Privacy Policy - GemsMantra

This website, https://gemsmantra.com ("Website"), is owned and operated by Astro Arun Pandit Private Limited (CIN: U93010UP2022PTC161029; hereinafter referred to as "Astro Arun Pandit", "GemsMantra", the "Company", "we", "us" or "our"), having its registered office at Plot No. 406, Gali No. 2, Krishna Puri, Chhapeda, Kanpur, Uttar Pradesh – 208025, India. As the entity that determines why and how your personal data is processed, we act as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and you — the individual whose data we process — are the Data Principal.

The protection of your personal data is of paramount importance to us. We conduct our business in strict adherence to the data-privacy and data-security laws applicable in the jurisdictions where our products are distributed, including the DPDP Act, 2023, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). This Privacy Policy is published in accordance with Rule 3(1) of the Information Technology (Intermediaries Guidelines) Rules, 2011 and the SPDI Rules, 2011, which require the publishing of a privacy policy for the collection, use, storage and transfer of sensitive personal data or information. It explains what personal data we collect, why we collect it, how it may be used and disclosed, how you can control it, and the measures we take to protect it. Please read it together with our Terms & Conditions and other policies on the Website.

1. Personal Data We Collect

We collect personal data that you provide directly, data collected automatically from your device, and data generated when you interact with our products, calculators and support team. We collect only what is needed for the purposes set out in Section 2.

2. Lawful Purposes & Consent

We process your personal data only for lawful, specified purposes and, where the DPDP Act requires it, on the basis of your consent or a legitimate use permitted by law. Our purposes are:

We rely on your consent for optional processing (such as marketing and the use of sensitive birth details), and on the necessity of performing our contract with you and our legitimate business interests (such as fraud prevention and record-keeping) and legal obligations (such as tax and accounting law) for the rest. You confirm that the information you provide is authentic, correct and current; we are not responsible for consequences arising from inaccurate information you supply.

3. How We Use & Share Your Data

We do not sell your personal data. We share it only with the categories of recipients below, only to the extent needed, and under confidentiality and data-protection obligations. All approved third-party providers go through a data-protection vetting process before selection and are bound by applicable data-privacy laws, confidentiality terms and this Privacy Policy.

4. Cookies & Tracking

We use cookies and similar technologies to keep the Website working, remember your preferences, understand usage, and support marketing. You can control or disable cookies through your browser settings — for more information visit allaboutcookies.org. Please note that disabling some cookies may affect how the Website functions.

Do Not Track: please note that we do not currently alter our data-collection and usage practices when we receive a Do-Not-Track signal from your browser.

5. Data Retention

We retain your personal data only for as long as necessary for the purposes it was collected, or as required to comply with legal, tax, accounting and regulatory obligations, to resolve disputes and to enforce our agreements. Order and invoice records are retained for the period required under applicable tax and company law. When your data is no longer required and no legal obligation compels us to keep it, we will erase or anonymise it. You may request deletion of your data at any time (see "Your Rights"), subject to these legal retention requirements.

6. Your Rights as a Data Principal

Under the DPDP Act, 2023 and applicable privacy laws, you have the following rights over your personal data — regardless of where you reside. To exercise any right, contact our Grievance Officer using the details in Section 10; we will verify your identity before acting on the request.

To opt out of marketing communications specifically, unsubscribe from any email, reply STOP to a message, or use our Data-Sharing Opt-Out page. We will not charge you for exercising these rights and will respond within the timelines required by law.

7. Data Security

We implement reasonable security practices and procedures designed to protect your personal data against unauthorised access, alteration, disclosure or destruction, in line with the SPDI Rules, 2011. These include secure hosting, access controls limiting data to personnel who need it, encryption in transit for payment and account pages, and contractual data-protection obligations on our service providers. Payment details are handled directly by PCI-compliant payment gateways and are not stored on our servers. While we work hard to protect your data, no method of transmission or storage over the internet is completely secure; in the unlikely event of a personal-data breach that affects you, we will act in accordance with applicable law.

8. Children's Data

The Website and our services are intended for users aged 18 years and above. We do not knowingly collect personal data of a child (a person under 18) or of a person with a disability who has a lawful guardian, without the verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you are under 18, please use the Website only with the involvement and consent of your parent or guardian. If you believe a child's data has been shared with us without proper consent, please contact our Grievance Officer immediately and we will take appropriate steps to delete it from our systems.

9. Cross-Border Data Transfer

GemsMantra ships to customers in India and internationally. Where we use service providers (such as hosting, analytics or payment processors) whose systems are located outside India, your personal data may be processed or stored outside your country of residence. Where such transfers occur, we take steps to ensure your data continues to receive protection consistent with this Policy and applicable law, and we transfer data only to jurisdictions that are not restricted under the DPDP Act. By using the Website, you consent to such transfer, storage and processing as described here.

10. Grievance Officer & Contact

If you have questions about this Policy, wish to exercise your rights, or would like to make a complaint about how your data is handled, please contact our Grievance Officer. We aim to acknowledge your request within 48 hours and resolve it within 30 days, or sooner where the law requires.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal and regulatory requirements. Any updates take effect when posted on this page, and the "last updated" date below will be revised. Where changes are significant, we will take reasonable steps to notify you. We encourage you to review this page periodically. Your continued use of the Website after an update constitutes acceptance of the revised Policy.

This Privacy Policy was last updated 9 July 2026.