Orenkafine Privacy Policy

Effective Date: 4 September 2026 | Last Updated: 4 September 2026

Note on current legal status (as of September 2026): This Policy is drafted with reference to the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), together with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), which were notified on 13 November 2025. The DPDP framework is being brought into force in phases: the Data Protection Board of India and certain provisions are already operative; Consent Manager provisions take effect in November 2026; and full substantive compliance and penalty provisions are scheduled to take effect on 13 May 2027. Until the DPDP Act is fully in force, the IT Act, 2000 and SPDI Rules, 2011 continue to apply to the collection and disclosure of sensitive personal data. Orenkafine will update this Policy as further provisions come into force.

1. Introduction

Orenkafine ("Orenkafine", "we", "us", "our") respects the privacy of individuals who access or use our website, mobile interface, online store and related services (collectively, the "Platform").

This Privacy Policy explains what personal data we collect, how and why we collect and use it, with whom it may be shared, how long we retain it, and the rights available to you as a data principal under applicable Indian law.

This Policy applies to visitors, registered users and Customers of the Platform, and should be read together with our Terms & Conditions and other policies referenced there.

By accessing the Platform or providing your personal data to us, you acknowledge that you have read and understood this Policy. Where consent is required by law for a particular processing activity, we will seek your free, specific, informed, unconditional and unambiguous consent separately, and you may withdraw such consent at any time as described in Clause 15.

2. Who We Are Data Fiduciary Details

For the purposes of applicable data protection law, Orenkafine is the "Data Fiduciary" in respect of personal data collected through the Platform.

Brand Name: Orenkafine
Legal Entity: BLUE GEMS & JEWELS LIMITED
Registered/Principal Business Address: Building No./Flat No.: A‑42, Name Of Premises/Building: Giriraj Ind Estate, Road/Street: Mahakali Caves Road, Andheri East, Locality/Sub Locality: Chakala MIDC, City/Town/Village: Mumbai, District: Mumbai Suburban, State: Maharashtra, PIN Code: 400093
Customer Care Email: Info@orenkafine.com
Customer Care Phone: +91 86559 64188
Data Protection Officer / Grievance Officer: Mayur Hitendra Parmar
Data Protection Officer / Grievance Email: Info@orenkafine.com
GSTIN: 27AAKCB0949A2ZW
CIN/LLPIN/Registration No.: U36911MH2021PLC366424

Where Orenkafine qualifies as a "Significant Data Fiduciary" under the DPDP Act (based on volume and sensitivity of personal data processed, as may be notified by the Central Government), it shall appoint a Data Protection Officer based in India and undertake such additional compliance measures (including periodic data protection impact assessments and audits) as may be prescribed.

3. Definitions

"Personal Data" means any data about an individual who is identifiable by or in relation to such data.

"Data Principal" means the individual to whom the personal data relates, and, where such individual is a child, includes the parent or lawful guardian of such child.

"Data Fiduciary" means the entity which, alone or with others, determines the purpose and means of processing of personal data here, Orenkafine.

"Processing" means an operation performed on personal data, including collection, recording, storage, use, sharing, disclosure, erasure or destruction.

"Consent Manager" means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review or withdraw consent through an accessible, transparent platform, once such framework becomes operative.

"Sensitive Personal Data or Information" (under the SPDI Rules) includes financial information such as bank account or payment instrument details, to the limited extent such rules continue to apply.

4. Personal Data We Collect

We may collect the following categories of personal data, depending on how you interact with the Platform:

4.1 Identity and Contact Information

Name, gender, date of birth (where relevant for personalisation or age verification);
Email address, phone number, postal/delivery address;
Account login credentials (where you create an account).

4.2 Order and Transaction Information

Products viewed, added to cart, wish‑listed or purchased;
Order history, invoices, customisation and engraving instructions, ring size and similar personalisation details;
Correspondence relating to an Order, return, exchange or complaint.

4.3 Payment Information

Payments are processed by third‑party, RBI‑regulated payment gateways and financial service providers. Orenkafine does not store full card numbers, CVV or net banking credentials on its own servers; such information is collected and processed directly by the relevant payment gateway in accordance with its own privacy policy and applicable RBI guidelines. We may receive limited transaction metadata (such as payment status, method used, and a masked/last‑four‑digit card reference) from the payment gateway for order verification and record keeping.

4.4 Identity/High‑Value Transaction Verification

For high‑value jewellery transactions, we may collect additional verification information such as government‑issued identification details, billing information, or other information reasonably required for fraud prevention, anti‑money laundering compliance or legal compliance, as described in our Terms & Conditions.

4.5 Device and Technical Information

IP address, browser type and version, device identifiers, operating system;
Log data, pages visited, time spent, referring/exit pages, click patterns;
Approximate location derived from IP address or, where permitted, precise location if you enable location services.

4.6 Communications and Marketing Preferences

Records of communications between you and our customer support team;
Marketing and communication preferences, including opt‑in/opt‑out status;
Content you submit voluntarily, such as reviews, photographs, ratings or feedback.

4.7 Cookies and Similar Technologies

See Clause 8 (Cookies and Tracking Technologies) below.

5. How We Collect Personal Data

We collect personal data:

Directly from you, when you create an account, place an Order, contact customer support, submit a review, or otherwise interact with the Platform;
Automatically, through cookies, SDKs and similar technologies as you browse the Platform;
From third parties, such as payment gateways (limited transaction status), logistics/delivery partners (delivery status), and, where you choose to sign in using a third‑party account, from that third‑party service, subject to your permissions there.

6. Purposes for Which We Use Personal Data

We use personal data for the following purposes:

To create and manage your account;
To process and fulfil Orders, including customisation, manufacturing, hallmarking, invoicing and delivery;
To process payments and prevent payment fraud;
To communicate Order confirmations, shipping updates, delivery notifications and security alerts;
To provide customer support and address complaints, returns, exchanges and warranty claims;
To carry out identity/verification checks for high‑value transactions and to prevent fraud, unauthorised transactions or misuse of promotional offers;
To send marketing communications, where you have opted in, and to allow you to opt out at any time;
To personalise your experience on the Platform, including product recommendations;
To maintain security of the Platform, investigate suspicious activity and enforce our Terms & Conditions;
To comply with applicable legal, tax, accounting and regulatory obligations, including retention of invoices under GST law and responding to lawful requests from courts, regulators or law enforcement agencies;
To improve the Platform, including through aggregated or anonymised analytics.

7. Legal Basis for Processing

Under the DPDP Act, Orenkafine processes personal data on the basis of:

Your free, specific, informed, unconditional and unambiguous consent, given through a clear affirmative action, for purposes such as marketing communications and optional personalisation features; and
"Certain legitimate uses" recognised under the DPDP Act, including processing necessary for the performance of a contract to which you are a party (such as fulfilling an Order), compliance with law (such as tax and consumer protection obligations), and other legitimate purposes as permitted by law, for which separate consent is not additionally required.

Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before such withdrawal, and without affecting our ability to continue processing where another legal basis (such as contract performance or legal obligation) applies.

8. Cookies and Tracking Technologies

The Platform uses cookies, web beacons, SDKs and similar technologies to:

Enable core Platform functionality (such as maintaining your cart and session);
Remember your preferences;
Understand how the Platform is used, through analytics tools;
Support advertising and retargeting, where permitted and where you have not opted out.

You can control cookies through your browser settings; disabling certain cookies may affect Platform functionality. Where required by law, we will present a cookie consent mechanism allowing you to accept or reject non‑essential cookies before they are set. See our Cookie Policy for full details.

9. Sharing and Disclosure of Personal Data

We do not sell personal data. We may share personal data with:

Payment gateways and financial institutions, to process payments;
Logistics and delivery partners, to fulfil and deliver Orders, including for high‑value delivery security procedures such as OTP or signature verification;
Manufacturing, hallmarking, certification and quality assurance partners, to the extent necessary to produce and verify Products, including Personalised Products;
Cloud hosting, IT infrastructure and customer support service providers, engaged under confidentiality and data processing obligations;
Analytics and marketing service providers, where you have consented to marketing communications or non‑essential cookies;
Professional advisors (legal, accounting, audit), as reasonably necessary;
Government authorities, regulators, courts or law enforcement agencies, where required by applicable law, in connection with legal proceedings, or to protect the rights, property or safety of Orenkafine, our Customers or the public;
A successor entity, in connection with a merger, acquisition, restructuring or sale of business assets, subject to that entity being bound by equivalent privacy protections.

10. Cross‑Border Transfer of Personal Data

Some of our service providers (such as certain cloud hosting, analytics or payment infrastructure providers) may store or process personal data outside India.

Under the DPDP Act, cross‑border transfer of personal data is permitted except to countries restricted by the Central Government by notification. Where we transfer personal data outside India, we take reasonable steps to ensure it continues to receive a level of protection consistent with this Policy and applicable law.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including:

For the duration of your account being active, plus a reasonable period thereafter to address disputes or comply with legal obligations;
Order, invoice and transaction records, generally for the period required under applicable tax (GST) and companies law record‑keeping requirements (typically not less than 8 years for statutory financial records, unless a longer period applies under applicable law);
Identity verification records collected for high‑value transactions, for the period required for fraud prevention and legal compliance purposes;
Marketing preference data, until you withdraw consent or opt out, and for a reasonable period thereafter to record that withdrawal.

Where personal data is no longer necessary for the purpose for which it was collected and retention is not otherwise required by law, we will erase or anonymise it, including on withdrawal of consent or on your request under Clause 15, subject to our right to retain data as required or permitted by applicable law.

12. Data Security

We implement reasonable security practices and procedures, including administrative, technical and physical safeguards, appropriate to the nature of the personal data, to protect it against unauthorised access, alteration, disclosure or destruction, consistent with the SPDI Rules and the DPDP Act.

While we take reasonable steps to protect personal data, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

13. Personal Data Breach Notification

In the event of a personal data breach, Orenkafine shall, in accordance with the DPDP Act and DPDP Rules, notify the Data Protection Board of India and affected Data Principals without undue delay, providing information regarding the nature of the breach, its likely consequences, and the measures taken or proposed to mitigate risk, in the manner and within the timeframes prescribed by applicable law.

14. Children's Data

The Platform is intended for use by individuals who are at least eighteen (18) years of age. Orenkafine does not knowingly collect personal data from children (individuals under 18 years of age) except where such use is undertaken with the verifiable consent and direct supervision of a parent or lawful guardian, as contemplated in our Terms & Conditions.

In accordance with the DPDP Act, where we become aware that we are processing a child's personal data, we do not undertake tracking or behavioural monitoring of children, and we do not carry out targeted advertising directed at children.

If you believe a child has provided personal data to us without appropriate parental/guardian consent, please contact us using the details in Clause 17 so that we can take appropriate action, including deletion of such data.

15. Your Rights as a Data Principal

Subject to applicable law and its phased implementation timelines, you have the following rights in relation to your personal data:

Right to Access to obtain a summary of the personal data we process about you and the processing activities undertaken;
Right to Correction and Updating to request correction of inaccurate or misleading personal data, completion of incomplete data, and updating of personal data;
Right to Erasure to request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to our right/obligation to retain data as required by law;
Right to Withdraw Consent to withdraw consent previously given, at any time, with effect for future processing;
Right to Grievance Redressal to have a readily available means of registering a grievance with us, and, if unresolved, to escalate it to the Data Protection Board of India once fully operative;
Right to Nominate to nominate another individual to exercise your rights in the event of death or incapacity, in the manner prescribed under the DPDP Rules.

To exercise any of these rights, please contact us using the details in Clause 17. We may need to verify your identity before acting on a request, and may decline a request to the extent permitted by law (for example, where retention is required for legal or regulatory compliance).

16. Consent Manager

Once the Consent Manager framework under the DPDP Act and DPDP Rules becomes operative (scheduled from November 2026), Orenkafine will, where applicable, enable Data Principals to give, manage, review and withdraw consent through a registered Consent Manager, in addition to the mechanisms described in this Policy.

17. Grievance Officer / Data Protection Officer Contact Us

For any questions, concerns or grievances regarding this Policy or our processing of your personal data, or to exercise the rights described in Clause 15, please contact:

Name: Mayur Hitendra Parmar
Designation: Grievance Officer / Data Protection Officer
Email: Info@orenkafine.com
Phone: +91 86559 64188
Postal Address: Building No./Flat No.: A‑42, Name Of Premises/Building: Giriraj Ind Estate, Road/Street: Mahakali Caves Road, Andheri East, Locality/Sub Locality: Chakala MIDC, City/Town/Village: Mumbai, District: Mumbai Suburban, State: Maharashtra, PIN Code: 400093

We will acknowledge receipt of your query or grievance within forty‑eight (48) hours and endeavour to resolve it within one (1) month of receipt, consistent with the timelines applicable to consumer grievances under our Terms & Conditions. If you are not satisfied with our response, you may, once the relevant provisions are in force, approach the Data Protection Board of India, or pursue other remedies available under applicable law, including through the National Consumer Helpline (1915) or the e‑Daakhil portal (edaakhil.nic.in) for consumer‑related grievances.

18. Third‑Party Links

The Platform may contain links to third‑party websites or services (including social media pages and payment gateways). This Policy does not apply to such third‑party services, and we encourage you to review their respective privacy policies before providing any personal data to them.

19. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal or regulatory requirements, including as further provisions of the DPDP Act and DPDP Rules come into force. The updated Policy will be published on the Platform with a revised "Last Updated" date. Where a change is material, we will provide an appropriate notice, including, where required, by seeking fresh consent.

20. Governing Law and Jurisdiction

This Policy shall be governed by the laws of India, including the Information Technology Act, 2000, the SPDI Rules, and the DPDP Act and DPDP Rules, as applicable and as they come into force.

Subject to the jurisdiction of the Data Protection Board of India (once operative) and any mandatory consumer or statutory forum, courts/authorities at Mumbai City, Maharashtra, India shall have jurisdiction over disputes arising in connection with this Policy.

21. Acknowledgement

By using the Platform or providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy and the manner in which your personal data will be collected, used, shared and protected as described herein.