Scope and data fiduciary

This Privacy Policy applies to personal data processed through www.zebrs.com, associated customer-support channels and services that expressly link to this Policy.

Zebrs India (OPC) Private Limited (“Zebrs”, “we”, “us” or “our”) determines the purpose and means of processing covered by this Policy and acts as the data fiduciary for that processing. An independent bank, NBFC, payment provider, logistics company or other third party may separately act as a data fiduciary for processing it controls under its own privacy notice.

Personal data we may collect

The data collected depends on how you interact with us and which services you choose.

How we collect personal data

• Directly from you when you register, shop, place an order, make a payment, apply for an available financing option, contact support or participate in a promotion.
• Automatically through cookies, pixels, logs and similar technologies when you use the Website.
• From service providers and partners such as payment gateways, logistics providers, financial partners, identity-verification providers, fraud-prevention providers and customer-support vendors.
• From lawful public or authorised sources where necessary for verification, fraud prevention, compliance or dispute resolution.

Please provide only data that is accurate and that you are authorised to share.

Why we process personal data

We process personal data for specified purposes, with your consent where required, to perform requested services, and for uses permitted under applicable law. These purposes include:

• creating and managing your account;
• displaying products and personalising relevant shopping features;
• processing orders, invoices, payments, delivery, returns, replacements and refunds;
• facilitating an EMI or finance journey you choose to initiate;
• communicating transaction, security and service updates;
• providing customer support and resolving complaints;
• detecting, investigating and preventing fraud, misuse and security incidents;
• improving the Website, products, operations and customer experience through analytics;
• sending marketing communications where you have consented or where otherwise permitted by law; and
• meeting legal, tax, accounting, regulatory, audit and dispute-resolution obligations.

Where processing is based on consent, you may withdraw that consent as described below. Withdrawal does not affect processing already completed lawfully and may limit services that require the relevant data.

Payments, EMI and financial partners

When you select a payment or financing option, relevant data may be sent to or received from the chosen provider to verify identity, assess eligibility, process payment or credit, prevent fraud, service the transaction and manage refunds or cancellations.

A financial partner may conduct KYC, obtain credit-bureau information with valid authorisation, assess creditworthiness, make an independent approval decision and report repayment information as permitted by law. Zebrs does not control or guarantee that decision. Review the partner’s consent request, Key Fact Statement and privacy notice before proceeding.

Payment credentials are generally entered on secure systems operated by authorised payment providers. Zebrs may receive transaction references, status and limited masked details, but does not need your full card PIN, UPI PIN, net-banking password or OTP through calls or messages.

When and with whom we share data

We do not sell or rent personal data for money. We may share only the data reasonably necessary for the relevant purpose with:

• payment gateways, banks, NBFCs and financing partners selected for a transaction;
• logistics, warehousing, installation and delivery partners;
• technology, cloud hosting, analytics, communications, customer-support, security, identity-verification and fraud-prevention vendors;
• manufacturers, authorised service centres or warranty providers when required to support a product;
• professional advisers, auditors and insurers under appropriate confidentiality obligations;
• our group entities where necessary for shared operations and permitted by law;
• government authorities, regulators, courts or law-enforcement bodies when disclosure is lawfully required; and
• a buyer, investor or successor in connection with a genuine merger, restructuring, financing or transfer of business, subject to appropriate safeguards and applicable law.

Our service providers are expected to process data only for authorised purposes and apply appropriate protection. Independent providers remain responsible for processing they determine themselves.

Cookies, analytics and advertising

Cookies and similar technologies help the Website function, remember preferences, secure sessions, measure performance and understand how users interact with our services.

• Essential cookies support login, cart, checkout, security and other core functions.
• Preference cookies remember choices such as language or saved settings.
• Analytics cookies help measure traffic, errors and Website performance.
• Advertising cookies or pixels may measure campaigns or show more relevant advertising, subject to available consent controls and applicable law.

You can manage non-essential cookies through available cookie controls or browser settings. Blocking some cookies may affect Website functionality. Third-party analytics and advertising providers may process identifiers under their own privacy terms.

Data security and breach response

We use reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, alteration, disclosure, loss or misuse. Measures may include access controls, encryption or masking where appropriate, secure transmission, monitoring, backups, vendor safeguards and staff access restrictions.

No internet transmission or storage method can be guaranteed completely secure. You should use a strong password, protect your device and never share OTPs, PINs or passwords. If a personal-data breach occurs, we will assess it, take appropriate mitigation steps and notify affected individuals and authorities where required by applicable law.

How long we retain data

We retain personal data only for as long as reasonably necessary for the stated purpose, your active relationship with us, and applicable legal, tax, accounting, fraud-prevention, warranty and dispute-resolution requirements.

Retention periods vary by data type. Order, invoice, payment, support and compliance records may be kept for legally required periods even after account closure. When data is no longer required, we take reasonable steps to delete, anonymise or securely dispose of it, subject to backup cycles and lawful retention obligations.

Your privacy rights and choices

Subject to applicable law and verification of your request, you may have the following rights:

To exercise a right, contact us using the details in Section 16. We may request reasonable information to verify your identity and protect your account. Certain requests may be limited where an exception or legal obligation applies. If you withdraw consent for data essential to an order or requested service, we may be unable to continue that service.

Marketing preferences

You can opt out of promotional emails by using the unsubscribe link and may request changes to other marketing preferences through customer support. We may still send essential account, order, payment, delivery, security, policy and service communications that are not promotional.

Children’s privacy

The Website is intended for use by adults capable of entering into a contract. We do not knowingly seek to process a child’s personal data for purchasing or financing without the involvement and legally required verifiable consent of a parent or lawful guardian. Financing facilities are not intended for children.

If you believe a child has provided personal data without appropriate authorisation, contact us so we can assess and take required action.

International processing

Some technology or service providers may process or store data outside your state or outside India. Where personal data is transferred internationally, we will take steps required under applicable Indian law and respect any transfer restrictions notified by the Government of India.

External websites and services

The Website may link to third-party websites, apps or services. Their privacy practices are controlled by them, not by this Policy. Review the relevant third party’s privacy notice before providing personal data. A link does not by itself mean we endorse or control that service.

Changes to this Policy

We may update this Policy when our services, data practices or legal obligations change. The latest version will be posted here with an updated effective date. If a change materially affects how we use personal data, we will provide an appropriate notice and obtain fresh consent where required by law.

Contact and privacy grievances

For privacy questions, consent withdrawal, rights requests or complaints, contact the person responsible for privacy queries using the details below. Please explain your request and include sufficient information for us to verify and respond securely.

We will acknowledge and address requests within the period required by applicable law. If you are dissatisfied after using our grievance process, you may pursue the remedy available before the competent authority under applicable law.