Privacy Policy

Last Updated: 2 August 2026

1. Introduction

This Privacy Policy explains how Posh Lush, a partnership firm registered in Surat, Gujarat, India, operating under the brand name CZARD (“CZARD”, “we”, “us” or “our”), collects, uses, stores, shares and protects your personal information.

This Privacy Policy applies when you:

• visit or use www.czard.com and any related pages operated by us;

• create or use a customer account;

• purchase, return, exchange or request servicing of a CZARD product;

• join a waitlist, submit a form or register for a product launch;

• subscribe to our email, SMS, WhatsApp or other communications;

• contact our customer-support team;

• submit a warranty or repair request;

• interact with our advertisements, campaigns or social-media accounts; or

• otherwise engage with CZARD.

By using our website, you acknowledge that you have read this Privacy Policy. Where consent is required, we will request it separately through an appropriate affirmative action. Your use of the website alone does not constitute consent to every form of personal-data processing described in this Privacy Policy.

2. Information We Collect

The information we collect depends on how you interact with CZARD.

2.1 Information You Provide to Us

We may collect information that you provide directly, including:

• your first and last name;

• email address;

• telephone or mobile number;

• billing address;

• shipping or delivery address;

• city, state, country and postal code;

• account login or authentication information;

• communication and marketing preferences;

• information submitted through forms, surveys, waitlists or product-launch registrations;

• correspondence sent through email, telephone, WhatsApp, SMS, social media or customer-support channels; and

• feedback, reviews or other content submitted to us.

2.2 Order and Transaction Information

When you place or attempt to place an order, we may collect:

• products viewed, selected or purchased;

• product preferences and selected variants;

• order number;

• order and purchase history;

• payment status;

• transaction reference;

• invoice information;

• coupon or promotional-code information;

• delivery and fulfilment information;

• cancellation information;

• return, exchange and refund information;

• cash-on-delivery information, where applicable; and

• information relating to unsuccessful or incomplete transactions.

2.3 Payment Information

Payments are processed through authorised third-party payment gateways, banks, card networks, UPI providers, wallet providers or other payment-service providers.

Depending on your chosen payment method, the relevant provider may collect information such as:

• card details;

• bank-account information;

• UPI identifiers;

• wallet information;

• billing information;

• authentication information;

• one-time passwords; and

• fraud-prevention or transaction-risk information.

CZARD generally receives only the information required to verify, reconcile and manage a transaction, such as the amount, payment method, payment status, transaction time and transaction reference.

We do not ordinarily receive or retain complete card numbers, card security codes, banking passwords or payment one-time passwords.

The payment provider’s collection and use of your information will also be governed by its own terms and privacy policy.

2.4 Warranty, Repair and After-Sales Information

When you register a product or submit a warranty, repair or servicing request, we may collect:

• product model;

• product serial number;

• date and place of purchase;

• invoice or proof of purchase;

• photographs or videos of the product;

• description of the issue;

• repair and service history;

• pickup and delivery details; and

• any other information reasonably required to assess or fulfil the request.

2.5 Information Collected Automatically

When you access our website, CZARD and our service providers may automatically collect certain technical and usage information, including:

• Internet Protocol address;

• browser type and version;

• device type;

• device identifiers;

• operating system;

• language and time-zone settings;

• referring and exit pages;

• pages and products viewed;

• links or buttons selected;

• date and time of access;

• time spent on the website;

• search queries;

• cart and checkout activity;

• abandoned-cart activity;

• approximate location derived from your Internet Protocol address;

• cookie identifiers;

• advertising identifiers;

• website interaction information;

• error logs;

• performance information; and

• other diagnostic or usage information.

We do not collect your precise device location unless a particular feature requires it, the purpose is disclosed to you and any consent required by applicable law has been obtained.

2.6 Information Received From Third Parties

We may receive information from third parties that help us operate our business, including:

• Shopify and other ecommerce or hosting providers;

• payment gateways and financial-service providers;

• courier, logistics, warehousing and fulfilment providers;

• form, verification and authentication providers;

• customer-support providers;

• email, SMS, WhatsApp and communication providers;

• fraud-prevention and security providers;

• analytics and website-performance providers;

• advertising and marketing platforms;

• social-media platforms;

• referral or affiliate partners; and

• other technology or professional-service providers.

When you interact with CZARD through a social-media platform, we may receive information such as your name, username, profile information, message content and other information made available according to your settings and the platform’s policies.

3. How We Use Your Information

We may use your personal information for the following purposes.

3.1 To Operate Our Website

We may use your information to:

• display and maintain the website;

• provide customer accounts;

• remember your preferences;

• maintain cart and checkout functionality;

• authenticate users;

• detect technical problems;

• improve website performance; and

• maintain the security and reliability of our services.

3.2 To Process and Fulfil Orders

We may use your information to:

• accept and confirm orders;

• verify and process payments;

• issue invoices;

• arrange packaging, shipping and delivery;

• provide order-status updates;

• verify delivery information;

• process cash-on-delivery orders;

• manage unsuccessful delivery attempts;

• manage cancellations;

• process returns, exchanges and refunds; and

• maintain transaction and accounting records.

3.3 To Provide Customer Support

We may use your information to:

• respond to questions and requests;

• verify purchases;

• resolve complaints;

• provide product information;

• administer warranties;

• manage servicing and repairs;

• arrange product pickup and redelivery;

• investigate product or delivery issues; and

• maintain customer-support and service records.

3.4 To Communicate With You

We may contact you by email, telephone, SMS, WhatsApp or another appropriate channel concerning:

• order confirmations;

• payment updates;

• delivery updates;

• return or refund updates;

• account or authentication information;

• warranty and servicing updates;

• security or fraud alerts;

• responses to your requests; and

• other information necessary to provide a product or service requested by you.

These transactional and service-related communications are separate from promotional communications.

3.5 To Send Marketing Communications

Where permitted by applicable law and based on your communication preferences, we may send:

• product announcements;

• collection launches;

• restock notifications;

• waitlist updates;

• invitations;

• promotional offers;

• editorial or brand communications; and

• information about products or services that may interest you.

Where consent is required, we will request it before sending such communications.

You may opt out of promotional communications at any time by using the unsubscribe option included in the communication or by contacting us.

Opting out of marketing communications will not prevent us from sending necessary transactional or service-related communications.

3.6 To Personalise and Improve Our Services

We may use information to:

• understand how visitors use our website;

• remember customer preferences;

• analyse customer journeys;

• understand product interest;

• improve our products and services;

• test website features;

• evaluate website performance;

• measure advertising and campaign performance; and

• provide more relevant content and advertising.

Where required by applicable law, non-essential analytics, personalisation and advertising technologies will be used only after obtaining the appropriate consent.

3.7 To Prevent Fraud and Maintain Security

We may process information to:

• verify identity or transactions;

• detect suspicious activity;

• prevent payment and delivery fraud;

• protect customer accounts;

• prevent unauthorised access;

• investigate security incidents;

• enforce our policies; and

• protect CZARD, our customers and other persons from harm.

3.8 To Comply With Legal Obligations

We may use or retain information to:

• comply with tax, accounting, consumer-protection and other legal obligations;

• respond to lawful requests from courts, regulators or government authorities;

• maintain records required by law;

• investigate possible misconduct;

• resolve disputes;

• enforce our agreements and policies; and

• establish, exercise or defend legal claims.

3.9 Business Transfers

Information may be reviewed, disclosed or transferred in connection with an actual or proposed merger, investment, financing, restructuring, reorganisation, acquisition or sale involving some or all of CZARD’s business or assets.

Where required, we will provide notice before your information becomes subject to a materially different privacy policy.

4. Legal Grounds for Processing

We process personal information only for lawful purposes.

Depending on the circumstances and applicable law, we may process your information:

• with your consent;

• when you voluntarily provide information for a specified purpose;

• to process or fulfil an order or request initiated by you;

• to provide customer support, warranty or after-sales services;

• to comply with a legal obligation;

• to prevent fraud, misuse, security threats or unlawful activity;

• to establish, exercise or defend legal claims; or

• where processing is otherwise permitted under applicable law.

Where we rely on consent, you may withdraw that consent in the manner described in this Privacy Policy.

5. Cookies and Tracking Technologies

CZARD, Shopify and our service providers may use cookies, pixels, tags, local storage and similar technologies.

5.1 Essential Cookies

Essential cookies may be required to:

• operate the website;

• maintain security;

• enable cart and checkout functionality;

• authenticate users;

• prevent fraud;

• remember privacy choices; and

• provide services requested by you.

The website may not function correctly if essential cookies are disabled.

5.2 Functional Cookies

Functional cookies may be used to remember:

• login preferences;

• language or currency selections;

• previously viewed products;

• saved choices; and

• other website preferences.

5.3 Analytics Cookies

Analytics and performance technologies may help us understand:

• visitor numbers;

• traffic sources;

• website performance;

• navigation patterns;

• product engagement;

• errors; and

• how visitors interact with our website.

5.4 Advertising Technologies

Subject to applicable law and your consent choices, advertising technologies may be used to:

• measure advertising performance;

• understand whether an advertisement resulted in a website visit or purchase;

• limit repeated advertising;

• create or measure advertising audiences; and

• display advertising that may be more relevant to your interests.

5.5 Managing Cookie Preferences

Where a cookie-preference tool is provided, you may use it to accept, reject or manage non-essential cookies.

You may also block or delete cookies through your browser settings. Disabling certain cookies may affect cart functionality, saved preferences, website performance or other features.

Cookie choices may need to be managed separately on each browser and device.

6. How We Share Your Information

We may share personal information only where reasonably necessary for the purposes described in this Privacy Policy, or where permitted or required by applicable law.

6.1 Shopify and Technology Providers

Our online store is operated using Shopify. Shopify and related technology providers may process information to provide ecommerce, website hosting, checkout, security, fraud-prevention, analytics and other platform services.

Other providers may support forms, customer accounts, authentication, website integrations, content delivery, data storage and technical operations.

6.2 Payment Providers

We may share relevant order and transaction information with payment gateways, banks, card networks, UPI providers, wallet providers and fraud-prevention providers to process, authenticate, reconcile, refund or investigate transactions.

6.3 Courier and Fulfilment Providers

We may share information with courier, logistics, warehousing and fulfilment providers to:

• package and dispatch orders;

• contact you regarding delivery;

• verify delivery details;

• collect cash-on-delivery payments;

• manage delivery attempts;

• process returns; and

• arrange product pickup or redelivery.

6.4 Communication and Customer-Support Providers

We may share relevant contact and communication information with providers that support:

• email;

• SMS;

• WhatsApp;

• telephone communications;

• customer support;

• one-time-password verification;

• surveys;

• forms; and

• notifications.

6.5 Analytics and Advertising Providers

Subject to applicable law and your consent choices, we may share limited identifiers, usage information, transaction events or campaign information with analytics, advertising and marketing providers.

These providers may help us measure website use, understand campaign performance and conduct marketing activities.

6.6 Professional Advisers

We may share information with lawyers, accountants, auditors, insurers, consultants and other professional advisers where reasonably necessary for professional services, legal compliance, risk management or dispute resolution.

6.7 Legal Authorities

We may disclose personal information:

• where required by law;

• in response to a valid court order, regulatory request or government demand;

• to prevent, detect or investigate fraud, security incidents or unlawful activity;

• to protect the rights, safety or property of CZARD, our customers or another person; or

• to establish, exercise or defend legal claims.

6.8 With Your Consent

We may disclose information to another person or organisation for a purpose to which you have specifically consented.

We require service providers acting on our behalf to process personal information only for authorised purposes and subject to appropriate confidentiality, security and data-protection obligations.

7. International Processing and Transfers

Some of our service providers may process or store personal information outside India.

The privacy and data-protection laws in those locations may differ from Indian law. Where information is processed or transferred outside India, we will take reasonable steps to ensure that it is handled in accordance with applicable law and appropriate contractual, organisational or technical safeguards.

We will comply with any restriction or condition imposed by the Government of India or another competent authority concerning the transfer of personal information outside India.

8. Retention of Information

We retain personal information only for as long as reasonably necessary to:

• fulfil the purpose for which it was collected;

• process orders and provide services;

• maintain customer accounts;

• fulfil warranty and after-sales obligations;

• comply with legal, tax and accounting requirements;

• prevent fraud or misuse;

• resolve disputes;

• enforce agreements; and

• establish, exercise or defend legal claims.

Retention periods may differ depending on the type of information.

For example:

• order, invoice, payment and transaction records may be retained for legally required accounting or tax periods;

• warranty and service information may be retained for the applicable warranty period and a reasonable period thereafter;

• account information may be retained while the account remains active and for a reasonable period after closure;

• marketing information may be retained until you unsubscribe or withdraw consent, subject to retaining limited information necessary to record your opt-out; and

• security and technical logs may be retained for a shorter period unless they are required for security, investigation or legal purposes.

When information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it, unless continued retention is required or permitted by law.

9. Security of Your Information

We maintain reasonable administrative, technical and organisational safeguards appropriate to the nature of the information we process and the risks associated with that processing.

These measures may include:

• access controls;

• authentication measures;

• protected transmission and storage;

• restricted staff access;

• logging and monitoring;

• backups and recovery procedures;

• service-provider assessments; and

• security-incident response procedures.

No method of transmission over the internet and no method of electronic storage is completely secure. We therefore cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly if you believe that your account or information has been compromised.

10. Personal-Data Breaches

If we become aware of a personal-data breach, we will take reasonable steps to:

• contain and investigate the incident;

• mitigate reasonably foreseeable harm;

• restore the security of affected systems;

• preserve relevant records; and

• notify affected individuals, regulators or authorities where required by applicable law.

The timing, content and method of any notification will depend on the nature of the incident and applicable legal requirements.

11. Your Privacy Rights

Subject to applicable law, you may have the right to:

11.1 Access Your Information

You may request confirmation of whether we process your personal information and request a summary of the information being processed.

Where required by law, you may also request information concerning the identities or categories of service providers with whom your information has been shared.

11.2 Correct or Update Your Information

You may request that we:

• correct inaccurate or misleading information;

• complete incomplete information; or

• update information that is no longer current.

You may also be able to update certain information through your customer account.

11.3 Request Erasure

You may request deletion of information that is no longer required for the purpose for which it was collected.

We may retain information where required or permitted for legal compliance, accounting, fraud prevention, warranty administration, dispute resolution or the establishment, exercise or defence of legal claims.

11.4 Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal will not affect processing carried out lawfully before the withdrawal.

Where particular information is required to complete an order, provide a service or fulfil another request, withdrawal may affect our ability to provide the relevant service.

11.5 Opt Out of Marketing

You may unsubscribe from promotional communications through the unsubscribe mechanism included in the communication or by contacting us.

We may retain limited information necessary to record and respect your opt-out preference.

11.6 Raise a Grievance

You may raise a grievance concerning our collection, use, sharing, retention, security or other processing of your personal information.

11.7 Nominate Another Individual

Where this right is available under applicable law, you may nominate another individual to exercise your privacy rights in the event of your death or incapacity.

12. How to Exercise Your Rights

To submit a privacy request, contact us using the information provided in the “Contact Us and Grievance Officer” section below.

Please include, where applicable:

• your full name;

• the email address or telephone number connected with your interaction with CZARD;

• the relevant order number;

• the right you wish to exercise;

• a clear description of your request; and

• any information reasonably required to locate the relevant records.

We may request additional information to verify your identity and protect personal information against unauthorised access, correction or deletion.

We will respond within the period required under applicable law. Where we cannot fulfil a request, we will explain the reason where required or appropriate.

13. Children’s Privacy

Our website and services are intended for individuals who are at least eighteen years old and capable of entering into a binding contract.

Individuals under eighteen should use the website only with the involvement and authorisation of a parent or lawful guardian.

We do not knowingly seek to collect personal information from a person under eighteen without any parental or guardian consent required by applicable law.

We do not knowingly conduct targeted advertising directed at children or behavioural monitoring of children in a manner prohibited by law.

Where a parent or lawful guardian believes that a child has provided information to us without appropriate authorisation, they may contact us. We will take reasonable steps to investigate and delete or otherwise lawfully address the information.

14. Third-Party Websites and Services

Our website may contain links to websites, applications or services operated by third parties.

We do not control the privacy, security or data-processing practices of those third parties. Your use of a third-party service will be governed by that party’s own terms and privacy policy.

We encourage you to review the relevant privacy policy before providing information to a third-party service.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes in our business practices;

• changes to our website or services;

• new service providers or technologies;

• legal or regulatory developments; or

• security and operational requirements.

The revised Privacy Policy will be posted on our website with an updated “Last Updated” date.

Where a change materially affects how we process your information, we will provide additional notice or obtain consent where required by applicable law.

16. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India.

Subject to any mandatory rights, statutory remedies or consumer forums available under applicable law, courts having jurisdiction in Surat, Gujarat shall have jurisdiction over disputes arising from this Privacy Policy.

Nothing in this section limits any legal right or remedy that cannot lawfully be excluded or restricted.

17. Contact Us

For privacy questions, requests or grievances, please contact:

Legal Entity: Posh Lush
Brand: CZARD
Email: care@czard.com

Please write “Privacy Request” or “Privacy Grievance” in the subject line wherever possible.

We will endeavour to resolve grievances promptly and within the period required under applicable law.