Privacy Policy

Sheopal's Private Limited

1. About This Policy

Sheopal's Private Limited (“We”, “Our”, “Us”, “Company”, “Sheopal's”) is a company incorporated and registered under the Companies Act, 2013, having CIN U74999DL2016PTC301589 and its registered office at E-44/10, Okhla Industrial Area, Phase 2, Entire First Floor, Okhla Industrial Estate, South Delhi, New Delhi, Delhi, India, 110020.

We have developed the website www.sheopals.com (the “Website”) for the purpose of selling Ayurvedic and herbal wellness products manufactured by the Company. This Privacy Policy is our privacy notice for the Website and the Services defined below. It explains what personal data we collect, why and how we process it, who we share it with, and how you can exercise your rights over it.

2. Scope and Applicability

This Privacy Policy is governed by Indian law and is to be construed in accordance with the Information Technology Act, 2000 and the rules made thereunder, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) read with the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and other applicable law as amended from time to time. This Policy applies to personal data we collect through the Website, our mobile experience (if any), our customer care channels, and any free-consultation service we offer, and should be read together with our Terms of Use.

3. Definitions

Account

A unique account created for you to access the Service or parts of the Service.

Company / We / Our / Us

Sheopal's Private Limited, the Data Fiduciary deciding the purpose and means of processing personal data under this Policy.

Consent

An affirmative, specific, informed, unconditional, and unambiguous action signifying agreement to the processing of your personal data for a specified purpose, given in accordance with the DPDP Act.

Consent Manager

An entity registered with the Data Protection Board of India that enables you to give, manage, review, and withdraw your consent through an interoperable platform, once such a mechanism is operational.

Data Principal

The individual to whom the personal data relates — i.e., you.

Data Fiduciary

The entity that determines the purpose and means of processing personal data — i.e., Sheopal's.

Minor / Child

Any person below the age of 18 years.

Personal Data

Any data about an individual who is identifiable by or in relation to such data.

Sensitive Categories (incl. Health Data)

Personal data revealing health, medical, or physiological information, including information you share with us through a free consultation, which we treat with heightened safeguards as described in Section 8.

Service(s)

The products and/or services made available by the Company through the Website.

Service Provider

Any third-party company or individual engaged by the Company to perform services on the Company's behalf.

Usage Data

Data collected automatically, generated by your use of the Website.

You / Your / User

The individual accessing or using the Service, or the entity on whose behalf such individual is doing so.

4. Personal Data We Collect and How

We collect the following categories of personal data, directly from you or automatically through your use of the Website:

We do not store your card, UPI, or net-banking credentials; these are processed directly by our payment partner.

Wherever we collect personal data on the basis of your consent, we provide you with a separate, standalone notice - shown at or before the point of collection (for example, at checkout, account creation, WhatsApp opt-in, or consultation intake) - in clear and plain language, specifying exactly what data is being collected and for what purpose, in addition to this long-form Policy, in accordance with the DPDP Rules. Consent is recorded only through a clear, affirmative action on your part; we do not use pre-ticked boxes or any other default-opt-in mechanism. You may withdraw your consent at any time by writing to us at the contact details in Section 13; withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to continue providing certain Services to you.

5. Purpose of Processing

We use your personal data to: create and manage your account; process, deliver, and provide support for your orders; respond to queries raised through customer care or a free consultation; investigate and respond to adverse event or product safety reports you share with us; send transactional communications about your orders; send promotional or marketing communications where you have separately opted in; improve and personalise your experience on the Website; detect and prevent fraud; and comply with our legal and regulatory obligations.

6. Sharing and Disclosure of Personal Data

We value your privacy and do not sell or otherwise disclose your personal data for monetary or other valuable consideration. We may, however, share your personal data with the following categories of recipients, for the purposes described:

6.1 Third-Party Service Providers

Payment processors and gateways, logistics and delivery partners, e-commerce platform and IT service providers, and similar vendors, solely to the extent necessary for them to perform their contractual obligations to us.

6.2 Affiliates and Subsidiaries

Our affiliates, subsidiaries, and other businesses under our common control, subject to this Policy.

6.3 Legal Disclosures

Regulators, courts, law enforcement, or other legal authorities, where disclosure is necessary to comply with applicable law, a valid legal process, or to protect our rights or the safety of any person.

6.4 Business Transfers

In connection with a merger, acquisition, reorganisation, or sale of business assets, in which case your personal data would continue to be governed by this Policy (or a policy providing at least equivalent protection) following the transfer.

We require our Service Providers to use your personal data only for the purposes for which it is shared with them, and to hold it securely for no longer than is necessary for that purpose.

7. Cross-Border Transfer of Personal Data

This Policy governs the processing of personal data collected through the Website within India, and also applies to processing outside India where that processing relates to offering goods or services to individuals located in India. Where we or our Service Providers transfer personal data outside India, we do so in accordance with the DPDP Act and DPDP Rules, including any restrictions the Central Government may notify from time to time in respect of specific countries or entities.

8. Sensitive and Health-Related Data

Because we offer a free consultation service, and because you may choose to report an adverse event or product safety concern to us, you may share health, wellness, or lifestyle information with us that goes beyond ordinary order and account data. We treat this information as a distinct, higher-sensitivity category, and process it under one of the following two bases only:

8.1 Consultation Data

Where you share health, wellness, or lifestyle information in connection with a free consultation:

• a)We collect it only where you choose to share it in connection with the consultation, and only to the extent you provide;
• b)We use it solely to respond to the consultation and to provide product recommendations connected to it, and not for any unrelated marketing, profiling, or analytics purpose;
• c)Access to this information within the Company is restricted to personnel who need it to service your consultation; and
• d)We retain it only as long as necessary for the purpose in Section 10, after which it is deleted or anonymised.

Please do not share health information with us other than in direct response to a question we have asked you in connection with a consultation you have requested.

8.2 Adverse Event and Product Safety Data

Where you report an adverse reaction, injury, or other product safety concern to us, whether under our Legal Disclaimer or otherwise:

• a)We collect it only to the extent you choose to share it in connection with the report;
• b)We use it solely to investigate and respond to the report, and for product-safety and quality-assurance purposes, and not for any marketing, profiling, or analytics purpose;
• c)Access to this information within the Company is restricted to personnel who need it to investigate or respond to the report, or to meet a related regulatory obligation; and
• d)We retain it for as long as necessary to investigate the report, meet any applicable regulatory record-keeping obligation, and defend or establish a legal claim, after which it is deleted or anonymised.

9. Cookies and Tracking Technologies

The Website uses cookies and similar tracking technologies to operate correctly, remember your preferences, understand how the Website is used, and, where you consent, to support marketing and personalisation. Some cookies are strictly necessary for the Website to function; others (such as analytics and advertising cookies) are used only with your consent. You can control or disable non-essential cookies through your browser settings or, where available, through the Website's cookie preference tool.

10. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, including to provide the Service, comply with our legal and tax obligations (including under GST and other applicable law), resolve disputes, and enforce our agreements. As a general rule, we retain account and order data for the duration of your relationship with us and for [2 years] thereafter, to allow us to establish, exercise, or defend legal claims, after which it is deleted or anonymised in a manner that it no longer identifies you. Health/consultation data is retained only as described in Section 8.

11. Information Security and Breach Notification

We implement reasonable technical and organisational security safeguards - including access controls, encryption in transit, and monitoring - to protect your personal data against unauthorised access, disclosure, alteration, or misuse, including where processing is carried out on our behalf by a Service Provider. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals without delay, in the manner and containing the information prescribed under the DPDP Rules, including the nature of the breach, its likely consequences, and the steps we are taking or recommend you take in response.

12. Children's and Persons with Disabilities' Data

We do not knowingly collect personal data of a Minor except with verifiable consent of the Minor's parent or lawful guardian, obtained in the manner prescribed under the DPDP Rules, save where processing falls within a category exempted under the DPDP Rules (such as certain healthcare, educational, or child-safety purposes). Where we become aware that we have collected a Minor's personal data without such verifiable consent, we will delete it without undue delay. If you are a parent or lawful guardian and believe your child has provided us with personal data without your verifiable consent, please contact us using the details in Section 13.

Where personal data relates to a person with a disability who has a lawful guardian, we will process such data only on the basis of consent given by the lawful guardian, verified in the manner prescribed under the DPDP Rules.

13. Your Rights as a Data Principal

Subject to the DPDP Act and DPDP Rules, you have the right to:

• a)Access a summary of the personal data we hold about you and the processing activities we carry out;
• a)Seek correction, completion, and updating of your personal data;
• b)Seek erasure of your personal data, unless we are required to retain it to fulfil a legal obligation or contractual purpose, in which case we will inform you of the reason we are unable to comply, or anonymise the data where erasure is not possible;
• c)Withdraw consent at any time, as described in Section 4;
• d)Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, in the manner prescribed under Section 14 of the DPDP Act; and
• e)Register a complaint with the Data Protection Board of India, if you are not satisfied with how we have addressed your grievance.

We will respond to requests within a reasonable timeframe and in a clear, transparent, and accessible manner, and may decline frivolous or repeated requests, with reasons.

14. How to Reach Us / Grievance Redressal

For any questions, requests, or complaints about this Policy or our processing of your personal data, please contact our designated privacy point of contact:

Email: legal@sheopals.in or care@sheopals.in

Sheopal's Private Limited, E-44/10, Okhla Industrial Area, Phase 2, South Delhi, New Delhi – 110020

For general order or product complaints, you may also contact our customer care at support@sheopals.com, or our Grievance Officer named in our Terms of Use, who acknowledges complaints within 48 hours and endeavours to resolve them within 1 month, in accordance with applicable consumer-protection law.

15. Marketing Communications

With your consent, we may write to you about new products, offers, and other updates by e-mail, SMS, WhatsApp, or voice call. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing e-mail, replying “STOP” to an SMS/WhatsApp message, or writing to us at the contact details above. This will not affect transactional messages necessary to service an order you have placed.

16. Third-Party Links and Social Media

The Website may contain links to third-party websites or platforms we do not operate or control; your engagement with those third parties is governed by their own privacy policies. Where you engage with us through social media platforms such as WhatsApp or Instagram, your use of those platforms is also subject to the relevant platform's own privacy policy.

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. We will post the revised Policy on this page, update the “Last updated” date above, and, where the change is material, notify you by e-mail and/or WhatsApp before it takes effect.