Privacy Policy

JollyPet is an online pet commerce Platform serving customers in India. For the purposes of the DPDP Act, JollyPet acts as a Data Fiduciary in respect of personal data collected through the Platform.

Legal entity name: [INSERT REGISTERED BUSINESS NAME, e.g. JollyPet Private Limited / LLP].

Registered office / principal place of business: [INSERT FULL REGISTERED ADDRESS, City, State, PIN — India]. (Operational fulfilment references on the Platform may mention Patna, Bihar.)

CIN / registration number (if applicable): [INSERT CIN OR REGISTRATION NUMBER].

Contact for privacy and data requests: [email protected] · WhatsApp / phone +91 93348 03286 · www.jollypet.in · Public policy URL: https://www.jollypet.in/info/privacy

This Policy applies to personal data relating to identified or identifiable individuals who browse, register, purchase, or otherwise interact with the Platform in India.

"Personal data" means data about an individual who is identifiable by or in relation to such data. "Sensitive personal data or information" (under the SPDI Rules, where still relevant) may include passwords, financial information, and similar categories if we collect them. "Data Principal" means the individual to whom the personal data relates (you). "Processing" includes collection, storage, use, sharing, and deletion of personal data.

Account information: Indian mobile number (the primary identifier for your account); one-time passwords (OTPs) we send to that number to sign you in, verify a number change, or confirm delivery; name, email address, profile photo, and Google account identifier if you use Google as an alternate sign-in; and account preferences.

Delivery information: full name, phone, email, house/street, landmark, city, state, PIN code, and country for addresses you save or use at checkout.

Order and transaction information: products ordered, amounts, taxes, delivery instructions, order status history, invoices/receipts, and payment method chosen at checkout (currently cash on delivery; prepaid methods may be offered later via payment partners).

Device and usage information: browser or app type, device identifiers needed for sessions, IP address (or approximate network location), pages or screens viewed, search history on the storefront, referral source, and basic analytics events.

Location: approximate location only if you grant permission (for example to suggest delivery areas or autofill address details). You may deny or revoke this permission in your browser or device settings.

Notifications: a push-notification subscription token (endpoint and keys) if you enable order alerts.

Communications: messages you send us by email, WhatsApp, in-app support, or other channels, and related metadata needed to respond.

We do not knowingly collect government identity numbers (such as Aadhaar) through the storefront. Do not share unnecessary sensitive documents with us unless we expressly request them for a lawful purpose.

We collect and process personal data only for specified, clear purposes, including to: create and manage your account; authenticate you (primarily by sending a one-time password to your mobile number, and optionally via Google Sign-In); process, fulfil, and deliver orders; send transactional updates (OTP SMS, order confirmation, shipping, delivery confirmation OTP, and optional push notifications); provide customer support and handle returns/refunds; personalise and improve the storefront and catalogue experience; prevent fraud, abuse, chargebacks, and security incidents; meet legal, tax, GST, accounting, and record-keeping obligations; enforce our Terms of Service; and communicate about material service or policy changes.

We will not use your personal data for a purpose that is incompatible with the purposes disclosed above without a fresh lawful basis (including consent where required).

Under the DPDP Act and other applicable law, we process personal data: (a) for the performance of a contract or to take steps at your request before entering a contract (account creation and OTP login, checkout, delivery, support); (b) with your free, specific, informed, unconditional, and clear consent for optional features (for example location access or marketing/push notifications where consent is required); (c) for compliance with law or legal claims; and (d) for certain legitimate uses recognised under applicable law (such as security, fraud prevention, and employment-related processing if relevant to our staff).

Where processing is based on consent, you may withdraw consent at any time (for example by disabling notifications or location, or by emailing [email protected]). Withdrawal does not affect processing already lawfully carried out, or processing that must continue under another lawful basis (for example completed orders and tax records).

If you provide personal data of another person (for example an alternate delivery recipient), you confirm you have the authority to share that information and that the other person has been informed of this Policy where required.

Where we process sensitive personal data or information within the meaning of the SPDI Rules (for example passwords or payment-related data handled on our systems), we follow reasonable security practices and procedures, including organisational and technical measures appropriate to the nature of the data.

Payment credentials for prepaid methods, if introduced later, will be processed by licensed payment partners / payment aggregators under their own policies and PCI-DSS or equivalent obligations; we do not store full card numbers on our servers. Today checkout is cash on delivery only.

Security measures include HTTPS/TLS in transit, access controls, secure hosting, and need-to-know access for staff and contractors. Login and verification OTPs are generated on our servers, stored only as a short-lived hash (not the code itself) for a limited time, and then deleted. We do not persist OTP codes in your account profile. No method of transmission or storage is completely secure. Please protect your device, do not share OTPs with anyone (including anyone claiming to be JollyPet), keep your Google account credentials secure if you use Google Sign-In, and sign out on shared devices.

Phone OTP login is the primary way to create and access your account. When you request an OTP, we send a transactional SMS to the Indian mobile number you enter. We use Ping4SMS (and its telecom operator partners) as our OTP/SMS delivery provider. For that purpose we share your 10-digit mobile number and the OTP message content (which follows a TRAI DLT-registered template). Ping4SMS and the operators process this data solely to deliver the SMS. Requesting an OTP is consent to receive that transactional message on the number you provided. OTP SMS is not marketing; we do not use this channel for promotional campaigns unless we obtain a separate lawful basis and you can opt out where required.

Google Sign-In is offered as an optional alternate authentication method. Google processes sign-in data under its own policies. We receive limited profile identifiers (such as Google account ID, name, email, and profile photo) needed to create, recognise, or link your account. If you later add a phone number to a Google-created account, we may link it with an existing account for the same verified number so you have a single customer profile.

We use service providers (Data Processors / intermediaries) to host the site and databases, deliver images/CDN content, run analytics (for example Vercel Analytics on the website), geocode or look up PIN codes, send operational alerts and OTP SMS, and provide customer communication tools.

Delivery partners and logistics providers receive the name, address, phone number, and order details needed to complete delivery.

If online payments are enabled, payment partners process payment details under their own policies.

We may disclose personal data if required by law, regulation, court order, government authority, or to protect rights, safety, or property of JollyPet, our users, or the public.

We do not sell your personal information. Sharing is limited to purposes described in this Policy or with your consent.

We use cookies and similar technologies (including local storage) for session management, security (for example CSRF protection), preferences, cart and wishlist state, and basic analytics required to run the storefront. You can clear site data in your browser or Android app settings; doing so may sign you out or empty your cart. Essential cookies are required for the Platform to function; optional analytics cookies, where used beyond what is necessary, will be handled consistently with applicable consent requirements.

If you enable order notifications, we store a push subscription so we can notify you about order status changes. Notifications are optional. You can disable them anytime in Profile settings or your device/browser notification settings.

Transactional messages about your orders and account — including login OTPs, phone-number verification OTPs, and delivery confirmation OTPs — are not marketing. These are sent because you requested them or because they are necessary to complete a service you asked for. If we send promotional messages by SMS, email, WhatsApp, or push, we will do so in line with applicable law (including TRAI regulations for commercial communications) and provide an unsubscribe or opt-out mechanism where required.

We retain account and order records only as long as needed for the purposes stated above — including fulfilling orders, handling returns and support, meeting legal and accounting requirements (including GST and tax record retention periods), resolving disputes, and enforcing agreements — and thereafter delete or anonymise personal data that is no longer required. OTP hashes are kept only for a short verification window (typically minutes) and are then deleted. Your mobile number remains part of your account until the account is deleted or the number is changed.

You may request deletion of your account by emailing [email protected]. We will delete or anonymise personal data that is no longer required, except where retention is required or permitted by law (for example invoices, tax records, or fraud-prevention logs).

Our primary customers and operations are in India. Some service providers may process data on servers outside India. Where personal data is transferred outside India, we will do so in accordance with the DPDP Act and applicable rules (including any government-notified restrictions or conditions), and we take reasonable contractual and organisational steps so that processing remains consistent with this Policy and Indian law.

Subject to the DPDP Act and other applicable law, you may have the right to: (a) access a summary of personal data being processed and processing activities; (b) correct inaccurate or incomplete personal data; (c) erase personal data that is no longer necessary for the stated purpose or whose consent has been withdrawn (subject to legal retention); (d) withdraw consent for consent-based processing; (e) nominate another individual to exercise rights in the event of death or incapacity, once nomination mechanisms are operational under applicable rules; and (f) grievance redressal regarding our personal data practices.

To exercise these rights, email [email protected] with the subject line "Data Principal Request" and enough detail for us to verify your identity and locate your records. We will respond within the timelines required by applicable law (and in any event aim to acknowledge promptly).

JollyPet is intended for adults purchasing pet products. We do not knowingly offer the Platform to children under 18 years of age, or knowingly process children's personal data without verifiable consent of a parent or lawful guardian as required under the DPDP Act. If you believe a child has provided us personal data, contact [email protected] and we will take steps to delete it.

In accordance with the IT Act, SPDI Rules, and DPDP Act requirements on grievance redressal, you may contact our Grievance Officer / designated data protection contact:

Name: [INSERT GRIEVANCE OFFICER FULL NAME]

Designation: Grievance Officer

Email: [INSERT GRIEVANCE OFFICER EMAIL, e.g. [email protected]] (you may also write to [email protected])

Phone / WhatsApp: +91 93348 03286

Postal address: [INSERT GRIEVANCE OFFICER / REGISTERED OFFICE ADDRESS, India]

We will acknowledge grievances relating to personal data as soon as practicable and aim to resolve them within the period prescribed under applicable law (including timelines under the SPDI Rules / DPDP framework as applicable). If you remain unsatisfied, you may escalate to the Data Protection Board of India or other competent authority under applicable law once such redressal mechanisms are operational for your complaint type.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will change when we do. Continued use of JollyPet after an update means you accept the revised policy to the extent permitted by law. For material changes, we may also provide a notice on the website or app, or by email/WhatsApp where appropriate.

Privacy questions and data requests: [email protected] · WhatsApp / phone +91 93348 03286 · www.jollypet.in · Public policy URL: https://www.jollypet.in/info/privacy