Effective Date: July 14, 2026

At Prem Patra® (a registered trademark operating under the umbrella of House of Kvaab), we value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you interact with our e-commerce platform, whether through our website, social media channels, or direct messaging platforms.

This policy is designed to comply with India’s Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000, and the Consumer Protection (E-Commerce) Rules, 2020.

Under the DPDP Act, 2023, House of Kvaab acts as the Data Fiduciary determining the purpose of data processing, and you, the customer, are the Data Principal. We collect personal data only when it is necessary to provide you with our products and services across multiple touchpoints:

• Website Direct Collection: When you place an order, create an account, or subscribe to our newsletter, we collect your name, billing and shipping addresses, email address, phone number, and payment information.

• Social Media & Direct Messaging: When you interact with us, place orders, or request support via Instagram, Facebook, WhatsApp, or SMS, we collect your social media handle, profile name, phone number, and the contents of your messages.

• Automated Collection: We may collect session details, IP addresses, and browsing behavior on our website to ensure site functionality and improve your shopping experience.

In accordance with the principle of purpose limitation, we only process your data for the specific purposes you have consented to:

• Order Fulfillment: To process payments, arrange shipping, and provide order updates via email, SMS, or WhatsApp.

• Customer Support: To respond to your inquiries, handle returns, and address grievances.

• Marketing & Communications: To send you promotional offers and updates, only if you have explicitly opted in.

• Legal Compliance: To maintain transaction records as required by Indian tax laws and e-commerce regulations.

Under the DPDP Act, your consent must be free, specific, informed, and unambiguous.

• Explicit Action: We do not use pre-ticked boxes for data collection. You must actively consent to marketing communications and non-essential data processing.

• Right to Withdraw: You have the right to withdraw your consent at any time. If you wish to stop receiving marketing messages on WhatsApp, SMS, or email, you can opt out using the provided link or by contacting our Nodal Officer. Note that withdrawing consent does not affect the legality of data processed prior to withdrawal.

• Language of Notice: In compliance with the DPDP Act, you have the right to request this Privacy Policy and any consent notices in any of the 22 scheduled languages of India by contacting our Grievance Officer.

We do not sell your personal data. We only share it with trusted third-party service providers (Data Processors) strictly for operational purposes:

• Logistics & Delivery Partners: To ship your Prem Patra orders.

• Payment Gateways: To process secure transactions.

• IT & Hosting Services: To maintain our website infrastructure safely.

All our third-party vendors are bound by agreements to protect your data in compliance with Indian privacy laws.

• We adhere to the principle of data minimization. Your personal data is retained only for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable laws (such as GST and income tax record-keeping).

• If you delete your account or withdraw consent, we will erase your personal data unless retention is legally mandated.

• For inactive accounts, we will delete or anonymize your personal profile data after a sustained period of inactivity (typically up to 3 years).

Under the DPDP Act, 2023, you hold the following rights regarding your personal data:

• Right to Access: You can request a summary of the personal data we hold about you and the identities of third parties we have shared it with.

• Right to Correction & Erasure: You can ask us to correct inaccurate data or delete data that is no longer necessary for its original purpose.

• Right to Nominate: You can nominate another individual to exercise your privacy rights in the event of your death or incapacity.

• Right to Grievance Redressal: You have the right to readily available means of resolving any privacy-related complaints.

Prem Patra does not knowingly collect data from children under the age of 18 without verifiable parental consent. Furthermore, we strictly prohibit behavioral tracking or targeted advertising directed at children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

• Data Security: We implement appropriate technical and organizational safeguards to protect your personal data from unauthorized access, alteration, disclosure, or destruction. This includes secure servers, encrypted payment gateways, and restricted employee access.

• Data Breach Notification: In the unlikely event of a personal data breach, House of Kvaab is mandated by law to notify the Data Protection Board of India and all affected Data Principals without undue delay, outlining the nature of the breach and remedial actions taken.

In compliance with the DPDP Act, 2023, and the Consumer Protection (E-Commerce) Rules, 2020, House of Kvaab has appointed a dedicated Nodal/Grievance Officer to handle all privacy and consumer-related concerns.

If you wish to exercise any of your rights, request this policy in a regional language, or have a grievance regarding your personal data, please contact:

• Nodal/Grievance Officer: Vasundhara Anand

• Mobile: +919999329570

• Email: vasundharaanand@kvaab.com or hi@kvaab.com

• Mailing Address: House of Kvaab, D-583 Chittaranjan Park, New Delhi 110019

We will acknowledge your grievance within 48 hours and resolve it within a maximum of 30 days, as stipulated by the DPDP Act and IT Rules.