Privacy Policy

Last updated: 1 July 2026

At Ravi Furnitures, we respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy explains what information we collect when you visit or shop on https://www.ravifurnitures.in, how and why we use it, with whom we share it, how long we keep it, and the rights and choices available to you.

This Policy is published in compliance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the Consumer Protection (E-Commerce) Rules, 2020.

In this Policy, "we", "us", "our" and "Ravi Furnitures" refer to Ravi Furnitures, a sole proprietorship having its principal place of business and manufacturing unit at Mallavelli Industrial Area, Krishna District, Vijayawada, Andhra Pradesh – 521212, India. "You", "your" and "data principal" refer to the person who visits, registers on, or places an order through our website.

By using our website, creating an account, or placing an order, you acknowledge that you have read and understood this Privacy Policy. This Policy does not, and is not intended to, limit any right available to you as a consumer under the Consumer Protection Act, 2019, or as a data principal under the DPDP Act, 2023; such statutory rights always prevail over anything stated here.

1. Who we are (Data Fiduciary)

For the purposes of the DPDP Act, 2023, Ravi Furnitures is the Data Fiduciary that determines the purpose and means of processing your personal data.

• Legal entity: Ravi Furnitures (sole proprietary concern)
• Tagline: Manufacturers & Dealers of All Types of Furniture
• GSTIN: 37AOBPY0245C1Z5 (Andhra Pradesh, GST State Code 37)
• Registered/Principal place of business & manufacturing unit: 10/42, Mallavelli Industrial Area, Krishna District, Vijayawada, Andhra Pradesh — 521111, India
• Branch: Nunna Mango Market, Vijayawada, Andhra Pradesh
• Website: https://www.ravifurnitures.in

Our designated Grievance Officer for privacy/data-protection matters and for consumer grievances under the Consumer Protection (E-Commerce) Rules, 2020, is named in Section 13 below. Commercial disclosures (pricing, delivery, returns, warranty, country of origin, and related E-Commerce-Rules information) are set out on our separate Terms & Conditions and Returns & Refunds pages; this Privacy Policy addresses how we handle your personal data.

2. What information we collect

We collect only the information we need to operate our store, fulfil your orders, and serve you well. The categories of data we collect are:

a. Identity and contact details

• Your name, email address, and mobile number
• Your delivery and billing addresses (including PIN code, city, and state)
• GSTIN (only if you choose to provide it for a business/GST invoice)

b. Account credentials and authentication

• Your login email or mobile number used to access your account
• We authenticate you using one-time passwords (OTP) sent to your email or mobile number, and Google sign-in; we do not use or store reusable account passwords. Authentication secrets are handled securely.
• Where you sign in using OTP or Google sign-in, we receive only the basic profile information needed to authenticate you (such as your name and email address)

c. Order and transaction history

• Products viewed, added to cart, wishlisted, and purchased
• Order numbers, GST tax invoices, amounts, taxes (CGST/SGST/IGST), HSN codes, and delivery records
• Returns, replacements, cancellations, refunds, gift cards, and Protection Plan records

d. Payment information

• The amount, currency, payment method type, and the success/failure status of a transaction
• We do not collect or store your full card number, CVV, card expiry, UPI PIN, or net-banking credentials. All online payments are processed directly by our payment gateway, Razorpay (see Section 4).

e. Communications

• Messages, queries, feedback, reviews, and support tickets you send to us
• Records of your correspondence with our support and grievance teams

f. Device and usage data

• IP address, browser type and version, device type, operating system
• Pages visited, time spent, referring URLs, and similar website-analytics data
• Cookies and similar technologies (see Section 5)

A note on data categories. Under the DPDP Act, 2023, all personal data is protected uniformly; the Act does not retain the SPDI Rules' separate "sensitive personal data" category, and we apply DPDP-grade protection to all personal data we hold. (The SPDI Rules continue to be relevant only to our reasonable-security-practices obligation under the IT Act — see Section 8.) As a matter of policy, we do not ask for, and request that you do not share, special-category information such as health, biometric, genetic, religious, or caste data, and we do not knowingly collect it.

3. How and why we use your information, and our lawful basis

We process your personal data only for clear, lawful purposes, and only on a basis permitted by the DPDP Act, 2023.

Our lawful bases under the DPDP Act are:

• Your consent — for the bulk of our processing (for example, creating and operating your account, processing and delivering your orders, and sending marketing where you have opted in). Your consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and may be withdrawn at any time (see Sections 9 and 11 for how).
• Certain "legitimate uses" enumerated in the DPDP Act, which apply without separate consent — in particular:
  • processing of personal data that you have voluntarily provided to us for a specified purpose, and in respect of which you have not indicated that you do not consent to its use (for example, information you give us to answer a support query); and
  • processing necessary for compliance with any law or judgment in force in India (for example, retaining tax invoices, or responding to a lawful order from a court or authority).

We do not rely on "performance of a contract" as a standalone DPDP lawful ground, because the DPDP Act's list of legitimate uses is closed and does not include it; order-related processing therefore rests on your consent, supported where applicable by the legitimate uses above.

The purposes for which we process your personal data are:

DPDP consent notice and language availability. At or before the point at which we collect your personal data, we present a DPDP consent notice that itemises the personal data we collect and the specific purpose of each item, so that you can give informed consent. This Policy and that notice are available in English and, on request, in any of the languages specified in the Eighth Schedule to the Constitution of India, and each contains a link to withdraw your consent and to lodge a complaint with the Data Protection Board of India.

No solely-automated decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing of your personal data. Where we personalise offers, we do so only with your consent, and you may withdraw that consent at any time.

We will not use your personal data for any new purpose that is incompatible with the above without informing you and, where the law requires, obtaining your fresh consent.

4. Payment data and Razorpay

Online payments on our website are processed by Razorpay Software Private Limited ("Razorpay"), a third-party payment gateway that is PCI-DSS compliant.

• When you pay online (UPI, debit/credit cards, net-banking, wallets, EMI / No-Cost EMI), you enter your payment details directly into Razorpay's secure environment.
• Ravi Furnitures never sees or stores your card details, CVV, UPI PIN, or net-banking credentials.
• We receive only the result of the transaction (success/failure, amount, payment-method type, and a transaction reference) so that we can confirm your order and issue your invoice.
• For Cash on Delivery (COD) orders (available up to ₹20,000 per order), no online payment data is collected at checkout; payment is collected at the time of delivery.

Razorpay acts as a Data Processor / independent service provider and processes your payment data in accordance with its own privacy policy and applicable law.

5. Cookies and analytics

Our website uses cookies and similar technologies to function correctly and to improve your experience. We use:

• Essential cookies — required for the site to work, such as keeping you logged in, remembering your cart, and processing checkout. These cannot be switched off.
• Functional cookies — to remember your preferences (such as your selected address or recently viewed items).
• Analytics cookies (non-essential) — to understand, on a strictly aggregated and anonymised basis, how visitors use our site so we can improve it. We configure our analytics so that they do not identify you individually, and we set non-essential analytics cookies only where you have consented through our cookie banner; you may decline or withdraw this consent at any time without affecting your ability to shop.
• Marketing cookies (with consent) — to show you relevant offers, set only where you have opted in.

We do not set any non-essential analytics or marketing cookies, or carry out behavioural tracking, before age and consent are established — see the age-aware tracking safeguard in Section 10.

You can control or delete cookies through your browser settings and through our cookie banner. Please note that disabling essential cookies may prevent parts of the website — including login and checkout — from working properly.

6. With whom we share your information

We share your personal data only as far as necessary, and only with the following categories of recipients. We never sell your personal data.

• Logistics and delivery partners — to deliver your orders, provide installation/assembly in serviceable areas, and arrange returns/reverse pickups. They receive your name, delivery address, PIN code, and contact number.
• Payment gateway (Razorpay) — to process online payments, EMI, and refunds securely (see Section 4).
• Cloud hosting provider — our website and data are hosted on Microsoft Azure (India region).
• Communication providers for SMS/OTP and transactional email — for example, Microsoft Azure Communication Services (ACS), used to deliver one-time passwords, order confirmations, dispatch/delivery updates, and similar transactional messages.
• Professional advisers — such as auditors, accountants, and legal advisers, where reasonably required and under confidentiality obligations.
• Government, regulatory, and legal authorities — where we are required to disclose by law, court order, or a valid legal request (for example, tax authorities or law-enforcement agencies).

Other than the professional advisers and authorities described above, all of the service providers listed in this section act as our Data Processors under written contract. They process your personal data only on our documented instructions and only for the agreed purposes, keep it confidential, and are bound to apply DPDP-grade security safeguards. As the Data Fiduciary, we remain responsible to you for any processing carried out on our behalf by our Data Processors.

7. Data retention

We keep your personal data only for as long as it is needed for the purposes described in this Policy, or for as long as the law requires, and we erase or anonymise it once the purpose is served and no legal retention obligation applies.

• Order, invoice, and tax records are retained for 8 (eight) years from the end of the relevant financial year, as required under the GST law, the Income-tax law, and accounting/companies-law record-keeping requirements. After this period, we securely delete or anonymise these records unless a longer retention is specifically required by law or to defend a live legal claim.
• Account information is kept while your account is active. If you close your account or ask us to erase your data, we will delete or anonymise it within a reasonable time, except where we must keep certain records (such as completed-order and tax invoices) to comply with the law or to resolve disputes.
• Marketing data is kept until you withdraw your consent or unsubscribe, after which we stop using it for marketing and delete or anonymise it unless another lawful basis requires us to retain it.

When personal data is no longer required for any purpose and no legal obligation requires its retention, we securely delete or anonymise it.

8. Security safeguards

We follow reasonable security practices and procedures as required under the SPDI Rules (under the IT Act, 2000) and the security obligations of the DPDP Act, 2023, to protect your personal data against unauthorised access, alteration, disclosure, or loss. These measures include:

• Encryption of data in transit (HTTPS/TLS) across our website
• Hosting on Microsoft Azure (India region), with access controls and network protections
• Restricting access to personal data on a need-to-know basis
• OTP- and Google-based authentication, with no reusable passwords stored on our systems
• Tokenised, gateway-handled payments so that card data never touches our systems
• Secure handling of authentication secrets and regular review of our security practices

While we take strong measures to protect your information, no method of transmission or storage over the internet is completely secure. We encourage you to keep your account access (including OTPs) confidential and to notify us promptly of any suspected misuse.

Breach notification. In the event of a personal-data breach, we will notify the Data Protection Board of India and each affected data principal in the manner and within the timelines prescribed under the DPDP Act, 2023, and we will also comply with our CERT-In reporting obligations under the IT Act, 2000.

9. Marketing and your choices

We will send you promotional communications (offers, newsletters, new-product updates) only where you have opted in to receive them.

• You can opt out at any time by clicking the "unsubscribe" link in any marketing email, replying STOP to a marketing SMS where indicated, changing your communication preferences in your account settings, or contacting us at support@ravifurnitures.in or grievance@ravifurnitures.in.
• Opting out of marketing is treated as a withdrawal of consent for marketing processing; it is as easy as opting in, takes effect within a reasonable time, and does not affect the lawfulness of processing carried out before withdrawal.
• Opting out of marketing will not stop essential transactional messages (such as order confirmations, dispatch and delivery updates, invoices, and support responses), which we need to send to fulfil your orders.

Promotional SMS and the TRAI/DND framework. Any promotional SMS or messaging we send is sent in compliance with the Telecom Regulatory Authority of India (TRAI) Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR) and the associated DLT registration and Do-Not-Disturb / National Do Not Call (DND/NDNC) framework. We send promotional messages only to subscribers who have opted in and whose numbers are not registered on the DND/NDNC registry for the relevant category, and we route such messages through registered headers and templates as required by that framework.

10. Children's data

Our website and products are intended for, and offered only to, adults (18 years and above). We do not offer our services to persons under 18, and we do not knowingly collect or process personal data of children (persons under 18).

Age confirmation at registration. During account registration you are required to confirm that you are 18 years of age or older, and our services are provided on that basis. Where the DPDP Act, 2023 and the rules made under it prescribe a specific mechanism for verifying that a data principal is not a child (or for obtaining verifiable parental/guardian consent), we will adopt and apply the prescribed verification mechanism rather than relying on self-declaration alone, and we will update this Policy and our registration process accordingly.

Age-aware tracking safeguard. We do not allow non-essential tracking to fire before age and consent are established. Specifically:

• Essential cookies (needed for the site, your cart, and checkout to work) operate as described in Section 5.
• Non-essential analytics and marketing cookies, and any behavioural tracking, are not set until you have (a) confirmed your age at the relevant point and (b) given consent through our cookie banner. Until both conditions are met, no analytics or marketing/behavioural-tracking cookies are placed.
• We do not knowingly enable tracking, behavioural monitoring, or targeted advertising directed at any user identified as, or reasonably suspected to be, a child, consistent with the DPDP Act, 2023.

No child data is intentionally processed. Because the service is adults-only, we do not operate a route for processing children's personal data and do not invite under-18s to register. If we become aware that we have collected the personal data of a person under 18, we will cease the relevant processing and delete that data without undue delay. If you believe a child has provided us with personal data, please contact our Grievance Officer (Section 13) and we will act promptly.

11. Your rights and choices as a data principal

Subject to the DPDP Act, 2023 and other applicable law, you have the following rights in relation to your personal data:

• Right to access — to obtain a summary of the personal data we hold about you, the processing activities undertaken, and the identities of other Data Fiduciaries and Processors with whom it has been shared.
• Right to correction, completion and updating — to ask us to correct inaccurate or misleading data, complete incomplete data, or update outdated data. You can also edit much of your account information directly when logged in.
• Right to erasure — to ask us to erase your personal data, except where we are required by law to retain it (for example, tax and completed-order records) or where it is necessary for a specified purpose to which you have consented.
• Right to withdraw consent — where we rely on your consent, you may withdraw it at any time, and withdrawal is as easy as giving consent. You may withdraw consent through your account settings or by emailing grievance@ravifurnitures.in or support@ravifurnitures.in. On withdrawal, we and our Data Processors will stop the relevant processing within a reasonable time, unless retention or continued processing is required by law. Withdrawing consent does not affect the lawfulness of processing already carried out and may limit our ability to provide certain services.
• Right to grievance redressal — to a readily available means of registering a grievance with us about our handling of your data (see Section 13).
• Right to nominate — to nominate another individual who may exercise your rights on your behalf in the event of your death or incapacity, as provided under the DPDP Act, 2023.

To exercise any of these rights, please contact us using the details in Section 13. We may need to verify your identity before acting on your request. We will respond to and act on data-principal rights requests within the timelines prescribed under the DPDP Act, 2023 and its rules.

Exercising these rights is free of charge in the ordinary course. These rights are in addition to, and do not limit, your statutory rights as a consumer under the Consumer Protection Act, 2019.

12. Data localisation and cross-border transfers

We store and process your personal data on Microsoft Azure servers located in India (Azure India region), and our SMS/OTP and transactional-email communications are handled through Azure Communication Services configured for India. Our processing is therefore India-resident by design.

If, in future, any limited processing involves a transfer of personal data outside India, we will ensure that the transfer complies with the DPDP Act, 2023 and applicable law, and that your data continues to be protected by appropriate contractual and technical safeguards. We will not transfer personal data to any country or territory notified as restricted by the Central Government under the DPDP Act, 2023.

13. Grievance redressal, Grievance Officer and escalation

If you have any questions, concerns, or complaints about how we collect, use, or protect your personal data, or wish to exercise any of your rights, you may contact us as set out below. Mr. Jagadish Yalavarthi serves in two distinct statutory roles — as our Grievance Officer under the DPDP Act, 2023 and as our Grievance Officer / nodal customer-care contact under the Consumer Protection (E-Commerce) Rules, 2020 — and may be reached on the same line for both:

Customer Care (Consumer Protection (E-Commerce) Rules, 2020)

• Email: support@ravifurnitures.in
• Phone: +91 78932 47773
• Business hours: Monday to Saturday, 10:00 AM to 7:00 PM IST

Grievance Officer (DPDP Act, 2023 and CP (E-Commerce) Rules, 2020)

• Name: Mr. Jagadish Yalavarthi
• Email: grievance@ravifurnitures.in
• Phone: +91 78932 47773
• Address: Ravi Furnitures, Mallavelli Industrial Area, Krishna District, Vijayawada, Andhra Pradesh – 521212, India
• Business hours: Monday to Saturday, 10:00 AM to 7:00 PM IST

We will acknowledge your grievance within 48 hours and resolve it within one month (30 days) of receipt, as required under the Consumer Protection (E-Commerce) Rules, 2020. Data-principal rights requests under the DPDP Act are handled within the timelines prescribed under that Act and its rules.

Escalation to the Data Protection Board. If your grievance is not satisfactorily resolved by our Grievance Officer, you may escalate your complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act, 2023. Your right to approach the Board, or any consumer forum or other authority available to you under law, is not affected by this Policy.

Commercial disclosures and consumer grievances relating to price, delivery, returns, refunds, warranty, and country of origin are addressed on our Terms & Conditions and Returns & Refunds pages, which also carry the relevant Consumer Protection (E-Commerce) Rules, 2020 disclosures.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will revise the "Last updated" date at the top of this page and, where appropriate, notify you.

For material changes that involve new or expanded processing requiring consent under the DPDP Act, 2023, we will obtain your fresh consent before such processing begins. Your continued use of our website after an update signifies acceptance only of changes that do not require fresh consent under applicable law; it does not operate as consent to any new processing for which the law requires fresh, affirmative consent. We encourage you to review this Policy periodically.

15. Governing law and jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of India. Subject to the rights described below, the competent courts at Vijayawada, Andhra Pradesh shall have jurisdiction over disputes relating to this Policy.

Nothing in this Policy limits or excludes your statutory rights. In particular:

• As a consumer, you retain your right under the Consumer Protection Act, 2019 to approach the District, State, or National Consumer Disputes Redressal Commission at the place where you reside or work, and this Policy does not require you to arbitrate or to give up access to any consumer forum.
• As a data principal, you retain your right to seek redress through the Grievance Officer and, on escalation, the Data Protection Board of India (Section 13).

Contact us

We are here to help with any privacy question or concern.

Customer Support

• Email: support@ravifurnitures.in
• Phone: +91 78932 47773
• Hours: Monday to Saturday, 10:00 AM to 7:00 PM IST

Grievance Officer (DPDP Act, 2023 and Consumer Protection (E-Commerce) Rules, 2020)

• Mr. Jagadish Yalavarthi
• Email: grievance@ravifurnitures.in
• Phone: +91 78932 47773
• Address: Ravi Furnitures, 10/42, Mallavelli Industrial Area, Krishna District, Vijayawada, Andhra Pradesh — 521111, India
• Hours: Monday to Saturday, 10:00 AM to 7:00 PM IST
• We acknowledge grievances within 48 hours and resolve them within one month (30 days). If unresolved, you may escalate to the Data Protection Board of India under the DPDP Act, 2023.

Ravi Furnitures — Manufacturers & Dealers of All Types of Furniture 10/42, Mallavelli Industrial Area, Krishna District, Vijayawada, Andhra Pradesh — 521111, India GSTIN: 37AOBPY0245C1Z5 | https://www.ravifurnitures.in