Privacy policy

Effective date: 25 September 2026
Last updated: 25 September 2026
Policy version: RHAMA-PP-2026-09-25-v1

This Privacy Policy explains how Taarakesh Tech Private Limited, trading as RHAMA ("RHAMA", "we", "us" or "our"), collects, uses, shares, stores and protects personal data when you visit https://rhama.co, use our online store, start or complete checkout, buy a product, contact us, or otherwise interact with us.

This Policy also explains your choices and how to raise a privacy request or complaint. It should be read with our Terms of Service, Shipping Policy, Return, Exchange and Refund Policy, and any short notice or consent choice shown at the point where data is collected.

1. Who is responsible for your personal data

For personal data covered by this Policy, the business responsible for deciding why and how it is processed is:

Taarakesh Tech Private Limited, trading as RHAMA
Registered/business address: B16, Portion-B, Keshopur Industrial Area, West Delhi, Delhi 110018, India
Website: https://rhama.co
Privacy and customer-care email: support@rhama.co
Customer-care telephone: +91 98108 36934

Our store is hosted by Shopify. Some providers may process personal data under their own privacy terms when they provide an independently controlled service, such as payment authentication or a third-party website. Section 10 explains the main recipient categories.

2. Scope and governing privacy standards

This Policy applies to RHAMA's website, online store, checkout, customer accounts, order fulfilment, support, returns, complaints and RHAMA-controlled communications in India. It does not govern an unrelated website, application or service operated independently by another organisation.

We process personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 to the extent they remain applicable, and the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 to the extent their relevant provisions are in force from time to time. We also apply relevant consumer-protection and telecom requirements to our online disclosures and communications.

We intend the protections and choices stated in this Policy to operate as RHAMA commitments even where a particular statutory provision is not yet in force. Nothing in this Policy reduces a right or remedy that cannot lawfully be excluded.

3. Meaning of personal data

"Personal data" means data about an identifiable individual. It includes data that identifies you directly and data that can identify you when combined with other information. Data that has been irreversibly anonymised so that no individual can reasonably be identified is not personal data.

4. Personal data we collect

The data collected depends on how you interact with RHAMA. We may collect the following categories only where relevant to the stated purpose.

4.1 Identity and contact data

  • name;
  • telephone or mobile number;
  • email address;
  • billing and delivery address, landmark, city, state and postal code; and
  • recipient details where you ask us to deliver a gift or order to another person.

If you provide another person's details, you must be authorised to do so and must make this Policy available to that person where appropriate.

4.2 Account and preference data

  • customer or account identifier;
  • login and account-security information;
  • saved addresses and account settings;
  • wishlist, product and communication preferences; and
  • records of consent, opt-in, opt-out, withdrawal and suppression choices.

4.3 Cart, order and transaction data

  • products viewed, searched for, selected, placed in a cart or purchased;
  • checkout progress and incomplete-checkout status;
  • order number, quantity, price, discount, tax and invoice information;
  • payment method, payment status and transaction reference;
  • Cash on Delivery verification and status;
  • fulfilment, courier, tracking and proof-of-delivery information; and
  • cancellation, return, exchange, replacement and refund information.

Payment providers process card, banking, UPI, wallet or other payment credentials needed to authorise a payment. RHAMA does not intentionally collect or store your full card number, card verification value, UPI PIN, internet banking password or one-time banking password. You should never send those credentials to RHAMA by email, chat, WhatsApp or telephone.

  • IP address and approximate location derived from it;
  • browser, operating system, device type and language;
  • cookie, session and similar online identifiers;
  • referral source and pages, products or features used;
  • date, time, duration and interaction events; and
  • diagnostic, security, error and fraud-risk signals.

4.5 Communications and customer-support data

  • email, chat, WhatsApp, SMS and other messages exchanged with us;
  • the date, time, source, purpose and outcome of customer-service or telephone contact;
  • call recordings where a call is recorded after a clear recording notice;
  • questions, requests, complaints and our responses; and
  • identity-verification information reasonably needed to handle a data request or protect an account.

4.6 Return, refund and complaint evidence

Where you request support, a return, replacement or refund, we may collect your order details and relevant photographs or videos of the product, packaging, shipping label, invoice, batch information, damage or other issue. Please avoid including unrelated people, documents or sensitive information in such media.

4.7 Reviews and content you submit

We may collect a rating, review, photograph, video, profile name or other content that you choose to submit, together with information needed to verify that it relates to a genuine interaction or purchase. Published content may be visible to other people. Do not submit content that you do not want made public.

We do not ask you to provide health, biometric, government-identity, sexual, political or religious information to browse or buy ordinary RHAMA products. Please do not send such information unless we specifically request information that is lawful and necessary for a clearly explained purpose.

5. How we collect personal data

We may collect personal data:

  1. Directly from you, including when you browse, create an account, add a product to the cart, start or complete checkout, place an order, contact us, submit a review, or request a return or refund.
  2. Automatically from your device, through cookies, pixels, local storage, logs and similar technologies when you use our website or checkout.
  3. From providers acting for us, including Shopify, Shiprocket Fastrr, payment providers, telephony or messaging providers, customer-support tools, fraud-prevention providers and couriers.
  4. From platforms or partners you use, where you interact with a RHAMA advertisement, social-media feature, marketplace or referral and the platform is permitted to provide relevant information to us.
  5. From lawful public or official sources, where necessary for fraud prevention, dispute handling, regulatory compliance or protection of legal rights.

The contact details displayed or auto-filled in checkout may originate from details you previously entered in the store, checkout provider, browser, device or compatible account. An auto-filled number or email address is not by itself permission for optional marketing or incomplete-checkout outreach.

6. Why we use personal data

We use personal data only for a specific, lawful purpose. The main purposes, data involved and basis are described below.

Purpose Typical data Why processing is permitted
Display and operate the website, cart and checkout device, usage, session, cart and contact data to provide the service you request and maintain a secure store
Create and manage an account contact, login, preferences and account activity to provide the account you request and protect it
Verify, accept and process an order contact, cart, order, payment-status and fraud-risk data to take steps requested by you and perform the purchase contract
Collect payment or support Cash on Delivery order, payment-status, transaction reference and verification data to process the transaction, prevent fraud and meet legal obligations
Pack, ship and deliver an order recipient, address, order, courier and tracking data to perform the purchase contract
Handle support, cancellation, return, replacement or refund contact, order, messages, evidence and payment-status data to provide requested support, perform our contract and meet consumer-law duties
Issue invoices and maintain business records identity, contact, order, tax, payment-status and refund data to comply with tax, accounting and legal obligations
Keep the service secure and prevent misuse device, account, transaction, communication and risk data to protect customers, RHAMA and the integrity of the service
Improve store reliability and customer experience aggregated or minimised device, usage, order and support data to diagnose problems and improve services without using more data than necessary
Provide incomplete-checkout assistance contact, cart, checkout and consent record only after a separate optional affirmative choice, for the limited period in Section 8.2
Send marketing or personalised advertising contact, preferences, cookie and interaction data only where we have the consent or other permission required for the relevant channel and use
Establish, exercise or defend legal rights order, communication, consent, complaint, audit and security data to respond to disputes, lawful requests and legal proceedings

Where consent is the basis, you may refuse or withdraw it without losing access to a purchase or service that does not require that optional processing. Withdrawal does not make earlier lawful processing invalid.

Where data is needed to complete a purchase, deliver an order, issue an invoice, prevent fraud or comply with law, we may be unable to provide the relevant service if the necessary data is not supplied. We will not make optional marketing permission a condition of purchase.

7. Checkout and payment data

RHAMA uses Shopify for its online store and may use Shiprocket Fastrr for an accelerated checkout. These systems may receive the details needed to display checkout, verify a mobile number, remember compatible details, calculate an order, process payment and create an order.

We seek to collect only information reasonably necessary for checkout and the purposes clearly described at the point of collection. The primary purpose of checkout is to enable a purchase, not to collect leads. A customer must be able to complete a purchase without agreeing to optional marketing or incomplete-checkout contact.

Payment authentication and settlement may be performed by banks, UPI systems, card networks, wallets and payment gateways. Those providers may process data under their own legal and security obligations. RHAMA generally receives a payment status, method, amount and transaction reference rather than the secret credentials used to authorise the payment.

8. Calls, SMS, WhatsApp and email

We separate communications into service communications, incomplete-checkout assistance and marketing. Permission for one category does not automatically permit another.

8.1 Placed-order and requested-service communications

If you place an order or ask us for support, RHAMA and providers acting for us may contact you by telephone call, SMS, WhatsApp or email where reasonably necessary to:

  • send an OTP or security notice;
  • verify an order or Cash on Delivery request;
  • confirm payment status or investigate suspected fraud;
  • provide dispatch, tracking and delivery updates;
  • resolve delivery issues;
  • process a cancellation, return, replacement or refund;
  • provide a product-safety notice or recall; or
  • answer a request you made.

These communications must remain related to the order, safety or requested service. They must not be used as disguised promotional messages.

8.2 Optional incomplete-checkout assistance

RHAMA may contact you about a checkout that you did not complete only when you make a separate, clear and affirmative optional choice for that contact. The choice must identify the purpose and selected channels, such as telephone call, SMS, WhatsApp or email.

Starting checkout, entering or auto-filling a telephone number, requesting or receiving an OTP, accepting the Terms, or reading this Policy does not by itself constitute consent to incomplete-checkout outreach.

The recommended choice shown next to an unticked checkbox is:

Contact me about this incomplete checkout for up to 7 days by phone call, SMS, WhatsApp or email. This is optional, is not required to buy, and I can withdraw at any time.

Where the interface permits channel-level selection, we will honour the specific channels selected. This permission applies for no more than seven days from the relevant checkout or digital inquiry, ends sooner when its purpose is completed, and ends immediately when you withdraw. It is not ongoing marketing permission.

8.3 Optional marketing

Offers, launches, product recommendations and other promotional communications are optional. We may send them only where we have the consent or other permission required by applicable privacy and telecom law. Marketing permission is separate from order processing, customer support and incomplete-checkout assistance, and is not a condition of purchase.

Where available, you may choose individual channels. We will use registered headers, templates, numbers, telemarketers and other controls required by applicable telecom rules. A message about an order must not be converted into a promotion merely because we have your contact details.

8.4 Withdrawing or opting out

You may stop optional communications by:

  • using the unsubscribe, STOP or opt-out method provided in the message;
  • emailing support@rhama.co;
  • calling customer care at +91 98108 36934; or
  • telling our caller that you do not want further optional contact.

We will record and apply the request to RHAMA and instruct relevant providers acting for us. It can take a short operational period to synchronise suppression across systems, but no new campaign should be initiated for you after the request is received. We may retain the minimum contact detail and opt-out record needed to prevent further optional communications.

An opt-out does not stop a communication that remains necessary for an existing order, product safety, fraud prevention, legal compliance or support request.

8.5 Communication evidence and call recordings

To honour choices and resolve complaints, we may keep records of the notice or consent wording, policy version, source, date and time, selected channels, related cart or order identifier, contact attempts, delivery status, outcome, withdrawal and suppression status.

If a call is recorded, the caller must clearly disclose the recording at the start of the call. We restrict access to recordings and use them for quality, training, fraud prevention, dispute handling and compliance. A caller must not claim that a call was recorded if no recording exists.

9. Cookies, analytics and advertising

Our website and providers may use cookies, pixels, tags, local storage and similar technologies for the following purposes:

  • Strictly necessary: security, network management, cart, checkout, payment, fraud prevention and session continuity;
  • Functional: language, location, preferences, chat and account features;
  • Analytics: understanding aggregated site use, errors, performance and customer journeys; and
  • Advertising: measuring campaigns, limiting repetition and, where permitted, personalising advertisements.

You may manage cookies through the consent controls made available on the website and through your browser or device. Blocking necessary cookies may stop the cart, account or checkout from functioning. We will apply consent or opt-out choices to optional analytics and advertising where required by applicable law and supported by the relevant technology.

RHAMA does not sell personal data for money. We may disclose limited device, cookie or shopping-interaction data to analytics and advertising providers when those tools are enabled and the use is permitted. You may request that RHAMA stop optional personalised advertising through support@rhama.co or the website's data-sharing opt-out control where available. Browser-level deletion or a different device may require you to renew that preference.

10. Who receives personal data

We disclose only the data reasonably needed for the relevant purpose. The main recipient categories are:

Recipient Purpose and typical data
Shopify hosting the store, accounts, cart, checkout, orders, security, analytics and store functionality
Shiprocket Fastrr and checkout providers accelerated checkout, mobile verification, cart, order creation and checkout support
Payment gateways, banks, UPI systems, card networks and wallets payment authentication, settlement, refunds, fraud checks and disputes
Courier, warehousing and fulfilment providers packing, shipping, delivery, proof of delivery, reverse pickup and returns
Tata Smartflo or other telephony and messaging providers used by RHAMA order, support and properly authorised checkout or marketing communications, together with communication logs
Tawk.to or another customer-support tool displayed by RHAMA customer chat, support tickets and complaint handling
Email and SMS providers delivery of account, order, support and properly authorised promotional messages
Cloud, security, fraud-prevention, analytics and technical providers secure operation, monitoring, incident response, measurement and service improvement
Advertising platforms campaign measurement and optional advertising where permitted and subject to applicable choices
Professional advisers, auditors and insurers confidential legal, accounting, audit, insurance and dispute support
Government, regulators, law-enforcement bodies and courts a valid legal obligation, lawful request, investigation, or protection of rights and safety

Providers acting for RHAMA are expected to process data only for documented and lawful purposes, apply appropriate safeguards, restrict access and delete or return data when their services end, subject to legal retention. Some payment, platform, courier or communications providers may also have independent legal obligations and publish their own privacy notices.

We may disclose relevant data in connection with a proposed or completed merger, financing, reorganisation, acquisition or sale of business assets, subject to confidentiality, lawful processing and continued protection of personal data. We do not publish a customer's private contact, payment, complaint or order data.

11. Shopify's role

Shopify hosts RHAMA's online store and processes information about use of the store to provide and secure Shopify services. Data submitted through the store is transmitted to Shopify and may be processed in countries where Shopify or its providers operate.

Shopify may separately process information across merchants for features it controls. For more information about Shopify's own processing and available choices, see the Shopify Consumer Privacy Policy and Shopify Privacy Portal.

You may send a request to RHAMA even where Shopify holds the relevant store data. We will handle the portion for which RHAMA is responsible and coordinate with Shopify where reasonably necessary.

12. International processing and transfers

Some providers, including Shopify, cloud, analytics, advertising, support or communications providers, may process data outside India. Where personal data is transferred outside India, RHAMA will use providers and arrangements that permit an appropriate level of protection and will comply with any transfer restriction notified under applicable Indian law.

We will not transfer personal data merely to avoid Indian privacy obligations. The safeguards and purpose restrictions described in this Policy continue to apply to a provider processing data for RHAMA.

13. Retention and deletion

We keep personal data only for as long as needed for the disclosed purpose, legal recordkeeping, security, complaints and disputes. Our normal retention framework is:

Record Normal retention
Incomplete cart or checkout that did not become an order up to 90 days; optional outreach ends within 7 days or earlier on completion or withdrawal
Checkout-contact or marketing consent, notice version, withdrawal and suppression evidence while the permission is used and normally for 5 years after the last relevant action or complaint; a minimal suppression record may be kept longer to honour the opt-out
Order, invoice, tax, payment-status, delivery, cancellation, refund and accounting records normally 8 financial years after the relevant transaction, or longer where required by law or an active dispute
Customer account while active and normally up to 3 years after closure or sustained inactivity, except transaction records retained separately under legal requirements
Customer-support, return and ordinary complaint files normally 3 years after closure
Litigation, regulatory inquiry, chargeback, fraud or material dispute file until the matter and applicable review or limitation periods have ended
Call recording, where recording was disclosed normally up to 180 days; up to 3 years after closure when preserved for a complaint, fraud review or dispute
Website security, access and diagnostic logs normally up to 1 year unless a security incident requires longer preservation
Optional marketing profile until consent is withdrawn, the purpose ends, or after 24 months without meaningful engagement, whichever occurs first, subject to the minimal suppression record
Published review or customer content while published for the relevant purpose; removed or anonymised when no longer needed or following a valid request, subject to legal exceptions

We may keep a record longer where tax, accounting, consumer, telecom or other law requires it; where needed to investigate fraud or a security incident; or where a complaint, chargeback, litigation or regulatory inquiry is pending. We may delete or irreversibly anonymise data earlier where it is no longer needed.

Deletion from active systems may not immediately remove data from secure backup cycles. Backup data remains protected, is not restored for ordinary use, and is deleted or overwritten through the normal backup lifecycle unless preservation is legally required.

14. Security safeguards

RHAMA uses administrative, technical and physical safeguards appropriate to the nature of the data and risk, including as relevant:

  • access controls and least-privilege permissions;
  • authentication and account-security measures;
  • encryption in transit and provider-supported encryption at rest;
  • secure payment processing through specialist payment providers;
  • logging, monitoring, malware and fraud controls;
  • backup, recovery, incident-response and continuity procedures;
  • confidentiality and data-protection obligations for staff and providers;
  • periodic access, provider and security reviews; and
  • deletion, anonymisation and secure disposal controls.

No internet transmission or storage method is guaranteed to be completely secure. You are responsible for protecting your account credentials and OTPs. Please contact us promptly if you suspect unauthorised use of your account or communications that falsely claim to be from RHAMA.

15. Personal-data breaches

If RHAMA becomes aware of unauthorised access, disclosure, alteration, loss or destruction of personal data, we will contain and assess the incident, preserve relevant evidence, take reasonable remediation steps and notify affected individuals and the competent authority when and in the manner required by applicable law.

An incident notice may explain the nature and likely consequences of the breach, measures taken or proposed, recommended safety steps and a contact route for questions, to the extent known and legally permitted.

16. Your rights and choices

Subject to applicable law, identity verification and relevant exceptions, you may ask RHAMA to:

  • confirm whether we process personal data about you and provide a summary or access to that data;
  • identify the purposes and main recipients of that data;
  • correct inaccurate or misleading data;
  • complete incomplete data or update outdated data;
  • erase data that is no longer needed or lawfully retained;
  • withdraw consent for optional processing;
  • stop optional marketing or incomplete-checkout contact;
  • provide information about and a route to challenge a privacy decision;
  • register or update a nominee where that right applies under Indian law; and
  • raise a grievance about our processing or response.

You may also manage account information through available account controls and manage cookies through the website or browser controls described in Section 9.

Rights are not absolute. For example, we may retain invoice or transaction data required by law, preserve evidence of an active complaint, or decline to reveal information that would adversely affect another person's rights. If we cannot fully comply, we will explain the applicable reason unless law prevents us from doing so.

17. How to make a data request

Send your request to support@rhama.co with the subject line Privacy Request. Describe the right you wish to exercise and provide the telephone number or email address associated with your RHAMA interaction and, where relevant, the order number.

We may request proportionate information to verify that the request relates to you or to an authorised person. Do not email passwords, OTPs, full payment-card details or government identity documents unless RHAMA specifically explains why a document is necessary and provides an appropriate submission method. We will not ask for more verification data than reasonably needed.

We will acknowledge the request and respond within the time required by applicable law. Our operating target is to acknowledge a grievance within 48 hours and resolve it within one month. A complex or legally constrained request may require more time where law permits; if so, we will explain the reason and expected next step.

We do not charge for an ordinary, reasonable request. We may decline or limit a request that is fraudulent, abusive, technically impossible, repetitive without new grounds, or not required by law, after documenting the reason.

18. Grievance Officer and escalation

For a privacy concern, contact:

Grievance Officer: J. Singh
Email: support@rhama.co
Grievance telephone: +91 93117 79652
Postal address: B16, Portion-B, Keshopur Industrial Area, West Delhi, Delhi 110018, India

Please include enough information for us to identify the issue, such as the relevant date, channel, order or cart reference and contact detail. Do not post private information publicly.

RHAMA will investigate the source, purpose, consent or order record, communication history, provider logs, opt-out status and policy version relevant to the complaint. We will correct records, stop unauthorised optional contact, instruct relevant providers, or take other remedial action where appropriate.

If you are dissatisfied after using RHAMA's grievance process, you may use any regulatory, telecom, consumer or court remedy available under applicable law, including the Data Protection Board of India once the relevant statutory complaint mechanism applies. This Policy does not prevent you from approaching a competent authority.

19. Children

RHAMA's online store is intended for adults. A person under 18 should use the store only through a parent or lawful guardian. We do not knowingly seek to profile children, send them behavioural advertising or obtain a child's data for an avoidable purpose.

If you believe a child provided personal data without appropriate parental or guardian involvement, contact support@rhama.co. We will verify the report and delete or restrict the data where required, unless retention is necessary to protect the child, complete a lawful transaction or comply with law.

20. Automated checks

Checkout, payment and platform providers may use automated signals to detect fraud, abuse, account compromise or unusual transactions. A high-risk signal may cause additional verification, payment refusal, order review or cancellation. RHAMA does not knowingly make a decision producing a comparable significant effect about a customer solely from sensitive personal data.

You may contact customer care if you believe an automated fraud or security check incorrectly affected your order. We will review information reasonably available to RHAMA, but a bank or payment provider may control its own payment authorisation decision.

21. Third-party websites and public features

Our website may link to a third-party website, social network, payment service or other platform. That third party's privacy terms govern data you provide directly to it. RHAMA does not control an unrelated site's security or data use merely because RHAMA provides a link.

Information you post in a public review, social-media comment or other public feature can be viewed, copied or shared by others. Do not post private order, contact, identity or payment information in a public area.

22. Changes to this Policy

We may update this Policy when our practices, providers, products or applicable law change. We will publish the revised text with a new effective date and version. Where a change materially expands an optional use of previously collected data, we will provide any additional notice or obtain fresh consent required by law rather than relying only on a silent policy update.

The policy version in force when a particular interaction occurred will remain relevant to that interaction. We maintain version and publication records so that the applicable notice can be identified if a question or complaint arises.

23. Contact us

For privacy questions, rights requests or complaints:

  • Email: support@rhama.co
  • Customer care: +91 98108 36934
  • Grievance Officer: J. Singh, +91 93117 79652
  • Postal address: Taarakesh Tech Private Limited, trading as RHAMA, B16, Portion-B, Keshopur Industrial Area, West Delhi, Delhi 110018, India

For account safety, do not send passwords, OTPs, full payment-card details, UPI PINs or internet-banking credentials through these channels.