Privacy Policy

Effective Date: ___________________

WHEREAS:

A. Restylee Fashiion LLP (the “Company” or “Restylee” ), a limited liability

partnership incorporated under the Limited Liability Partnership Act, 2008, bearing

LLPIN: ACP-2761 and having its registered office at Galleria office 212, 2nd floor,

Galleria Tower, DLF Phase 4, Gurugram, Haryana 122009, India , owns and

operates an online Fashion marketplace accessible through the website

www.restylee.in and the Restylee mobile application (the “Platform” ), and in the

course of its operations collects and processes the personal data of Buyers, Sellers,

visitors and other individuals who interact with the Platform.

B. Restylee acts as a Data Fiduciary within the meaning of the Digital Personal Data

Protection Act, 2023, in respect of the personal data whose purpose and means of

processing it determines, and is committed to protecting the personal data and

privacy of all Data Principals in accordance with the highest standards of

transparency, accountability, purpose limitation, data minimisation and lawful

processing.

C. Restylee is committed to ensuring that its data-governance practices remain

compliant with the laws in force in India, including the Digital Personal Data

Protection Act, 2023, the Information Technology Act, 2000, the Information

Technology (Reasonable Security Practices and Procedures and Sensitive Personal

Data or Information) Rules, 2011, and the Information Technology (Intermediary

Guidelines and Digital Media Ethics Code) Rules, 2021, together with the directions,

advisories and notifications issued by the Indian Computer Emergency Response

Team (CERT-In) and the Ministry of Electronics and Information Technology

(MeitY).

D. Restylee acknowledges that personal data, including any sensitive personal

information such as payment-related and financial information, must be processed

only on lawful grounds, including the consent of the Data Principal or the legitimate

uses recognised under law, and safeguarded through appropriate technical and

organisational measures to prevent misuse, loss or unauthorised access.

NOW, THEREFORE, Restylee adopts and publishes this Privacy Policy to provide a clear,

lawful and user-centric framework for the collection, use, storage, processing, disclosure

and protection of personal data. By accessing or using the Platform or otherwise providing

personal data to Restylee, you acknowledge that you have read and understood this

Privacy Policy and that your personal data will be processed in accordance with this Policy

and applicable law.

a) This Privacy Policy (“Policy”) is issued by Restylee Fashiion LLP , a limited liability

partnership incorporated under the Limited Liability Partnership Act, 2008, having

LLPIN: ACP-2761 and its registered office at Galleria office 212, 2nd floor,

Galleria Tower, DLF Phase 4, Gurugram, Haryana 122009, India (“Restylee”,

“we”, “our”, or “us”), which owns and operates the website www.restylee.in and

the Restylee mobile application and related services (collectively, the “Platform”).

b) Restylee is an online Fashion marketplace that enables Users to buy and sell brand-

new and preloved Fashion and lifestyle products. This Policy explains how

Restylee collects, uses, stores, shares, protects, and otherwise processes your

personal data when you use the Platform, communicate with us, or interact with

any of our services.

c) This Policy is framed in accordance with the Digital Personal Data Protection Act,

2023 (“DPDP Act”), the Information Technology Act, 2000, the Information

Technology (Reasonable Security Practices and Procedures and Sensitive Personal

Data or Information) Rules, 2011, the Information Technology (Intermediary

Guidelines and Digital Media Ethics Code) Rules, 2021, and other Applicable Laws,

and is guided by internationally recognised privacy principles including

lawfulness, purpose limitation, data minimisation, accuracy, storage limitation,

and security.

d) By creating an account, accessing, browsing, purchasing, selling, listing, or

otherwise using the Platform, or by voluntarily submitting personal data, you

acknowledge that you have read, understood, and agree to this Policy. If you do

not agree, you should discontinue use of the Platform.

e) This Policy should be read together with our Terms and Conditions and any

specific policy published by Restylee in future. In the event of any conflict between

this Policy and Applicable Law, Applicable Law shall prevail.

For the purposes of this Policy:

a) “Act” / “DPDP Act” means the Digital Personal Data Protection Act, 2023, together

with all rules, notifications, and amendments made thereunder, and includes the

Information Technology Act, 2000 and the IT (Reasonable Security Practices) Rules,

2011 to the extent applicable.

b) “Data Principal” means the individual to whom personal data relates, including

any User, Buyer, Seller, visitor, or prospective user; and where the individual is a

child, includes the parent or lawful guardian.

c) “Data Fiduciary” means Restylee, which determines the purpose and means of

processing personal data.

d) “Data Processor” means any person who processes personal data on behalf of

Restylee pursuant to a contract or lawful instruction.

e) “Personal Data” means any data about an individual who is identifiable by or in

relation to such data, whether directly or indirectly.

f) "Sensitive Information" means passwords, financial account information

(including bank account, UPI or payment details), and any other information that

Restylee treats as requiring enhanced protection under applicable law.

g) “Processing” means any operation performed on personal data, including

collection, recording, storage, organisation, use, disclosure, sharing, transfer, or

deletion.

h) “Consent” means any freely given, specific, informed, unconditional, and

unambiguous indication of the Data Principal’s agreement, through a clear

affirmative action, to the processing of their personal data for a specified purpose.

i) “Service Providers” / “Third Parties” means external persons or entities engaged

by Restylee to perform services on its behalf, including Payment Service Providers,

Logistics Partners, Quality Check providers, cloud and IT providers, and

marketing and analytics partners.

j) “Quality Check” means the inspection conducted by or on behalf of Restylee to

verify the condition, cleanliness, and compliance of listed Products.

k) “Cookies” include cookies, pixels, web beacons, SDKs, local storage, and similar

tracking technologies.

l) “Data Breach” means any unauthorised or accidental disclosure, alteration, loss,

access, or destruction of personal data that compromises its confidentiality,

integrity, or availability.

m) “Grievance Officer” means the individual appointed by Restylee to address

privacy-related grievances.

n) “Nominee” means a person nominated by a Data Principal under the DPDP Act to

exercise their rights in the event of death or incapacity.

o) “User” means any person who accesses or uses the Platform in any capacity,

including Buyers, Sellers, and visitors.

Headings are for convenience only. Words in the singular include the plural and vice versa.

References to any law include amendments and re-enactments. Terms defined elsewhere

in this Policy carry the meaning assigned to them there.

This Policy applies to all personal data collected by Restylee through the website; the

mobile application; customer-support interactions; seller onboarding; buyer transactions;

payment processing; logistics and shipping; quality-check procedures; promotional

campaigns; social-media interactions; marketing communications; surveys and feedback;

contests or promotional events; and any other services offered by Restylee.

This Policy applies to Buyers, Sellers, visitors, registered users, prospective users,

individuals contacting customer support, and individuals participating in promotions or

campaigns, regardless of the device, platform, or medium used to access the Platform.

This Policy does not apply to: (a) aggregated or anonymised information that does not

identify an individual; (b) third-party websites, payment gateways, courier partners,

social-media platforms, or other external services operating under their own privacy

policies; or (c) data processed for purely personal or household purposes and exempted

under the DPDP Act.

In case of any conflict between this Policy and any contractual terms agreed between

Restylee and a Data Principal, the provisions offering higher privacy protection shall

prevail, unless Applicable Law requires otherwise.

We collect information to operate our marketplace, fulfil transactions, improve user

experience, comply with legal obligations, detect fraud, and maintain platform security.

The nature and extent of data collected depends on how you use the Platform and your

role as a user (Buyer, Seller, or visitor). Personal data may be: (i) provided by you directly;

(ii) collected automatically; (iii) received from third parties; or (iv) inferred from your

activity.

Category Examples Source /

Collection Typical Scenario

Account &

Identity Data Full name, username,

email, mobile number,

password, profile photo

(if provided) Provided by User Account

registration and

login

Seller Data Seller profile,

pickup/return address,

bank account, UPI ID,

Tax details (where

applicable), GST

registration details,

invoices, proof of

ownership, authenticity

documents, KYC

documents, PAN (where

legally required),

business registration

details, earnings, wallet

details, listing and

pricing information. Provided by Seller Seller onboarding

and listing

Buyer Data Billing & shipping

address, contact details,

delivery instructions, Provided by Buyer Placing and

managing Orders

order history, wishlist,

saved items, preferences

Payment &

Financial Data Transaction ID, payment

status, payment method,

refund status, wallet

credits, settlement &

invoice details, GST

details (where

applicable) Payment Service

Provider, User Making a

purchase /

receiving a payout

Product Listing

Data Product photographs,

description, category,

size, colour, condition,

original purchase info,

proof of authenticity

(where required) Provided by Seller Listing a Product

Customer-

Support Data Emails, chat messages,

call recordings, tickets,

complaint details,

attachments, screenshots,

communication history Provided by User,

support systems Contacting

customer support

Device &

Technical Data Device type & identifiers,

browser, OS, app

version, language, screen

resolution, network

provider, IP address,

login timestamps,

browser fingerprint,

authentication logs, audit

logs, failed login

attempts

Automatically

collected Accessing the

Platform

Usage & Log

Data Listings viewed,

searches, filters, purchase

& selling activity,

wishlist & cart activity,

feature usage, session

data, errors Automatically

collected Interacting with

the Platform

Location Data Approximate location,

GPS (where permitted),

country, state, city, postal

code User device /

browser Deliveries, search,

fraud prevention

Cookies &

Tracking Data Cookie IDs, pixels, SDKs,

local storage, analytics

identifiers Automatically

collected Browsing the

website / app

Third-Party

Data Payment confirmations,

delivery status,

inspection reports,

campaign/referral data,

social-login data Service Providers,

partners Fulfilment,

verification,

marketing

User-Generated

Content Reviews, ratings,

testimonials, uploaded

photos/videos, feedback Provided by User Submitting

content

Derived /

Inferred Data Preferences,

recommendations,

repeat-purchase and

engagement patterns Platform analytics Personalisation &

improvement

Restylee does not store complete debit or credit card numbers unless specifically permitted

by Applicable Law and payment regulations, and does not intentionally collect biometric

data, health data, or government identifiers (such as Aadhaar or PAN) unless required by

law or provided with your consent for a legitimate purpose. Support calls may be

monitored or recorded for training, quality assurance, fraud prevention, and dispute

resolution, where permitted by law.

Restylee processes personal data only for specified, explicit and proportionate purposes

and only where a lawful basis exists under the DPDP Act, including Consent or other

Legitimate Uses recognised under the Act. The table below sets out the principal purposes,

the data involved, and the corresponding legal basis.

Purpose of Processing Data Involved Legal Basis

Create and manage accounts;

authenticate users Account & Identity Data Consent and/or

Legitimate Use

under the DPDP

Act

Facilitate buying/selling; process

Orders, pickups & deliveries Buyer, Seller, Location,

Order Data Consent and/or

Legitimate Use

under the DPDP

Act

Process payments, commission

deductions, refunds, Seller payouts,

wallet credits and withdrawals,

chargebacks, reversals, set-offs and

recovery of lawful dues through the

Restylee Wallet. Payment & Financial Data Consent and/or

Legitimate Use

under the DPDP

Act

Conduct Quality Checks and verify

Products Listing Data, Product &

inspection data Consent and/or

Legitimate Use

under the DPDP

Act;

Provide customer support and resolve

disputes Customer-Support, Order

Data Consent and/or

Legitimate Use

under the DPDP

Act;

Communicate service and

transactional updates Contact & Order Data Performance of

Contract

Personalise experience and

recommend products Usage, Behavioural,

Wishlist Data Consent; Legitimate

Use

Marketing, promotions, surveys and

campaigns Contact & Marketing

Preferences Consent

Detect and prevent fraud, abuse &

policy violations Identity, Device,

Transaction Data Legitimate Use;

Legal Obligation

Comply with legal, tax, accounting &

regulatory duties Identity, Transaction,

Payment Data Legal Obligation

Maintain records for audit, risk &

dispute defence Identity, Contact,

Transaction Data Legal Obligation;

Legitimate Use

Improve, secure & analyse the

Platform Usage, Device,

Aggregated Data Consent (cookies);

Legitimate Use

Engage authorised Service Providers Relevant categories, as

needed Consent and/or

Legitimate Use

under the DPDP

Act

Investigate fraud, enforce the Terms,

suspend or terminate accounts, recover

penalties and protect Platform

integrity Identity, account,

transaction, device and

communication data Legitimate Use /

Legal Obligation

Restylee does not use personal data for purposes other than those stated without providing

appropriate notice and, where required, obtaining fresh consent. Where consent is the

basis for processing, you may withdraw it at any time (see Clauses 6 and 15); withdrawal

may affect the availability of certain services. Restylee may use AI-enabled or automated

tools for product description generation, listing assistance, recommendation engines,

fraud detection, spam detection, search optimisation, moderation, customer support

automation, analytics and operational improvements, subject to accuracy checks and

safeguards; automated processing will not be the sole basis for any decision that materially

and adversely affects you without appropriate safeguards.

a) Legal Bases. Restylee relies on one or more of the following lawful bases under the

DPDP Act:

i. Consent- for optional features and certain marketing communications,

obtained through a clear affirmative action;

ii. Performance of Contract- to create and maintain your account, process

purchases and sales, deliver Products, process payments and payouts, and

provide support;

iii. Legitimate Use (as permitted under the DPDP Act)- including where you

voluntarily provide data, for the provision of a service or benefit, and for

fraud prevention and platform security; and

iv. Legal Obligation- to comply with applicable laws, taxation and audit

requirements, court orders, and lawful requests from authorities.

b) Obtaining Consent. Where consent is required, it is obtained in a clear and

granular manner at the point of collection (for example, during registration,

checkout, newsletter subscription, participation in contests, or acceptance of

cookies), accompanied by a plain-language notice describing the purpose,

categories of data, any sharing, a link to this Policy, and the Grievance Officer’s

contact details. No pre-ticked boxes, bundled consent, or inferred consent are used.

c) Records of Consent. Restylee maintains verifiable records of consent (including

time, method, and purpose), which may be produced to the Data Protection Board

of India or other authorities upon lawful request.

d) Withdrawal of Consent. You may withdraw consent at any time using unsubscribe

or opt-out links, account settings, or by contacting the Grievance Officer

(support@restylee.in ) , without affecting the lawfulness of prior processing. Upon

withdrawal, Restylee will cease the relevant processing within a reasonable time

unless retention is required by law, and certain services dependent on the

withdrawn data may become unavailable.

e) Notice. Restylee provides a clear and accessible notice, before or at the time of

collecting personal data, of the personal data to be collected, the purpose of

processing, the manner of exercising rights, and the manner of making a complaint

to the Data Protection Board of India, in accordance with the DPDP Act.

7. CHILDREN’S DATA

a) The Platform is intended for individuals who are 18 (eighteen) years of age or older.

For the purposes of this Policy and Section 9 of the DPDP Act, a “child” is an

individual who has not completed 18 years of age.

b) Restylee does not knowingly collect or process the personal data of children without

verifiable consent of a parent or lawful guardian, and does not undertake tracking,

behavioural monitoring, or targeted advertising directed at children.

c) If Restylee becomes aware that personal data of a child has been collected without

lawful consent, it shall promptly delete such data and, where identifiable, notify the

parent or guardian.

Restylee uses cookies and similar technologies to improve functionality, security, and

performance; personalise your experience; understand user behaviour; and provide

certain features. These include:

i. Performance & Analytics cookies — to understand visits, most-viewed

pages, user journeys, time spent, navigation patterns, technical errors, and

performance;

ii. Functional cookies — to remember login sessions, saved preferences,

recently viewed products, wishlist preferences, and search filters; and

iii. Advertising & marketing technologies — where permitted by law, to

measure campaign effectiveness, display relevant advertisements, limit

repetition, track conversions, and personalise promotional content, some of

which may be operated by trusted third-party partners.

Most browsers allow you to control or disable cookies and delete stored cookies. Disabling

certain cookies may affect the availability or performance of some features. Further details

are set out in our Cookie Policy, which forms an integral part of this Policy. Essential

cookies required for the operation, security and functionality of the Platform may remain

active for as long as you continue to access or use the Platform. Non-essential cookies and

similar technologies will be used only with your consent where required under applicable

law and will remain active only for the period specified in our Cookie Policy or until you

withdraw your consent or delete such cookies through your browser or device settings.

Restylee does not sell your personal data to third parties. We share information only where

necessary to provide our services, comply with legal obligations, protect our legitimate

interests, or with your consent. Personal data may be accessed internally on a strict need-

to-know basis under role-based access controls. We share data with the following

categories of recipients, who are contractually bound to protect it and process it only for

authorised purposes:

Recipient Category Purpose of Sharing Type of Data Shared

Payment Service Providers Process payments, refunds,

payouts; detect fraud; maintain

financial records Name, contact,

transaction ID,

payment/settlement

info

Logistics / Courier Partners Pickup, shipment, and delivery

of Orders; tracking Name, contact, pickup &

delivery address,

shipment details

Cloud, Hosting & IT

Providers Securely store, host, and

manage Platform data Device metadata, IP

address, access logs,

stored data

Marketing & Analytics

Partners Run campaigns, measure

performance, personalise

content Contact, cookie &

behavioural data (as

permitted)

Communication / CRM

Providers Send transactional &

promotional email, SMS,

notifications Email, phone,

communication logs

Professional Advisors Legal, tax, audit, insurance and

compliance purposes Financial, transaction,

and where necessary

user data

Government / Legal

Authorities Comply with law, court orders,

and law-enforcement requests Data legally mandated,

upon lawful request

Sellers / Buyers

(counterparties) Complete a transaction and

effect delivery Only the information

reasonably necessary for

the Order

Corporate-transaction parties Merger, acquisition,

restructuring, or transfer of

assets Relevant data, subject to

this Policy

Only the information reasonably necessary for the relevant purpose will be shared.

Restylee undertakes vendor due diligence and executes data-processing agreements or

confidentiality undertakings requiring Service Providers to process data only for stated

purposes, apply adequate security, and cease processing on completion or termination of

the engagement. Restylee may share anonymised or aggregated data, which does not

identify any individual, for analytics, research, or service-improvement purposes.

Restylee is not responsible for the privacy, security or data-handling practices of third-

party websites, payment gateways, logistics providers or other external services that are

not owned or controlled by Restylee. Users should review the privacy policies of such third

parties before providing personal data to them.

10. CROSS-BORDER DATA TRANSFERS

a) Restylee primarily stores and processes personal data on servers located in India.

Certain Service Providers may process data on infrastructure located outside India,

subject to appropriate legal safeguards.

b) Any transfer of personal data outside India will be carried out in accordance with

Section 16 of the DPDP Act and any rules or notifications issued by the Central

Government relating to cross-border transfers, and will not be made to any country

or territory restricted by the Central Government.

c) Restylee will ensure that such transfers are subject to appropriate contractual,

organisational and technical safeguards consistent with applicable Indian law and

any requirements notified under the DPDP Act.

Restylee retains personal data only for as long as reasonably necessary to fulfil the purpose

for which it was collected, comply with legal or regulatory obligations, resolve disputes,

and enforce agreements. Indicative retention periods are set out below and are subject to

change in the event of legal proceedings, enforcement actions, or statutory holds.

Category of Data Indicative Retention Period Basis

Identity & Contact Data 3 years from last

activity/transaction Limitation for

claims, account

recovery, support

Order & Transaction Data 8 years from date of transaction Income-tax, GST,

accounting & audit

requirements

Payment & Financial Data

(masked) As required under applicable

RBI/payment regulations or

contractual obligations with

Payment Service Providers Regulatory, fraud

monitoring,

chargeback defence

Customer-Support & Complaint

Logs 3 years from last correspondence Grievance handling,

dispute resolution,

audit

Marketing Preferences / Opt-in Until withdrawal of consent or 2

years of inactivity Consent-based

retention

Analytics & Usage Data

(pseudonymised) 12–18 months from collection Platform

optimisation &

benchmarking

Account Credentials (hashed) Until account deletion or as long

as necessary to maintain account

security and comply with legal

obligations. Login,

authentication,

session recovery

Dormant Account Data 2 years of inactivity, with prior

notice before deletion Data minimisation &

housekeeping

Seller / Business-Partner Data 8 years from the last transaction

or engagement. Taxation, TDS, GST

compliance,

accounting, audits,

fraud prevention

and contractual

enforcement.

User-Generated Content Until takedown request is

verified & processed Public content

hosted until removal

requested

Anonymised / Aggregated Data Retained indefinitely No longer personal

data under the

DPDP Act

Fraud Investigation, Litigation &

Enforcement Records Until completion of investigation

and expiry of applicable Fraud prevention,

legal claims,

limitation periods or legal

proceedings regulatory

compliance

Upon expiry of the applicable retention period, personal data is either permanently deleted

from active and backup systems using industry-standard erasure methods, or anonymised

so that re-identification is not reasonably possible. A Data Principal or their Nominee may

request deletion where the data is no longer necessary, consent has been withdrawn with

no other lawful basis, or the data has been unlawfully processed, subject to statutory

retention obligations, taxation requirements, accounting obligations, pending

investigations, fraud prevention, legal proceedings and enforcement of contractual rights.

Encrypted backups are maintained for recoverability and are subject to the same retention

and deletion practices.

In accordance with the Digital Personal Data Protection Act, 2023, and, where applicable,

Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and

Sensitive Personal Data or Information) Rules, 2011, Restylee implements appropriate

technical, organisational and administrative safeguards to protect personal data against

accidental or unlawful destruction, loss, alteration, unauthorised access, disclosure or

misuse. These include, without limitation:

i. encryption of personal data in transit using industry-standard SSL/TLS

protocols and, where appropriate, encryption of personal data at rest;

ii. hashing and salting of passwords;

iii. firewalls, intrusion detection and prevention systems (IDS/IPS), and

continuous security monitoring;

iv. role-based access control on a need-to-know basis, with access logging and

periodic review;

v. secure APIs and encrypted payment gateways;

vi. multi-factor authentication for administrative access;

vii. regular vulnerability assessments and penetration testing; and

viii. secure backup, disaster recovery and business continuity measures

designed to preserve the availability and integrity of personal data;

ix. timely security patching and system updates.

Personal data is stored on secure servers hosted by reputable cloud service providers that

implement recognised information security standards, including, where applicable,

ISO/IEC 27001, SOC 2 or equivalent certifications. Service Providers processing personal

data on Restylee’s behalf are contractually bound to maintain comparable or higher

standards of security and confidentiality. However, no method of transmission or storage

is completely secure, and while Restylee takes reasonable measures, it cannot guarantee

absolute security.

a) Restylee adopts a structured approach to identifying, containing, investigating,

mitigating, documenting and responding to any actual or suspected personal data

breach. In the event of a suspected or confirmed personal data breach, Restylee will

promptly activate its internal Data Breach Response Procedure (see Annexure A)

and take reasonable measures to contain, assess and remediate the incident.

b) Where required under the DPDP Act, the rules framed thereunder, and applicable

CERT-In directions, Restylee will notify the Data Protection Board of India and

affected Data Principals in the manner and within the timelines prescribed by

applicable law. Such notification may include, where applicable, the nature of the

breach, the categories and approximate volume of personal data affected, the likely

consequences, the mitigation measures taken or proposed, the contact details of the

Grievance Officer, and any recommended steps that affected Data Principals may

take to protect themselves.

c) Users who become aware of any actual or suspected compromise of their account

or personal data (including unauthorised login attempts, phishing attempts or

suspicious transactions) are encouraged to report the same immediately by

emailing support@restylee.in . Restylee will investigate such reports as promptly

as reasonably practicable and take appropriate remedial action where necessary.

d) Restylee shall maintain appropriate records of personal data breaches, the

investigations conducted, remedial measures implemented, and notifications

made, in accordance with applicable law and its internal information security

policies.

Subject to the DPDP Act and reasonable verification of identity, you have the following

rights in relation to your personal data. Requests may be made to the Grievance Officer at

the contact details in Clause 15.

Right Description Indicative

Timeline

Right to obtain

information To obtain a summary of the personal data

processed and the processing activities

undertaken Within a

reasonable period

(target ~15

working days)

Right to Correction &

Completion To correct, complete, or update inaccurate

or incomplete data Target ~10

working days

Right to Erasure To request deletion of data no longer

necessary or unlawfully processed, subject

to legal retention Target ~15

working days

Right to Withdraw

Consent To withdraw previously given consent for

specific processing Effect upon

confirmation

Right to Grievance

Redressal To complain about handling of data or

non-fulfilment of rights Acknowledgement

within 48 hrs;

resolution per law

Right to Nominate To nominate a person to exercise rights on

death or incapacity As per records

You are responsible for providing accurate information and for not suppressing material

information when exercising these rights, and for cooperating with reasonable identity-

verification requests. If you are dissatisfied with the resolution provided, or no response

is received within the prescribed period, you may escalate the matter to the Data Protection

Board of India in accordance with the DPDP Act.

In accordance with the DPDP Act and Rule 5(9) of the IT Rules, 2011, Restylee has

appointed a Grievance Officer to address privacy-related concerns, complaints, and

requests in a transparent, secure, and time-bound manner. You may raise a grievance

regarding denial or delay in fulfilling your rights, misuse or unauthorised access to your

data, non-compliance with consent withdrawal, or any breach of this Policy or Applicable

Law.

Grievance at:

Email: support@restylee.in

Address: Galleria office 212, 2nd floor, Galleria Tower, DLF Phase 4, Gurugram,

Haryana 122009, India

The Grievance Officer will acknowledge complaints within 48 (forty-eight) hours and

endeavour to resolve them within the timelines prescribed under Applicable Law.

In the event of a merger, acquisition, reorganisation, investment, restructuring, or sale of

all or part of Restylee’s business or assets, personal data held by Restylee may be

transferred to the successor or acquiring entity. The successor entity shall remain bound

by this Privacy Policy until a revised Privacy Policy is communicated to Users.

Restylee shall not be liable for any failure or delay in performing its obligations under this

Policy, including processing rights requests or breach notifications, due to circumstances

beyond its reasonable control, such as natural disasters, war, civil unrest, pandemics,

governmental actions, power or internet outages, or cyber-attacks. During such events,

Restylee will take reasonable steps to mitigate the impact and restore normal operations

as soon as practicable.

This Policy shall be governed by and construed in accordance with the laws of India.

Subject to the rights available to Data Principals under the DPDP Act (including recourse

to the Data Protection Board of India), the courts at Gurugram, Haryana, India shall have

exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

Restylee may update or modify this Policy from time to time to reflect changes in legal

requirements, business practices, or technology. Material changes will be notified through

prominent notices on the Platform, email to registered Users (where applicable), and an

update to the “Last Updated” date above. You are encouraged to review this Policy

periodically. Your continued use of the Platform after any update constitutes acceptance

of the revised Policy to the extent permitted by law.

If you have any questions, concerns, or requests regarding this Privacy Policy, the

processing of your personal data, or your rights as a Data Principal, please contact:

Restylee Fashiion LLP

Email: support@restylee.in

Website: www.restylee.in

Registered Office: Galleria office 212, 2nd floor, Galleria Tower, DLF Phase 4,

Gurugram, Haryana 122009, India

By continuing to access or use the Platform, you acknowledge that you have read and understood

this Privacy Policy and agree to the processing and disclosure of your personal data in accordance

with this policy and applicable law.

ANNEXURE A — DATA BREACH RESPONSE FRAMEWORK

The following framework sets out the indicative stages and internal timelines Restylee will

follow on detection of a personal data breach. Actual notification obligations to the Data

Protection Board of India, CERT-In, and affected Data Principals will be discharged in

accordance with the DPDP Act, applicable rules, and CERT-In directions in force at the

relevant time.

Stage Action Indicative

Timeline

1. Detection &

Containment Identify and verify the breach; isolate

affected systems Promptly on

detection

2. Preliminary Risk

Assessment Assess scope, data categories, sensitivity,

and impact Shortly after

detection

3. Internal Escalation Notify Grievance Officer and senior

management Shortly after

detection

4. Reporting to Authorities Notify CERT-In and/or the Data

Protection Board as required by law Within statutory /

CERT-In timelines

5. Notification to

Individuals Notify affected Data Principals where

required under the DPDP Act, the Rules

framed thereunder, applicable directions

of the Data Protection Board of India, or

applicable CERT-In directions. Within the

timelines

prescribed under

the DPDP Act, the

Rules framed

thereunder,

applicable

directions of the

Data Protection

Board of India, and

applicable CERT-In

directions.

6. Remedial Action Contain breach, patch systems, reset

credentials, prevent recurrence As soon as

practicable

7. Documentation & Audit

Trail Record breach details, investigation logs,

and measures taken Following

containment

8. Final Report & Policy

Review Root-cause analysis; review of internal

controls and training After resolution

Note: The specific timelines for notifying the Data Protection Board of India and affected Data

Principals must be aligned with the DPDP Act and the rules notified thereunder, and with

prevailing CERT-In directions, at the time of the incident.