PRIVACY POLICY

Effective Date: 1st April 2026

At ISOUA, your privacy is treated with the same level of care and precision as your skin. We are committed to protecting your personal data with transparency, integrity, and the highest standards of security.

This Privacy Policy (“Policy”) is issued by ISOUA (“Company”, “we”, “us”, or “our”), acting as a Data Fiduciary in accordance with applicable Indian data protection laws, and governs the collection, processing, storage, use, disclosure, and protection of personal data of users (“you”, “your”, or “Data Principal”).

This Policy is framed in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and other applicable Indian laws.

By using our website or services, you acknowledge that you have read, understood, and consented to this Policy. Where required, consent shall be free, specific, informed, unconditional, and unambiguous, evidenced through clear affirmative action.

Section 1 – Nature And Categories Of Personal Data

We collect and process personal data that is necessary for lawful business purposes. Such data includes personally identifiable information such as your name, mobile number, email address, billing and shipping address, and transaction-related details. We may also process sensitive personal data or information, including financial information, strictly through compliant third-party payment gateways in accordance with the SPDI Rules.

We automatically collect certain technical and behavioural data when you access our website, including IP address, device identifiers, browser specifications, usage patterns, and interaction metrics. To the extent such data can identify an individual, it shall be treated as personal data under applicable law.

Any data that is anonymised, aggregated, or irreversibly de-identified shall not be treated as personal data and may be used for lawful analytical and business purposes.

Section 2 – Purpose Limitation, Lawful Processing, And Legitimate Uses

Personal data is processed only for lawful, specific, and clearly defined purposes, including enabling order processing and fulfilment, facilitating secure payments, providing customer support, improving website functionality, conducting analytics, ensuring cybersecurity, preventing fraud, and complying with applicable legal and regulatory obligations.

In addition to consent-based processing, we may process personal data without consent where permitted under the legitimate uses provisions of the DPDP Act, including for purposes such as compliance with law, responding to medical emergencies, employment-related purposes, fraud prevention, network and information security, and other uses expressly permitted under applicable law.

We adhere to the principles of purpose limitation and data minimisation and do not process personal data beyond what is necessary for the purposes stated herein.

Section 3 – Cookies, Tracking & Ad Technologies

We use cookies and similar technologies to enhance your experience on our website. These technologies support essential website functionality, analytics such as Google Analytics, and advertising and re-marketing services such as Meta Pixel and Google Ads. They help us understand user behaviour, improve performance, and display relevant advertisements. You may control or disable cookies through your browser settings, although doing so may affect certain features or functionality of the website.

Section 4 – Consent, Notice, And Withdrawal

We provide clear notice at the time of data collection specifying the nature of personal data collected, the purpose of processing, and your rights as a Data Principal. Consent is obtained where required under applicable law.

You may withdraw your consent at any time by contacting us. Upon withdrawal, we shall cease processing your personal data unless such processing is required for compliance with legal obligations, enforcement of contractual rights, prevention of fraud, or other legitimate uses permitted under law. Withdrawal of consent may affect the availability of certain services.

Section 5 – Data Sharing, Processors, And Disclosures

We do not sell or rent personal data. Personal data may be shared with authorised data processors and service providers strictly on a need-to-know basis and subject to contractual obligations ensuring confidentiality, security, and compliance with applicable law. Such entities may include payment processors, logistics partners, cloud service providers, analytics vendors, and customer support platforms.

We may disclose personal data where required to comply with applicable law, judicial orders, or lawful governmental requests, or where necessary to enforce our rights, prevent fraud, investigate violations, or protect the safety of users or the public.

Section 6 – Cross-border Data Transfers

Where personal data is transferred outside India, such transfers shall be undertaken only to jurisdictions permitted under applicable law and subject to appropriate safeguards to ensure a level of data protection comparable to that required under Indian law. We ensure that such transfers are governed by contractual and technical safeguards, including confidentiality obligations and security standards.

Section 7 – Data Storage, Retention, And Deletion

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected or as required under applicable legal, regulatory, taxation, or accounting obligations. Upon completion of such purposes, personal data shall be securely deleted, anonymised, or archived.

We conduct periodic data audits to ensure that personal data is not retained longer than necessary and that retention practices remain compliant with applicable law.

Section 8 – Information Security And Accountability

We implement reasonable security practices and procedures in accordance with Section 43A of the Information Technology Act, 2000 and the SPDI Rules. These include administrative, technical, and physical safeguards such as encryption, secure infrastructure, access controls, internal governance policies, employee confidentiality obligations, and periodic security assessments.

We maintain internal accountability mechanisms, including data access controls, audit logs, and periodic reviews, to ensure compliance with applicable data protection laws.

Section 9 – Personal Data Breach Management

In the event of a personal data breach, we shall undertake prompt remedial actions, including containment, assessment, and mitigation. Where required under applicable law, we shall notify the relevant authorities and affected Data Principals without undue delay.

We maintain documented incident response procedures to detect, investigate, and address data breaches in compliance with applicable legal requirements.

Section 10 – Rights Of Data Principals

In accordance with the Digital Personal Data Protection Act, 2023, you have the right to access your personal data, request correction or updating of inaccurate data, request erasure of personal data, withdraw consent, and seek grievance redressal.

Requests submitted by Data Principals shall be acknowledged and responded to within 15 to 30 days, or within such shorter period as may be prescribed under applicable law, subject to verification of identity and legal requirements.

Section 11 – Children’s Data

We do not knowingly collect or process personal data of individuals under the age of 18 without verifiable parental or guardian consent. If such data is identified, we shall take immediate steps to delete it in accordance with applicable law.

Section 12 – Third-party Links And Services

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such third parties. Users are advised to review the privacy policies of such external platforms before providing any personal data.

Section 13 – Grievance Officer And Redressal Mechanism

In accordance with applicable Indian laws, including the Information Technology Act, 2000 and the DPDP Act, the Company has appointed a Grievance Officer.

Grievance Officer (Appointed under IT Act & DPDP Act): ISOUA Compliance Officer
Email: isoua.help@gmail.com
Address: Delhi, India

All grievances shall be acknowledged within a reasonable timeframe and resolved within 30 days from the date of receipt, in accordance with applicable legal requirements.

Section 14 – Policy Updates And Governing Law

This Policy may be updated periodically to reflect changes in legal, regulatory, or operational requirements. Updates shall become effective upon publication on our website. Continued use of our services constitutes acceptance of the revised Policy.

This Policy shall be governed by and construed in accordance with the laws of India, and any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts in Delhi, India.

We respect your privacy. Your data is used only to enhance your experience with ISOUA and will never be sold.

Section 15 – Contact Information

For any questions regarding these Policies, you can reach us at:

ISOUA
Email: support@isoua.com
Website: www.isoua.com

Thank you for choosing ISOUA. Your trust inspires us to create skincare that helps your skin look and feel its best every day.

For support or inquiries, contact us at isoua.help@gmail.com or visit www.isoua.com

ISOUA – The Science of Skin Rejuvenation