This Privacy Policy explains how ("Glemey", "we", "us", or "our") collects, uses, stores, shares, and protects your personal data when you visit scrubsy.co.in, use our services, or otherwise interact with us. It is issued under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and rules thereunder, and the Consumer Protection (E-Commerce) Rules, 2020.

By using our website or services, you (as a "Data Principal" under the DPDP Act) consent to the collection and processing of your personal data in accordance with this Privacy Policy. If you do not agree, please do not use our services.

1. Who we are

Data Fiduciary: BoldChem Science Private Limited

Registered office: Plot 174/42 Arpan Enterprise Ground Floor Near Hp Gas Agency Chhiri Vapi Pincode 396191 Gujarat

Customer care WhatsApp: 6202923746

Website: glemey.shop

Under the DPDP Act, we act as a "Data Fiduciary" — the entity that determines the purpose and means of processing your personal data.

2. Grievance Officer / Data Protection Contact

In accordance with Section 8(9) of the DPDP Act, 2023, Rule 5 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020, we have designated the following officer to address your queries, complaints, and requests:

Customer care WhatsApp: 6202923746

Working hours: Monday to Saturday, 10:00 AM to 7:00 PM IST (excluding public holidays)

We will acknowledge your complaint within 48 hours of receipt and aim to resolve it within 30 days from the date of receipt, in line with applicable law.

3. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

•       Contact details: name, postal address, billing address, shipping address, email address, mobile number.

•       Transaction details: items viewed, added to cart, purchased, returned, exchanged or cancelled; order history; delivery preferences.

•       Payment details: payment method type, transaction ID, payment confirmation status. We do not store full credit/debit card numbers, CVV, UPI PINs or net banking credentials — these are handled directly by our PCI-DSS compliant payment processors (Shopify Payments, Razorpay, and similar).

•       Account details: username, password (stored in encrypted form), saved preferences, wishlist, communication preferences.

•       Communications: any information you share with us via email, WhatsApp, phone, chat, or social media — including support tickets, product reviews, and feedback.

•       Technical and device data: IP address, device identifier, browser type, operating system, referring URL, language preference, and similar diagnostic information.

•       Usage data: pages visited, time spent on pages, click patterns, search queries on our website, and similar behavioural data collected via cookies and similar technologies (see Section 8).

We do not knowingly collect Sensitive Personal Data or Information (such as health, biometric, financial account passwords, or sexual orientation data) and request that you do not submit such data to us. If you do, we will delete it on becoming aware of it.

4. How we collect your personal data

•       Directly from you, when you create an account, place an order, fill a form, opt in to WhatsApp/SMS/email updates, contact our support, leave a review, or interact with our website.

•       Automatically through cookies, pixels and similar technologies when you use our website (see Section 8).

•       From our service providers and partners — for example payment processors confirming a transaction, logistics partners confirming delivery, or marketplaces (Amazon, Flipkart, quick commerce platforms) when you purchase via them and they share order data with us as permitted.

•       From publicly available sources where lawful, for example to verify business customer information.

5. Purposes for which we process your personal data

We process your personal data only for specific, lawful purposes for which you have given consent under the DPDP Act, or where processing is necessary for a legitimate use as permitted under the Act. The purposes include:

•       Order fulfilment: processing, shipping, delivering, billing and providing customer support for your orders, including returns, refunds and replacements.

•       Account management: creating, maintaining and securing your account and authenticating you when you log in.

•       Service communications: sending you order confirmations, dispatch and delivery updates, return/refund status, and other transactional messages by email, SMS, WhatsApp or push notification.

•       Marketing communications (with consent): sending you offers, new product launches, surveys, and promotional content. You can opt out at any time (see Section 9).

•       Personalisation: showing you relevant products, recommendations and content based on your interests and prior interactions with us.

•       Analytics and improvement: understanding how our website and products are used so we can improve them.

•       Fraud prevention and security: detecting and preventing fraud, abuse, security incidents, and unauthorised activity.

•       Legal and regulatory compliance: meeting our obligations under tax, GST, consumer protection, and other applicable laws, and responding to lawful requests by public authorities.

6. How we share your personal data

We share your personal data only as necessary for the purposes set out above, and only with the following categories of recipients. We require all third parties to handle your data securely and in line with applicable law.

6.1 Service providers and Data Processors

•       Shopify Inc. — e-commerce platform that hosts our website and processes transactional data.

•       Payment processors — Razorpay, Shopify Payments, Cashfree, and other PCI-DSS compliant gateways for processing payments.

•       Logistics and courier partners — Amazon Logistics, Delhivery, Shadowfax, Ekart, Shiprocket, and other shipping partners for order delivery.

•       Marketing and communications platforms — WebEngage, CleverTap, Tellephant, Meta (Facebook/Instagram), Google, and similar platforms used for email, SMS, WhatsApp and online advertising.

•       Analytics providers — Google Analytics, Meta Pixel, Shopify Analytics, and similar tools to understand how our website is used.

•       Customer support tools — helpdesk, chat and ticketing systems used by our support team.

•       Cloud hosting and IT infrastructure providers — including Shopify's hosting and our internal cloud storage providers.

•       Professional advisers — auditors, lawyers, chartered accountants, and consultants where required for our business.

6.2 Group entities and corporate transactions

•       With affiliates, subsidiaries or group companies, on the same terms as set out in this Privacy Policy.

•       In connection with a merger, acquisition, restructuring, financing, sale of assets, or insolvency — in which case data may be transferred to the relevant counterparty subject to confidentiality.

6.3 Legal and regulatory disclosures

•       When required by applicable law, regulation, court order, or lawful request from a government or regulatory authority.

•       To enforce our terms, protect our rights, property or safety, or those of our users or third parties.

•       To investigate, prevent, or address suspected fraud, security incidents, or illegal activity.

We do not sell your personal data. We do not share your personal data with third parties for their own independent marketing purposes without your consent.

7. Cross-border data transfer

Some of our service providers (including Shopify, Meta, Google, and certain marketing/analytics tools) are headquartered or store data outside India, including in the United States and the European Union. Where personal data is transferred outside India, we ensure that:

•       Such transfers are made only to jurisdictions that the Central Government of India has not restricted under Section 16 of the DPDP Act, 2023.

•       Appropriate contractual safeguards (including, where applicable, Standard Contractual Clauses or equivalent) are in place with the recipient.

•       The recipient is bound to maintain confidentiality and security standards consistent with this Privacy Policy.

8. Cookies and similar technologies

Our website uses cookies and similar technologies (pixels, tags, local storage, SDKs) to operate the website, remember your preferences, analyse usage, and personalise your experience and advertising.

We use the following categories of cookies:

•       Strictly necessary cookies: required for the website to function (e.g., cart, login session, checkout). These cannot be disabled.

•       Preference cookies: remember your settings such as language, region, and recently viewed products.

•       Analytics cookies: help us understand how visitors use our site (e.g., Google Analytics, Shopify Analytics).

•       Marketing and advertising cookies: used to deliver relevant ads on our site and on third-party platforms (e.g., Meta Pixel, Google Ads).

You can manage cookies through your browser settings or, where available, through our on-site consent controls. Disabling certain cookies may affect website functionality.

9. Your rights as a Data Principal

Subject to the DPDP Act, 2023 and other applicable laws, you have the following rights in respect of your personal data:

•       Right to access information: you can ask us for a summary of the personal data we process about you and the purposes of such processing.

•       Right to correction and erasure: you can request correction of inaccurate or incomplete data, and erasure of data that is no longer necessary for the purpose it was collected.

•       Right to withdraw consent: where we process your data based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

•       Right to nominate: you can nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.

•       Right to grievance redressal: you can complain to our Grievance Officer (Section 2). If you are not satisfied with our response, you can complain to the Data Protection Board of India.

•       Marketing opt-out: you can opt out of promotional emails by clicking the unsubscribe link in any marketing email, opt out of WhatsApp/SMS by replying STOP, or by writing to grievance@scrubsy.co.in. We will continue to send you transactional messages relating to your orders.

To exercise any of these rights, please contact our Grievance Officer using the details in Section 2. We may verify your identity before acting on your request and may decline requests where required or permitted by law (for example, where we must retain data for legal compliance).

10. Data retention

We retain your personal data only for as long as necessary for the purposes set out in this Privacy Policy, or as required under applicable law. Indicative retention periods are:

•       Transaction and tax records: for the period required under the Income Tax Act, Companies Act, GST law and other applicable laws (typically 8 years from the end of the relevant financial year).

•       Account information: while your account is active and for a reasonable period thereafter for legal, accounting and dispute resolution purposes.

•       Marketing data: until you withdraw consent or opt out.

•       Support communications: typically up to 3 years from the date of last interaction.

When personal data is no longer required, we will delete or anonymise it in line with our internal data retention schedule.

11. Security of your personal data

We implement reasonable security practices and procedures consistent with Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including:

•       Encryption of data in transit (HTTPS / TLS) on our website.

•       Access controls and authentication for our internal systems.

•       Use of PCI-DSS compliant payment processors so that we do not handle full card details ourselves.

•       Regular review of our security practices.

No method of transmission or storage is fully secure. While we make commercially reasonable efforts to protect your data, we cannot guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required under applicable law.

12. Children

Our website and products are intended for users aged 18 years and above. We do not knowingly collect personal data from any individual under 18 years of age. If we become aware that we have inadvertently collected personal data from a person under 18, we will delete such data promptly. If you believe a child has provided us with personal data, please contact the Grievance Officer (Section 2).

13. Third-party websites and platforms

Our website may contain links to third-party websites, plug-ins or applications, including marketplaces (Amazon, Flipkart, quick commerce platforms) and social media (Instagram, Facebook, YouTube). We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third party before sharing your data with them.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. When we make material changes, we will update the "Last updated" date at the top and, where required by law, notify you by email or by a prominent notice on our website. Your continued use of the website after the changes become effective constitutes acceptance of the updated Privacy Policy.

15. Governing law and jurisdiction

This Privacy Policy is governed by the laws of India. Any disputes arising in connection with this Privacy Policy will be subject to the exclusive jurisdiction of the courts at Gurgaon, Haryana, subject to the arbitration clause in our Terms of Service.

16. How to contact us

For any questions about this Privacy Policy, your personal data, or to exercise your rights, please contact:

Customer care WhatsApp: 6202923746

Postal address: Plot 174/42 Arpan Enterprise Ground Floor Near Hp Gas Agency Chhiri Vapi Pincode 396191 Gujarat