Privacy Policy

This Privacy Policy (“Policy”) was updated on 1st March 2026 (“Effective Date”).

This Privacy Policy (“Policy”) is issued by HYPE APPAREL VENTURES (OPC) PRIVATE LIMITED (“The Designer Hype” or “Company”), a company incorporated under the laws of India and having its registered office at A-13, Wazipur Industrial Area, North West Delhi- 110052, which owns and operates the website www.thedesignerhype.com and its relevant mobile application (“The Designer Hype ” or “Company”).

The Designer Hype is an e-commerce platform that curates and showcases exclusive, community-driven, and culturally relevant products in the domains of fashion, sneakers, lifestyle collectibles, and designer-led collaborations. It enables users to explore, purchase, and engage with curated collections, while also inviting resellers and creators to contribute, showcase, and collaborate with the brand.

This Policy governs the collection, use, storage, processing, and disclosure of personal data of all individuals interacting with the Platform, including but not limited to customers, users, collaborators, and resellers. The Policy reflects The Designer Hype’s commitment to upholding the rights of individuals and its obligation to adopt responsible, transparent, and secure data practices.

This Policy is formulated in accordance with the provisions of the Digital Personal Data Protection Act, 2023 (“DPDPA”), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and such other rules, regulations, and guidelines as may be applicable. It is also guided by internationally recognised privacy principles, including purpose limitation, data minimisation and data security.

The Policy reflects the Company’s enduring commitment to ensure that all personal data is processed fairly, lawfully, and in a manner that respects the privacy rights of individuals and upholds the principles of integrity, confidentiality, and accountability.

WHEREAS 

1. HYPE APPAREL VENTURES (OPC) PRIVATE LIMITED (“The Designer Hype” or “Company”) operates an online e-commerce platform and is committed to protecting the personal data and privacy rights of its users and stakeholders in accordance with the highest standards of transparency, accountability, and ethical data governance; 
2. The Designer Hype is committed to ensuring that its data governance practices remain fully compliant with the applicable laws in force within India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as well as any relevant rules, directions, advisories, or notifications issued by the Indian Computer Emergency Response Team (CERT-In) and the Ministry of Electronics and Information Technology(MeitY);
   

1. The Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 require data fiduciaries such as the Company to establish clear privacy practices, ensure security safeguards, and provide mechanisms for informed consent and redressal; 
2. The Company acknowledges that personal data, including sensitive personal data such as payment information, must be processed lawfully, with consent or legitimate basis, and handled in a manner that prevents misuse, loss, or unauthorized access; 
3. The Designer Hype aims to foster user trust and legal compliance by establishing this comprehensive Privacy Policy, which ensures that all individuals interacting with the brand whether as buyers, browsers, service providers, or personnel are informed of their rights, the Company’s obligations, and the mechanisms available for grievance redressal and data protection;

NOW THEREFORE, HYPE APPAREL VENTURES (OPC) PRIVATE LIMITED hereby adopts this Privacy Policy to provide a clear, lawful, and user-centric framework for the collection, processing, storage, use, disclosure, and protection of personal data, thereby reinforcing its commitment to data privacy and regulatory compliance. By accessing, browsing, using the Platform, via website or its application, submitting any personal data voluntarily, or otherwise engaging with the services of The Designer Hype, each user is deemed to have read, understood, and agreed to be bound by this Privacy Policy, and to adhere to the rights and obligations set out herein.

1. DEFINITIONS AND INTERPRETATION 

1.1. Definitions: In this Policy (including the recitals above hereto), except where the context otherwise requires, the following words and expressions shall bear the meaning assigned to them below:

1. a) “Act” shall mean the Digital Personal Data Protection Act, 2023, including all applicable rules, notifications, and amendments relating to the collection, processing, storage, transfer, and protection of personal data in India, and shall include the Information Technology Act, 2000, and IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable. 
2. b) “Data Principal” shall mean the individual to whom the personal data relates, and includes any user, customer, website visitor, or individual whose personal data is processed by the Company. 
3. c) “Data Fiduciary” shall mean HYPE APPAREL VENTURES (OPC) PRIVATE LIMITED, which determines the purpose and means of processing personal data in its capacity as a data fiduciary under the Act. 
4. d) “Data Processor” means any natural or legal person, public or private entity, agency, or other body, whether incorporated or unincorporated, who processes personal data on behalf of the Data Fiduciary pursuant to a contract or other lawful instruction. A Data Processor shall not process such data for any purpose other than as expressly instructed by the Data Fiduciary, and 

shall be subject to obligations of confidentiality, data security, and regulatory compliance as prescribed under applicable law.

1. e) “Personal Data” shall mean any data about an individual who is identifiable by or in relation to such data, whether directly or indirectly, through reference to identifiers such as name, contact details, location data, online identifiers, or any other characteristic or attribute of identity. 
2. f) “Sensitive Personal Data” shall mean personal data that relates to passwords, financial information such as bank account or credit card details, biometric data, and any other category of data notified as sensitive under applicable law. 
3. g) “Processing” shall mean any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction. 
4. h) “Consent” shall mean any freely given, specific, informed, and unambiguous indication of the Data Principal’s agreement to the processing of their personal data for the intended purpose, either through a clear affirmative action or through any other prescribed manner under applicable law. 
5. i) “Grievance Officer” shall mean the designated individual appointed by the Company to address privacy-related grievances and ensure redressal in accordance with the timelines and procedures under the Act. 
6. j) “Third Parties” shall mean any external persons or entities, including service providers, contractors, consultants, logistics partners, and technology vendors, with whom personal data may be shared for business purposes, subject to appropriate safeguards. 
7. k) “Data Breach” shall mean any unauthorised or accidental disclosure, alteration, loss, access, or destruction of personal data that compromises its confidentiality, integrity, or availability. 
8. l) “Website” shall mean the online platform of the Company, accessible at www.thedesignerhype.com, including all subdomains and mobile applications operated by or on behalf of the Company. 
9. m) “User” shall mean any individual who accesses or uses the Company’s website, interacts with its services, purchases products, or otherwise provides personal data to the Company. 
10. n) “The Designer Hype Team” or “Personnel” shall mean all full-time, part-time, probationary, temporary, or contractual employees, interns, consultants, and authorised representatives of the Company, regardless of location or designation. 
11. o) “Nominee” shall mean a person appointed by a Data Principal under the Act to act on their behalf in the event of their death or incapacity. 
12. p) “Notice” shall mean a clear and accessible statement provided by the Company to the Data Principal, before collecting personal data, informing them of the purpose, method, legal basis, and rights in relation to such processing.

1.2. Interpretation 

1. a) In addition to the terms defined above, certain terms may be defined elsewhere in this Policy, and wherever such terms are used, they shall have the meaning assigned to them. 
2. b) Section headings are for convenience only and shall not affect the construction or interpretation of any provision of this Policy. 
3. c) References to sections or annexures are, unless the context otherwise requires, references to sections or annexures of this Policy. 
4. d) Where a word or phrase is defined, other parts of speech and grammatical forms and the cognate variations of that word or phrase will have corresponding meanings 
5. e) Words denoting singular shall include the plural and vice versa, and words denoting any gender shall include all genders unless the context otherwise requires. 
6. f) The terms “hereof”, “herein”, “hereto” and derivative or similar words refer to this entire Policy or specified Sections of this Policy, as the case may be. 
7. g) All references to this Policy shall include any amendments or updates to this Policy, as approved by the Compliance Officer or the designated authority from time to time.
8. PURPOSE
9. a) The purpose of this Privacy Policy is to establish a clear, lawful, and comprehensive framework for the collection, processing, usage, storage, disclosure, and protection of personal data submitted to, or collected by, the Designer Hype platform. The Policy reflects the Company’s commitment to ensuring the privacy and dignity of individuals whose data is processed in connection with the use of the Platform. 
10. b) This Privacy Policy (“Policy”) applies to all Personal Data collected, received, processed, stored, disclosed, transferred, or otherwise handled by HYPE APPAREL VENTURES (OPC) PRIVATE LIMITED (“The Designer Hype” or “Company”) in the course of its operations through its website thedesignerhype.com, mobile applications, communication platforms, or other digital interfaces owned or operated by the Company (“Platform”). This Policy applies to all data principals who interact with the Platform in any capacity, including but not limited to:

(i) Users who access, browse, or interact with any part of the website, irrespective of account creation whose session-based or cookie-related data is collected during their interaction with the Platform;

(ii) Registered customers who make purchases or create user profiles on the Platform; 

(iii) Resellers, vendors, or business partners who submit information for the purposes of onboarding, verification, collaboration, or fulfilment; 

(iv) Designers, artists, creative collaborators, and contributors who engage with the Platform through product design, promotion, or creative representation; 

(v) Personal Data collected through both online and offline channels, including but not limited to customer interactions, surveys, feedback forms, product inquiries, email communications, social media interactions, and payment gateways; 

(vi) Third parties acting on behalf of the Company (such as logistics providers, payment processors, marketing affiliates, or cloud service providers), to the extent that they process Personal Data under the Company’s instructions and authority; 

(vii) Personal Data processed in India, as well as data collected from Users outside India but processed or stored in India, subject to applicable local and cross-border data transfer laws.

1. c) This Policy shall apply regardless of the device, platform, or medium used to access the Company’s services, including desktops, mobile phones, tablets, smart devices, and other digital channels. 
2. d) This Policy does not apply to: 

(i) Aggregated or anonymised information that does not, directly or indirectly, identify an individual; 

(i) Data submitted directly to courier partners, affiliate service providers, or external applications used in conjunction with the Platform but governed by their own privacy practices; 

(ii) Third-party websites, platforms, or applications which may be linked from the Company’s Platform but are not owned or operated by the Company. Users are encouraged to review the privacy policies of such third-party services independently; 

(iii) Data that is collected or processed for purely personal, household, or journalistic purposes by individuals and is exempted under the provisions of the Digital Personal Data Protection Act, 2023.

1. e) By accessing or using the Platform or otherwise providing Personal Data to the Company, the User expressly acknowledges and agrees to the terms of this Policy, and consents to the processing of their Personal Data in accordance with the terms stated herein. 
2. f) In case of any conflict between this Policy and any contractual terms agreed between the 

Company and any Data Principal (such as employees, vendors, or consultants), the provisions offering higher privacy protection shall prevail, unless otherwise required by applicable law.

3. CATEGORIES OF PERSONAL DATA COLLECTED
4. a) The Designer Hype collects and processes specific categories of personal data to facilitate the delivery of its e-commerce services, enhance user experience, ensure legal compliance, and enable commercial collaboration. The nature and extent of data collected may vary depending on the user’s role and interaction with the Platform, including but not limited to that of a customer, reseller, creator, visitor, or guest user; 
5. b) Personal data may be acquired through one or more of the following sources: 

(i) Data voluntarily submitted by users during registration, checkout, communication, or onboarding; 

(ii) Data automatically collected from the user’s browser, device, or activity on the Platform; (iii) Data obtained from third-party integrations or external platforms used to support the Designer Hype’s functionality; 

(iv) Data inferred or derived through behavioural patterns, interaction history, and system analytics.

Social login data 

Information obtained through

Collected from 

(e.g., Google, Meta), payment gateway 

Login via third-party providers, processing

Third Parties

external service providers, tools, or integrations. 

status, influencer links, courier tracking data. 

Wishlist trends, repeat purchase 

payments, affiliate and referral tracking. 

Behavioural targeting,

Derived or 

Data analytically generated based on 

analysis, likelihood 

personalisation, product

Inferred Data 

existing data and behaviour patterns. 

of churn or engagement, profile preference tags. 

recommendations, 

feature improvements.

1. c) The above Personal Data may be collected at the time of account creation, while placing an order, subscribing to newsletters, interacting with the Platform or customer care, participating in surveys or contests, or otherwise voluntarily provided by the User. 
2. d) In addition to the above, the Company may collect certain Non-Personal Data (data that does not identify an individual directly or indirectly), which may include aggregated statistics, anonymised usage metrics, and analytics data, solely for internal research, service improvement, or marketing performance purposes. 
3. e) The Company does not intentionally collect or process biometric data, health data, or official government identifiers (such as Aadhaar or PAN), unless specifically required by law or consented to by the User for a legitimate purpose. 
4. f) In the course of providing its products, services, and operating its Platform, the Company may collect and process the following categories of Personal Data, either directly from the User or through third-party service providers acting on its behalf: 

4. PURPOSE OF DATA COLLECTION & USE
5. a) The Company collects and processes Personal Data only for specified, lawful, and legitimate purposes. Such processing is done either with the consent of the Data Principal or as reasonably necessary for the performance of a contract, compliance with legal obligations, or for purposes permissible under applicable law. 
6. b) The following table outlines the specific purposes for which each category of Personal Data may be collected and used: 

To communicate order updates and service-related information 

Contact Data, Order Data, Transaction Data 

Legitimate use; Performance of contract 

To personalise user experience and Usage Data, Device Data, Consent (via

1. c) The Company does not use Personal Data for any purpose other than those stated above without providing appropriate notice and, where applicable, obtaining specific and informed consent from the Data Principal. 
2. d) Where consent is the legal basis for processing, the User may withdraw such consent at any time by contacting the Grievance Officer or using the mechanisms provided on the Platform. However, withdrawal of consent may affect the ability to deliver certain products or services. 
3. e) The Company ensures that all processing of Personal Data is proportionate, limited to the extent necessary for the stated purposes, and in accordance with the principles of fairness, transparency, and accountability under applicable law.
4. LEGAL BASIS FOR PROCESSING
5. a) The Company processes Personal Data only when there is a lawful basis for such processing under the Digital Personal Data Protection Act, 2023, or other applicable laws. The legal bases may include one or more of the following: 

(i) Consent of the Data Principal: Where the Company collects Personal Data directly from a User or Data Principal, it shall do so after obtaining the individual’s free, specific, informed, unconditional, and unambiguous consent through clear affirmative action.

Examples: 

1. Subscribing to marketing emails or newsletters; 
2. Providing optional demographic details or feedback; 
3. Participating in surveys, contests, or promotional campaigns; 
4. Creating an account on the Platform. 

(ii) The User may withdraw consent at any time through the settings panel, opt-out links, or by contacting the Grievance Officer. Such withdrawal shall not affect any prior lawful processing.

(iii) Performance of a Contract: The Company may process Personal Data where such processing is necessary to fulfil its obligations under a contract with the Data Principal or to take steps at their request before entering into a contract. 

Examples: 

1. Processing an order placed by a User; 
2. Arranging for delivery, payment, and returns; 
3. Providing customer support regarding the order. 

(iv) Compliance with Legal Obligations: The Company may process Personal Data where it is legally required to do so under applicable laws, court orders, or regulations, including requirements imposed by government or law enforcement agencies. 

Examples: 

1. Complying with taxation and invoicing regulations; 
2. Retaining records for audits; 
3. Assisting law enforcement in fraud or criminal investigations; 
4. Compliance with obligations under the Information Technology Act 

or applicable consumer laws. 

(v) Legitimate Use (as permitted under Section 7 of the DPDPA, 2023): The Company may process Personal Data without consent for certain “legitimate uses” as explicitly provided under the DPDPA, including but not limited to:

(vi) The Company ensures that any reliance on legitimate use does not override the fundamental rights and expectations of the Data Principal and is consistent with the purpose limitation and necessity principles. 

(vii) Public Interest or Public Health (If Applicable): In exceptional circumstances such as pandemics or emergencies, the Company may process Personal Data in the interest of public health, subject to applicable statutory permissions or directions from government authorities. 

(viii) Where Personal Data is collected indirectly or through third-party service providers, the Company ensures that such third parties have obtained appropriate legal basis (including consent) for sharing such data with the Company. A list of categories of third parties (including their names, where applicable) with whom Personal Data may be shared is set out below. These third parties are contractually obligated to maintain the confidentiality and security of the data and to process such data strictly in accordance with applicable law and instructions issued by the Company.

Email & SMS Communication 

To send order updates, alerts, and promotional 

messages 

Mailchimp, 

Sendinblue, 

Gupshup, Twilio 

Email, phone number, 

communication logs 

Web Hosting & Website operation, Hostinger, AWS, Device metadata, IP 

 CA firms, Legal 

Internal 

Consultants & Auditors 

Government or Legal Authorities 

Legal, tax, or compliance 

purposes 

Legal compliance, law enforcement 

counsel, 

Compliance 

auditors (on retainer) 

Income Tax Dept., Police, Consumer Forums 

Financial, order, and sometimes user data 

Any legally mandated personal data, upon request 

(ix) The Company maintains detailed internal records of the legal basis applicable to each processing activity, and such records are reviewed periodically to ensure compliance. 

(x) In cases where the legal basis for processing changes (e.g., from contract to consent), the Company shall notify the Data Principal and, where required, obtain fresh consent before proceeding.

6. CONSENT MANAGEMENT
7. a) Obtaining Consent: The Company shall obtain the free, specific, informed, unconditional, and unambiguous consent of the Data Principal before collecting or processing any Personal Data, unless the processing is permitted under legitimate use or legal obligation in accordance with Section 5 of this Policy. 
8. b) Consent is obtained in a clear and granular manner at the point of data collection, such as during: 

(i) Account registration; 

(ii) Checkout and payment stages; 

(iii) Subscription to newsletters or marketing communications; 

(iv) Participation in contests, surveys, or referral programs; 

(v) Accepting cookies and similar tracking technologies on the website. 

1. c) No pre-ticked boxes, bundled consent, or inferred consent mechanisms are used. Consent must be affirmatively provided by the User. 
2. d) Layered Notices: All consent requests are accompanied by a layered privacy notice that includes: 

(i) The purpose of data collection; 

(ii) The categories of data collected; 

(iii) Whether the data will be shared with third parties; 

(iv) A link to this Privacy Policy; 

(v) Contact details of the Grievance Officer.

1. e) These notices are drafted in clear, plain, and concise language to ensure that Users understand what they are agreeing to. 
2. f) Proof and Record of Consent: The Company maintains verifiable records of the consent obtained from each Data Principal, including the time, method, and purpose for which consent was granted. These records are stored securely and may be made available to the Data Protection Board or other authorities in the event of a lawful request or audit.
3. g) Refusal or Conditional Consent: 

(i) Users have the right to refuse consent for optional features (such as marketing communications) without affecting their access to essential services (such as ordering products). 

(ii) Any conditional consent that ties unrelated services or benefits to the provision of Personal Data is not enforced by the Company, unless reasonably necessary for the functioning of such services.

1. h) Withdrawal of Consent: 

(i) The Data Principal may withdraw consent at any time, without any adverse consequences, by: 

1. Using the unsubscribe or opt-out links in emails or messages; 
2. Changing settings in the user account dashboard; 
3. Contacting the Grievance Officer directly at support@thedesignerhype.com i) Upon withdrawal of consent: 

(i) The Company shall cease processing the concerned Personal Data within a reasonable time, unless required to retain it under law; 

(ii) Certain services may become unavailable to the User where such services are dependent on the withdrawn data.

1. j) Consent for Minors: 

(i) The Company does not knowingly collect Personal Data from individuals below the age of 18 years without verifiable parental or guardian consent as required under Section 9 of the DPDPA, 2023. 

(ii) If the Company becomes aware that Personal Data of a minor has been collected without lawful parental consent, such data shall be promptly deleted.

1. k) Cookies and Tracking Consent: 

(i) The Company uses cookies and similar technologies for enhancing User experience, analytics, and targeted advertising. 

(ii) Consent for cookies is obtained through a cookie banner that allows Users to: 

1. Accept all cookies; 
2. Manage preferences by category; 
3. Reject non-essential cookies. 

(iii) The Company honors the User’s tracking preferences and provides information on how to modify or withdraw cookie preferences in its Cookie Policy. 

1. l) Updates to Consent Preferences: 

(i) Users may modify their consent preferences at any time by visiting their My Account > Privacy Settings section or by contacting customer care. 

(ii) The Company periodically prompts Users to review and confirm their consent preferences to ensure continued alignment with their expectations and legal requirements.

7. CHILDREN’S DATA 
8. a) The Company is committed to protecting the privacy of children and complying with the provisions of Section 9 of the Digital Personal Data Protection Act, 2023, which restricts the processing of personal data of children without verifiable parental or guardian consent. 
9. b) For the purposes of this Policy, a child is defined as an individual who has not completed the age of 18 years, unless a different age threshold is prescribed by applicable law. 
10. c) The Company does not knowingly collect, process, or store Personal Data from children unless: 

(i) It is necessary for delivering a service explicitly intended for child users; and 

(ii) Verifiable parental or guardian consent has been obtained through acceptable means, such as a digitally signed declaration or validated OTP-based consent process. 

1. d) If it comes to the Company’s attention that Personal Data of a child has been collected without lawful consent, the Company shall: 

(i) Promptly delete such Personal Data from its systems; and 

(ii) Notify the parent or guardian, if identifiable, of such deletion. 

1. e) The Company does not engage in behavioral tracking, profiling, or targeted advertising towards children, directly or indirectly, in compliance with the prohibitions under Section 9 of the DPDPA.
2. COOKIE AND TRACKING TECHNOLOGIES
3. a) The Company uses cookies and similar tracking technologies (such as pixels, beacons, and local storage) on its website and mobile applications to enhance user experience, deliver personalized content, enable core functionalities, analyze usage trends, and facilitate marketing campaigns. 
4. b) Users are shown a cookie consent banner upon their first visit to the Platform, in accordance with the notice and consent requirements under the Digital Personal Data Protection Act, 2023, and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. This banner allows Users to: 

(i) Accept all cookies; 

(ii) Reject non-essential cookies; 

(iii) Manage preferences granularly by category. 

1. c) The types of cookies used, their purposes, and the list of third-party tools involved are described in the Company’s Cookie Policy, which forms an integral part of this Privacy Policy. 
2. d) Users may review or update their cookie preferences at any time by visiting the Cookie Settings Panel available in the footer of the Website or in their account dashboard. 
3. e) For more detailed information on our cookie practices, including how to manage or disable cookies at the browser level, please refer to our full Cookie Policy.
4. DATA SHARING AND THIRD-PARTY TRANSFERS
5. a) Internal Access and Sharing: Personal Data collected by the Company may be accessed by authorised internal teams, including but not limited to operations, customer support, marketing, logistics coordination, product development, finance, and compliance, strictly on a need-to-know basis. All such access is governed by internal access controls, confidentiality obligations, and data minimisation principles. 
6. b) Third-Party Disclosures: The Company may share Personal Data with trusted third-party service providers, vendors, and business partners (collectively, “Third Parties”) solely for the purpose of enabling the Company to provide its products and services efficiently. These Third Parties process Personal Data on behalf of the Company and are contractually bound to comply with applicable data protection laws, maintain data confidentiality, and use the data only for 

the specified purposes. A summary of categories of Third Parties with whom data may be shared, and the purpose of sharing, is set out in Section 5(a)(viii) above. 

1. c) Categories of Third Parties May Include: 

(i) Payment gateways and processors – to facilitate secure payment transactions; (ii) Shipping and logistics providers – to deliver products to customers; 

(iii) Cloud hosting and IT infrastructure providers – to securely store and manage Platform data; 

(iv) Marketing, analytics, and advertising tools – to run campaigns and personalise content; 

(v) Customer support and CRM tools – to resolve service requests and complaints; (vi) Auditors, legal counsel, tax advisors – for regulatory, dispute, or audit purposes; (vii) Government authorities or law enforcement – when required under applicable laws or court orders. 

(viii) Affiliate marketing and referral partners – to track referrals, influencer codes, and campaign performance. 

(ix) Retargeting and personalised advertising platforms – to deliver interest-based advertisements across websites and social media. 

(x) Analytics and performance monitoring tools – to understand usage patterns, improve features, and track system performance (e.g., Google Analytics). 

(xi) Communication and messaging platforms – to manage transactional emails, SMS, voice calls, and customer notifications (including via third-party APIs). 

(xii) User authentication and access management providers – to verify identity and manage secure account login and session activity. 

(xiii) Product testing and development service providers – to conduct usability testing, feature deployment, and technical troubleshooting. 

(xiv) Affiliates and group entities – to ensure coordinated service delivery and shared business operations under common control. 

(xv) Business partners – to jointly offer or promote co-branded products, services, events, or incentives. 

(xvi) M&A or corporate transaction parties – in connection with mergers, acquisitions, investments, restructuring, or sale of business assets. 

1. d) Cross-Border Transfers: 

(i) As of the effective date of this Policy, the Company stores and processes all Personal Data on servers located within India. However, certain third-party tools and service providers may process data on infrastructure located outside India, subject to appropriate legal safeguards. 

(ii) Any transfer of Personal Data outside India (if required in the future) shall be conducted in accordance with Section 16 of the Digital Personal Data Protection Act, 2023, and any rules or government-issued notifications relating to cross-border transfers. 

(iii) The Company shall ensure that any such transfers are made: 

1. To countries or territories recognised by the Indian Government as having adequate data protection standards; or 
2. Pursuant to appropriate contractual arrangements (such as standard contractual clauses or data protection agreements) that ensure the same level of data protection as applicable under Indian law. 

(iv) No Sale of Personal Data: The Company does not sell, rent, trade, or otherwise monetize Personal Data of its users or customers to any third party for direct commercial gain. 

(v) Aggregated and Anonymised Data: The Company may share anonymised or aggregated data (which does not identify an individual directly or indirectly) with business partners, advertisers, or research agencies for the purpose of market analysis, trend detection, or improving services. Such data is outside the scope of “Personal Data” as defined under applicable law. 

(vi) Due Diligence and Oversight: The Company undertakes vendor due diligence and executes appropriate data processing agreements or confidentiality undertakings with all Third Parties who receive or process Personal Data, ensuring that: 

1. Data is processed only for legitimate and stated purposes; 
2. Adequate security measures are in place to prevent misuse or unauthorised access; 
3. Processing ceases upon completion of the contractual purpose or termination of engagement.
4. USER OBLIGATIONS
5. a) Users who access or interact with The Designer Hype’s Platform are required to act in good faith, observe lawful conduct, and take reasonable responsibility for the personal data and activities associated with their accounts. By engaging with the Platform, each user accepts the obligation to comply with this Policy, the Platform’s Terms of Use, and all applicable Indian laws. 
6. b) Users are expected to ensure the accuracy, completeness, and legality of the information they provide. Personal data submitted must not be false, misleading, stolen, impersonated, or unlawfully obtained. The Designer Hype shall not be liable for any consequences arising from reliance on erroneous or unauthorised data submitted by users. 
7. c) Users shall be personally responsible for the integrity and confidentiality of their account credentials, devices, and access points used to engage with the Platform: 
8. Login credentials (including passwords and OTPs) must not be shared, 

disclosed, or reused in an insecure manner; 

1. Devices used to access the Platform must be protected against unauthorised use, malware, or data breaches; 

iii. Users are advised to log out from shared or public systems and update 

passwords periodically 

1. d) Users shall refrain from engaging in, authorising, or facilitating any activity that: 
2. Violates the intellectual property rights, privacy, or dignity of other users, creators, resellers, or collaborators; 
3. Circumvents or manipulates Platform features, analytics systems, payment processes, or consent flows; 

iii. Submits or uploads objectionable, abusive, harmful, fraudulent, or misleading content, including fabricated user reviews or impersonated identities. 

1. e) Users shall not attempt to: 
2. Probe, scan, or test the vulnerability of the Platform or its security systems; ii. Gain unauthorised access to other user accounts, internal databases, restricted APIs, or administrative areas; 

iii. Use any automated tools or scripts (e.g., bots, scrapers, crawlers) without prior written consent from the Company. 

1. f) Users must promptly notify the Designer Hype in the event of: 
2. Suspected unauthorised access to their account or credentials; 
3. Discovery of any system vulnerabilities or data security concerns; 

iii. Receipt of fraudulent communications impersonating the Platform. 

1. g) Users may have the ability to submit, post, or upload content on the the Designer Hype Platform, including but not limited to product reviews, testimonials, feedback, comments, ratings, creative media, and other publicly visible content (“User-Generated Content” or “UGC”) 
2. h) All UGC submitted must be original, lawful, respectful, and relevant to the purpose for which it is submitted. Users shall be solely responsible for the content they contribute and represent that they have full rights and authority to submit such material. 
3. i) By submitting UGC to the Platform, the user grants the Designer Hype a worldwide, royalty-free, non-exclusive, and irrevocable license to use, display, reproduce, publish, modify, and distribute such content for the purposes of: 
4. Displaying it on the Platform; 
5. Promoting products, campaigns, or community engagement; 

iii. Reposting or syndicating it via the Designer Hype’s social media or partner platforms. 

1. j) The Designer Hype reserves the right to: 
2. Review, moderate, or edit submitted content; 
3. Refuse publication of content deemed inappropriate, misleading, defamatory, or in violation of law or Platform policy;  

iii. Remove any UGC without prior notice at its sole discretion. 

1. k) Users may request the removal of UGC that they have previously submitted by writing to the Company, subject to verification and lawful review. 
2. l) The Designer Hype reserves the right to suspend, restrict, or terminate a user’s account or access if a violation of these obligations is suspected, reported, or confirmed. Further, the Company may initiate legal proceedings or report such violations to competent authorities under applicable law.
3. MARKETING, COMMUNICATIONS, NEWSLETTERS AND VISIBILITY PREFERENCES
4. a) The Designer Hype may, from time to time, send users promotional communications, newsletters, event announcements, limited-edition releases, and product or brand-related updates, based on prior consent. Users are provided the option to manage their communication preferences at the time of subscription, registration, or through account settings. 
5. b) Marketing and promotional content is shared only: 
6. Where the user has explicitly opted in to receive such communications; 
7. Where a business partner (e.g., reseller or creator) has consented to visibility or promotional participation; 

iii. Through channels approved by the user, such as email, SMS, WhatsApp, or push notifications. 

1. c) Users, collaborators, or business partners may withdraw their consent to receive marketing communications or newsletters at any time by: 
2. Clicking the “unsubscribe” or “opt-out” link included in promotional emails; ii. Accessing their profile or account settings to update preferences; 

iii. Writing directly to the Company at the contact email provided in this Policy. 

1. d) Certain platform communications may be transactional in nature and not subject to consent withdrawal. These include order confirmations, delivery updates, security alerts, and account related notices. 
2. e) Resellers and creators onboarded on the Platform may be invited to participate in promotional campaigns, featured listings, or editorial content. Such visibility is optional and subject to: 
3. Explicit opt-in via onboarding forms or campaign invitations; 
4. Withdrawal or modification of consent by written notice to the Company; iii. De-listing or content takedown within a reasonable timeline upon request. 
5. All marketing and visibility preferences shall be recorded, timestamped, and retained as part of the Platform’s consent management framework, in accordance with the Digital Personal Data Protection Act, 2023 and related regulations. 

12. DATA RETENTION & STORAGE 
13. a) Retention Principle: The Company retains Personal Data only for as long as is reasonably necessary to: 

(i) Fulfil the purpose for which it was collected; 

(ii) Comply with legal or regulatory obligations; 

(iii) Resolve disputes, enforce contracts, or defend legal claims; 

(iv) Maintain records for auditing, taxation, or business continuity purposes. 

1. b) The retention period is determined by the nature of the data, the purpose of processing, and any applicable legal or contractual requirements. 
2. c) Data Retention Timelines:
   

Aggregated DataRetained indefinitelyOutside scope of “Personal Data” 

Anonymised or 

under DPDPA

Note: The above periods are subject to change in case of any legal proceedings, enforcement actions, or statutory hold directives.

1. d) Deletion and De-identification: Upon expiration of the applicable retention period, Personal Data is either: 

(i) Permanently deleted from all systems (active and backup); or 

(ii) Anonymised or de-identified in a way that prevents re-identification of the Data Principal. 

The Company ensures that deletion is performed in a secure manner using industry-standard sanitization or erasure methods. 

1. e) Right to Request Deletion: 

(i) A Data Principal may request deletion of their Personal Data where: 

1. The data is no longer necessary for the purpose for which it was collected; 2. Consent has been withdrawn and there is no other legal basis for retention; 3. The data has been unlawfully processed. 

(ii) Such requests will be honored subject to legal and contractual retention obligations and shall be responded to within a reasonable period as prescribed under the DPDPA, 2023. 

1. f) Storage Location and Backups: Personal Data is stored on secure servers operated by the Company or its authorized hosting providers, currently located in India. Periodic encrypted backups are maintained to ensure data recoverability in case of system failure, which are subject to the same retention and deletion practices outlined above. 
2. g) Policy Review and Updates: The Company periodically reviews its data retention schedules 

and storage practices to ensure compliance with evolving legal standards and operational needs. Any changes to retention durations will be notified through an update to this Policy.

13. REASONABLE SECURITY PRACTICES 
14. a) The Designer Hype is committed to ensuring the security, integrity, and confidentiality of the Personal Data it collects and processes. In line with Rule 8 of the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and Section 8(5) of the Digital Personal Data Protection Act, 2023, the Company implements appropriate technical, organizational, and administrative security measures to protect Personal Data against accidental loss, unauthorized access, destruction, misuse, alteration, or disclosure. 
15. b) The Company adopts industry-standard safeguards including, but not limited to: 

(i) End-to-end encryption of sensitive data during transmission (SSL/TLS protocols); (ii) Hashing and salting of passwords; 

(iii) Firewalls and intrusion detection systems for network monitoring; 

(iv) Access control policies based on role and need-to-know; 

(v) Secure APIs and encrypted payment gateways; 

(vi) Multi-factor authentication (MFA) for administrative and system access; 

(vii) Logging and monitoring of access to sensitive systems; 

(viii) Regular vulnerability assessments and penetration testing (VAPT); 

(ix) Frequent security patching and system updates. 

1. c) Personal Data is stored in secure servers hosted on reputable cloud platforms that are compliant with industry frameworks such as ISO/IEC 27001 and SOC 2, where applicable. All third-party service providers processing Personal Data on the Company’s behalf are contractually bound to adhere to similar or higher levels of security and confidentiality.
2. NOTIFICATION OF PERSONAL DATA BREACH
3. a) The Designer Hype adopts a proactive and structured approach to identifying, mitigating, and responding to any personal data breach. A personal data breach refers to any unauthorized or accidental disclosure, alteration, loss, destruction, or access to Personal Data that compromises its confidentiality, integrity, or availability—whether caused by technical failures, malicious attacks, human error, or organizational gaps. 
4. b) Data Breach Response Procedure and Timelines: In the event of a suspected or confirmed data breach, the Company shall activate its internal Data Breach Response Procedure, which comprises the following steps and timeframes as detailed in Annexure A. 
5. c) Information Included in Notifications: Any notification to the Data Protection Board of India, CERT-In, or affected individuals (Data Principals) shall include the following information: 

(i) Nature and categories of Personal Data af ected; 

(ii) Number of individuals impacted; 

(iii) Date and time of the breach (estimated and confirmed); 

(iv) Likely consequences or harm; 

(v) Actions taken to mitigate risks and limit damage; 

(vi) Contact information of the Grievance Of icer or point of contact; 

(vii) Instructions for Users on how to protect themselves. 

1. d) Breach Severity Categorisation: The Company classifies data breaches into three severity levels: 

(i) Level 1 – Minor: No sensitive data involved, minimal or no risk; 

(ii) Level 2 – Moderate: Involves contact or identity data, limited exposure; (iii) Level 3 – Critical: Involves sensitive personal data, financial data, or a large number of individuals, with potential for significant harm.

Only Level 2 and Level 3 breaches require mandatory external notification.

1. e) User Cooperation: Users who become aware of any potential compromise of their account, such as unauthorized login attempts, phishing emails, or suspicious transactions, must report the same immediately by emailing support@thedesignerhype.com. The Company will investigate such reports on priority and take appropriate action.
2. RIGHTS OF DATA PRINCIPALS 
3. a) As a Data Principal under the Digital Personal Data Protection Act, 2023, you are entitled to exercise the following rights in relation to your Personal Data collected and processed by The Designer Hype. These rights are subject to reasonable limitations and applicable legal requirements. 
4. b) As per the Digital Personal Data Protection Act, 2023, Data Principals have the following rights in relation to their Personal Data: 

16. GRIEVANCE REDRESSAL MECHANISM 
17. a) The Designer Hype is committed to addressing all privacy-related concerns, complaints, and requests in a transparent, secure, and time-bound manner. In accordance with Section 13 of 

the Digital Personal Data Protection Act, 2023 and Rule 5(9) of the IT Rules, 2011, the Company has appointed a Grievance Officer to ensure proper handling of grievances related to Personal Data. 

1. b) Lodging a Grievance: If you have any concerns or grievances regarding: 

(i) Denial or delay in fulfilling your data rights; 

(ii) Misuse, unauthorized access, or mishandling of your Personal Data; 

(iii) Withdrawal of consent not being respected; 

(iv) Violation of any terms of this Privacy Policy; 

(v) Any breach of applicable data protection laws; 

1. c) You may raise a grievance by sending an email to the designated Grievance Officer: Grievance Officer 

Email: support@thedesignerhype.com. 

Address: A-13 Wazirpur industrial area -110052 

Working Hours: Monday to Friday, 10:00 AM to 6:00 PM IST 

1. d) Grievance Handling Procedure and Timelines: 

e) If you are dissatisfied with the resolution provided by the Grievance Officer or if no response is received within the prescribed period, you have the right to escalate the matter to the Data Protection Board of India under Section 13(2) of the Digital Personal Data Protection Act, 2023.

FORCE MAJEURE 

The Company shall not be held liable for any failure or delay in performing its obligations under this Privacy Policy, including the processing of rights requests or breach notifications, due to circumstances beyond its reasonable control. Such events may include natural disasters, war, civil unrest, pandemic, governmental actions, electricity or internet outages, cyberattacks, or other force majeure events. During such periods, the Company will take reasonable steps to mitigate the impact and restore normal operations as soon as practicable.

18. GOVERNING LAW AND JURISDICTION 

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts located in New Delhi, India, without regard to conflict of law principles.

19. CHANGE IN OWNERSHIP OR CONTROL
    In the event of a merger, acquisition, reorganisation, or sale of all or a portion of the Company’s assets or business, Personal Data held by the Company may be transferred to the successor entity. Such transfer will continue to be governed by the terms of this Privacy Policy unless and until it is amended by the successor with due notice to Users.

20. POLICY UPDATES AND NOTIFICATION
    The Company may update or modify this Privacy Policy from time to time to reflect changes in legal requirements, business practices, or technological advancements. Any material changes will be notified to Users through:

(i) Prominent notices on the Platform; 

(ii) Email communication to registered Users (where applicable); and 

(iii) Updates to the “Last Updated” date at the top of this Policy.

Users are encouraged to periodically review this Policy to stay informed of how their Personal Data is protected.

21. CONTACT US
    If you have any questions, concerns, or require clarification regarding this Privacy Policy, the processing of your Personal Data, or your rights as a Data Principal, you may contact our designated

Grievance Officer 

Email: support@thedesignerhype.com. 

Address: A-13 Wazirpur industrial area 110052 

Working Hours: Monday to Friday, 10:00 AM to 6:00 PM IST 

By continuing to access or use the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to its terms. Your continued use of the services constitutes your consent to the collection, processing, and disclosure of your Personal Data in accordance with this Policy.

This Privacy Policy shall remain in effect until it is updated, superseded, or revoked by the Company. 

****** 

ANNEXURE A 

DATA BREACH RESPONSE FRAMEWORK & TIMELINE