Privacy Notice

DAWN HAVEN JEWELLERY PRIVATE LIMITED (VIXII) (“We”, “Our”, “Us”, or “Company”) understands and respects that you care about your personal data and how it is used. We value your trust in sharing your personal data with us and are dedicated to protecting your personal data when you visit our website https://www.vixiiworld.com, as further described in this Privacy Notice.

Scope:This Privacy Notice (“Notice”) applies to personal consumer data collected by the Company through the Website. This Privacy Notice describes in detail: (i) the types of data we collect about you; (ii) how we use your data (the purposes for processing your data); (iii) with whom we share it; (iv) for how long we retain the data; (v) the choices and rights you have with regard to your data; (vi) how we protect your data; (vii) how we store your data; and (viii) how you can contact us about our privacy practices and grievance redressal.

This Notice is in line with the standards expected by the European General Data Protection Regulation (EU GDPR) and the Digital Personal Data Protection Act, 2023 (DPDPA) of India. DAWN HAVEN JEWELLERY PRIVATE LIMITED (VIXII) will be the Data Controller / Data Fiduciary responsible for processing any personal data.

For users in India, the Company is a “Data Fiduciary” and you are a “Data Principal” under the DPDPA. Where you are a child, or a person with disability who has a lawful guardian, “Data Principal” includes your parent or lawful guardian. Under the DPDPA, we process your personal data only (i) with your consent, or (ii) for a “legitimate use” listed in section 7 of the DPDPA. The DPDPA does not recognise “legitimate interests” or “contract” as grounds for processing; where these are mentioned in this Notice, they apply only to processing governed by the GDPR.

Personally identifiable information (“PII”) is any data that could potentially identify a specific individual. Protecting PII is essential for personal privacy, data privacy, data protection, information privacy and information security. Under the DPDPA, “personal data” means any data about an individual who is identifiable by or in relation to such data, and this Notice applies to all such data.

We may source, use and / or otherwise process your personal data in different ways. In all cases we are committed to protecting your personal data.

We have described below how we obtain your personal data and how we treat it:

Website Visitors:

• Sources of personal data.
• Personal data that we collect and process.
• Why we collect your personal data and what is the lawful basis for it?

Sources of personal data:

We may obtain your personal data from the following sources:

• from you directly (for example, when you purchase our goods or services online, or at the time of subscribing to any services offered on our Website, including but not limited to any e-newsletter and / or e-promotions); and/or
• from your device or browser.

If you contact us, we may keep a record of that correspondence.

Personal data that we collect & process:

• Name;
• Email address;
• Phone number;
• Communication preferences;
• Password;
• Home address;
• Date of birth
• Payment preference and details (for example, bank account details, credit card or PayPal details supplied to us by you);
• Purchase history;
• Cookie data (for more information please see our Cookie Notice);
• Preferences regarding online marketing; and/or
• IP address.

Why we collect your personal data & what is the lawful basis for it?

Where we rely on your consent, we will ask for it through a separate, stand-alone notice at the point of collection, in clear and plain language, which lists the personal data and the specific purpose, and you give it by a clear affirmative action (we do not use pre-ticked boxes). The notice will be available in English and, on request, in any language listed in the Eighth Schedule to the Constitution of India. You may withdraw your consent at any time, as easily as you gave it, by [using the ‘unsubscribe’ link in our emails / your account settings / the cookie settings panel] or by emailing us at care@vixiiworld.com, or through a Consent Manager registered with the Data Protection Board of India. Withdrawal does not affect processing carried out before it; after withdrawal, we and our Data Processors will stop processing, and will erase, the personal data concerned within a reasonable time, unless its retention is required by law. If you object to our use of your personal data under the GDPR, including for direct marketing, please email us at care@vixiiworld.com.

We will keep your personal data only for as long as is necessary for the purposes for which it was collected in connection with your requests via our Website or your use of our website.

• We do not sell your personal data to third parties.
• We may share your personal data with DAWN HAVEN JEWELLERY PRIVATE LIMITED (VIXII)’s affiliates, if any;
• Our partner organizations and service providers;
• Organizations that provide a service to us, whilst ensuring that they are contractually obligated to keep your personal data confidential and in compliance with the GDPR, DPDPA and other relevant data protection laws;
• The following types of service providers:
  • technical support providers who assist with our Website and IT infrastructure;
  • our payment solutions providers for processing payments;
  • third party software providers, including ‘software as a service’ solution providers, where the provider hosts the relevant personal data on our behalf;
  • professional advisers such as solicitors, accountants, tax advisors, auditors and insurance brokers;
  • providers that help us generate and collate reviews in relation to our goods and services; and/or
  • our advertising and promotional agencies and consultants and / or those organizations selected by us to carry out marketing campaigns on our behalf.

We engage Data Processors only under a valid contract, and we remain responsible for the personal data they process on our behalf. On request, we will provide you with the identities of the other Data Fiduciaries and Data Processors with whom we have shared your personal data, and a description of the data shared.

As stated in our Terms and Conditions, to register and make purchase(s) on our Website you must meet the ‘Age Requirements’ (as defined in our Terms and Conditions). If you are a ‘Minor’ or ‘Child’, i.e. an individual who does not meet the Age Requirements, then you may not register on our website, and only your parent / guardian can register on the website on your behalf, agree to all website terms and enable access to you under their guidance and supervision.

For the Privacy Notice and use of our Website, an individual below the age of 18 years in India and below the age of 16 years in Europe is a minor and is prohibited from using the Website without the supervision and consent of their legal guardian / parent. The same applies to a person with disability who has a lawful guardian.

We do not knowingly collect personal data of a child / minor. Before processing any personal data of a child in India (or of a person with disability who has a lawful guardian), we will obtain the verifiable consent of the parent or lawful guardian, and will verify that the person identifying as the parent is an identifiable adult, using reliable identity and age details already available to us or a virtual token issued by an entity entrusted by law or the Government (for example, through DigiLocker), as required by section 9 of the DPDPA and Rule 10 of the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”). We do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children, and do not process personal data in a manner likely to have a detrimental effect on a child’s well-being. If you are a parent / guardian and believe that your child has provided us with personal data without your consent, please contact us at care@vixiiworld.com, and we will erase it.

We may disclose your personal data as permitted by law, in order to investigate, prevent or take action regarding illegal activities, suspected fraud, violation of our intellectual property rights, situations involving potential threats to the physical safety of any person, violation of our Terms and Conditions or other agreements, or as required by law.

Company Mergers and Takeovers: We may transfer your personal data to potential purchasers and their advisors, subject to appropriate confidentiality obligations, in the event we decide to dispose of all or parts of our business.

We may transfer the personal information we collect to countries with laws that may offer a different level of protection compared to the laws in the country in which you reside.

Personal data of users in India may be transferred outside India, except to any country or territory that the Central Government restricts by notification under section 16 of the DPDPA, and subject to any requirements the Central Government may specify under Rule 15 of the DPDP Rules. Where personal data is transferred from the UK / EEA, we use appropriate safeguards, such as standard contractual clauses, a copy of which you may request by contacting us at care@vixiiworld.com.

The GDPR / DPDPA provides you with certain rights in relation to the processing of your personal data, including to:

• Request access to personal data about you (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal data we hold about you, and to check that we are lawfully processing it.
• Request rectification, correction or updating to any of the personal data that we hold about you. This enables you to have any inaccurate or outdated information we hold about you corrected.
• Request personal data provided by you to be transferred in a machine-readable format (‘data portability’).
• Request erasure of personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove personal data where you have exercised your right to object to processing (see below).
• Request a restriction on processing of your personal data. This enables you to ask us to suspend the processing of personal data about you (e.g. if you want us to establish its accuracy or the reason for processing it).
• Object to the processing of your personal data in certain circumstances. This right may apply where the processing of your personal data is based on the legitimate interests of Company, as explained above.
• Withdrawal of consent. If we rely on your consent (for example, when setting cookies on your device or for direct marketing), you may withdraw your consent at any time.
• Additional rights for users in India (DPDPA): (a) to obtain a summary of the personal data we process about you and the processing activities, and the identities of all other Data Fiduciaries and Data Processors with whom it has been shared, with a description of the data shared; (b) to have your personal data corrected, completed, updated or erased; (c) to have your grievances redressed by us; and (d) to nominate another individual to exercise your rights in the event of your death or incapacity. The rights to data portability, restriction and objection described above arise under the GDPR and are not provided under the DPDPA.

These rights listed may be subject to various conditions under applicable data protection and privacy legislation. To exercise any of these rights or raise a grievance, please contact us at care@vixiiworld.com, giving your name and the email address or order number associated with your account, so that we can identify you. We will respond to requests and grievances from users in India within 15 days and, in any event, within 90 days of receipt, as required by the DPDP Rules. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India, after first exhausting our grievance redressal process.

We maintain administrative, technical and physical safeguards designed to protect the personal data we have about you against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. However, no data transmission or storage, or use of the Internet, can be guaranteed to be 100% secure.

These safeguards include [encryption or masking of personal data, access controls, logging and monitoring of access, and data backups], and we require our Data Processors to maintain equivalent safeguards. If a personal data breach occurs, we will inform affected users in India without delay, describing the breach, its likely consequences, the steps we have taken and that you can take to protect yourself, and how to contact us, and we will report the breach to the Data Protection Board of India as required by the DPDPA and the DPDP Rules.

Your data will be retained as long as you access and / or have an account on our website and continue to use our services. This data will include your purchase history, transactions and personal information. Thereafter, we retain it only as long as required for the purposes described in this Notice or to comply with legal, tax, accounting or regulatory requirements. For users in India, we will erase your personal data (and require our Data Processors to erase it) when you withdraw your consent or when it is reasonable to assume that the specified purpose is no longer being served, unless retention is required by law. We will, however, retain personal data, associated traffic data and logs of processing for at least one year from the date of processing for the purposes specified in the DPDP Rules, after which they will be erased unless longer retention is required by law.

From time to time, we may change our Privacy Notice to reflect changes to our privacy practices and services. If we modify the Privacy Notice, we will update the ‘Last Modified Date’ and the changes will be effective as of the date we post. For material changes, we will notify you by posting a prominent notice on our Website indicating at the top of the Privacy Notice when it was most recently updated.

If you have any questions or comments about this Privacy Notice or the manner in which we or our service providers treat your personal information, would like to exercise your choices or would like us to update information we have about you or your preferences, please contact us at:

(Details of the Data Protection Officer, if appointed, or of the person who is able to answer, on our behalf, questions about the processing of your personal data and who handles grievances for users in India, as required by Rule 9 of the DPDP Rules)

Name: Prabha Karan
By email: care@vixiiworld.com