was last changed. If we make an important change, we will tell you on the website or by email.

For any question, request or complaint about your personal data, please contact our Grievance Officer:

Mamta Nahar, House of Thea, Chennai, Tamil Nadu, India. Email: info@houseoftheajewels.com

We will acknowledge your message promptly and aim to resolve it within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it is constituted.