This Chatbot Privacy Policy explains how Twenty2Yards And Beyond India Private Limited collects, processes, stores, and protects personal data when you interact with our website chatbot (“Chatbot”). This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable laws and regulations.

By using the Chatbot, you provide your free, specific, informed, unconditional, and unambiguous consent to the processing of your personal data for the purposes set out herein.

• Definitions

  Personal Data: Any data about an individual who is identifiable by or in relation to such data.

  Data Principal: The individual to whom the Personal Data relates.

  Data Fiduciary: The Company that determines the purpose and means of processing Personal Data.

  Processing: Collection, storage, use, sharing, or any operation performed on Personal Data.

• Categories of Personal Data Collected

  When you interact with the Chatbot, we may collect:

  • Identity & Contact Data

    • Name

    • Email address

    • Phone number (if provided by you)

  • User-Generated Content

    Messages, queries, attachments, and responses shared during interactions.

  • Technical & Usage Data

    IP address, device type, browser type, timestamps, session identifiers, and interaction logs.

  • Transactional/Service Data (if applicable)

    Order details, preferences, and service-related information.

  We collect only such Personal Data as is necessary and proportionate for the purposes stated below in accordance with the principle of data minimization.

• Lawful Basis & Purpose of Processing

  We process Personal Data based on your consent and, where applicable, for legitimate uses permitted under the DPDP Act. The purposes include:

  • Responding to queries and providing customer support.

  • Operating, maintaining, and improving the Chatbot and our services.

  • Personalizing user experience and communications (where consented).

  • Preventing fraud, misuse, or security incidents.

  • Complying with legal obligations and regulatory requirements.

  We will not process Personal Data for purposes incompatible with those stated above without obtaining fresh consent, where required under applicable law.

• Notice & Consent

  • A clear notice is provided before or at the time of data collection through the Chatbot interface.

  • By continuing to use the Chatbot after being presented with this Policy, you consent to the processing described herein.

  • You may withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to such withdrawal.

• Data Retention

  • Personal Data is retained only for as long as necessary to fulfill the stated purposes, comply with legal obligations, or resolve disputes.

  • Upon expiry of the applicable retention period, Personal Data is erased or anonymized, unless continued retention is required by applicable law.

• Data Security Safeguards

  We implement reasonable security safeguards in accordance with industry standards and the DPDP Act, including:

  • Access controls and role-based permissions.

  • Encryption (in transit and, where applicable, at rest).

  • Secure hosting and monitoring.

  • Periodic security reviews and audits.

• Data Sharing & Third-Party Processors

  We may share Personal Data with:

  • Service Providers and Data Processors (e.g., chatbot platform providers, cloud hosting, analytics) under written agreements containing appropriate confidentiality and security obligations.

  • Group entities and internal teams for support and service improvement.

  • Government authorities or law enforcement where required by applicable law.

  We do not sell Personal Data.

• Rights of Data Principals

  Subject to applicable law, you have the right to:

  • Access information about your Personal Data being processed.

  • Request correction and erasure of inaccurate or outdated Personal Data.

  • Withdraw consent for processing.

  • Grievance redressal through our Grievance Officer.

  • Nominate another individual to exercise rights in the event of death or incapacity (as per DPDP Act provisions).

  Requests may be submitted using the contact details provided below.

• Duties of Data Principals

  • Provide accurate and authentic information.

  • Not impersonate another person.

  • Not submit any unlawful, harmful, or misleading content.

• Cross-Border Data Transfers

  Personal Data may be transferred outside India to jurisdictions permitted under applicable law and approved or notified by the Government of India, subject to appropriate safeguards.

• Children’s Data

  • The Chatbot is not intended for use by children.

  • We do not knowingly collect Personal Data from individuals under 18 years of age without verifiable parental consent.

  • If any such data is identified, it will be deleted promptly.

• Cookies & Tracking Technologies

  The Chatbot and website may use cookies or similar technologies to enable functionality, analyze usage, and improve performance. You may control cookies through your browser settings, although doing so may affect certain functionalities of the Chatbot or website.

• Grievance Redressal & Contact Details

  Under applicable privacy laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act), you may have certain rights to:

  • Access, correct, or delete your personal data.

  • Withdraw consent for the processing of your Personal Data.

  • File grievances or complaints.

  Contact Email: info@twenty2yards.com

  We will acknowledge and address grievances within a reasonable timeframe.

• Updates to this Policy

  We may update this Policy from time to time. The “Effective Date” of this Policy will be revised accordingly. Your continued use of the Chatbot following any updates constitutes acceptance of the revised Policy.

  Effective Date: 27/06/2026